Client problem monitoring method and device based on log analysis

Abstract

The invention relates to a client problem monitoring method and device based on log analysis. The method comprises the following steps: acquiring a log of a client, scanning the log of the client, extracting an abnormal log identifier, and acquiring an abnormal log according to the abnormal log identifier; performing classified storage on the abnormal logs according to different classification strategies; obtaining a preset exception problem analysis rule, and analyzing the classified exception logs based on the exception problem analysis rule to obtain detailed exception logs; and based on the detailed abnormal logs, performing problem positioning and analysis on the detailed abnormal logs to obtain abnormal reasons, and performing classified storage and reporting on the abnormal logs according to the abnormal reasons. By analyzing local logs in real time and automatically reporting problems, related runtime data and stack tracking can be automatically obtained for even problems existing in a client, the problems can be quickly positioned and checked, the problems are effectively solved, user experience is improved, and working efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a client problem monitoring method and device based on log analysis. Background Art

[0002] With the continuous iteration and update of the client, the business scenarios of the application become more and more complex, and the problems of the client will become more obscure and diverse. When problems occur in the current client, it is difficult to fully understand and solve potential problems by relying on users to actively report the problems. At the same time, since the communication is not face-to-face, the user's description of the problem may be unclear or even wrong, which makes it impossible for the development team to correctly locate the cause of the problem and provide a corresponding solution.

[0003] Although there are various logging tools on the client side, they all need to contact the user and obtain the client logs through technical means. When the user cannot be contacted or does not cooperate, the data related to the problem cannot be obtained. When occasional problems occur on the client side, users may choose to ignore these problems and not actively report them to the development team. This will make it difficult to reproduce and diagnose the problem, miss the opportunity for improvement, and affect the user experience. When a problem occurs on the client side, sometimes the user does not report the problem immediately, but reports it a few days later. At this time, the runtime data and stack traces related to the problem may have been cleared, and the problem cannot be troubleshooted. Summary of the invention

[0004] To address the deficiencies in the prior art, the present invention provides a client problem monitoring method based on log analysis. The client analyzes local logs in real time to obtain problems that have occurred or potential problems on the client, and establishes an automatic problem reporting mechanism to automatically report runtime data, stack traces, and other useful context information when problems occur, so that the development team can diagnose and analyze the problems.

[0005] To achieve the above objectives, the technical solutions adopted by the present invention include:

[0006] A client problem monitoring method based on log analysis, characterized by comprising:

[0007] S1 obtains the client log, scans the client log, extracts the exception log identifier, and obtains the exception log according to the exception log identifier;

[0008] S2. Classify and store the abnormal logs according to different classification strategies;

[0009] S3. Obtain preset abnormal problem analysis rules, and parse the classified abnormal logs based on the abnormal problem analysis rules to obtain detailed abnormal logs;

[0010] S4. Based on the detailed exception log, locate and analyze the problem of the detailed exception log to obtain the cause of the exception, and classify, store and report the exception log according to the cause of the exception.

[0011] Furthermore, the log includes the log level, the code location where the log occurs, the occurrence time, the log content, the runtime data, and the stack trace information.

[0012] Further, the classification strategy includes a first classification strategy, a second classification strategy and a third classification strategy;

[0013] The first classification strategy is to classify abnormal logs according to log time;

[0014] The second classification strategy is to classify according to the log exception level, and the log exception level includes: fatal, error, warning, and debug;

[0015] The third classification strategy is to classify according to the exception type, and the exception type includes system error, business error, process error, and network error.

[0016] Further, the parsing of the classified abnormal logs based on the abnormal problem parsing rules includes:

[0017] Obtaining screening rules, and screening the classified abnormal logs based on the screening rules;

[0018] Obtaining the occurrence time of the records in the abnormal log, determining the earliest record in the occurrence time of the abnormal log records as the start time of the target record, and determining the latest record in the occurrence time of the abnormal log records as the end time of the target record;

[0019] The logs in the time period between the start time and the end time are queried to obtain and store the relevant information of the abnormal logs, where the relevant information of the abnormal logs includes runtime data and stack trace information.

[0020] Further, based on the detailed exception log, the detailed exception log is located and analyzed to obtain the cause of the exception, and the exception log is classified, stored and reported according to the cause of the exception, including:

[0021] Based on the detailed exception log, the code location where the log occurs is obtained, the cause of the exception is determined according to the code location where the log occurs and the exception log identifier, and the exception log is merged and classified and counted based on the exception cause;

[0022] The abnormal causes of the abnormal logs are scored and rated. When the score of the abnormal cause reaches the abnormal problem score rating threshold, the abnormal cause is classified as an abnormal problem and reported; when the score of the abnormal cause is less than the abnormal problem score rating threshold, the abnormal problem is classified as a problem to be observed, and the problem to be observed is temporarily postponed for reporting and combined with the next abnormal log analysis.

[0023] Furthermore, the calculation formula of the score rating is:

[0024]

[0025] Among them, n1 represents the total number of abnormal reasons in the current log analysis, n2 represents the total number of abnormal reasons in the historical log analysis, d1 represents the total time of the current log analysis, and d2 represents the total time of the historical log analysis. It indicates the frequency of occurrence of the abnormal cause per unit time, and L indicates the level of the abnormal cause.

[0026] The present invention also relates to a client problem monitoring device based on log analysis, which is characterized by comprising:

[0027] An acquisition module, used to acquire a log of a client, scan the log of the client, extract an abnormal log identifier, and acquire the abnormal log according to the abnormal log identifier;

[0028] A classification module, used for classifying and storing the abnormal logs according to different classification strategies;

[0029] The parsing module is used to obtain preset abnormal problem parsing rules, and parse the classified abnormal logs based on the abnormal problem parsing rules to obtain detailed abnormal logs;

[0030] The reporting module is used to locate and analyze the detailed exception log based on the detailed exception log, obtain the exception cause, and classify, store and report the exception log according to the exception cause.

[0031] The present invention also relates to a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and the computer program implements the above method when executed by a processor.

[0032] The present invention also relates to an electronic device, characterized in that it comprises a processor and a memory;

[0033] The memory is used to store program instructions;

[0034] The processor is used to execute the above method by calling program instructions.

[0035] The present invention also relates to a computer program product, comprising a computer program and / or instructions, characterized in that the computer program and / or instructions implement the steps of the above method when executed by a processor.

[0036] The beneficial effects of the present invention are:

[0037] By adopting the client problem monitoring method and device based on log analysis described in the present invention, by real-time analysis of local logs and automatic problem reporting, the development team can locate the root cause of the problem in the first time and take corresponding solutions, thereby improving user experience and reducing customer complaints; for occasional problems existing in the client, relevant runtime data and stack traces can be automatically obtained, and the problem can be quickly located and checked, so that the problem can be effectively solved; when a problem occurs, automatic acquisition of relevant runtime data and stack traces can greatly reduce the communication cost between the user and the development team, thereby improving the work efficiency of both parties. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0039] Figure 1 A schematic diagram of a client problem monitoring method based on log analysis according to the present invention;

[0040] Figure 2 This is a structural schematic diagram of a client problem monitoring device based on log analysis of the present invention;

[0041] Figure 3 The figure is a schematic structural diagram of an electronic device of the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be clearly and completely described below in conjunction with the specific embodiments of the present application and the corresponding drawings. It should be understood that the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments, and these embodiments are only used to illustrate the present application and are not used to limit the scope of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0043] like Figure 1 As shown, the embodiment of the present invention discloses a client problem monitoring method based on log analysis, and the steps of the process include:

[0044] Step S1. Obtain the log of the client, scan the log of the client, extract the abnormal log identifier, and obtain the abnormal log according to the abnormal log identifier.

[0045] The embodiment of the present invention provides a log collection method. The client writes the corresponding log to a local file through a log tool according to its own business function. For example, the program 1 operation log is generated according to program 1, the program 2 operation log is generated according to program 2, ..., the program N operation log is generated according to program N. The log includes information such as the log level, the code location where the log occurs, the time when the log occurs, the log content, runtime data, stack trace, etc. In the specific implementation, the recorded information content can be increased or decreased accordingly according to its own business function. The log format collected in this embodiment is as follows. The specific log format and content can be modified in combination with the characteristics of the implementation process:

[0046] [I]2024 / 06 / 14 09:32:19:694[Page]-[UIViewController+SCLog:35]-[iOS]YXTShakeViewController

[0047] [I]2024 / 06 / 14 09:32:19:821[Normal]-[AppDelegate:476]App life cycle->App is in the foreground

[0048] [I]2024 / 06 / 14 09:32:19:858[Net]-[AppDelegate:838]=Network status=Current network status is: Network (5G), whether to open VPN: Yes

[0049] [I]2024 / 06 / 14 09:32:20:108[Progress]-[SCMapManager:80][P001]Map-Start authorization verification results (2-1)

[0050] [E]2024 / 06 / 14 09:32:20:135[Progress]-[SCMapManager:71][P001]Map-Authorization failed (2-2)

[0051] [I]2024 / 06 / 14 09:32:20:265[Page]-[UIViewController+SCLog:35]-[iOS]YXTNavigationController

[0052] [I]2024 / 06 / 14 09:32:20:307[Page]-[UIViewController+SCLog:35]-[iOS]YXTFaceLiveLoginViewController

[0053] [I]2024 / 06 / 14 09:32:20:307[Progress]-[YXTFaceLiveLoginViewController:90][P002]Location->Initiate positioning

[0054] [I]2024 / 06 / 14 09:32:20:311[Net]-[[YXTLocationManager:161]Current network speed↑(0B / s)↓(0B / s)

[0055] [I]2024 / 06 / 14 09:32:20:311[Page]-[UIViewController+SCLog:35]-[iOS]YXTFaceLiveViewController

[0056] [E]2024 / 06 / 14 09:32:20:337[Progress]-[YXTFaceLiveLoginViewController:90][P002] Positioning->Initiate positioning->Failed

[0057] [E]2024 / 06 / 17 15:33:18:662[Crash]-[[AppDelegate:254]SOSExceptionreason: NSRangeException

[0058] Exception name: ***-[__NSArrayI objectAtIndexedSubscript:]:index3beyond bounds[0..1]

[0059] Exception stack: (null)

[0060] Obtain the local client log file, scan the log line by line, and extract the abnormal log identifier. In this embodiment, the abnormal log identifier is [E][W], where the log identified as [E] is an abnormal log that has been determined to have a problem, and the log identified as [W] is an abnormal log with potential problems.

[0061] Step S2: Categorize and store the abnormal logs according to different classification strategies.

[0062] Specifically, the classification strategy includes a first classification strategy, a second classification strategy, and a third classification strategy;

[0063] The first classification strategy is to classify abnormal logs according to log time;

[0064] The second classification strategy is to classify according to the log exception level, and the log exception level includes: fatal, error, warning, and debug;

[0065] The third classification strategy is to classify according to the exception type, and the exception type includes system error, business error, process error, and network error.

[0066] In this embodiment, the first classification strategy is first used to classify the acquired exception logs according to the log time, and the exception logs are divided into multiple time spans with natural days as the set; secondly, the second classification strategy is used to classify the exception logs classified by the first classification strategy according to the log exception level, and the log exception level may include closed, fatal, error, warning, information, debugging, and tracking; finally, the third classification strategy is used to classify the exceptions by functional exception types. In this embodiment, the exception logs can be divided into system exceptions, business exceptions, network exceptions, functional exceptions, process exceptions, fatal exceptions, etc.

[0067] Step S3: Obtain preset abnormal problem analysis rules, and analyze the classified abnormal logs based on the abnormal problem analysis rules to obtain detailed abnormal logs.

[0068] In this embodiment, a preset abnormal problem analysis rule file is obtained, and the abnormal problem analysis rule is read. The specific analysis rule can be customized according to the own business.

[0069] In this embodiment, a preset screening rule is obtained, and the classified abnormal logs are screened based on the preset screening rule.

[0070] The parsing process further includes:

[0071] First, determine whether the exception log is a Crash type exception. If so, obtain the occurrence time of the exception from the exception log, determine the earliest record in the occurrence time of the exception log as the start time of the target record, and determine the latest record in the occurrence time of the exception log as the end time of the target record. According to the start time and end time, obtain the runtime data, stack trace information and other detailed exception log information of the log in this time period;

[0072] Second, determine whether the abnormal log is a system type abnormality. The system type can be subdivided into network abnormality, device abnormality, permission abnormality, etc. If it is a system type, directly obtain the current abnormal log information;

[0073] Third, determine whether the abnormal log is a process type abnormality. If so, filter the process abnormality log. Further, in this embodiment, the process abnormality can be divided into positioning abnormality, outbound call abnormality, recording abnormality, etc. Take positioning abnormality as an example, and further filter it. When positioning authority abnormality occurs, obtain the log information related to positioning authority, including positioning authority log, network log and positioning error information log, to form detailed abnormality log information;

[0074] Fourth, determine whether the abnormal log is a business function type abnormality. If so, filter the business function log.

[0075] Step S4: Based on the detailed exception log, locate and analyze the problem of the detailed exception log to obtain the cause of the exception, and classify, store and report the exception log according to the cause of the exception.

[0076] Specifically, step S4 includes:

[0077] Based on the detailed exception log obtained in step S3, the code location where the log occurs is obtained, the cause of the exception is determined according to the code location where the log occurs and the exception log identifier, and the exception logs are combined and classified and counted based on the exception cause;

[0078] The abnormal causes of the abnormal logs are scored and rated. When the score of the abnormal cause reaches the abnormal problem score rating threshold, the abnormal cause is classified as an abnormal problem and reported; when the score of the abnormal cause is less than the abnormal problem score rating threshold, the abnormal problem is classified as a problem to be observed, and the problem to be observed is temporarily postponed from reporting and stored locally for merging with the next abnormal log analysis.

[0079] The score rating calculation formula is:

[0080]

[0081] n1 represents the total number of abnormal reasons in the current log analysis, n2 represents the total number of abnormal reasons in the historical log analysis, d1 represents the total time of the current log analysis, d2 represents the total time of the historical log analysis, It indicates the frequency of occurrence of the abnormal cause per unit time, and L indicates the level of the abnormal cause. The higher the level, the larger the value.

[0082] like Figure 2 As shown, the embodiment of the present invention discloses a client problem monitoring device based on log analysis, and its structure includes:

[0083] An acquisition module, used to acquire a log of a client, scan the log of the client, extract an abnormal log identifier, and acquire the abnormal log according to the abnormal log identifier;

[0084] A classification module, used for classifying and storing the abnormal logs according to different classification strategies;

[0085] The parsing module is used to obtain preset abnormal problem parsing rules, and parse the classified abnormal logs based on the abnormal problem parsing rules to obtain detailed abnormal logs;

[0086] The reporting module is used to locate and analyze the detailed exception log based on the detailed exception log, obtain the exception cause, and classify, store and report the exception log according to the exception cause.

[0087] The device can be independent of the terminal device, and can perform log collection, abnormal log analysis, and abnormal log reporting. By using the device, the above-mentioned operation processing method can be executed and the corresponding technical effect can be achieved.

[0088] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the method in the above embodiment, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the method in the above embodiment are implemented.

[0089] The embodiment of the present invention further provides an electronic device for executing the above method, as a device for implementing the method, and its structure is as follows: Figure 3 As shown, the electronic device 300 includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one. It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the specific structure of the electronic device 300. In other embodiments of the present application, the electronic device 300 may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware. Optionally, the electronic device may also include a display screen 305 for displaying images, or receiving user operation instructions when necessary.

[0090] The processor 301 is applied in the embodiment of the present application to implement the method shown in the above method embodiment. The transceiver 304 may include a receiver and a transmitter. The transceiver 304 is applied in the embodiment of the present application to implement the function of the electronic device of the embodiment of the present application communicating with other devices when executed.

[0091] Processor 301 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0092] The processor 301 may also include one or more processing units, for example, the processor 301 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processor (NPU). Among them, different processing units may be independent devices or integrated into one or more processors. Among them, the controller may be the nerve center and command center of the electronic device 300. The controller may generate an operation control signal according to the instruction opcode and the timing signal to complete the control of fetching and executing instructions. A memory may also be set in the processor 301 for storing instructions and data. In some embodiments, the memory in the processor 301 is a high-speed cache memory. The memory may store instructions or data that the processor 301 has just used or circulated. If the processor 301 needs to use the instruction or data again, it may be directly called from the memory. Repeated access is avoided, the waiting time of the processor 301 is reduced, and the efficiency of the system is improved.

[0093] The processor 301 can run the method provided in the embodiment of the present application. The processor 301 can include different devices. For example, when a CPU and a GPU are integrated, the CPU and the GPU can cooperate to execute the method provided in the embodiment of the present application, for example, part of the algorithm in the method is executed by the CPU, and another part of the algorithm is executed by the GPU to obtain faster processing efficiency.

[0094] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0095] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory), or may include a high-speed random access memory, or may include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0096] Optionally, the memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301, and the memory 303 stores an operating system. The abnormal log analysis program and the abnormal log reporting program, the memory 303 can also store the acquired abnormal log data, log type, abnormal log related information, parsing rules, etc. The processor 301 is used to execute the application code stored in the memory 303 to implement the method provided in any embodiment of the present application.

[0097] The memory 303 can be used to store computer executable program codes, which include instructions. The processor 301 executes various functional applications and data processing of the electronic device 300 by running the instructions stored in the memory 303. The memory 303 may include a program storage area and a data storage area. Among them, the program storage area may store the code of the operating system, application program, etc. The data storage area may store data created during the use of the electronic device 300 (such as images, videos, etc. collected by the camera application), etc.

[0098] The memory 303 may also store one or more computer programs corresponding to the method provided in the embodiment of the present application. The one or more computer programs are stored in the above-mentioned memory 303 and are configured to be executed by the one or more processors 301. The one or more computer programs include instructions, and the above-mentioned instructions can be used to execute each step in the above-mentioned corresponding embodiment.

[0099] Of course, the code of the method provided in the embodiment of the present application can also be stored in an external memory. In this case, the processor 301 can run the code of the method stored in the external memory through the external memory interface, and the processor 301 can control the running process.

[0100] The display screen 305 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 300 may include 1 or N display screens 305, where N is a positive integer greater than 1. The display screen 305 can be used to display information input by a user or information provided to a user and various graphical user interfaces (GUI). For example, the display screen 305 can display photos, videos, web pages, or files.

[0101] The electronic device provided in the embodiment of the present application is applicable to any embodiment of the above method. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, which will not be repeated here.

[0102] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0103] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0104] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0105] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0106] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A client problem monitoring method based on log analysis, characterized in that: include: S1 obtains the client log, scans the client log, extracts the exception log identifier, and obtains the exception log according to the exception log identifier; S2. Classify and store the abnormal logs according to different classification strategies; S3. Obtain preset abnormal problem analysis rules, and parse the classified abnormal logs based on the abnormal problem analysis rules to obtain detailed abnormal logs; S4. Based on the detailed exception log, locate and analyze the problem of the detailed exception log to obtain the cause of the exception, and classify, store and report the exception log according to the cause of the exception.

2. The method according to claim 1, characterized in that The log includes log level, code location where the log occurs, occurrence time, log content, runtime data, and stack trace information.

3. The method according to claim 1, characterized in that The classification strategy includes a first classification strategy, a second classification strategy and a third classification strategy; The first classification strategy is to classify abnormal logs according to log time; The second classification strategy is to classify according to the log exception level, and the log exception level includes: fatal, error, warning, and debug; The third classification strategy is to classify according to the exception type, and the exception type includes system error, business error, process error, and network error.

4. The method according to claim 1, characterized in that The analyzing the classified abnormal logs based on the abnormal problem analysis rules includes: Obtaining screening rules, and screening the classified abnormal logs based on the screening rules; Obtaining the occurrence time of the records in the abnormal log, determining the earliest record in the occurrence time of the abnormal log records as the start time of the target record, and determining the latest record in the occurrence time of the abnormal log records as the end time of the target record; The logs in the time period between the start time and the end time are queried to obtain and store the relevant information of the abnormal logs, where the relevant information of the abnormal logs includes runtime data and stack trace information.

5. The method according to claim 1, characterized in that Based on the detailed exception log, the problem is located and analyzed on the detailed exception log to obtain the cause of the exception, and the exception log is classified, stored and reported according to the cause of the exception, including: Based on the detailed exception log, the code location where the log occurs is obtained, the cause of the exception is determined according to the code location where the log occurs and the exception log identifier, and the exception log is merged and classified and counted based on the exception cause; The abnormal causes of the abnormal logs are scored and rated. When the score of the abnormal cause reaches the abnormal problem score rating threshold, the abnormal cause is classified as an abnormal problem and reported; when the score of the abnormal cause is less than the abnormal problem score rating threshold, the abnormal problem is classified as a problem to be observed, and the problem to be observed is temporarily postponed for reporting and combined with the next abnormal log analysis.

6. The method according to claim 5, characterized in that The calculation formula for the score rating is: Among them, n1 represents the total number of abnormal reasons in the current log analysis, n2 represents the total number of abnormal reasons in the historical log analysis, d1 represents the total time of the current log analysis, and d2 represents the total time of the historical log analysis. It indicates the frequency of occurrence of the abnormal cause per unit time, and L indicates the level of the abnormal cause.

7. A client problem monitoring device based on log analysis, characterized in that: include: An acquisition module, used to acquire a log of a client, scan the log of the client, extract an abnormal log identifier, and acquire the abnormal log according to the abnormal log identifier; A classification module, used for classifying and storing the abnormal logs according to different classification strategies; The parsing module is used to obtain preset abnormal problem parsing rules, and parse the classified abnormal logs based on the abnormal problem parsing rules to obtain detailed abnormal logs; The reporting module is used to locate and analyze the detailed exception log based on the detailed exception log, obtain the exception cause, and classify, store and report the exception log according to the exception cause.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store program instructions; The processor is configured to execute the method according to any one of claims 1 to 6 by calling program instructions.

10. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or the instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images