Abnormality processing method and device, electronic equipment, medium and program product

Abstract

The invention discloses an exception handling method and device, electronic equipment, a medium and a program product, and relates to the field of artificial intelligence, and the method comprises the steps: obtaining a target log when target alarm information is received; converting the target log into a target format log, and inputting the target format log into a pre-trained log analysis large model to obtain a log exception reason and an exception handling method corresponding to target alarm information output by the log analysis large model; and sending the log exception reason and the exception handling method to user equipment corresponding to the target worker. According to the scheme provided by the invention, the condition that the time for analyzing the log abnormity is relatively long when a worker manually determines the log abnormity is avoided, so that the analysis efficiency of the log abnormity is improved, the influence degree of the log abnormity on a service system is reduced, and the requirement on the capability of the worker is reduced.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and in particular to an exception handling method, device, electronic device, medium and program product. Background Art

[0002] Application log analysis has become an important part of modern application development and operation and maintenance. It can help banking and enterprise operation and maintenance personnel better understand the operation and performance of applications, detect and solve problems in applications in a timely manner, and improve the reliability and security of applications.

[0003] At present, in the application log analysis system used by banks, the channels for obtaining system-level logs, application-level background logs, operation and maintenance-level foreground logs, and batch scheduling task logs are distributed on multiple platforms. When operation and maintenance personnel receive abnormal alarms from related logs, they need to manually determine the root cause of the abnormal alarm. Therefore, operation and maintenance personnel need to obtain platform logs from different platforms to analyze the cause of the abnormality.

[0004] However, when an abnormality occurs in the production environment of a banking system, the operation and maintenance personnel need to identify the alarm type and possible alarm source after receiving the relevant alarm information, and then obtain logs from multiple log acquisition channels for analysis to determine the abnormality. The analysis link in this process is long, which makes the analysis of log abnormalities take a long time and is inefficient, which will have a great impact on the use of the business system and requires a high level of skills for the operation and maintenance personnel. Summary of the invention

[0005] The present application provides an exception handling method, device, electronic device, medium and program product to solve the problem in the prior art that the analysis of log exceptions takes a long time and is inefficient, which has a significant impact on the use of the business system and requires a high level of skills for operation and maintenance personnel.

[0006] In a first aspect, the present application provides an exception handling method, the method comprising:

[0007] When receiving target alarm information, obtain target log;

[0008] Convert the target log into a target format log, and input the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log;

[0009] The log exception reason and the exception handling method are sent to the user device corresponding to the target staff member.

[0010] In a second aspect, the present application provides an exception handling device, the device comprising:

[0011] The acquisition module is used to obtain the target log when receiving the target alarm information;

[0012] An analysis module, used to convert the target log into a target format log, and input the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log;

[0013] The sending module is used to send the log exception reason and the exception handling method to the user device corresponding to the target staff member.

[0014] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the exception handling method as described in any embodiment of the present application is implemented.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the exception handling method as described in any embodiment of the present application.

[0016] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the exception handling method as described in any embodiment of the present application.

[0017] The scheme of the present application, when receiving the target alarm information, obtains the target log; converts the target log into a target format log, and inputs the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log; the log abnormality cause and abnormality handling method are sent to the user device corresponding to the target staff. That is, the scheme of the present application, when receiving the target alarm information, inputs the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method and send them to the user device of the staff, thereby avoiding the situation that the staff takes a long time to analyze the log abnormality when manually determining the log abnormality, thereby improving the analysis efficiency of the log abnormality, reducing the impact of the log abnormality on the business system, and reducing the ability requirements for the staff. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flowchart of the exception handling method provided by this application;

[0020] Figure 2 It is a schematic diagram of the training process of the log analysis model of the exception handling method provided by this application;

[0021] Figure 3 It is a structural schematic diagram of the exception handling device provided by the present application;

[0022] Figure 4 It is a structural schematic diagram of the electronic device provided by this application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0024] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0025] Figure 1 The present invention provides a flowchart of an exception handling method, which can be executed by an exception handling device, which can be implemented in software and / or hardware. In a specific embodiment, the device can be applied to an electronic device, which can be a computer. The following embodiments will be described by taking the application of the device in an electronic device as an example, referring to Figure 1 , the method may specifically include the following steps:

[0026] Step 101, when receiving target alarm information, obtain the target log.

[0027] Specifically, the target alarm information refers to the alarm information that can indicate that the operation of the business system is abnormal. The target alarm information can be the target alarm information obtained by the electronic device executing this embodiment when the business system is abnormal, or it can be the target alarm information received by the electronic device executing this embodiment from the user device of the staff, and this application does not limit this. The target log is a variety of application logs in the business system when the business system runs abnormally, such as system-level logs, application-level background logs, operation and maintenance-level foreground logs, and batch scheduling task logs. The method for obtaining the target log can also be the target log obtained by the electronic device executing this embodiment when the business system is abnormal, or it can be the target log received by the electronic device executing this embodiment from the user device of the staff, and this application does not limit this.

[0028] Optionally, the information format of the target alarm information is a preset information format, and the preset information format is consistent with the log format of the target format log.

[0029] Specifically, the preset information format is a pre-set format that is easy for the large model to understand, such as a lightweight data exchange format. The information format of the target alarm information is the preset information format, and the preset information format is consistent with the log format of the target format log, which can facilitate the large model to obtain and understand the target alarm information, avoid format conversion of the target alarm information before it can be processed by the large model, and improve the efficiency of abnormal processing of logs.

[0030] Exemplarily, the target alarm information in the preset information format includes information identification of the target alarm information, alarm content, abnormal system path record, abnormal device path record and other contents.

[0031] Step 102, convert the target log into a target format log, and input the target format log into a pre-trained log analysis model to obtain the log exception cause and exception handling method corresponding to the target alarm information output by the log analysis model.

[0032] Among them, the log analysis model is used to determine the cause of log anomalies and the method of handling anomalies based on the target format log.

[0033] Specifically, the log analysis big model is an open source log analysis big model used to determine the cause of log anomalies and the method for handling anomalies based on the target format log, that is, a deep learning model trained with a large amount of log data, so that the model can understand the meaning of the log and obtain the cause and handling method corresponding to the abnormal log. The target format log is a format that is easy for the big model to understand, such as a lightweight data exchange format. When the target log is a target format log, the big model can read it directly. When the target log is a log in another format, the target log needs to be converted to a target format log for easy reading by the big model. The log conversion method can be achieved by a preset conversion method between multiple formats of logs, such as extracting the application running information in the log, and then outputting the application running information in the target format to obtain the target format log. Converting the target log to the target format log can further improve the efficiency of the big model in handling anomalies.

[0034] After converting the target log into a target format log, the target format log is input into a pre-trained log analysis model. The log analysis model can output the cause of the log exception and the recommended processing method for the exception log based on the target format log. Therefore, the cause of the log exception and the exception processing method corresponding to the target alarm information output by the log analysis model can be obtained.

[0035] Optionally, converting the target log into a target format log may be implemented through steps 21 and 22 .

[0036] Step 21: If the log format of the target log is a text format, information is extracted from the target log using a regular expression to obtain target log information.

[0037] Specifically, when the log format of the target log is a text format, information is extracted from the target log using a regular expression to obtain information that can describe the running status of the application corresponding to the log, that is, the target log information.

[0038] For example, assuming that the original log is a string, the string includes the running time, application name, application level and sent data content of the application corresponding to the log. The target log is extracted through regular expressions to obtain the running time, application name, application level and sent data content of the above application.

[0039] Step 22: Generate a target format log according to the target log information.

[0040] Specifically, after obtaining the target log information, the target log information is output according to the target format to generate a target format log. Converting the target log into a target format log can further improve the efficiency of the large model in performing exception processing.

[0041] Exemplarily, the application running time is output in a standard time format to facilitate the understanding of the large model, thereby improving the efficiency of the large model in handling exceptions.

[0042] Step 103: Send the log exception reason and exception handling method to the user device corresponding to the target staff member.

[0043] Specifically, after obtaining the log exception cause and exception handling method corresponding to the target alarm information output by the log analysis model, the log exception cause and exception handling method are sent to the user device corresponding to the target staff member, so that the staff can handle the log exception according to the exception handling method.

[0044] Optionally, after executing step 103, steps 31 to 33 may also be executed.

[0045] Step 31, receiving the large model analysis result evaluation returned by the user device.

[0046] Specifically, after the cause of the log exception and the exception handling method are sent to the user device corresponding to the target staff member, the target staff member handles the log exception according to the exception handling method, and evaluates the log analysis big model according to the processing result to obtain the big model analysis result evaluation, and returns the big model analysis result evaluation to the electronic device executing this embodiment.

[0047] Exemplarily, the evaluation of the large model analysis results includes evaluation identification information, a brief description of the target alarm information, a score of the large model analysis results, a detailed description of the target alarm information, information describing whether the cause of the log anomaly obtained by the large model is correct, and information describing whether the exception handling method obtained by the large model is correct.

[0048] Step 32: If the evaluation of the large model analysis result does not meet the preset evaluation requirements, the evaluation abnormality cause and the evaluation processing method corresponding to the target alarm information sent by the user equipment are obtained.

[0049] Specifically, the preset evaluation requirements are pre-set requirements that should be met to determine the accuracy of the large model analysis results. For example, the preset evaluation requirements are that the score of the large model analysis results is greater than the score threshold. The evaluation abnormality cause and evaluation processing method corresponding to the target alarm information are the abnormality cause and abnormal log processing method corresponding to the target alarm information determined by the staff based on human experience. When the evaluation of the large model analysis results does not meet the preset evaluation requirements, the staff sends the evaluation abnormality cause and evaluation processing method corresponding to the target alarm information to the electronic device executing this embodiment through the user device, and the electronic device executing this embodiment receives the evaluation abnormality cause and evaluation processing method corresponding to the target alarm information.

[0050] Step 33, adjust the target model parameters of the log analysis big model according to the log exception cause, target log, evaluation exception cause and evaluation processing method, so that the log analysis big model can obtain the evaluation exception cause and evaluation processing method according to the log exception cause and target log.

[0051] Specifically, the target model parameters of the log analysis large model are adjusted according to the log abnormality cause, target log, evaluation abnormality cause and evaluation processing method, for example, the learning rate of the large model is adjusted to improve the accuracy of the large model output results, so that the log analysis large model can obtain the evaluation abnormality cause and evaluation processing method according to the log abnormality cause and the target log. When the evaluation of the large model analysis result does not meet the preset evaluation requirements, the model parameters of the large model are adjusted according to the evaluation abnormality cause and evaluation processing method sent by the user device, so that the adjusted large model can obtain the evaluation abnormality cause and evaluation processing method according to the log abnormality cause and the target log, further improving the accuracy of the large model output results, thereby further improving the efficiency of abnormality processing according to the large model.

[0052] The scheme of the present application, when receiving the target alarm information, obtains the target log; converts the target log into a target format log, and inputs the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log; the log abnormality cause and abnormality handling method are sent to the user device corresponding to the target staff. That is, the scheme of the present application, when receiving the target alarm information, inputs the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method and send them to the user device of the staff, thereby avoiding the situation that the staff takes a long time to analyze the log abnormality when manually determining the log abnormality, thereby improving the analysis efficiency of the log abnormality, reducing the impact of the log abnormality on the business system, and reducing the ability requirements for the staff.

[0053] Figure 2 It is a schematic diagram of the training process of the log analysis model of the exception handling method provided by this application. Figure 1 Based on the illustrated embodiment and various optional implementation schemes, the steps of training the log analysis large model are described in detail. Figure 2 As shown, the method may include the following steps:

[0054] Step 201, obtaining training logs.

[0055] The log format of the training log is consistent with the log format of the target format log, the number of the training log is at least one, and the training log is a log in a preset training log library.

[0056] Specifically, a large number of training logs are stored in the preset training log library, and the training logs can be historical logs of the business system. The log format of the training log is consistent with the log format of the target format log, so that the log format during the large model training is consistent with the log format in subsequent applications, thereby improving the accuracy of the large model output results.

[0057] Exemplarily, the training log includes the log identifier, log time information, log level, log thread information, log class name, and log exception type and exception information of the training log.

[0058] Step 202: input the training log into the large model to be trained, and obtain the abnormal reason of the training log output by the large model to be trained and the training abnormality processing method.

[0059] Specifically, the large model to be trained can be any open source large model. By inputting the training log into the large model to be trained, the reason for the abnormality of the training log output by the large model to be trained and the method for handling the abnormality of the training can be obtained.

[0060] Step 203, adjusting the target model parameters of the large model to be trained according to the training target reason, training processing method, training log abnormality reason and training abnormality processing method corresponding to the training log, to obtain the large model to be trained after parameter adjustment.

[0061] Specifically, the training target cause and training processing method corresponding to the training log are the true abnormal cause and the correct processing method for the abnormality corresponding to the training log. Therefore, according to the training target cause and training processing method corresponding to the training log, and the training log abnormal cause and training abnormality processing method output by the large model, the target model parameters of the large model to be trained are adjusted, such as adjusting the learning rate of the large model, to obtain the large model to be trained after parameter adjustment.

[0062] Optionally, target model parameters include a learning rate and / or the length of the soft hint embeddings.

[0063] Specifically, the target model parameters are determined as the learning rate and / or the length of the soft hint embedding because complex tasks require longer soft hint embeddings and / or smaller learning rates. A smaller learning rate can avoid the situation where a larger learning rate destroys the existing language understanding ability of the large model. Selecting a smaller learning rate and a longer soft hint embedding can ensure the stability of the training process of the large model while avoiding overfitting.

[0064] Step 204, use the large model to be trained after the parameters are adjusted as the new large model to be trained, use at least one log in the training log library that has not been input into the large model to be trained as a new training log, return to execute step 202, until the preset iteration end condition is reached, and use the large model to be trained after the parameters are adjusted as the log analysis large model.

[0065] Specifically, the large model to be trained after parameter adjustment is used as a new large model to be trained, and at least one log in the training log library that has not been input into the large model to be trained is used as a new training log, and the step of inputting the training log into the large model to be trained is returned until the preset iteration end condition is reached. For example, the preset iteration end condition may be to stop training when the training reaches a certain end condition, that is, to stop the return step, and the end condition may be that the number of training rounds reaches a preset number of rounds, or the training loss is lower than a certain value, etc. The large model to be trained after parameter adjustment obtained at this time is the log analysis large model.

[0066] The solution of the present application adjusts the model parameters of the large model to be trained by the training target reasons, training processing methods, training log abnormal reasons, and training abnormal processing methods corresponding to the training logs, so that the accuracy of the large model in obtaining abnormal reasons and abnormal processing methods based on the logs is improved. In addition, the target model parameters are determined as the learning rate and / or the length of the soft prompt embedding, which can ensure the stability of the training process of the large model while avoiding the occurrence of overfitting, thereby further improving the accuracy of the large model in handling log abnormalities.

[0067] Figure 3 is a structural diagram of an exception handling device provided by the present application, and the device is suitable for executing the exception handling method provided by the present application. Figure 3 As shown, the device may specifically include:

[0068] The acquisition module 301 is used to acquire the target log when receiving the target alarm information;

[0069] The analysis module 302 is used to convert the target log into a target format log, and input the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log;

[0070] The sending module 303 is used to send the log exception reason and the exception handling method to the user device corresponding to the target staff member.

[0071] In one embodiment, the information format of the target alarm information acquired by the module 301 is a preset information format, and the preset information format is consistent with the log format of the target format log.

[0072] In one embodiment, the analysis module 302 is specifically used to convert the target log into a target format log: if the log format of the target log is a text format, extract information from the target log through a regular expression to obtain target log information; and generate the target format log according to the target log information.

[0073] In one embodiment, the device also includes: an adjustment module, used to receive the large model analysis result evaluation returned by the user device; if the large model analysis result evaluation does not meet the preset evaluation requirements, then obtaining the evaluation abnormality cause and the evaluation processing method corresponding to the target alarm information sent by the user device; adjusting the target model parameters of the log analysis large model according to the log abnormality cause, the target log, the evaluation abnormality cause and the evaluation processing method, so that the log analysis large model can obtain the evaluation abnormality cause and the evaluation processing method according to the log abnormality cause and the target log.

[0074] In one embodiment, the device also includes: a log analysis large model training module, which is used to obtain training logs; wherein the log format of the training log is consistent with the log format of the target format log, the number of the training logs is at least one, and the training log is a log in a preset training log library; the training log is input into the large model to be trained to obtain the abnormal reason for the training log output by the large model to be trained and the training abnormality processing method; the target model parameters of the large model to be trained are adjusted according to the training target reason, the training processing method, the abnormal reason for the training log and the training abnormality processing method corresponding to the training log to obtain the large model to be trained after the parameters are adjusted; the large model to be trained after the parameters are adjusted is used as the new large model to be trained, and at least one log in the training log library that is not input into the large model to be trained is used as the new training log, and the step of "inputting the training log into the large model to be trained to obtain the abnormal reason for the training log output by the large model to be trained and the training abnormality processing method" is returned to execute until the preset iteration end condition is reached, and the large model to be trained after the parameters are adjusted is used as the log analysis large model.

[0075] In one embodiment, the target model parameters of the log analysis large model training module include a learning rate and / or a length of soft prompt embedding.

[0076] The device of the present application obtains the target log upon receiving the target alarm information; converts the target log into the target format log, and inputs the target format log into the pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log; and sends the log abnormality cause and abnormality handling method to the user device corresponding to the target staff. That is, the scheme of the present application, by inputting the target format log into the pre-trained log analysis model upon receiving the target alarm information, obtains the log abnormality cause and abnormality handling method and sends them to the user device of the staff, thereby avoiding the situation that the staff takes a long time to analyze the log abnormality when manually determining the log abnormality, thereby improving the analysis efficiency of the log abnormality, reducing the impact of the log abnormality on the business system, and reducing the ability requirements for the staff.

[0077] The present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the exception handling method provided in any of the above embodiments when executing the program.

[0078] The present application also provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the exception handling method provided in any of the above embodiments is implemented.

[0079] Reference below Figure 4 , which shows a structural schematic diagram of an electronic device 400 suitable for implementing the present application. Figure 4 The electronic device shown is only an example and should not bring any limitation to the function and scope of use of the present application.

[0080] like Figure 4 As shown, the electronic device 400 includes a central processing unit (CPU) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage part 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 400 are also stored. The CPU 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0081] The following components are connected to the I / O interface 405: an input section 406 including a keyboard, a mouse, etc.; an output section 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, a modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the I / O interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage section 408 as needed.

[0082] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the central processing unit (CPU) 401, the above-mentioned functions defined in the system of the present application are executed.

[0083] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0084] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0085] The modules and / or units described in this application may be implemented in software or hardware. The modules and / or units described may also be provided in a processor, for example, it may be described as follows: a processor includes an acquisition module, an analysis module, and a sending module. The names of these modules do not, in some cases, constitute limitations on the modules themselves.

[0086] As another aspect, the present application also provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device performs the following operations:

[0087] When receiving the target alarm information, obtain the target log; convert the target log into a target format log, and input the target format log into a pre-trained log analysis model to obtain the log exception cause and exception handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log exception cause and exception handling method according to the target format log; send the log exception cause and exception handling method to the user device corresponding to the target staff member.

[0088] According to the technical solution of the present application, when the target alarm information is received, the target log is obtained; the target log is converted into a target format log, and the target format log is input into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log; the log abnormality cause and abnormality handling method are sent to the user device corresponding to the target staff. That is, the solution of the present application, when the target alarm information is received, the target format log is input into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method and send them to the user device of the staff, thereby avoiding the situation that the staff takes a long time to analyze the log abnormality when manually determining the log abnormality, thereby improving the analysis efficiency of the log abnormality, reducing the impact of the log abnormality on the business system, and reducing the ability requirements for the staff.

[0089] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the exception handling method provided in any embodiment of the present application.

[0090] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present application, and the programming language includes an object-oriented programming language, such as Java, Smalltalk, C++, and also includes a conventional procedural programming language, such as "C" language or similar programming language. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0091] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0092] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. An exception handling method, characterized in that: The method comprises: When receiving target alarm information, obtain target log; Convert the target log into a target format log, and input the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log; The log exception reason and the exception handling method are sent to the user device corresponding to the target staff member.

2. The method according to claim 1, characterized in that The information format of the target alarm information is a preset information format, and the preset information format is consistent with the log format of the target format log.

3. The method according to claim 1, characterized in that The converting the target log into a target format log comprises: If the log format of the target log is a text format, extracting information from the target log using a regular expression to obtain target log information; The target format log is generated according to the target log information.

4. The method according to claim 1, characterized in that The method further comprises: Receiving a large model analysis result evaluation returned by the user device; If the evaluation of the large model analysis result does not meet the preset evaluation requirements, obtaining the evaluation abnormality cause and the evaluation processing method corresponding to the target alarm information sent by the user equipment; The target model parameters of the log analysis big model are adjusted according to the log exception cause, the target log, the evaluation exception cause and the evaluation processing method, so that the log analysis big model can obtain the evaluation exception cause and the evaluation processing method according to the log exception cause and the target log.

5. The method according to claim 1, characterized in that The log analysis model is trained according to the following steps: Acquire a training log; wherein the log format of the training log is consistent with the log format of the target format log, the number of the training log is at least one, and the training log is a log in a preset training log library; Input the training log into the large model to be trained, and obtain the abnormal reason of the training log output by the large model to be trained and the training abnormality processing method; Adjust the target model parameters of the large model to be trained according to the training target reason, the training processing method, the training log abnormality reason and the training abnormality processing method corresponding to the training log, to obtain the large model to be trained after the parameters are adjusted; The large model to be trained after the parameter adjustment is used as the new large model to be trained, and at least one log in the training log library that has not been input into the large model to be trained is used as a new training log, and the process returns to execute the step of "inputting the training log into the large model to be trained, and obtaining the reason for the abnormality of the training log output by the large model to be trained and the method for handling the training abnormality", until the preset iteration end condition is reached, and the large model to be trained after the parameter adjustment is used as the log analysis large model.

6. The method according to claim 5, characterized in that The target model parameters include the learning rate and / or the length of the soft hint embedding.

7. An exception handling device, characterized in that: The device comprises: The acquisition module is used to obtain the target log when receiving the target alarm information; An analysis module, used to convert the target log into a target format log, and input the target format log into a pre-trained log analysis model to obtain the log abnormality cause and abnormality handling method corresponding to the target alarm information output by the log analysis model; wherein the log analysis model is used to determine the log abnormality cause and abnormality handling method according to the target format log; The sending module is used to send the log exception reason and the exception handling method to the user device corresponding to the target staff member.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the exception handling method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the exception handling method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the exception handling method according to any one of claims 1 to 6.

Images