Log analysis method and device

Abstract

The invention discloses a log analysis method and device, and belongs to the technical field of computers. The log analysis method comprises the steps of obtaining first log data of a target service of a target time window and a first sub-vector of the target service of the target time window based on a Sidecar proxy container; the first sub-vector is used for indicating a target parameter of a target service of the target time window; based on a log template set corresponding to the target service and the first log data, obtaining a second sub-vector of the target service of the target time window; the second sub-vector is used for indicating the number of each event in the first log data; the events are in one-to-one correspondence with log templates included in the log template set; analyzing the feature vector based on the trained decision tree, and judging whether the target service of the target time window is abnormal or not; the feature vector is obtained based on the first sub-vector and the second sub-vector. According to the log analysis method and device provided by the invention, a more comprehensive and more accurate log analysis result can be obtained.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular, relates to a log analysis method and device. Background Art

[0002] More and more systems are running on containers, and more and more cloud computing technologies and distributed cloud system architectures are being adopted. As a result, the number of logs generated by these systems is increasing, and the types of logs are becoming more and more complex and diverse. For massive and diverse log data, the existing method is generally to manually analyze whether the log data is normal, which has limited analysis dimensions, low efficiency and poor accuracy. Summary of the invention

[0003] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes a log analysis method and device, which can improve the efficiency and accuracy of log analysis.

[0004] In a first aspect, the present application provides a log analysis method, the method comprising:

[0005] Based on the Sidecar proxy container, obtain first log data of a target business in a target time window and a first subvector of the target business in the target time window; the first subvector is used to indicate a target parameter of the target business in the target time window;

[0006] Based on the log template set corresponding to the target business and the first log data, obtaining a second sub-vector of the target business in the target time window; the second sub-vector is used to indicate the number of each event in the first log data; the events correspond one to one with the log templates included in the log template set;

[0007] The feature vector is analyzed based on the trained decision tree to determine whether the target service in the target time window is abnormal; the feature vector is obtained based on the first sub-vector and the second sub-vector.

[0008] According to the log analysis method of the present application, by adopting a non-invasive Sidecar proxy method to collect logs, and introducing AI artificial intelligence algorithms into the logs for machine training and anomaly detection, the workload invested by developers in log management and anomaly detection can be greatly reduced, so that developers can focus more on developing applications and see abnormal logs and log trends more conveniently and intuitively, which can improve the efficiency and accuracy of log analysis, and can analyze logs from more dimensions to obtain more comprehensive and accurate log analysis results.

[0009] According to an embodiment of the present application, before acquiring the second sub-vector of the target service in the target time window based on the log template set corresponding to the target service and the first log data, the method further includes:

[0010] For the second log data of the target business in at least one historical time window, a variable in each log in the second log data is replaced with a wildcard and then deduplication is performed to obtain a log template set corresponding to the target business.

[0011] According to an embodiment of the present application, after acquiring the log template set corresponding to the target service and before acquiring the second sub-vector of the target service in the target time window based on the log template set corresponding to the target service and the first log data, the method further includes:

[0012] For each log template in the log template set, a weight of the log template for each time window is determined.

[0013] According to an embodiment of the present application, acquiring a second sub-vector of the target service in the target time window based on the log template set corresponding to the target service and the first log data includes:

[0014] Obtaining an original vector based on the number of log lines in the first log data that match each of the log templates;

[0015] The second sub-vector is obtained based on the weight of the target time window and the original vector.

[0016] According to an embodiment of the present application, before analyzing the feature vector based on the trained decision tree to determine whether the target service in the target time window is abnormal, and after obtaining the log template set corresponding to the target service, the method further includes:

[0017] Based on the third log data of the target business in at least one historical time window and the log template set, acquiring a feature vector of the third log data as a training sample;

[0018] The feature vector of the third log data is labeled based on the target regular expression to obtain a label corresponding to the training sample; the label corresponding to the training sample is used to indicate whether the third log data is abnormal; the target regular expression is used to indicate the relationship between the elements in the feature vector of the third log data and the relationship between each element and the corresponding threshold value;

[0019] Training is performed based on the training samples and labels corresponding to the training samples to obtain the trained decision tree.

[0020] According to an embodiment of the present application, after analyzing the feature vector based on the trained decision tree to determine whether the target service in the target time window is abnormal, the method further includes:

[0021] Obtaining manual review information of a judgment result on whether the target service in the target time window is abnormal; the manual review information is used to indicate whether the judgment result is correct;

[0022] The trained decision tree is updated based on the manual review information and the feature vector.

[0023] In a second aspect, the present application provides a log analysis device, the device comprising:

[0024] A collection module, used to obtain, based on the Sidecar proxy container, first log data of a target business in a target time window and a first sub-vector of the target business in the target time window; the first sub-vector is used to indicate a target parameter of the target business in the target time window;

[0025] an acquisition module, configured to acquire a second sub-vector of the target business in the target time window based on the log template set corresponding to the target business and the first log data; the second sub-vector is used to indicate the number of each event in the first log data; the events correspond one-to-one to the log templates included in the log template set;

[0026] The analysis module is used to analyze the feature vector based on the trained decision tree to determine whether the target service in the target time window is abnormal; the feature vector is obtained based on the first sub-vector and the second sub-vector.

[0027] According to the log analysis device of the present application, by adopting a non-invasive Sidecar proxy method to collect logs, and introducing AI artificial intelligence algorithms to the logs for machine training and anomaly detection, the workload invested by developers in log management and anomaly detection can be greatly reduced, so that developers can focus more on developing applications and see abnormal logs and log trends more conveniently and intuitively, which can improve the efficiency and accuracy of log analysis, and can analyze logs from more dimensions to obtain more comprehensive and accurate log analysis results.

[0028] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the log analysis method as described in the first aspect above when executing the computer program.

[0029] In a fourth aspect, the present application provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the log analysis method as described in the first aspect above.

[0030] In a fifth aspect, the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the log analysis method as described in the first aspect.

[0031] In a sixth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the log analysis method as described in the first aspect above.

[0032] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0034] Figure 1 It is a flow chart of the log analysis method provided in the embodiment of the present application;

[0035] Figure 2 It is a schematic diagram of an applicable scenario of the log analysis method provided in an embodiment of the present application;

[0036] Figure 3 is a schematic diagram of a log template provided in an embodiment of the present application;

[0037] Figure 4 is a schematic diagram of second log data provided by an embodiment of the present application;

[0038] Figure 5 is a schematic diagram of a database provided in an embodiment of the present application;

[0039] Figure 6 is a schematic diagram of a training sample provided in an embodiment of the present application;

[0040] Figure 7 It is a structural schematic diagram of a log analysis device provided in an embodiment of the present application;

[0041] Figure 8 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0043] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0044] In the related art, for systems running on containers, the log analysis of the above systems mainly has the following shortcomings: low efficiency, low versatility, low accuracy and low scalability.

[0045] The relevant technology is generally manual observation of logs, usually by logging into a specific electronic device or container to execute commands to observe and analyze logs. When the amount of log data is small, manual methods can still cope with it, but it is obvious that the larger the amount of log data, the lower the efficiency of manual observation and analysis of logs. Although logs can be uniformly collected and stored in the log center, and can be directly searched and filtered based on this, there is still a phenomenon that manual observation of highly similar or large numbers of duplicate logs is required, and the efficiency is still low.

[0046] In the process of manually observing logs, you can first use shell scripts or other processing methods to filter out log lines involving these two keyword information, such as error and warning. However, business anomalies generally need to be specifically analyzed based on other information, and the above other information is not necessarily log lines involving error or warning. Therefore, different businesses use different shell scripts or other processing methods, which greatly increases the workload of manual development of the above shell scripts or other processing methods.

[0047] In addition to its own information, general business logs lack service quality logs or statistical logs, and therefore lack statistical information related to service quality, such as HTTP (Hypertext Transfer Protocol) response time, gRPC (Google Remote Procedure Call) response time, response message size, number of calls and time window. In the absence of the above-mentioned statistical information related to service quality, it is impossible to analyze the status of business programs from more dimensions, resulting in low accuracy of log anomaly detection. Adding service quality logs or statistical logs can better assist in analyzing the abnormal status of business programs. However, to add the above-mentioned service quality logs or statistical logs to the business logs, it is often necessary to add more code at the business code level. Even if the added code can be integrated into a unified code base, there may be problems of repeated development in multiple development languages. In addition, whenever the relevant functions of the service quality log or statistical log are added or deleted, the code of each business must be updated accordingly to match these capabilities, exposing the problem of low scalability.

[0048] The log analysis method, log analysis device, electronic device and readable storage medium provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings through specific embodiments and their application scenarios.

[0049] The log analysis method may be applied to a terminal, and may be specifically executed by hardware or software in the terminal.

[0050] The terminal includes, but is not limited to, a portable communication device such as a mobile phone or tablet computer with a touch-sensitive surface (e.g., a touch screen display and / or a touch pad). It should also be understood that in some embodiments, the terminal may not be a portable communication device, but a desktop computer with a touch-sensitive surface (e.g., a touch screen display and / or a touch pad).

[0051] In the following various embodiments, a terminal including a display and a touch-sensitive surface is described. However, it should be understood that the terminal may include one or more other physical user interface devices such as a physical keyboard, a mouse and a joystick.

[0052] The log analysis method provided in the embodiment of the present application may be executed by an electronic device or a functional module or functional entity in the electronic device that can implement the log analysis method. The electronic devices mentioned in the embodiment of the present application include but are not limited to mobile phones, tablet computers, computers, cameras, and wearable devices. The log analysis method provided in the embodiment of the present application is described below using an electronic device as an example of the execution subject.

[0053] like Figure 1As shown, the log analysis method includes: step 110, step 120 and step 130.

[0054] Step 110: Based on the Sidecar proxy container, obtain the first log data of the target business in the target time window and the first subvector of the target business in the target time window; the first subvector is used to indicate the target parameters of the target business in the target time window.

[0055] In actual execution, the log analysis method provided in the embodiment of the present application can be applied to a system running on a container. The above-mentioned system running on a container is generally based on a Kubernetes cluster. Kubernetes, referred to as k8s, is an open source containerized application for managing multiple hosts in a cloud platform. The goal of Kubernetes is to make the deployment of containerized applications simple and efficient. Kubernetes provides a mechanism for application deployment, planning, updating, and maintenance.

[0056] The smallest unit that can be created and deployed in Kubernetes is a Pod. The above Pod is an application instance in a Kubernetes cluster and is always deployed on the same node. A Pod can contain one or more containers, and can also include resources shared by each container, such as storage and network. The above Pod can support multiple container environments.

[0057] refer to Figure 2 The architecture of the system based on the Kubernetes cluster can be as follows Figure 2 shown. Figure 2 Although only one business Pod is shown in the figure, those skilled in the art can understand that the system based on this architecture includes multiple business Pods.

[0058] In some embodiments, based on the Sidecar proxy container of each business Pod, log data of each business container in the business Pod can be collected. Wherein, a Sidecar proxy container can be set in each business Pod. Each business container can be used to implement a business.

[0059] For any business Pod, a Sidecar proxy container can be automatically injected to collect business logs without intrusion. Business logs refer to the log files of the business container in the business Pod injected with the Sidecar proxy container. The log files of the business container can be called business log files. The log data of the business container can be carried in business log files.

[0060] When you need to run a business, you can start one or more business Pods, and mount the business containers that need to be run in the corresponding business Pods. It is understandable that each business Pod can correspond to one business. In each Pod, there are one or more business containers for running corresponding business functions. Each business container will generate corresponding logs, and all business containers in each Pod run functions for the same business. The Sidecar proxy container in each business Pod can be created together with the startup of the business Pod (i.e., automatically injected), and before the Sidecar proxy container in each business Pod is modified, the Sidecar proxy container is always configured in the corresponding business Pod. The Sidecar proxy container in each business Pod can be configured according to demand, and the Sidecar proxy container in each Sidecar proxy container Pod can be the same or different.

[0061] In some embodiments, a Kubernetes cluster can be deployed, and business applications (which can be implemented through business Pods), Sidecar control plane programs (which can be implemented through log control plane Pods), and middleware (used to implement functions such as message queues, time series search engine Loki, and databases, which can be implemented through corresponding middleware Pods) can be deployed on the cluster.

[0062] In some embodiments, the Sidecar control plane program can inject the Sidecar proxy container into the business Pod in a corresponding manner based on the different ways of creating the business Pod, and the Sidecar proxy container can collect logs in a corresponding manner based on the different ways of creating the business Pod. For example, for any business Pod created by the Deployment controller, the annotations of the Deployment controller carry a special key-value (e.g., "sidecar-inject": "true"), and the Sidecar control plane program can automatically inject the Sidecar proxy container into the business Pod when monitoring the creation event; the Sidecar proxy container can automatically perceive the business log path according to the LOG_PATH in the environment variable of the business Pod (e.g., LOG_PATH = [" / var / log / appA.log", " / var / log / appB.log"]), and then automatically collect the logs under the above path.

[0063] The Sidecar proxy container can automatically hijack the network traffic passing through the corresponding business Pod (referring to the business Pod injected with the Sidecar proxy container) through the Iptables of the business Pod to collect service quality logs and statistical logs such as the number of HTTP calls and / or the number of gRPC calls and their corresponding response times, and print them to the standard output of the business Pod. In some embodiments, the Sidecar proxy container can collect conventional business logs, service quality logs, and statistical logs through the log collection module included in it, and replay the conventional business logs to the standard output of the business Pod, and can print the collected service quality logs and statistical logs to the standard output of the business Pod through the service quality log printing module included in it.

[0064] In some embodiments, the container runtime can automatically save the standard output content of each business Pod to the container log file corresponding to the host. The above container log file can generally be / var / log / containers / {CONTAINER_NAME}.log.

[0065] In some embodiments, an example of printing a quality of service log is as follows:

[0066] "[2024-01-01:08:00:00 2024-01-01:08:10:00]info HttpAccessCount 1000";

[0067] "[2024-01-01:08:10:00 2024-08-08:08:20:00]info GrpcAccessCount 2000".

[0068] In some embodiments, a "log collection node agent" program running on a Kubernetes node (k8s-node) in the form of a Daemonset can collect corresponding container logs (eg, / var / log / containers / myapp-xxxxx.log)) and push them to a message queue.

[0069] In some embodiments, the log control plane Pod (specifically, the log persistence module) running on the Kubernetes cluster can periodically pull log data from the message queue in batches, then add relevant business tags to each line of log data, and finally save it to the time series search engine Loki.

[0070] It should be noted that the purpose of adding relevant business tags is to distinguish which business the logs correspond to. For example, the log data after adding business tags is:

[0071] {app=myapp,container=myapp-xxxxx,msg="[2024-01-01:08:00:002024-01-01:08:10:00]info HttpAccessCount 1000]"......}.

[0072] In actual execution, the target business can be any business carried by the system running on the container. The target time window can be any time window. The time window can be a time period of a preset duration. The specific value of the preset duration is not limited in the embodiment of the present application. In some embodiments, the preset duration can be 1 hour, 12 hours, or 1 day, etc. Therefore, a unit time can be divided into multiple time windows according to the preset duration. For example, when the preset duration is 1 hour, the unit time of one day can be divided into 24 time windows, that is, 0:00-1:00, 1:00-2:00, ..., 22:00-23:00, 23:00-24:00 are respectively used as a time window.

[0073] In some embodiments, Figure 2 The log model analysis module in obtains the regular business logs of the target business in the target time window from the time series search engine Loki, as well as the service quality logs and statistical logs. It can be understood that the regular business logs of the target business, as well as the service quality logs and statistical logs, can all be collected through the Sidecar proxy container. Among them, the first log data includes the above-mentioned regular business logs.

[0074] In some embodiments, the log model analysis module can read logs from the time series search engine Loki according to the time window set in the configuration center, and then enter the subsequent log analysis process.

[0075] In some embodiments, based on the quality of service log and the statistical log, the target parameters of the target service in the target time window can be obtained; after the target parameters of the target service in the target time window are obtained, the first subvector can be obtained based on the target parameters of the target service in the target time window. Therefore, the first subvector carries information about the target parameters of the target service in the target time window, so that the first subvector can be used to indicate the target parameters of the target service in the target time window.

[0076] In some embodiments, the number of the target parameters may be one or more. After the target parameters are acquired, the target parameters may be respectively taken as an element, so as to obtain a first sub-vector including the above elements.

[0077] In some embodiments, the target parameter may include at least one of HTTP response time, gRPC response time, number of HTTP calls, number of gRPC calls, response message size, etc. In some embodiments, at least one of HTTP response time, gRPC response time, response message size, etc. may adopt at least one of mathematical statistics values ​​such as maximum value, minimum value, average value, and median value.

[0078] It should be noted that adding service quality logs or statistical logs can better assist in analyzing abnormal status of business programs and help improve the accuracy of log analysis.

[0079] It should be noted that the embodiment of the present application adopts a log collection method based on the Sidecar proxy architecture that is non-invasive to the business code. In addition to collecting regular business logs, it can also automatically print and collect service quality logs or statistical logs such as the number of HTTP calls, the number of gRPC calls and their response time, which can better analyze the abnormal status of the business program. Collecting logs of the custom path of the business Pod through the Sidecar proxy can greatly reduce the development workload. The business Pod only needs to declare LOG_PATH in the environment variable to be collected by the Sidecar proxy. The Sidecar proxy can help the business increase the collection of service quality logs or statistical logs, and can more conveniently analyze the abnormal status of the business from more dimensions. If new dimensions need to be added later, they can be added directly in the Sidecar proxy without modifying the business code. There is no invasion of the business code, it can solve cross-language problems, and can reduce the user's development workload.

[0080] Step 120: Based on the log template set corresponding to the target business and the first log data, obtain a second subvector of the target business in the target time window; the second subvector is used to indicate the number of each event in the first log data; the events correspond one-to-one to the log templates included in the log template set.

[0081] In actual execution, the first log data can be further processed based on the log template set corresponding to the target business to obtain the number of each event in the first log data, that is, the number of each event of the target business in the target time window; after obtaining the number of each event, the second sub-vector can be obtained based on the number of each event. Therefore, the second sub-vector carries information about the number of each event of the target business in the target time window, so that the second sub-vector can be used to indicate the number of each event in the first log data.

[0082] It should be noted that the log template set may include multiple log templates. Each log template may be used to represent an event. Any two log templates represent different types of events, so there is a one-to-one correspondence between events and log templates. Figure 3 A log template set corresponding to a target service is exemplarily illustrated. The log template set includes five log templates corresponding to five events (Event 1 to Event 5).

[0083] It should be noted that the log template is used to characterize an event and thus can be used to indicate the characteristics of the event, so that the number of the event in the first log data can be obtained based on the log lines in the first log data that match the log template.

[0084] In some embodiments, an identification (ID) different from other log templates (which may include log templates of the same service and log templates of other services) may be set for each log template to distinguish which log template it is.

[0085] It should be noted that, since the types of events generated by different services may be the same or different, different services may correspond to the same or different log template sets, and the log template sets corresponding to any two services may be the same or different. Usually, the log template sets corresponding to any two services are different.

[0086] Step 130: Analyze the feature vector based on the trained decision tree to determine whether the target service in the target time window is abnormal; the feature vector is obtained based on the first sub-vector and the second sub-vector.

[0087] In actual execution, the first sub-vector and the second sub-vector may be fused to obtain a feature vector of the target service in the target time window. In some embodiments, the first sub-vector and the second sub-vector may be concatenated to obtain a feature vector.

[0088] After obtaining the feature vector, log anomaly detection can be performed based on the feature vector. Based on the trained decision tree, a decision can be made according to the feature vector to determine whether the target business in the target time window is abnormal. It should be noted that the trained decision tree is the decision tree corresponding to the target business.

[0089] In some embodiments, the decision tree corresponding to the target service can be called by executing the function decision(new_logs) to make a decision, and obtain a judgment result of whether the target service in the target time window is abnormal. The judgment result can be recorded as label_logs.

[0090] It is understandable that for the above-mentioned Kubernetes cluster-based system, log data sets of different time windows (which may include business logs of different business routines, as well as service quality logs and statistical logs) can be judged using corresponding decision trees to determine whether an abnormality occurs.

[0091] It can be understood that if the target business in the target time window is abnormal, the business Pod corresponding to the target business is abnormal; conversely, if the target business in the target time window is normal, the business Pod corresponding to the target business is normal.

[0092] In some embodiments, when the judgment result is that the target service in the target time window is abnormal, Figure 2 The notification module shown sends a prompt message to notify the user. In some embodiments, the user may be an administrator of the above-mentioned Kubernetes cluster-based system.

[0093] It should be noted that the embodiment of the present application provides a method for constructing a more accurate log anomaly detection model (referring to a trained decision tree). The accuracy of log anomaly judgment can be continuously improved through machine learning, which can greatly increase the possibility of automated management of clusters such as Kubernetes. In addition, by introducing intelligent algorithms, problems such as low efficiency of manual detection of abnormal logs and large amount of repetitive work can be solved. Through continuous machine learning, the accuracy of log anomaly detection can be improved.

[0094] According to the log analysis method provided in the embodiment of the present application, by adopting a Sidecar proxy method that does not invade the business code to collect logs, and introducing AI artificial intelligence algorithms into the logs for machine training and anomaly detection, the workload invested by developers in log management and anomaly detection can be greatly reduced, so that developers can focus more on developing applications and see abnormal logs and log trends more conveniently and intuitively, which can improve the efficiency and accuracy of log analysis, and can analyze logs from more dimensions to obtain more comprehensive and accurate log analysis results.

[0095] In some embodiments, before obtaining the second sub-vector of the target business in the target time window based on the log template set corresponding to the target business and the first log data, the method also includes: for the second log data of the target business in at least one historical time window, replacing the variables in each log in the second log data with wildcards and then performing deduplication processing to obtain the log template set corresponding to the target business.

[0096] In actual execution, before step 120, the second log data of at least one target business in a historical time window may be processed in advance for the target business to obtain a log template set corresponding to the target business.

[0097] In some embodiments, the historical time window may be any of the aforementioned time windows before the target time window. The second log data of any target business in the historical time window may include the above-mentioned conventional business log of the target business in the historical time window. It is understandable that the second log data of the target business in at least one of the above-mentioned historical time windows is also obtained based on the Sidecar proxy container.

[0098] In some embodiments, all second log data read from the time series search engine Loki can be processed based on the algorithm of the Ft-Tree concept to obtain multiple log templates. The set consisting of the multiple log templates is the log template set corresponding to the target business.

[0099] In some embodiments, the second log data can be processed based on the algorithm of the Ft-Tree concept, including: removing variables in the second log data, replacing the removed variables with a wildcard, and obtaining multiple processed log lines; summarizing all processed log lines by deduplication, so as to obtain multiple log templates. It can be understood that the log template consists of constants and does not include variables.

[0100] In some embodiments, the second log data may be processed by executing the function ft_tree(logs) to obtain a log template set corresponding to the target business.

[0101] Figure 4 The second log data is exemplarily shown, based on Figure 4 The log template set obtained from the second log data shown can be as follows Figure 3 shown. Figure 4 The 8 log lines shown are summarized as Figure 4 5 log templates are shown. Figure 4 It also shows Figure 4 The corresponding relationship between 8 log lines and 5 log templates is shown.

[0102] In some embodiments, the wildcard may be a symbol that does not appear in a log line, such as "*" or "|, etc." The specific wildcard used is not limited in the embodiments of the present application.

[0103] For example, for Figure 4The first and sixth log lines in the log file (which can be recorded as Log1 and Log6 respectively) include the name of the data packet (for example, pkg_42198389, pkg_42199345), IP address (for example, 10.233.81.56, 10.233.101.5), and pipeline number (for example, line_12, line_11). After replacing the above variables with wildcards, two processed log lines are obtained, both of which contain "Send package*to*success(Pipeline:*)". After deduplication, the following can be obtained: Figure 4 The log template corresponding to Event1 is shown.

[0104] For example, for Figure 4 The 5th and 7th log lines in the log file (which can be recorded as Log5 and Log7 respectively) contain pipeline numbers (such as line_13 and line_14) and ttl times (such as 3600 and 7200). After replacing the above variables with wildcards, two processed log lines are obtained, both of which contain "Create new pipeline*success, ttl*(s)". After deduplication, the following can be obtained: Figure 4 The log template corresponding to Event4 is shown.

[0105] In some embodiments, the log template set corresponding to the target service may be stored in a log template table in the database. Figure 5 The log template table can be used to store log templates. For each log template, the fields in the log template table may include a business name (which can be used as an identifier of the business corresponding to the log template), a log template identifier (ID), and the content of the log template (such as Figure 3 The content after the colon in ( ) and the threshold corresponding to the log template (that is, the threshold corresponding to each element in the second sub-vector or the threshold of various event times, which can be used to label the training samples of the decision tree), etc.

[0106] According to the log analysis method provided in the embodiment of the present application, by replacing the variables in each log in the second log data with wildcards for the target business in at least one historical time window and performing deduplication processing, a log template is obtained, thereby obtaining a set of log templates corresponding to the target business. This allows for more convenient and accurate acquisition of the number of events in the target time window based on the log template, and allows for more accurate log analysis based on the number of events in the target time window to determine whether the target business in the target time window is abnormal.

[0107] In some embodiments, after obtaining a log template set corresponding to the target business, and before obtaining a second sub-vector of the target business in the target time window based on the log template set corresponding to the target business and the first log data, the method also includes: determining, for each log template in the log template set, a weight of the log template for each time window.

[0108] In actual execution, after obtaining each log template, the weight of the log template for each time window can also be determined. The relationship between the weights of each time window can be used to indicate the relationship between the value of the target parameter in each time window and the normal range of the number of times at each time. Based on the weight of each time window, the value of the target parameter in different time windows and the normal range of the number of times at each time can be unified so that the characteristics of the target time window log can be easily obtained. The weight is a positive integer.

[0109] In some embodiments, different log templates under the same service may be set to different weights in different time windows (such as 12:00-13:00 and 23:00-00:00). It is understandable that, in the case of uncertain weights, the default log template has the same weight for each time window.

[0110] For example, if the log template corresponding to a SQL query business still has slow queries in the time window of 23:00-00:00, which has low concurrent access volume, the time window can be weighted a little larger to facilitate observation of the access volume in the time window. The number of events after weight processing has significant characteristics.

[0111] In some embodiments, the weight of the log template for each time window can be determined based on the user's input or pre-setting. Alternatively, the weight of the log template corresponding to the event for each time window can also be determined based on the number of a certain event in different historical time windows. For example, the number of A events in 8 time windows such as 22:00-6:00 is about 10 and the number of A events in 16 time windows such as 6:00-22:00 is about 100, then the weight of the log template corresponding to the A event for 8 time windows such as 22:00-6:00 can be determined as 10, and the weight of the log template corresponding to the A event for 16 time windows such as 6:00-22:00 can be determined as 1.

[0112] In some embodiments, reference Figure 5 The weight of each time window of the log template can also be stored in the database, specifically in the log template weight table. The fields of the log template weight table may include the service name, the identification (ID) of the log template, the time window and the weight, etc.

[0113] According to the log analysis method provided in the embodiment of the present application, by determining the weight of the log template for each time window, the access volume of different time windows can be easily observed, and the number of events after weight processing has significant characteristics, so that a second sub-vector that is more helpful for accurate analysis of the log can be obtained, which can improve the accuracy of the log analysis.

[0114] In some embodiments, obtaining a second sub-vector of the target service in the target time window based on the log template set corresponding to the target service and the first log data includes: obtaining an original vector based on the number of log lines matching each log template in the first log data.

[0115] In actual execution, each log line in the first log data can be matched with each log template in the log template set corresponding to the target business, so as to determine which log template in the log template set the log line matches. After determining the log template that each log line matches, the number of times each log template is matched can be counted, that is, the number of log lines that each log template matches can be counted. The number of log lines that each log template matches is used as an element in the original vector, so that the original vector can be obtained.

[0116] Based on the weight of the target time window and the original vector, a second sub-vector is obtained.

[0117] In actual execution, the original vector may be processed based on the weight of the target time window to obtain the second sub-vector.

[0118] In some embodiments, the weight of the target time window may be multiplied by the original vector to obtain a second sub-vector, which may be represented by the following formula: second sub-vector = weight * original vector.

[0119] For example, if the weight of the target time window is 10 and the value of the x-th element in the original vector is 20, the value of the x-th element in the second sub-vector is 200.

[0120] In some embodiments, in the process of obtaining the feature vector, the first sub-vector may be processed by the weight of the target time window, and then the obtained vector may be concatenated with the second sub-vector (when the second sub-vector is obtained based on the weight of the target time window and the original vector) to obtain the feature vector. In some embodiments, the elements corresponding to the number of HTTP calls and / or the number of gRPC calls in the first sub-vector may be multiplied by the weight of the target time window, while the elements corresponding to the HTTP response time, the gRPC response time, and the response message size may remain unchanged, i.e., not multiplied by the weight of the target time window.

[0121] According to the log analysis method provided in the embodiment of the present application, the original vector is obtained based on the number of log lines matching each log template in the first log data, and the second sub-vector is obtained based on the weight of the target time window and the original vector. This is equivalent to normalizing the number of events in the target time window, and can obtain a second sub-vector that is more helpful for accurately analyzing the log, thereby improving the accuracy of the log analysis.

[0122] In some embodiments, before analyzing the feature vector based on the trained decision tree to determine whether the target business in the target time window is abnormal, and after obtaining the log template set corresponding to the target business, the method also includes: based on the third log data and log template set of at least one historical time window target business, obtaining the feature vector of the third log data as a training sample.

[0123] In actual execution, before step 120, training may be performed in advance for the target business according to the second log data of the target business in at least one historical time window to obtain a trained decision tree as the decision tree corresponding to the target business.

[0124] Based on the log template set corresponding to the target business, the third log data of the target business in at least one historical time window can be processed the same as step 110, step 120 and the feature vector of the target business in the target time window to obtain the target parameters and the number of events, thereby obtaining the feature vector of the third log data. For each historical time window in the at least one historical time window, the third log data may include a conventional business log, a service quality log, and a statistical log. The feature vector of each third log data obtained can be used as a training sample.

[0125] The feature vector of the third log data is labeled based on the target regular expression to obtain the label corresponding to the training sample; the label corresponding to the training sample is used to indicate whether the third log data is abnormal; the target regular expression is used to indicate the relationship between the elements in the feature vector of the third log data and the relationship between each element and the corresponding threshold.

[0126] In actual execution, each training sample can be labeled to obtain a label corresponding to the training sample. The label corresponding to the training sample can be used to indicate whether the target business in the historical time window corresponding to the training sample is abnormal. Based on each training sample and the label corresponding to the training sample, a training sample set can be obtained.

[0127] In some embodiments, a user's input for the training sample may be obtained, and a label corresponding to the training sample may be determined based on the input.

[0128] In some embodiments, the training sample can be judged according to a target regular expression to determine whether the target service of the historical time window corresponding to the training sample is abnormal, so as to determine the label corresponding to the training sample according to the judgment result. The target regular expression can represent a certain rule, and the rule can be a rule representing log anomalies.

[0129] In some embodiments, a target regular expression can be generated based on the user's input. For example, the target regular expression can be (ID1>ID1.Limit)&&(ID2>ID2.Limit)||(ID1<ID2). Wherein, ID1 and ID2 can respectively represent the number of times of target time window event 1 and event 2; ID1.Limit and ID2.Limit can respectively represent the thresholds of the number of times of event 1 and event 2 in a time window (that is, the thresholds of the number of times of event 1 and event 2 or the thresholds corresponding to the elements representing the number of times of event 1 and event 2 in the second sub-vector); "&&" and "||" are logical operators, representing "logical AND" and "logical OR" respectively.

[0130] In some embodiments, referring to Figure 5 , the target regular expressions of each target service can also be stored in a database, specifically in a log anomaly rule table. The fields of the log anomaly rule table can include the service name and the target regular expression, etc.

[0131] Referring to Figure 6 , the training sample can also include a first sub-vector and a second sub-vector. The elements corresponding to the first sub-vector respectively represent the HTTP response time, gRPC response time, HTTP call count, gRPC call count, and response message size. The second sub-vector respectively represents the number of times of events 1 to M. The label corresponding to the training sample indicates whether the service (or service Pod) is normal. Wherein, M is a positive integer representing the number of types of events.

[0132] Train based on the training sample and the label corresponding to the training sample to obtain a trained decision tree.

[0133] In actual execution, a decision tree can be trained based on each training sample and the label corresponding to each training sample, so as to obtain a trained decision tree.

[0134] In some embodiments, the labeled training samples of the target service can be imported into the training function generate_decision_tree(label_logs). After executing the training function, the trained decision tree corresponding to the target service can be obtained.

[0135] In some embodiments, referring to Figure 5The trained decision trees corresponding to each business can also be stored in the database, specifically in a business decision tree table. The fields of the business decision tree table can include business name and decision tree, etc.

[0136] According to the log analysis method provided in the embodiment of the present application, by obtaining a feature vector of the third log data and a log template set based on at least one historical time window target business, annotating the feature vector of the third log data based on the target regular expression, obtaining a label corresponding to the training sample, training based on the training sample and the label corresponding to the training sample, and obtaining a trained decision tree, a more accurate log anomaly detection model can be constructed, and the accuracy of log anomaly judgment can be continuously improved through machine learning, which can greatly increase the possibility of automated management of clusters.

[0137] In some embodiments, after analyzing the feature vector based on the trained decision tree to determine whether the target business in the target time window is abnormal, the method also includes: obtaining manual review information on the judgment result of whether the target business in the target time window is abnormal; the manual review information is used to indicate whether the judgment result is correct.

[0138] In actual execution, through step 130, the feature vector is analyzed based on the trained decision tree to determine whether the target business in the target time window is abnormal, and the judgment result of whether the target business in the target time window is abnormal can be obtained. The judgment result of whether the target business in the target time window is abnormal can be obtained, and the user (such as the administrator or other staff of the system running on the container mentioned above) can manually review the judgment result. The user can input manual review information based on whether the judgment result determined by manual review is correct, so as to obtain manual review information indicating whether the judgment result is correct.

[0139] Update the trained decision tree based on manual review information and feature vectors.

[0140] In actual implementation, the feature vector of the target service in the target time window may be used as a new training sample, and the label corresponding to the new training sample may be determined based on the manual review information and the judgment result obtained in step 130 .

[0141] In some embodiments, when the manual review information indicates that the judgment result obtained in step 130 is a correct result, the judgment result obtained in step 130 can be used as the label corresponding to the new training sample; and, when the manual review information indicates that the judgment result obtained in step 130 is an incorrect result, the opposite result of the judgment result obtained in step 130 can be used as the label corresponding to the new training sample.

[0142] For example, the judgment result obtained in step 130 is that the target business in the target time window is abnormal. When the above-mentioned manual review information indicates that the judgment result is a correct result, "abnormal" can be used as the label corresponding to the above-mentioned new training sample. When the above-mentioned manual review information indicates that the judgment result is an incorrect result, "not abnormal" or "normal" can be used as the label corresponding to the above-mentioned new training sample.

[0143] After obtaining the new training samples and the labels corresponding to the labels corresponding to the new training samples, the previously trained decision tree can be retrained based on the new training samples to update the previously trained decision tree.

[0144] According to the log analysis method provided in the embodiment of the present application, by obtaining manual review information on the judgment result of whether the target business in the target time window is abnormal, the trained decision tree is updated based on the manual review information and the feature vector. This can achieve continuous updating of the decision tree by expanding the training samples, increase the accuracy of the decision tree, and improve the accuracy of the log analysis.

[0145] It should be noted that in response to the shortcomings of the relevant technology, the embodiment of the present application adopts a log analysis method that combines Sidecar proxy, machine learning, intelligent algorithm and other technologies, which can effectively address the aforementioned problems existing in the relevant technology.

[0146] Among them, the Sidecar proxy can collect business logs and generate service quality logs or statistical logs without intrusion.

[0147] The intelligent algorithm can automatically generate several log templates according to the time window and for each business log, and organize a large number of logs with high similarity, high repetition and difficult to observe with the naked eye into a limited number of N (N is a positive integer) log templates with unique IDs with low repetition. The log templates can be stored in the database, and the number of occurrences of each log template in each time window can be counted, which can form the second sub-vector.

[0148] The intelligent algorithm can also obtain the pre-training data set for log anomaly detection (hereinafter referred to as Ta) by combining the counts of N log templates under each business. Each row of data in Ta is composed of multiple columns of feature vectors, and then each row of each combined data can be marked as abnormal to obtain a training sample set (hereinafter referred to as Tb). Based on Tb, machine learning technology can be used to generate a decision tree (hereinafter referred to as Dt). Dt can be used to analyze and infer whether new log data is abnormal. The judgment result obtained by Dt can be combined with manual review and used as a new training sample for machine learning again to increase the accuracy of log anomaly judgment.

[0149] The embodiments of the present application are implemented based on containers, Kubernetes, and Sidecar agents. Containerization technology packages the application and its dependencies into a lightweight container, which is scheduled and managed by Kubernetes, thereby achieving rapid deployment and migration of the application. The Sidecar agent then collects logs and traffic monitoring for the business code without intrusion, and finally allows the log analysis module to perform classification analysis using AI artificial intelligence algorithms. Container technology and Kubernetes are important concepts in modern software development and deployment. Together, they provide strong support for the operation of cloud-native applications. The combination of technologies based on this can make the system more flexible and easier to manage, becoming one of the important trends for future development.

[0150] The log analysis method provided in the embodiment of the present application can be executed by a log analysis device. In the embodiment of the present application, the log analysis device provided in the embodiment of the present application is described by taking the log analysis device executing the log analysis method as an example.

[0151] The present application also provides a log analysis device. Figure 7 As shown, the log analysis device includes:

[0152] The collection module 710 is used to obtain the first log data of the target business in the target time window and the first subvector of the target business in the target time window based on the Sidecar proxy container; the first subvector is used to indicate the target parameter of the target business in the target time window;

[0153] The acquisition module 720 is used to acquire a second sub-vector of the target business in the target time window based on the log template set corresponding to the target business and the first log data; the second sub-vector is used to indicate the number of each event in the first log data; the events correspond to the log templates included in the log template set one by one;

[0154] The analysis module 730 is used to analyze the feature vector based on the trained decision tree to determine whether the target service in the target time window is abnormal; the feature vector is obtained based on the first sub-vector and the second sub-vector.

[0155] According to the log analysis device provided in the embodiment of the present application, by adopting a Sidecar proxy method that does not invade the business code to collect logs, and introducing AI artificial intelligence algorithms into the logs for machine training and anomaly detection, the workload invested by developers in log management and anomaly detection can be greatly reduced, so that developers can focus more on developing applications and see abnormal logs and log trends more conveniently and intuitively, which can improve the efficiency and accuracy of log analysis, and can analyze logs from more dimensions to obtain more comprehensive and accurate log analysis results.

[0156] In some embodiments, the log analysis device may further include:

[0157] The template generation module is used to replace the variables in each log in the second log data with wildcards for at least one historical time window target business, and then perform deduplication processing to obtain a log template set corresponding to the target business.

[0158] In some embodiments, the log analysis device may further include:

[0159] The determination module is used to determine the weight of each log template for each time window for each log template in the log template set.

[0160] In some embodiments, the acquisition module 720 may be specifically used to:

[0161] Obtaining an original vector based on the number of log lines in the first log data that match each log template;

[0162] Based on the weight of the target time window and the original vector, a second sub-vector is obtained.

[0163] In some embodiments, the log analysis device may further include:

[0164] A training module is used to obtain a feature vector of the third log data as a training sample based on the third log data and log template set of the target business in at least one historical time window; annotate the feature vector of the third log data based on a target regular expression to obtain a label corresponding to the training sample; the label corresponding to the training sample is used to indicate whether the third log data is abnormal; the target regular expression is used to indicate the relationship between the elements in the feature vector of the third log data and the relationship between each element and the corresponding threshold; perform training based on the training sample and the label corresponding to the training sample to obtain a trained decision tree.

[0165] In some embodiments, the training module in the log analysis device may also be used to:

[0166] Obtaining manual review information of the judgment result of whether the target business in the target time window is abnormal; the manual review information is used to indicate whether the judgment result is correct;

[0167] Update the trained decision tree based on manual review information and feature vectors.

[0168] The log analysis device in the embodiment of the present application can be an electronic device, or a component in the electronic device, such as an integrated circuit or a chip. The electronic device can be a terminal, or other devices other than the terminal. Exemplarily, the electronic device can be a mobile phone, a tablet computer, a laptop computer, a palmtop computer, a vehicle-mounted electronic device, a mobile Internet device (Mobile Internet Device, MID), an augmented reality (augmented reality, AR) / virtual reality (virtualreality, VR) device, a robot, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and can also be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personalcomputer, PC), a television (television, TV), a teller machine or a self-service machine, etc., and the embodiment of the present application is not specifically limited.

[0169] The log analysis device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0170] The log analysis device provided in the embodiment of the present application can achieve Figures 1 to 6 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0171] In some embodiments, Figure 8 As shown, an embodiment of the present application also provides an electronic device 800, including a processor 810, a memory 820, and a computer program stored in the memory 820 and executable on the processor 810. When the program is executed by the processor 810, each process of the above-mentioned log analysis method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0172] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0173] An embodiment of the present application also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned log analysis method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0174] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0175] An embodiment of the present application also provides a computer program product, including a computer program, which implements the above-mentioned log analysis method when executed by a processor.

[0176] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory ROM, a random access memory RAM, a magnetic disk or an optical disk.

[0177] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned log analysis method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0178] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0179] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0180] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0181] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0182] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0183] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. A log analysis method, characterized in that: include: Based on the Sidecar proxy container, obtain first log data of a target business in a target time window and a first subvector of the target business in the target time window; The first sub-vector is used to indicate a target parameter of the target service in the target time window; Based on the log template set corresponding to the target business and the first log data, obtaining a second sub-vector of the target business in the target time window; the second sub-vector is used to indicate the number of each event in the first log data; the events correspond one to one with the log templates included in the log template set; The feature vector is analyzed based on the trained decision tree to determine whether the target service in the target time window is abnormal; the feature vector is obtained based on the first sub-vector and the second sub-vector.

2. The log analysis method according to claim 1, characterized in that: Before acquiring the second sub-vector of the target service in the target time window based on the log template set corresponding to the target service and the first log data, the method further includes: For the second log data of the target business in at least one historical time window, a variable in each log in the second log data is replaced with a wildcard and then deduplication is performed to obtain a log template set corresponding to the target business.

3. The log analysis method according to claim 2, characterized in that: After acquiring the log template set corresponding to the target service and before acquiring the second sub-vector of the target service in the target time window based on the log template set corresponding to the target service and the first log data, the method further includes: For each log template in the log template set, a weight of the log template for each time window is determined.

4. The log analysis method according to claim 3, characterized in that: The acquiring, based on the log template set corresponding to the target service and the first log data, a second sub-vector of the target service in the target time window includes: Obtaining an original vector based on the number of log lines in the first log data that match each of the log templates; The second sub-vector is obtained based on the weight of the target time window and the original vector.

5. The log analysis method according to claim 2, characterized in that: Before analyzing the feature vector based on the trained decision tree to determine whether the target service in the target time window is abnormal, and after obtaining the log template set corresponding to the target service, the method further includes: Based on the third log data of the target business in at least one historical time window and the log template set, acquiring a feature vector of the third log data as a training sample; The feature vector of the third log data is labeled based on the target regular expression to obtain a label corresponding to the training sample; the label corresponding to the training sample is used to indicate whether the third log data is abnormal; the target regular expression is used to indicate the relationship between the elements in the feature vector of the third log data and the relationship between each element and the corresponding threshold value; Training is performed based on the training samples and labels corresponding to the training samples to obtain the trained decision tree.

6. The log analysis method according to any one of claims 1 to 5, characterized in that: After analyzing the feature vector based on the trained decision tree to determine whether the target service in the target time window is abnormal, the method further includes: Obtaining manual review information of a judgment result on whether the target service in the target time window is abnormal; the manual review information is used to indicate whether the judgment result is correct; The trained decision tree is updated based on the manual review information and the feature vector.

7. A log analysis device, characterized in that: include: A collection module, configured to obtain, based on a Sidecar proxy container, first log data of a target service in a target time window and a first sub-vector of the target service in the target time window; The first sub-vector is used to indicate a target parameter of the target service in the target time window; an acquisition module, configured to acquire a second sub-vector of the target business in the target time window based on the log template set corresponding to the target business and the first log data; the second sub-vector is used to indicate the number of each event in the first log data; the events correspond one-to-one to the log templates included in the log template set; The analysis module is used to analyze the feature vector based on the trained decision tree to determine whether the target service in the target time window is abnormal; the feature vector is obtained based on the first sub-vector and the second sub-vector.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the log analysis method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the log analysis method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the log analysis method according to any one of claims 1 to 6 is implemented.

Images