Log processing method, device, equipment, storage medium and product

Abstract

The present application discloses a log processing method, device, equipment, storage medium and product, which relates to the field of cloud computing technology. The log processing method includes: scanning the log index information of the log storage area, and determining the log type of multiple access logs existing in the log storage area based on the scanning result; determining the dump strategy of each access log according to the log type of each access log; and processing each access log according to the dump strategy of each access log. Through the above method, periodic access log retrieval and dumping are provided, and different log types are designed to correspond to different dump strategies, which improves the dump efficiency, and realizes the rapid processing of different types of access logs, effectively solves the confusion of stored user access logs, and reduces the occupation of SSD through rapid dumping, effectively reducing the cost of use.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to log processing methods, devices, equipment, storage media and products. Background Art

[0002] When accessing unstructured data, it is necessary to record operation logs, which contain simplified metadata information of the object to trigger the execution of functional features, such as lifecycle management, bucket replication, and data merging. The existing solution is to directly store all access logs in the metadata, which will cause excessive storage usage. When there are many logs, it can only rely on the background service to scan and delete redundant access logs. At the same time, it is very inconvenient to use the logs later, resulting in low log utilization efficiency. Summary of the invention

[0003] The main purpose of this application is to provide a log processing method, device, equipment, storage medium and product, aiming to solve the technical problem of how to optimize the storage and management of unstructured data access logs and improve the efficiency of log processing for subsequent use.

[0004] To achieve the above purpose, the present application proposes a log processing method, which includes:

[0005] Scanning log index information of a log storage area, and determining log types of multiple access logs existing in the log storage area based on the scanning result;

[0006] Determine a dump strategy for each access log according to the log type of each access log;

[0007] Process each access log according to its dump policy.

[0008] In one embodiment, the step of processing each access log according to the dump strategy of each access log includes:

[0009] When the dump strategy of the access log is the first dump strategy, determining the file occupancy of each access log;

[0010] When the file occupancy of each access log is greater than a first preset occupancy, a merging task is generated and executed;

[0011] When the merging task is successfully executed, the log entry of each access log is deleted in the log index information.

[0012] In one embodiment, the step of processing each access log according to the dump strategy of each access log includes:

[0013] When the dump strategy of the access log is the second dump strategy, the log entry of each access log is written into the temporary storage area;

[0014] When the temporary storage information in the temporary storage area meets the secondary dump condition, each log entry in the temporary storage area is written into the long-term storage area, and each log entry in the long-term storage area is deleted from the log index information.

[0015] In one embodiment, the secondary dump condition includes at least one of the following:

[0016] The accumulated occupancy of the temporary storage area is greater than a second preset occupancy;

[0017] The storage period of the log entry of each access log in the temporary storage area reaches a preset period.

[0018] In one embodiment, after the step of writing each log entry existing in the temporary pool storage area to the long-term storage area and deleting each log entry existing in the long-term storage area in the log index information, the method further includes:

[0019] Determine the task type based on the background task information;

[0020] When the task type is the first type, determining a log life cycle;

[0021] The log entries existing in the long-term storage area are scanned according to the log life cycle, entries to be deleted are determined, and deletion operations are performed.

[0022] In one embodiment, before the step of scanning the log index information of the log storage area and determining the log types of the multiple access logs existing in the log storage area based on the scanning result, the step further includes:

[0023] Identify the log information of each access log, and determine the log type of each access log according to the identification result;

[0024] Constructing a log identifier for each access log according to the log type of each access log;

[0025] Log index information of the log storage area is constructed according to the log identifier of each access log and the metadata of each access log.

[0026] In addition, to achieve the above purpose, the present application also proposes a log processing device, the log processing device comprising:

[0027] A scanning module, used for scanning log index information of a log storage area, and determining log types of multiple access logs existing in the log storage area based on the scanning result;

[0028] A processing module, used to determine a dump strategy for each access log according to the log type of each access log;

[0029] The processing module is used to process each access log according to the dump strategy of each access log.

[0030] In addition, to achieve the above-mentioned purpose, the present application also proposes a log processing device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the log processing method described above.

[0031] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the log processing method described above are implemented.

[0032] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the log processing method described above are implemented.

[0033] The present application scans the log index information of the log storage area, and determines the log types of multiple access logs existing in the log storage area based on the scanning results; determines the dump strategy of each access log according to the log type of each access log; and processes each access log according to the dump strategy of each access log. Through the above method, periodic access log retrieval and dumping are provided, and different dump strategies corresponding to different log types are designed, which improves the dumping efficiency, and realizes the rapid processing of different types of access logs, effectively solves the confusion of stored user access logs, and reduces the occupancy of SSD through rapid dumping, effectively reducing the cost of use. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0036] Figure 1 A flowchart of the first embodiment of the log processing method of the present application is provided;

[0037] Figure 2 A flow chart of the second embodiment of the log processing method of this application;

[0038] Figure 3 A flowchart of the third embodiment of the log processing method of this application is provided;

[0039] Figure 4 A schematic diagram of the second type of access log processing of the log processing method provided in Example 3 of the present application;

[0040] Figure 5 A schematic diagram of the relationship between access logs and storage areas of the log processing method provided in Example 3 of the present application;

[0041] Figure 6 A brief flowchart of the log processing method provided in Example 1 of the present application;

[0042] Figure 7 This is a schematic diagram of the module structure of the log processing device according to an embodiment of the present application;

[0043] Figure 8 This is a schematic diagram of the device structure of the hardware operating environment involved in the log processing method in the embodiment of the present application.

[0044] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0046] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0047] The main solution of the embodiment of the present application is: scan the log index information of the log storage area, and determine the log type of multiple access logs existing in the log storage area based on the scanning results; determine the dump strategy of each access log according to the log type of each access log; process each access log according to the dump strategy of each access log.

[0048] When accessing unstructured data, it is necessary to record operation logs, which contain simplified metadata information of the object to trigger the execution of functional features, such as lifecycle management, bucket replication, and data merging. The existing solution is to directly store access logs in metadata without dumping the access logs, which will cause excessive storage usage and the need for continuous expansion, resulting in excessive costs. The only solution is to rely on background services to scan and delete redundant access logs.

[0049] At present, for single projects or distributed projects, user access log records are often collected and stored. In the existing solutions, the user access log records are collected by using the collection logic of different clients, and then the user access log records are stored with the same logic. The stored data is basically the same, which will cause duplication of storage code and confusion in the storage of user access log data. In addition, different collection solutions are required for different clients, and corresponding storage solutions need to be adopted for each client. The storage methods are quite different, and the background node needs to spend more threads to process the collected user log data of different clients.

[0050] The present application provides a solution, provides periodic access log retrieval and dumping, and designs different dump strategies corresponding to different log types, thereby improving the dumping efficiency and realizing fast processing of different types of access logs, effectively solving the problem of confusion in stored user access logs, and reducing the occupancy of SSD (Solid State Drive) through fast dumping, thereby effectively reducing the cost of use.

[0051] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or a log processing device capable of realizing the above functions, etc. The following takes the log processing device as the execution subject as an example to illustrate this embodiment and the following embodiments.

[0052] Based on this, the present application embodiment provides a log processing method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the log processing method of the present application.

[0053] In this embodiment, the log processing method includes steps S10 to S30:

[0054] Step S10, scanning log index information in the log storage area, and determining log types of multiple access logs existing in the log storage area based on the scanning result;

[0055] It should be noted that the storage system in the log processing device includes object storage and file storage, and access log records can drive business. Different types of access logs will be recorded when objects are uploaded and modified, including metadata information such as the object's mtime (modification time of the file content), etag (entity tag), data unique identification information (tag), etc. The access log is used to drive storage business, including data merging, life cycle and bucket replication and other characteristics, wherein the access log classification is briefly described as the first type and the second type, wherein the first type is used for data merging, and the second type is used for life cycle scanning background tasks. The access log of the object will be submitted together with the metadata through the transaction when the object is uploaded and modified, wherein the first type and the second type are distinguished by different namespaces. The dump module is divided into a first-level dump service and a second-level dump service, and the first-level dump is used to quickly scan the access log to generate a first-level dump and distinguish different types for different processing. For the second type, it is written into the data pool in the form of data, and the corresponding metadata is updated and the access log records in the index are deleted; for the first type of access log, the merging task is sent to the flow engine, and the access log records in the index are deleted.

[0056] In this embodiment, for the first-level dump file corresponding to the second type, its metadata is recorded in the dump list of the bucket. The second-level dump service performs the second-level dump by scanning the first-level dump file. The process needs to meet a certain size or meet a threshold time before issuing a task for dumping. The final form of the object access log dump is to generate a dump object on a daily basis, and the second-level dump can contain multiple objects. When the object is deleted, the access log will become meaningless. Therefore, when the entire bucket is expired or the entire bucket is deleted during the life cycle, the first-level and second-level dump logs of the corresponding date need to be deleted.

[0057] It should be noted that the log storage area refers to the area where all access logs are stored. Each log entry contains operation information and metadata about a specific object. The log storage area can be a storage bucket, folder, or other area. This embodiment does not limit this. In this embodiment, the log storage area is taken as a storage bucket for example. In the log storage area, data changes need to be recorded in the access log, which is used for data merging, life cycle, bucket replication, and other services.

[0058] It is understandable that in order to speed up retrieval and management, the system will create an index for the log entry corresponding to each access log, and this index records the location, identification and other relevant information of each log entry, so that the system can quickly locate and process a specific log entry. In this embodiment, the log index information includes the index of all access logs.

[0059] In a specific implementation, the log index information of the log storage area is scanned periodically. During the scanning process, all entries of each access log in the log index information are traversed to check the information contained in each entry, such as prefix, timestamp, and version number. Each log entry has a specific prefix to distinguish different types. For example, the prefix of the first type is 100_A, and the prefix of the second type is 100_B. In addition to the prefix, the system also parses other identification information in the log entry, such as timestamp and version number, to further confirm its uniqueness and specific attributes, so as to obtain the scanning result of each access log. According to the prefix and other identification information of each log entry in each access log in the scanning result, the system classifies the access log into different types. For example, the access log with the prefix "100_A_" is classified as the first type, and the access log with the prefix "100_B_" is classified as the second type.

[0060] In a feasible implementation manner, step S10 may include steps A11 to A13:

[0061] Step A11 , identifying the log information of each access log, and determining the log type of each access log according to the identification result.

[0062] It should be noted that the log information includes but is not limited to the metadata and operation information of each access log. For each access log, its log information is identified. When the log information only contains the OP type (Operation Type) "PUT" of the uploaded object, the access log is determined to be of the first type; when the log information contains detailed operation information and all OP types, such as uploading objects, deleting objects, setting ACL (Access Control List) permissions, etc., the access log is determined to be of the second type. For example, bucket replication will replicate deletion actions and metadata modification actions.

[0063] Step A12: construct a log identifier of each access log according to the log type of each access log.

[0064] It should be noted that, based on the log type of each access log, a log identifier is constructed for each access log, and the format of the log identifier is log type prefix + timestamp + version. For example, the instance format of the first type of access log is 100_A_20230703_000001; the instance format of the second type of access log is 100_B_20230703_000043, where the version value is self-incrementing. The information recorded in the access log is shown in Table 1.

[0065] Table 1

[0066] type meaning object Object Name bucket Bucket Name mtime Last modified time op Operation tag Unique ID eTag Entity Tags

[0067] Step A13: construct log index information of the log storage area according to the log identifier of each access log and the metadata of each access log.

[0068] It should be noted that necessary metadata information is extracted from the log entries of each access log, and the log index information of the log storage area is constructed using the log identifier of each access log and the extracted metadata. The consistency of the log index information is regularly checked and maintained to ensure that the log index information and the actual log entries remain synchronized.

[0069] Step S20, determining a dump strategy for each access log according to the log type of each access log;

[0070] It should be noted that different log types correspond to different dump strategies. In this embodiment, the dump strategy corresponding to the first type of access log is the first dump strategy; the dump strategy corresponding to the second type of access log is the second dump strategy. When the access log is of the first type, it means that the access log is a log corresponding to the merge business. For the merge business, it is necessary to complete the data merge as soon as possible to release the buffer pool space, and the access log is a one-time use. Therefore, the first dump strategy is not to dump the access log, that is, to keep it at the current state, and delete the first type of access log after the data is merged.

[0071] It can be understood that when the access log is of the second type, it means that the access log is used for scanning triggers of the life cycle and bucket replication, and the access log needs to be saved for a long time. For example, if the expiration deletion is configured for 100 days, the log for 100 days needs to be scanned. In order to reduce costs and reduce the space occupied by the SSD, the second dump strategy includes the first-level dump and the second-level dump. The first-level dump first scans the second type of access log to generate a first-level dump, and deletes the original log to release the SSD space as soon as possible. Since the generated first-level dump logs are small and large in number, the logs of the same day are packaged into a large log, that is, the second-level dump process.

[0072] Step S30: Process each access log according to the dump strategy of each access log.

[0073] This embodiment scans the log index information of the log storage area, and determines the log type of multiple access logs in the log storage area based on the scanning results; determines the dump strategy of each access log according to the log type of each access log; and processes each access log according to the dump strategy of each access log. Through the above method, periodic access log retrieval and dumping are provided, and different log types are designed to correspond to different dump strategies, which improves the dump efficiency, and realizes the rapid processing of different types of access logs, effectively solves the confusion of stored user access logs, and reduces the occupancy of SSD through rapid dumping, effectively reducing the cost of use.

[0074] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 2 In the log processing method, step S30 further includes steps S31 to S33:

[0075] Step S31, when the access log dumping strategy is the first dumping strategy, determine the file occupancy of each access log.

[0076] It should be noted that when the dump strategy of the access log is the first dump strategy, it indicates that the log type of the access log is the first type. At this time, the object file occupancy of the access log, that is, the size of the object in the storage, is obtained.

[0077] Step S32: When the file occupancy of each access log is greater than a first preset occupancy, a merging task is generated and executed.

[0078] It should be noted that the first preset occupancy is a preset merging threshold, such as 4MB. The first preset occupancy is used to determine when to trigger the merging task, specifically: when the file occupancy of the access log is greater than the first preset occupancy, the system will generate a merging task.

[0079] In the specific implementation, for the merging business, only objects of 0-4M need to be merged, and their metadata includes the unique identifier tail_tag of the object. For example, the tail_tag will change after the object is merged. In abnormal scenarios, whether merging is required can be determined by comparing the tail_tag.

[0080] Step S33, when the merging task is successfully executed, the log entry of each access log is deleted in the log index information.

[0081] It should be noted that the goal of the merge task is to merge multiple small files into a larger file to reduce disk space waste and improve storage efficiency. These small files are usually located in the SSD cache pool, and merging can release cache space faster. The merge task is performed by the flow engine, which merges small files that meet the conditions and updates the corresponding metadata information. For example, after an object is merged, its unique identifier tail_tag will change to reflect the new file status.

[0082] It is understandable that when the merging task is successfully completed, it will check and confirm that all related small files have been successfully merged. At this time, it is determined that the merging task is successfully executed, and the log entry corresponding to the first type of access log related to the merged object is deleted in the log index information, that is, the access log record in the index is deleted.

[0083] In a specific implementation, in addition to the above method, the merging task can also be triggered by the following conditions: when the number of objects in the access log reaches a preset number. Specifically: the first type of access log is used for data merging, and small files are merged and stored on disk. Usually, the disk has a minimum management unit, which can reduce disk space waste; at the same time, the set merging threshold is 4M, and the merging task is issued by scanning the access log to meet a certain threshold size or number of objects. Therefore, in the process of writing objects, only objects smaller than 4M in size will be recorded in the merged access log. In this embodiment, the preset number can be set to 16.

[0084] This embodiment determines the file occupancy of each access log when the dump strategy of the access log is the first dump strategy; generates and executes a merging task when the file occupancy of each access log is greater than the first preset occupancy; and deletes the log entry of each access log in the log index information when the merging task is successfully executed. In this way, disk space waste is reduced.

[0085] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those of the above-mentioned first embodiment and / or the second embodiment can refer to the above introduction, and will not be repeated later. Figure 3 In the log processing method, step S30 further includes steps S301 to S302:

[0086] Step S301, when the dump strategy of the access log is the second dump strategy, writing the log entries of each access log into a temporary storage area;

[0087] It should be noted that when the dump strategy of the access log is the second dump strategy, it means that the log type of the access log is the second type. At this time, the access log is used to trigger features such as life cycle and bucket replication. Therefore, access logs need to be recorded for each object size. The logs distinguish different types of ops, such as upload, copy and other operations. Finally, the service module triggers business distribution by scanning the dump log.

[0088] It is understandable that after the storage bucket is created, an access log metadata list will be created asynchronously to record the first-level dump and second-level dump log lists. The life cycle and bucket replication execute tasks by scanning the second-level access log list. The first-level dump is an internal transit state and is not reflected externally. The first-level dump of the second type of access log is performed by filtering the records of the second type prefix by scanning the index in the bucket by bucket, and the generated data is written to the storage pool by periodic scanning on the same day, and the access log metadata list is updated. After success, the access log of the index is deleted. The first-level dump log has a short scanning cycle interval and generates mostly small objects. Therefore, the storage pool is a temporary storage area composed of SSDs. In this embodiment, the temporary storage area can be a cache pool or other areas.

[0089] In the specific implementation, Figure 4 As shown, when the dump strategy is the second dump strategy, in order to dump the access log as soon as possible and release the SSD space, the log entries of each access log are written into the forest storage area through the first-level dump.

[0090] Step S302, when the temporary storage information in the temporary storage area meets the secondary dump condition, write each log entry in the temporary storage area to the long-term storage area, and delete each log entry in the long-term storage area in the log index information.

[0091] It should be noted that after completing the first-level dump, Figure 4 As shown, the bucket access log list needs to be scanned periodically for dumping, and the period is longer. The log entries in the temporary storage area are scanned to see if they meet the secondary dump conditions. If the secondary dump conditions are met, the system will write all relevant log entries in the temporary storage area to the long-term storage area, which can be a data pool or other areas. This step ensures that the log entries are stored securely and persistently, reducing the pressure on the temporary storage area. After successfully writing the log entries to the long-term storage area, the system deletes these log entries in the log index information. This not only reduces the size of the index, but also improves the efficiency of subsequent scanning and processing.

[0092] In a feasible implementation, the secondary dump condition includes at least one of the following: the cumulative occupancy of the temporary storage area is greater than a second preset occupancy; the storage period of the log entries of each access log in the temporary storage area reaches a preset period.

[0093] In this embodiment, the corresponding area of ​​the graded dump is as follows: Figure 5 When performing a secondary dump, the secondary dump conditions include but are not limited to the cumulative occupancy of log entries in the temporary storage area being greater than a set second preset occupancy; the storage period of log entries of each access log in the temporary storage area reaches a preset period. The preset period can be set to 1 day or other periods, which is not limited in this embodiment.

[0094] In this embodiment, the final form of the object access log dump is to generate a dump object on a daily basis, and the secondary dump can contain multiple objects. The access log is ultimately scanned and written to the data pool periodically on a daily basis, and the metadata is recorded in the access log list. The number of secondary dumps per day is usually related to the number of uploads or modifications. When the object is deleted, the access log becomes meaningless, so when the entire bucket is expired or the entire bucket is deleted during the life cycle, the primary and secondary dump logs of the corresponding date need to be deleted.

[0095] It should be noted that the first-level dump and second-level dump file lists are recorded in the bucket access log list, where the first-level dump is an internal state. The second-level dump module scans the access log list to realize the dumping of the first-level dump into the second-level dump object. Its implementation process reads the corresponding log data in the first-level dump list and aggregates them in the memory, and writes them to the data pool in the form of append writes. In addition, the metadata information is updated after meeting a certain size and number of entries. Before starting, the superposition of the corresponding data of the first-level dump in the list will be calculated to meet the threshold, the size exceeds 4M or the number of entries exceeds 16, otherwise the current scan will be skipped directly.

[0096] In a feasible implementation manner, step S302 may include steps C11 to C13:

[0097] Step C11, determining the task type according to the background task information.

[0098] It should be noted that the background task information includes but is not limited to the task name, description, and execution time, etc. The background task information is identified to determine the task type. In this embodiment, the task type includes but is not limited to lifecycle management tasks and bucket replication tasks.

[0099] Step C12: when the task type is the first type, determine the log life cycle.

[0100] It should be noted that when the task type is a lifecycle management task, it indicates that the task type is the first type, and the log lifecycle and corresponding cycle rules are further determined from the background task information. For example, the lifecycle configuration may stipulate that the object expires after 100 days, or the entire bucket is deleted under specific conditions.

[0101] Step C13, scanning each log entry existing in the long-term storage area according to the log life cycle, determining the entry to be deleted and performing a deletion operation.

[0102] It should be noted that the secondary dump logs in the long-term storage area are scanned to determine log entries of the access logs that meet the log life cycle, treat them as entries to be deleted, and perform corresponding deletion operations.

[0103] In this embodiment, for life cycle and bucket replication tasks: business drive is achieved by scanning the secondary dump log. For example, if the life cycle is configured to expire in 100 days, the task is triggered by scanning the log 100 days ago; bucket replication scans the secondary dump log for replication. When the bucket is configured to delete the entire bucket upon expiration, the data objects of the corresponding access log are deleted after the task is triggered, so the corresponding access log needs to be deleted. In addition, the secondary dump log and the unfinished primary dump will also be deleted after the bucket is deleted.

[0104] This embodiment writes the log entries of each access log into a temporary storage area when the access log dump strategy is the second dump strategy; when the temporary storage information of the temporary storage area meets the secondary dump condition, writes each log entry in the temporary storage area into the long-term storage area, and deletes each log entry in the long-term storage area in the log index information. In the above manner, the access log is dumped from the metadata index to the data pool, which reduces the use cost.

[0105] For example, to help understand the implementation process of the log processing method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 6 , Figure 6 A brief flow chart of a log processing method is provided. Specifically, the access log of an object will be submitted together with metadata through transactions when the object is uploaded and modified, where type A (i.e., the first type) and type B (i.e., the second type) are distinguished by different namespaces. The dump module is divided into a first-level dump service and a second-level dump service. The first-level dump is used to quickly scan the access log to generate a first-level dump and distinguish different types for different processing. For type B, it is written into the data pool as data, and the corresponding metadata is updated and the access log records in the index are deleted; for type A, a merge task is sent to the flow engine, and the access log records in the index are deleted.

[0106] The method of this embodiment specifically includes the following advantages: 1. By designing a dump module, the access log is transferred from the metadata index to the data pool, reducing the cost of use. The index pool is SSD, and the data pool is HDD (Hard Disk Drive). At the same time, the dump process design distinguishes the processing of different types of logs.

[0107] 2. Provide periodic access log retrieval and dumping. Improve dumping efficiency and fast dumping by designing first-level dump and second-level dump. This method can handle different types of access logs and trigger different types of services on dump logs. Design first-level dump service and second-level dump service. First-level dump is used to quickly scan access logs to generate first-level dumps and distinguish different types for different processing. First-level dump is a second-level cache to improve dumping efficiency and avoid disk loss caused by small IO (Input / Output) writes (if you want to scan quickly, it means that many relatively small second-level dump logs will be generated, and writing to the data pool will be small IO).

[0108] 3. Access logs are used to drive storage services, including features such as data merging, lifecycle, and bucket replication. Access logs are briefly classified into type A and type B. Type A is used for data merging, and type B is used for lifecycle scanning background tasks.

[0109] 4. For type B, write it into the data pool as data, update the corresponding metadata, and delete the access log records in the index; for type A, send the merge task to the flow engine, and delete the access log records in the index.

[0110] 5. The secondary dump service performs secondary dump by scanning the primary dump file. The process needs to meet a certain size or meet a certain threshold time before issuing a task for dumping.

[0111] 6. When the object is deleted, the access log becomes meaningless. Therefore, when the whole bucket is expired or the whole bucket is deleted during the life cycle, the primary and secondary dump logs of the corresponding date need to be deleted. The secondary dump log will be deleted immediately after the whole bucket is deleted during the life cycle configuration.

[0112] This embodiment implements access log dumping through the primary dump and secondary dump modules to achieve the purpose of reducing the cost of using SSD. At the same time, the dump module can distribute and process different types of logs. The designed primary dump is implemented as a cache for the secondary dump, which can improve efficiency and release space in time.

[0113] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the log processing method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0114] This application also provides a log processing device, please refer to Figure 7 , the log processing device comprises:

[0115] A scanning module 10, configured to scan log index information of a log storage area, and determine log types of multiple access logs existing in the log storage area based on the scanning result;

[0116] The processing module 20 is used to determine the dumping strategy of each access log according to the log type of each access log;

[0117] The processing module 20 is used to process each access log according to the dump strategy of each access log.

[0118] Optionally, the processing module 20 is further used for:

[0119] When the dump strategy of the access log is the first dump strategy, determining the file occupancy of each access log;

[0120] When the file occupancy of each access log is greater than a first preset occupancy, a merging task is generated and executed;

[0121] When the merging task is successfully executed, the log entry of each access log is deleted in the log index information.

[0122] Optionally, the processing module 20 is further used for:

[0123] When the dump strategy of the access log is the second dump strategy, the log entry of each access log is written into the temporary storage area;

[0124] When the temporary storage information in the temporary storage area meets the secondary dump condition, each log entry in the temporary storage area is written into the long-term storage area, and each log entry in the long-term storage area is deleted from the log index information.

[0125] Optionally, the processing module 20 is further used for:

[0126] The accumulated occupancy of the temporary storage area is greater than a second preset occupancy;

[0127] The storage period of the log entry of each access log in the temporary storage area reaches a preset period.

[0128] Optionally, the processing module 20 is further used for:

[0129] Determine the task type based on the background task information;

[0130] When the task type is the first type, determining a log life cycle;

[0131] The log entries existing in the long-term storage area are scanned according to the log life cycle, entries to be deleted are determined, and deletion operations are performed.

[0132] Optionally, the scanning module 10 is further used for:

[0133] Identify the log information of each access log, and determine the log type of each access log according to the identification result;

[0134] Constructing a log identifier for each access log according to the log type of each access log;

[0135] Log index information of the log storage area is constructed according to the log identifier of each access log and the metadata of each access log.

[0136] The log processing device provided by the present application adopts the log processing method in the above embodiment, which can solve the technical problem of how to optimize the storage and management of unstructured data access logs and improve the log processing efficiency for subsequent use. Compared with the prior art, the beneficial effects of the log processing device provided by the present application are the same as the beneficial effects of the log processing method provided by the above embodiment, and the other technical features in the log processing device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0137] The present application provides a log processing device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the log processing method in the above-mentioned embodiment 1.

[0138] Reference below Figure 8 , which shows a schematic diagram of the structure of a log processing device suitable for implementing the embodiment of the present application. The log processing device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The log processing device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0139] like Figure 8As shown, the log processing device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the log processing device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the log processing device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a log processing device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0140] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0141] The log processing device provided by the present application adopts the log processing method in the above embodiment, which can solve the technical problem of how to optimize the storage and management of unstructured data access logs and improve the log processing efficiency for subsequent use. Compared with the prior art, the beneficial effects of the log processing device provided by the present application are the same as the beneficial effects of the log processing method provided by the above embodiment, and the other technical features in the log processing device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0142] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0143] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0144] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the log processing method in the above-mentioned embodiment.

[0145] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0146] The computer-readable storage medium may be included in the log processing device; or may exist independently without being assembled into the log processing device.

[0147] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the log processing device, the log processing device: scans the log index information of the log storage area, and determines the log type of multiple access logs existing in the log storage area based on the scanning results; determines the dump strategy of each access log according to the log type of each access log; and processes each access log according to the dump strategy of each access log.

[0148] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0149] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0150] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0151] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned log processing method, and can solve the technical problem of how to optimize the storage and management of unstructured data access logs and improve the efficiency of log processing for subsequent use. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the log processing method provided by the above-mentioned embodiment, which will not be repeated here.

[0152] The present application also provides a computer program product, including a computer program, which implements the steps of the log processing method as described above when executed by a processor.

[0153] The computer program product provided by the present application can solve the technical problem of how to optimize the storage and management of unstructured data access logs and improve the efficiency of log processing for subsequent use. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the log processing method provided by the above embodiment, which will not be repeated here.

[0154] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A log processing method, characterized in that: The log processing method comprises: Scanning log index information of a log storage area, and determining log types of multiple access logs existing in the log storage area based on the scanning result; Determine a dump strategy for each access log according to the log type of each access log; Process each access log according to its dump policy.

2. The method according to claim 1, characterized in that The step of processing each access log according to the dump strategy of each access log includes: When the dump strategy of the access log is the first dump strategy, determining the file occupancy of each access log; When the file occupancy of each access log is greater than a first preset occupancy, a merging task is generated and executed; When the merging task is successfully executed, the log entry of each access log is deleted in the log index information.

3. The method according to claim 1, characterized in that The step of processing each access log according to the dump strategy of each access log includes: When the dump strategy of the access log is the second dump strategy, the log entry of each access log is written into the temporary storage area; When the temporary storage information in the temporary storage area meets the secondary dump condition, each log entry in the temporary storage area is written into the long-term storage area, and each log entry in the long-term storage area is deleted from the log index information.

4. The method according to claim 3, characterized in that The secondary dump condition includes at least one of the following: The accumulated occupancy of the temporary storage area is greater than a second preset occupancy; The storage period of the log entry of each access log in the temporary storage area reaches a preset period.

5. The method according to claim 3, characterized in that After the step of writing each log entry existing in the temporary pool storage area into the long-term storage area and deleting each log entry existing in the long-term storage area in the log index information, the method further includes: Determine the task type based on the background task information; When the task type is the first type, determining a log life cycle; The log entries existing in the long-term storage area are scanned according to the log life cycle, entries to be deleted are determined, and deletion operations are performed.

6. The method according to any one of claims 1 to 5, characterized in that Before the step of scanning the log index information of the log storage area and determining the log types of the multiple access logs existing in the log storage area based on the scanning result, the method further includes: Identify the log information of each access log, and determine the log type of each access log according to the identification result; Constructing a log identifier for each access log according to the log type of each access log; Log index information of the log storage area is constructed according to the log identifier of each access log and the metadata of each access log.

7. A log processing device, characterized in that: The log processing device comprises: A scanning module, used for scanning log index information of a log storage area, and determining log types of multiple access logs existing in the log storage area based on the scanning result; A processing module, used to determine a dump strategy for each access log according to the log type of each access log; The processing module is used to process each access log according to the dump strategy of each access log.

8. A log processing device, characterized in that: The device comprises: a memory, a processor, and a log processing program stored in the memory and executable on the processor, wherein the log processing program is configured to implement the steps of the log processing method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium stores a log processing program, and when the log processing program is executed by the processor, the steps of the log processing method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a log processing program, and when the log processing program is executed by a processor, the steps of the log processing method according to any one of claims 1 to 6 are implemented.

Images