Data processing method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses a data processing method and device, equipment and a storage medium. The method comprises the steps that a behavior time sequence diagram reflecting the session process of an object and an application program is acquired; searching a resource access log from N behavior logs reflected by the behavior sequence diagram; the resource access log reflects a resource access request of the object for the application program in the session process. And obtaining a link identifier corresponding to the resource access request from the resource access log, and generating a client calling log carrying the link identifier according to the link identifier. And after the server responds to the resource access request, generating a server response log carrying the link identifier according to the resource access request, and generating a session link of the session process according to the server response log carrying the link identifier, the client calling log, the N behavior logs reflected by the behavior sequence diagram and the behavior association relationship. According to the method, the query efficiency and accuracy of the abnormal event in the application program can be improved.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a data processing method, device, equipment and storage medium. Background Art

[0002] Users can access applications to obtain information or conduct business. Due to factors such as application code logic or user errors, abnormal events may occur during the user's access to the application. Currently, the cause of abnormal events is mainly queried through the user's application logs. In practice, it is found that in the process of querying the cause of abnormal events, there is a lack of completeness in the logs, such as client logs but lack of server logs; or server logs but lack of client logs, which will lead to low query efficiency and accuracy of abnormal events. Summary of the invention

[0003] The embodiments of the present application provide a data processing method, apparatus, device and storage medium to improve the query efficiency and accuracy for abnormal events in an application.

[0004] An embodiment of the present application provides a data processing method, including:

[0005] Obtaining a behavior sequence diagram reflecting a conversation process between an object and an application; the behavior sequence diagram reflects N behavior logs of the object with respect to the application during the conversation process, and behavior associations between the N behavior logs, where N is an integer greater than 1;

[0006] Find the resource access log from the N behavior logs reflected in the behavior sequence diagram; the resource access log reflects the resource access request of the object for the application during the session;

[0007] Obtaining a link identifier corresponding to the resource access request from the resource access log, and generating a client call log carrying the link identifier based on the link identifier; the client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object;

[0008] After the server responds to the resource access request, a server response log carrying the link identifier is generated according to the resource access request; the server response log reflects the response behavior of the server to the resource access request;

[0009] A session link of the session process is generated based on the server response log and the client call log carrying the link identifier, the N behavior logs reflected in the behavior sequence diagram, and the behavior association relationship; the session link is used to query the cause of an abnormal event when an abnormal event occurs during the session.

[0010] An embodiment of the present application provides a data processing device, including:

[0011] An acquisition module, used to acquire a behavior sequence diagram reflecting a conversation process between an object and an application; the behavior sequence diagram reflects N behavior logs of the object with respect to the application during the conversation process, and a behavior association relationship between the N behavior logs, where N is an integer greater than 1;

[0012] A search module, used to search for a resource access log from the N behavior logs reflected in the behavior sequence diagram; the resource access log reflects the resource access request of the object for the application during the session;

[0013] The first generating module is used to obtain the link identifier corresponding to the resource access request from the resource access log, and generate a client call log carrying the link identifier according to the link identifier; the client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object;

[0014] A second generating module is used to generate a server response log carrying the link identifier according to the resource access request after the server responds to the resource access request; the server response log reflects the response behavior of the server to the resource access request;

[0015] The third generation module is used to generate a session link for the above-mentioned session process based on the server response log and the above-mentioned client call log carrying the above-mentioned link identifier, the above-mentioned N behavior logs reflected in the above-mentioned behavior timing diagram, and the above-mentioned behavior association relationship; the above-mentioned session link is used to query the cause of the above-mentioned abnormal event when an abnormal event occurs in the above-mentioned session process.

[0016] On one hand, an embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0017] On one hand, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above method are implemented.

[0018] On the one hand, an embodiment of the present application provides a computer program product, including a computer program, which implements the steps of the above method when executed by a processor.

[0019] In the present application, a behavior sequence diagram is provided, which reflects the N behavior logs of the object for the application during the session, and the behavior association relationship between the N behavior logs, that is, the behavior sequence diagram can reflect the client log of the object for the application (that is, N behavior logs), and the association relationship between the client logs (that is, the behavior association relationship), and the operation path of the object for the application can be restored through the behavior sequence diagram. At the same time, through the link identifier in the resource access log, the client call log and the server response log with the link identifier are generated, and the session link in the session process is generated through the behavior sequence diagram, the client call log and the server response log. The session link realizes the connection between the client log and the server log (client call log and server response log) to ensure the integrity of the log. In the query process of abnormal events, not only can the operation path of the object be queried, but also the server sublink (including the link of the client call log and the server response log) can be queried, so as to improve the query efficiency and accuracy of abnormal events in the application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 It is a schematic diagram of a data processing system provided by this application;

[0022] Figure 2 It is a scenario diagram of obtaining a behavior timing diagram provided by this application;

[0023] Figure 3 This is a schematic diagram of a scenario for obtaining a service terminal link provided by this application;

[0024] Figure 4 It is a schematic diagram of an interface of a data processing method provided by the present application;

[0025] Figure 5 It is a schematic diagram of an interface of another data processing method provided by the present application;

[0026] Figure 6 is a schematic diagram of a conversation model data provided by this application;

[0027] Figure 7 This is a schematic diagram of an interface for displaying a behavior log during a session provided by the present application;

[0028] Figure 8 This is a schematic diagram of an interface showing a service terminal link during a session provided by the present application;

[0029] Fig. 9 is a structural schematic diagram of a data processing device provided in an embodiment of the present application;

[0030] Fig.10 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] For ease of understanding, the terms used in this application are explained as follows:

[0033] (1) Session: It can refer to the whole process from the beginning of the session to the end of the session. The beginning of the session refers to the first time that the terminal opens the page of the application, and the end of the session can refer to one or more of the following situations: a. Reloading the page opened in the application, b. Closing the page opened in the application, c. Opening the page of another application, e. The operation duration of the opened page is greater than the time threshold, which can be preset, such as 4 hours; f. No operation behavior on the opened page is detected within the preset time after the page is opened, and the preset time can be an empirical value, such as 15 minutes.

[0034] (2) Behavior sequence diagram: reflects the N behavior logs of the object in the above session with respect to the above application, as well as the behavioral associations between the N behavior logs. That is, the behavior sequence diagram is used to reflect the operation path (i.e., the front-end operation path) of the object for the application. It can also be called the behavior sequence diagram is used to reflect the front-end operation path of the object for the application. Based on the behavior sequence diagram, it is possible to understand which static resources the object has loaded, which interfaces it has requested, which behavior operations it has performed on the page, and which abnormal events have occurred on the page.

[0035] (3) Behavior log: used to reflect the operation behavior of the object on the application. For the sake of distinction, the operation behavior of the object on the application can be called application operation behavior; application operation behavior can include at least two of page access behavior, resource access behavior, page operation behavior, session behavior, abnormal behavior, and business processing behavior.

[0036] Among them, the page operation behavior may refer to one or more of the click operation, sliding operation, input operation, etc. of the application page, the session behavior may be the startup behavior for the application, and the abnormal behavior may refer to the abnormal event triggered by the object for the application. Business processing behavior may refer to the task completed during the session. The page access behavior reflects the page accessed by the object, the resource access behavior reflects the resources loaded by the object in the process of accessing the page, or the resource access behavior reflects the operation of the object on the resources in the displayed page (such as the viewing operation of the image, the playing operation of the video), and the resources may include interfaces, videos, images, Cascading Style Sheets (CSS), an object-oriented, prototype-based scripting language (JavaScript, JS), etc. JS is used to implement dynamic functions and interactive effects of web pages, so that web pages can respond to user operations.

[0037] Among them, the behavior log used to reflect the page access behavior of the object to the application can be called a page access log, and the behavior log used to reflect the resource access behavior of the object to the application can be called a resource access log. The behavior log used to reflect the page operation behavior of the object to the application can be called a page operation log, the behavior log used to reflect the session behavior of the object to the application can be called a session log, the behavior log used to reflect the abnormal behavior of the object to the application can be called an abnormal behavior log, and the behavior log used to reflect the business processing of the object to the application can be called a task log.

[0038] The definitions of various behavior logs are shown in Table 1:

[0039] Table 1

[0040]

[0041] As can be seen from Table 1, a session log may include a session identifier, session start time, session end time, etc. A page access log may be used to record a page accessed by an object, and a session process may include one or more page access logs. A page operation log may be used to record an object's operation behavior on a page. For the sake of distinction, an object's operation behavior on a page may be referred to as a page operation behavior. A page operation log may include the execution time, duration, and location of the page on which the page operation behavior is applied. A page operation behavior may trigger one or more resource access logs or abnormal behavior logs. A resource access log records resource access requests initiated for a page. A resource access log includes the execution time of the resource access behavior, the address of the resource access, the identifier of the requested resource, the parent link field in the resource access request, the link identifier, and the operation identifier; an abnormal behavior log may refer to all page errors. An abnormal behavior log may include the occurrence event of an abnormal event, the event type of the abnormal event, and the event type may include a page abnormality type, a network abnormality type, etc.; an abnormal event of a page abnormality type refers to problems such as display abnormality on the page. An abnormal event of a page abnormality type may be caused by an abnormal code module in the application program, and an abnormal event of a network abnormality type may be caused by network freeze or network instability. The task log records some tasks or code logic in the application that are not related to the background interface, such as recording the time of business processing, completed business (tasks), etc.

[0042] The parent link field is used to indicate that the resource access request is generated by the terminal, which can be expressed as traceparent; the link identifier (trace ID) is used to connect the server call log and the client call log about the first resource access request in series, indicating the processing path (operation path) of a resource access request. The operation identifier (span ID) is used to indicate the execution order of the operations corresponding to the server call log and the client call log.

[0043] (4) Behavior association relationship: It may refer to the relationship between the corresponding behavior logs of two application operation lines that have a trigger relationship or a context relationship. The trigger relationship may refer to that one application operation behavior is triggered by another application operation behavior. The context relationship may refer to that the execution order of one application operation behavior is after the execution order of another application operation behavior.

[0044] For example, when it is detected that the object has performed a page access behavior on the application, the terminal loads resources based on the page access behavior. After the terminal loads the resources, the resources displayed by the terminal can be viewed by the object, which indicates the object's resource access behavior on the application. The resource access behavior is triggered by the page access behavior, that is, there is a trigger relationship between the resource access behavior and the page access behavior, and it can be said that there is a behavioral association relationship between the resource access log corresponding to the resource access behavior and the page access log corresponding to the page access behavior. For another example, after the terminal displays the page of the application, the page displayed by the terminal can be accessed by the object, that is, the object has performed a page access behavior on the application; a page operation behavior on the page is detected, and the terminal responds to the page operation behavior. The page operation behavior is located after the page access behavior, that is, it can be said that there is a contextual relationship between the page operation behavior and the page access behavior, and it can be said that there is a behavioral association relationship between the page access log corresponding to the page access behavior and the page operation log corresponding to the page operation behavior.

[0045] (5) Expected association relationship: The association between different behavior logs obtained based on the statistics of the behavior logs of a large number of objects for an application. That is, the expected association relationship is used to indicate the possible behavior association relationship between different behavior logs. For example, a large number of objects will perform page operation behaviors on the pages of an application after performing page access behaviors. Therefore, it can be said that there is an expected behavior relationship between the page access log corresponding to the page access behavior and the page operation log corresponding to the page operation behavior.

[0046] (6) Server sublink: reflects the response behavior of the server corresponding to the application to the session process, that is, the server sublink includes the server log corresponding to the response behavior of the server during the session.

[0047] In order to facilitate a clearer understanding of the present application, the data processing system implementing the present application is first introduced. Figure 1 As shown, the data processing system includes a server and a terminal cluster, and the terminal cluster may include one or more terminals, and the number of terminals is not limited here. Figure 1 As shown, taking the terminal cluster including 4 terminals as an example, the terminal cluster can specifically include a first terminal, a second terminal, a third terminal, and a fourth terminal; it can be understood that the first terminal, the second terminal, the third terminal, and the fourth terminal can all be connected to the server through a network connection, so that each terminal can exchange data with the server through the network connection.

[0048] It is understandable that the server can be an independent physical server, or a server cluster or distributed system composed of at least two physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud knowledge base, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms. The terminal can specifically refer to a vehicle-mounted terminal, a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a screen speaker, a smart TV, a smart watch, etc., but is not limited to this. Each terminal and server can be directly or indirectly connected by wired or wireless communication. At the same time, the number of terminals and servers can be one or at least two, and this application is not limited here.

[0049] Among them, one or more applications are installed in any terminal, and the application can be an application accessible to the user. For example, the application can include an independent application, a web application, a mini-program in a host application, etc. The application can refer to a browser application, a social application, a shopping application, a content publishing application, etc.

[0050] The server refers to a device that provides server-side services for the application in the terminal. For example, the server can be used to respond to various requests initiated by the terminal (such as resource access requests) and optimize and update the application in the terminal.

[0051] In one embodiment, the data processing system can implement the data processing method in the present application, which may include a process for generating a behavior timing diagram and a process for generating a service terminal link. The specific implementation process may refer to Figure 2 and Figure 3 , Figure 2 A schematic diagram of a scenario of a generation process of a behavior timing diagram provided in an embodiment of the present application, Figure 3 A schematic diagram of a scenario of a service terminal link generation process provided in an embodiment of the present application.

[0052] Figure 2 The terminal in can refer to Figure 1 Any terminal in Figure 2 The server in can refer to Figure 1In the server, when the terminal detects the startup operation for the application, the terminal's operating environment can be initialized, that is, storage space is separately stored in the terminal for running the application, etc., which is equivalent to detecting the object's session behavior for the application, and a session log reflecting the session behavior can be generated. In response to the session behavior, the terminal can start the application, and when the page access behavior for the first page of the application is detected, the resources required for displaying the first page can be loaded, that is, the terminal generates a first resource access request, sends the first resource access request to the server, and the server returns the first resource based on the first resource access request, and displays the first page based on the first resource. The request header of the first resource access request includes a parent link field, a link identifier and an operation identifier. The parent link field is used to indicate that the first resource access request is generated by the terminal, the link identifier is used to concatenate the server call log and the client call log about the first resource access request, and the operation identifier is used to indicate the execution order of the operations corresponding to the server call log and the client call log. The parent link field in the first resource access request can be: traceparent; the link identifier is: 1aaa, and the operation identifier is: 11a. The terminal can generate a first page access log reflecting the page access behavior based on the page access behavior, where the first page here can refer to any page in the application. Before displaying the first page, the resources in the first page can be viewed by the object, which means that the object performs resource access behavior on the resources in the first page. The terminal can generate a first resource access log reflecting the resource access behavior based on the loaded first resource. The first resource access log includes the identifier of the first resource required to display the first page, the access time of the first resource, the parent link field in the first resource access request, as well as the link identifier and the operation identifier, etc. The displayed first page includes abnormal events such as garbled characters, images, texts, etc., which are not fully displayed. The terminal can determine that abnormal behavior of the object against the application is detected, and can generate a first abnormal behavior log reflecting the abnormal behavior.

[0053] After displaying the first page, when a page operation behavior for the first page is detected, a page operation log reflecting the page operation behavior is generated, and the terminal can respond to the page operation behavior, load the second resource associated with the page operation behavior, that is, generate a second resource access request, send the second resource access request to the server, and the server returns the second resource based on the second resource access request. The terminal can display the second resource in the first page. The request header of the second resource access request includes a parent link field, a link identifier and an operation identifier. The parent link field is used to indicate that the second resource access request is generated by the terminal, the link identifier is used to concatenate the server call log and the client call log about the second resource access request, and the operation identifier is used to indicate the execution order of the operations corresponding to the server call log and the client call log. The parent link field in the second resource access request can be: traceparent; the link identifier is: 2bbb, and the operation identifier is: 21b. After the terminal displays the second resource, the second resource can be viewed by the object, which indicates the resource access behavior of the object for the application, and a second resource access log reflecting the resource access behavior can be generated based on the second resource. The second resource access log may include the access time of the second resource, the identifier of the second resource, the parent link field in the second resource access request, as well as the link identifier and the operation identifier, etc. If the page operation behavior is a click operation on an image in the first page, the terminal may load the image, and the page operation log is used to indicate the clicked image, the time of the click, etc. The second resource access log may include the size of the image, the access time of the resource corresponding to the image, the source and identifier of the image, the parent link field in the second resource access request, as well as the link identifier and the operation identifier, etc. When the terminal fails to respond to an abnormal event such as a page operation behavior on the first page after detecting the page operation behavior on the first page, the terminal may generate a second abnormal behavior log reflecting the abnormal event.

[0054] Similarly, when a page access behavior for the second page of the application is detected, the terminal can display the second page of the application and generate a second page access log reflecting the page access behavior; the terminal can detect whether the object has resource access behavior, business processing behavior, page operation behavior, etc. for the second page, obtain a first detection result, and generate a corresponding behavior log based on the first detection result. When a page access behavior for the third page of the application is detected, the terminal can display the third page of the application and generate a third page access log reflecting the page access behavior; the terminal can detect whether the object has resource access behavior, business processing behavior, page operation behavior, etc. for the third page, obtain a second detection result, and generate a corresponding behavior log based on the second detection result.

[0055] It should be noted that Figure 2The page access logs in include the first page access log, the second page access log and the third page access log.

[0056] Among them, resource access requests can include interface requests and static resource requests. Interface requests can be used to request to call the server's interface to process a certain business. Static resource requests can be used to request the server to return static resources, including images, videos, etc.

[0057] The terminal can fuse the above-mentioned session log, page access log, page operation log, first resource access log, second resource access log, third resource access log, task log, first abnormal behavior log, and second abnormal behavior log to obtain log data, and send the log data and session model data to the server. The server can generate a behavior timing diagram after receiving the log data and session model data. Specifically, the session model data is used to reflect the expected association relationship between different behavior logs, as well as the generation time of each behavior log, and determine the behavior association relationship between different behavior logs in the log data. The server can create a node for each behavior log in the log data, connect two behavior logs with a behavior association relationship, and obtain a behavior timing diagram.

[0058] like Figure 2 In the behavior sequence diagram, the session log has a behavior association relationship with the first page access log, the second page access log, and the third page access log; the first page access log has a behavior association relationship with the page operation log, the task log, the first resource access log, and the first behavior exception log. The behavior sequence diagram shows that the page operation log has a behavior association relationship with the second resource access log and the second behavior exception log.

[0059] After generating the behavior sequence diagram, the server can generate the service end link, such as Figure 3As shown, since the resource access log of the above-mentioned behavior log can be associated with the server log, the server can generate a server sublink based on the resource access log. Specifically, the service component in the server can extract the first request log from the first resource access log, and the first request log carries the parent link field, link identifier and operation identifier in the first resource access request, and generates a first client call log based on the first request log. The first client call log is used to indicate that the first resource access request is obtained by the server from the terminal, that is, the first client call log is used to indicate that the first resource access request is an active call by the client (client span), and the first client call log includes a link identifier and an operation identifier, the link identifier is: 1aaa, the operation identifier is: 12a, and the operation identifier in the first client call log is used to indicate that the first resource access request has been sent to the server. After the server receives the first resource access request, the server can respond to the first resource access request, return the first resource to the terminal, and generate a first server response log and a second server response log. The server can report the first client call log, the first server response log, and the second server response log to the detection component. The detection component can create nodes for the first client call log, the first server response log, and the second server response log, and connect the nodes corresponding to the first client call log, the first server response log, and the second server response log in sequence according to the operation identifier to obtain the first server terminal sublink.

[0060] The detection component may refer to an application or a functional module in the server for querying abnormal events. The detection component may also be used to query behavior sequence diagrams and service terminal links.

[0061] Among them, the first server response log reflects the server's active call in response to the first resource access request. The first server response log can be called a server active call, that is, the first server response log reflects the call behavior initiated by the server to other devices or functional modules in response to the first resource access request. The first server response log may include the time when the server initiates the active call, the called object (such as other devices or functional modules), the link identifier and the operation identifier; the link identifier is: 1aaa, the operation identifier is: 13a, and the operation identifier in the first server call log is used to indicate that an active call is initiated to other devices or functional modules in the process of responding to the first resource access request.

[0062] Among them, the second server response log reflects that the server is called by the terminal to respond to the first resource access request. The second server response log can be called the server being called. The second server response log may include the identifier, link identifier and operation identifier of the first resource returned by the server; the link identifier is: 1aaa, the operation identifier is: 14a, and the operation identifier in the second server call log is used to indicate that the first resource access request has been responded to by the server.

[0063] The first service end link is used to reflect the processing path for the first resource access request, that is, the first service end link reflects the service-side processing process of the first resource access request.

[0064] Similarly, the service component in the server can extract the second request log from the second resource access log, and the second request log carries the parent link field, link identifier and operation identifier in the second resource access request, and generates a second client call log based on the second request log. The second client call log is used to indicate that the second resource access request is obtained by the server from the terminal, that is, the second client call log is used to indicate that the second resource access request is an active call by the client (client span). The second client call log includes a link identifier and an operation identifier. The link identifier is: 2bbb, and the operation identifier is: 22b. The operation identifier in the second client call log is used to indicate that the second resource access request has been sent to the server. After the server receives the second resource access request, the server can respond to the second resource access request, return the first resource to the terminal, and generate a third server response log and a fourth server response log. The server can report the second client call log, the third server response log, and the fourth server response log to the detection component. The detection component can create nodes for the second client call log, the third server response log, and the fourth server response log, and connect the nodes corresponding to the second client call log, the third server response log, and the fourth server response log in sequence according to the operation identifier to obtain the second server terminal sublink.

[0065] The detection component can connect the node corresponding to the first client call log in the first service terminal link with the node corresponding to the first resource access log in the behavior sequence diagram, and connect the node corresponding to the second client call log in the second service terminal link with the node corresponding to the second resource access log in the behavior sequence diagram to obtain the session link. The detection component can query the first service terminal link based on the link identifier in the first resource access log, and query the second service terminal link based on the link identifier in the second resource access log.

[0066] Among them, the third server response log reflects the server's active call in response to the second resource access request. The third server response log can be called the server active call, that is, the third server response log reflects the call behavior initiated by the server to other devices or functional modules in response to the second resource access request. The third server response log may include the time when the server initiates the active call, the called object (such as other devices or functional modules), the link identifier and the operation identifier; the link identifier is: 2bbb, the operation identifier is: 23b, and the operation identifier in the first server call log is used to indicate that an active call is initiated to other devices or functional modules in the process of responding to the second resource access request.

[0067] Among them, the fourth server response log reflects that the server is called by the terminal to respond to the second resource access request. The fourth server response log can be called the server being called. The fourth server response log may include the identifier, link identifier and operation identifier of the first resource returned by the server; the link identifier is: 2bbb, the operation identifier is: 24b, and the operation identifier in the second server call log is used to indicate that the second resource access request has been responded to by the server.

[0068] The second service end link is used to reflect the processing path for the second resource access request, that is, the second service end link reflects the service-side processing process of the second resource access request.

[0069] Among them, a resource access request corresponds to a service, that is, a resource access request can be used to process a service, such as Figure 3 The first resource access request corresponds to business A, and the second resource access request corresponds to business B.

[0070] In summary, the session link can be used to query the operation path of the object during the session, as well as the server processing (i.e., response behavior) of the session process. In the query process of abnormal events, not only the operation path of the object can be queried, but also the server sublink (including the link of the client call log and the server response log) can be queried, which improves the query efficiency and accuracy of abnormal events in the application.

[0071] For further information, see Figure 4 , is a flow chart of a data processing method provided in an embodiment of the present application. Figure 4 As shown, this method can be Figure 1 It can be executed by any terminal in the terminal cluster in Figure 1 can be executed by the server in Figure 1 The terminals and servers in the terminal cluster are used to perform collaborative execution. The devices used to perform the data processing method in this application can be collectively referred to as computer devices. The method may include the following steps:

[0072] S101. Obtain a behavior sequence diagram reflecting a conversation process between an object and an application.

[0073] The behavior sequence diagram reflects N behavior logs of the object regarding the application during the session, and the behavior association relationship between the N behavior logs, where N is an integer greater than 1.

[0074] In the present application, a computer device may obtain N behavior logs and session model data of an object for an application during a session from a terminal, and based on the N behavior logs and session model data, generate a behavior timing diagram reflecting the session process between the object and the application, or a computer device may obtain a behavior timing diagram reflecting the session process between the object and the application from a terminal.

[0075] Among them, the N behavior logs include at least two of the session log, page access log, page operation log, resource access log, abnormal behavior log, and task log in the above Table 1. The N behavior logs may refer to the behavior logs of the object during a session with the application.

[0076] S102: Search for resource access logs from the N behavior logs reflected in the behavior sequence diagram.

[0077] The resource access log reflects the resource access request of the object to the application during the session.

[0078] In this application, since the resource access log is a log associated with the server log among N behavior logs, the computer device can query the resource access log based on the content in the N behavior logs, such as taking the behavior log containing the link identifier among the N behavior logs as the resource access log.

[0079] The number of resource access logs can be one or more.

[0080] S103: Obtain a link identifier corresponding to the resource access request from the resource access log, and generate a client call log carrying the link identifier according to the link identifier.

[0081] The client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object.

[0082] In the present application, the computer device can obtain the link identifier corresponding to the resource access request from the resource access log, and the link identifier can be used to mark the operation path corresponding to the resource access request, and the operation path reflects the response process of the server to the resource access request. According to the link identifier, a client call log carrying the link identifier can be generated, and the client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object, that is, the client call log is used to indicate that the resource access request has been sent to the server.

[0083] The server corresponding to the application program may refer to a server used to provide backend services for the application server.

[0084] S104: After the server responds to the resource access request, a server response log carrying the link identifier is generated according to the resource access request.

[0085] The server response log reflects the server's response to the resource access request.

[0086] In the present application, after the server responds to the resource access request, the computer device can generate a server response log carrying the link identifier according to the resource access request; the server response log reflects the response behavior of the server to the resource access request, that is, the server response log reflects the response process of the server to the resource access request.

[0087] The server response log may include a first type of server response log, which may reflect the resource returned by the server in response to the resource access request. The server response log may include a second type of server response log, which may reflect the server's calling behavior for other devices or functional modules before returning the resource. The number of entries in the second type of server response log may be one or more, and different second type of server response logs may reflect the server's calling behavior for different other devices or functional modules before returning the resource.

[0088] It should be noted that both the server response log and the client call log may include an operation identifier, which is used to indicate the execution order of the operations corresponding to the server response log and the client call log. The client call log corresponds to the call operation (i.e., call behavior) for the resource access request, and the server response log corresponds to the response operation (response behavior) for the resource access request.

[0089] S105: Generate a session link of the session process according to the server response log and the client call log carrying the link identifier, the N behavior logs reflected in the behavior sequence diagram, and the behavior association relationship.

[0090] The session link is used to query the cause of an abnormal event when the abnormal event occurs during the session.

[0091] In the present application, the computer device can generate the session link of the above session process based on the server response log carrying the above link identifier and the above client call log, the above N behavior logs and the above behavior association relationship reflected by the above behavior sequence diagram; the session link is used to reflect the operation path of the object during the session, and the server processing (i.e., response behavior) for the session process. That is, the session link is used to reflect the behavior association relationship between different behavior logs of the object during the session, as well as the back-end server log, to improve the integrity of the log. When an abnormal event occurs during the session, the operation path of the object and the server processing can be queried to quickly locate the cause of the abnormal event, which can improve the query efficiency and accuracy for abnormal events in the application.

[0092] In one embodiment, the behavior sequence diagram includes nodes that respectively reflect the N behavior logs, and the nodes corresponding to the behavior logs with behavior association relationships in the behavior sequence diagram are connected; the above step S105 includes: the computer device can report the server response log carrying the link identifier and the client call log carrying the link identifier to the detection component. Through the detection component, a first node reflecting the server response log and a second node reflecting the client call log are generated; the first node and the second node are connected to obtain the server sublink of the above session process. In particular, when there are multiple server response logs, the computer device can sequentially connect the first node corresponding to the client call log and the second node corresponding to the multiple server response logs according to the execution order corresponding to the operation identifiers in the multiple server response logs and the operation identifiers in the client call log, and obtain the server sublink. The computer device can connect the third node in the above behavior sequence diagram with the first node in the above server sublink according to the behavior association relationship to obtain the session link of the above session process; the third node reflects the resource access log carrying the link identifier in the above N behavior logs. When querying abnormal events, by generating a session link, you can not only view the operation path of the object, but also view the backend link (i.e., the server end link) with one click, and quickly locate which link the abnormal event occurred. Combined with sourcemap (an information file that stores the mapping of the corresponding positions of source code and compiled code), source code-level positioning can be achieved. Especially for some abnormal events that are difficult to reproduce, the problem scene of the object at that time (i.e., the operation path) can be restored, greatly improving the efficiency and accuracy of abnormal event troubleshooting.

[0093] For further information, see Figure 5 , is a flow chart of a data processing method provided in an embodiment of the present application. Figure 5 As shown, this method can be Figure 1 It can be executed by any terminal in the terminal cluster in Figure 1 can be executed by the server in Figure 1 The terminals and servers in the terminal cluster are used to perform collaborative execution. The devices used to perform the data processing method in this application can be collectively referred to as computer devices. The method may include the following steps:

[0094] S201. From the terminal, N behavior logs of the object regarding the application during the session.

[0095] In the present application, after the session process ends, the computer device can obtain N behavior logs of the object regarding the application during the session from the terminal.

[0096] S202: Acquire conversation model data, and determine the behavior association relationship between the N behavior logs according to the expected association relationship reflected by the conversation model data.

[0097] Among them, the above-mentioned conversation model data reflects the expected correlation between different behavior logs.

[0098] In the present application, the computer device may obtain the session model data from the terminal, or the computer device may generate the session model data based on the behavior logs of the application program respectively for at least two objects. The computer device may determine the behavior association relationship between the N behavior logs according to the expected association relationship reflected by the session model data.

[0099] The session model data may be obtained by collecting statistics on the behavior logs of a large number of objects for an application program, and the session model data reflects the expected correlation between different behavior logs, that is, the expected correlation reflects the possible behavior correlation between different behavior logs.

[0100] In one embodiment, the computer device can obtain the behavior logs of at least two objects for the application from the terminal, and determine the preferred behavior paths of the at least two objects for the application based on the behavior logs corresponding to the at least two objects. The preferred behavior path reflects the operation behaviors that a large number of objects prefer to perform, as well as the execution order of the operation behaviors. The computer device can determine the expected association relationship between different behavior logs based on the preferred behavior paths corresponding to the at least two objects; and generate session model data reflecting the expected association relationship between different behavior logs.

[0101] For example, Figure 6As shown, when based on the behavior log of at least two objects for the application, the behavior log indicates that the operation behaviors performed by at least two objects for the application preference include session behavior, first page access behavior, second page access behavior, third page access behavior, page operation behavior, first resource access behavior, first abnormal behavior, second resource access behavior, and second abnormal behavior. And the behavior log indicates that the execution order of the first page access behavior, the second page access behavior, and the third page access behavior are all located after the execution order of the session behavior. Therefore, it is said that the page access log p1 corresponding to the first page access behavior, the page access log p2 corresponding to the second page access behavior, and the page access log p3 corresponding to the third page access behavior have an expected association relationship with the session log corresponding to the session behavior, that is, the page access log p1, the page access log p2, and the page access log p3 belong to the subordinate of the session log. The behavior log indicates that the execution order of business processing, page operation behavior, first resource access behavior, and first abnormal behavior are all located after the execution order of the first page access behavior, and the page operation behavior, the first resource access behavior, the business processing, the first abnormal behavior, and the first page access behavior are all for the same page. Therefore, it can be said that there is an expected behavior relationship between the task log corresponding to the business processing, the page operation log corresponding to the page operation behavior, the resource access log r1 corresponding to the first resource access behavior, the behavior abnormality log e1 corresponding to the first abnormal behavior and the page access log p1 corresponding to the first page access behavior, that is, the task log, the page operation log, the resource access log r1, and the behavior abnormality log e1 belong to the subordinate of the page access log p1. The behavior log indicates that the execution order of the second resource access behavior and the second abnormal behavior are both after the execution order of the first page operation behavior, and the second resource access behavior and the second abnormal behavior and the first page operation behavior are all for the same page. The computer device can determine that there is an expected behavior relationship between the resource access log r2 corresponding to the second resource access behavior and the abnormal behavior log e2 corresponding to the second abnormal behavior and the page access log p1 corresponding to the first page operation behavior, that is, the resource access log r2 and the abnormal behavior log e2 belong to the subordinate of the page access log p1. The computer device can generate nodes for each behavior log, connect the corresponding nodes of the behavior logs with the expected behavior relationship, and obtain the session model data.

[0102] In one example, the N behavior logs include a first behavior log and a second behavior log; the behavior association relationship between the N behavior logs is determined based on the expected association relationship reflected by the conversation model data, including: when the conversation model data indicates that the third behavior log has an expected association relationship with the fourth behavior log, the generation time of the first behavior log is obtained from the first behavior log, and the generation time corresponding to the second behavior log is obtained from the second behavior log. The computer device can perform a difference processing between the generation time of the first behavior log and the generation time of the second behavior log to obtain the generation time interval between the first behavior log and the second behavior log; when the generation time interval between the first behavior log and the second behavior log is less than the time interval threshold, it indicates that the operation behavior corresponding to the first behavior log has a trigger relationship or context relationship with the behavior operation corresponding to the second behavior log, and it is determined that the first behavior log and the second behavior log have a behavior association relationship. By determining the behavior association relationship between different behavior logs, it is helpful to understand the trigger relationship and context relationship between the behavior operations corresponding to the behavior logs.

[0103] Among them, the operation behavior indicated by the above three behavior logs is the same as the operation behavior indicated by the above first behavior log, and the operation behavior indicated by the above fourth behavior log is the same as the operation behavior indicated by the above second behavior log.

[0104] For example, the first line of the log is Figure 2 The first page access log in the second line log is Figure 2 The first resource access log in Figure 6 The session model data in indicates that there is an expected association relationship between the page access log p1 and the resource access log r1. The operation behaviors indicated by the first page access log and the page access log p1 are both page access behaviors, and the operation behaviors indicated by the first resource access log and the resource access log r1 are both resource access behaviors. The computer device can obtain the generation time of the first page log from the first page log, obtain the generation time of the first resource access log from the first resource access log, and perform a difference processing on the generation time of the first page access log and the generation time of the first resource access log to obtain the generation time interval of the first page access log and the first resource access log. When the generation time interval is less than the time interval threshold, it is determined that there is a behavior association relationship between the above-mentioned first page access log and the above-mentioned first resource access log.

[0105] In one instance, the N behavior logs include a first behavior log and a second behavior log; the behavior association relationship between the N behavior logs is determined based on the expected association relationship reflected by the conversation model data, including: when the conversation model data indicates that the third behavior log has an expected association relationship with the fourth behavior log, the first page reflected by the first behavior log is determined based on the first behavior log, and the second page reflected by the second behavior log is determined based on the second behavior log; when the first page is the same as the second page, it is determined that the first behavior log has a behavior association relationship with the second behavior log.

[0106] The first behavior log includes a page identifier of the first page, and the first page is the page acted upon by the behavior operation corresponding to the first behavior log, that is, the first page can be referred to as the page reflected by the first behavior log. The second behavior log includes a page identifier of the second page, and the second page is the page acted upon by the behavior operation corresponding to the second behavior log, that is, the second page can be referred to as the page reflected by the second behavior log.

[0107] S203, generating N nodes reflecting the N behavior logs, connecting the nodes corresponding to the behavior logs having behavior association relationships among the N nodes, and obtaining a behavior sequence diagram reflecting the conversation process between the object and the application.

[0108] In one embodiment, the above-mentioned generation of N nodes reflecting the above-mentioned N behavior logs, connecting the nodes corresponding to the behavior logs with behavior association relationships among the above-mentioned N nodes, and obtaining a behavior timing diagram reflecting the conversation process between the above-mentioned object and the above-mentioned application, includes: the computer device can report the behavior association relationship between the above-mentioned N behavior logs and the N behavior logs to the detection component; through the above-mentioned detection component, generating N nodes reflecting the above-mentioned N behavior logs, connecting the nodes corresponding to the behavior logs with behavior association relationships among the above-mentioned N nodes, and obtaining a behavior timing diagram reflecting the conversation process between the above-mentioned object and the above-mentioned application. Generating a behavior timing diagram through the detection component is conducive to querying the access path of the object to the application through the behavior timing diagram.

[0109] The behavior sequence diagram reflects N behavior logs of the object regarding the application during the session, and the behavior association relationship between the N behavior logs, where N is an integer greater than 1.

[0110] In the present application, a computer device can generate N nodes reflecting the above-mentioned N behavior logs, one behavior log corresponds to one node, and the nodes corresponding to the behavior logs with behavior association relationships among the above-mentioned N nodes are connected to obtain a behavior timing diagram reflecting the session process between the above-mentioned object and the above-mentioned application.

[0111] S204: Search for resource access logs from the N behavior logs reflected in the behavior sequence diagram.

[0112] The resource access log reflects the resource access request of the object to the application during the session.

[0113] S205: Obtain a link identifier corresponding to the resource access request from the resource access log, and generate a client call log carrying the link identifier according to the link identifier.

[0114] The client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object.

[0115] S206: After the server responds to the resource access request, a server response log carrying the link identifier is generated according to the resource access request.

[0116] The server response log reflects the server's response to the resource access request.

[0117] S207: Generate a session link of the session process according to the server response log and the client call log carrying the link identifier, the N behavior logs reflected in the behavior sequence diagram, and the behavior association relationship.

[0118] The session link is used to query the cause of an abnormal event when the abnormal event occurs during the session.

[0119] In one embodiment, when the N behavior logs reflected in the above behavior sequence diagram include abnormal behavior logs, the event type corresponding to the abnormal event occurring during the above session is determined based on the above abnormal behavior logs; if the abnormal behavior log indicates that the page of the application has a display abnormality, the event type is determined to be a page abnormality type; when the abnormal behavior log indicates a network interruption, the event type is determined to be a network abnormality type. When the event type is a page abnormality type, it indicates that an abnormality has occurred in the front end of the application. The computer device can determine the abnormal code module that causes the abnormal event of the above page abnormality type in the above application based on the above N behavior logs reflected in the above behavior sequence diagram in the above session link and the behavior association relationship. According to the above abnormal code module, the cause of the abnormal event of the above page abnormality type is generated, that is, the abnormal code module is used as the cause of the abnormal event of the page abnormality type. Through the session link, code-level positioning of abnormal events can be achieved, and the query efficiency and accuracy of abnormal events can be improved.

[0120] The abnormal code module may refer to a code module in the application program where the processing logic is abnormal.

[0121] In one embodiment, the above-mentioned determination of the abnormal code module causing the abnormal event of the above-mentioned page abnormality type in the above-mentioned application according to the above-mentioned N behavior logs and the above-mentioned behavior association relationship reflected by the above-mentioned session link includes: the computer device can query the fifth behavior log associated with the abnormal behavior log from the above-mentioned N behavior logs reflected by the above-mentioned session link according to the above-mentioned behavior association relationship, that is, the superior behavior log of the fifth behavior log and the abnormal behavior log. The computer device can query the sixth behavior log associated with the above-mentioned fifth behavior log from the above-mentioned N behavior logs reflected by the above-mentioned session link according to the above-mentioned behavior association relationship; that is, the sixth behavior log can be a behavior log at the same level as the abnormal behavior log. The computer device can obtain the candidate code modules respectively associated with the above-mentioned fifth behavior log and the above-mentioned sixth behavior log from the above-mentioned application; according to the candidate code modules respectively associated with the above-mentioned fifth behavior log and the above-mentioned sixth behavior log, determine the abnormal code module causing the abnormal event of the above-mentioned page abnormality type in the above-mentioned application. For example, the candidate code modules associated with the fifth behavior log and the sixth behavior log can be directly determined as the abnormal code modules that cause the abnormal event of the above-mentioned page abnormal type; or, the candidate code modules associated with the fifth behavior log and the sixth behavior log can be tested to obtain the test results, and the abnormal code modules that cause the abnormal event of the above-mentioned page abnormal type can be determined according to the test results. The abnormal code modules that cause the abnormal event of the above-mentioned page abnormal type can be determined by the candidate code modules corresponding to the superior behavior log and the same-level behavior log of the abnormal behavior log, which is conducive to improving the accuracy of determining the abnormal code module.

[0122] The candidate code module associated with the fifth behavior log is a code module that responds to the behavior operation corresponding to the fifth behavior log, and the candidate code module associated with the sixth behavior log is a code module that responds to the behavior operation corresponding to the sixth behavior log.

[0123] In one embodiment, when the resource access log contains an exception field, the computer device can determine that an abnormal event of the resource abnormality type occurred during the session; the computer device can query the service end link managed with the link identifier in the resource access log from the session link; the service end link is generated based on the server response log and the client call log carrying the link identifier. The computer device can determine the cause of the abnormal event of the resource abnormality type based on the service end link; the cause of the abnormal event of the resource abnormality type can be queried through the service end link, thereby improving the query efficiency and accuracy of the abnormal event.

[0124] For example, the computer device can query whether the information in the resource access request is abnormal based on the client call log in the service sub-link, such as querying whether the identifier, link identifier, operation identifier, etc. corresponding to the resource to be accessed in the resource access request are accurate or complete based on the communication protocol. When it is found that there is an error in the identifier, link identifier, and operation identifier corresponding to the resource to be accessed in the resource access request, or at least one of them is missing, it is determined that the resource access request is abnormal, and the abnormality of the resource access request is used as the cause of the abnormal event of the resource abnormality type. When there is no abnormality in the resource access request, the code module or hardware associated with the server response log in the service sub-link can be obtained, and the cause of the abnormal event of the resource abnormality type is determined based on the code module or hardware associated with the server response log in the service sub-link.

[0125] The communication protocol may refer to a protocol for information exchange between a terminal and a server.

[0126] The code module associated with the server response log may refer to a code module in the server for responding to resource access requests, and the hardware associated with the server response log may refer to hardware in the server for responding to resource access requests.

[0127] In one embodiment, the computer device can display a session list through a detection component; the session list includes at least one session identifier corresponding to each session process; in response to a selection operation on a session identifier in the session list, a behavior log list is displayed; the behavior log list includes the behavior log of the session process corresponding to the selected session identifier. By visualizing the behavior log, it is helpful to view the access path of the object to the application.

[0128] For example, Figure 7 As shown, the computer device can display a query page 71a, which includes a session list 72a and a session search area 73a. The session search area 73a is used to configure the information of the session process to be searched (such as session identification, time consumption), and the session list 72a includes the session identification (S1) of the first session process, the session identification (S2) of the second session process, and the session identification (S3) of the third session process. The session list 72a also includes the time consumption, number of accesses, number of exceptions, number of operations, number of resources, application program at the beginning of the session, and application program at the end of the session for each session process. The number of accesses may refer to the number of times resource access behaviors are performed during the session, the number of exceptions may refer to the number of times abnormal events occur during the session, the number of operations may refer to the number of times page operations are performed during the session, and the number of resources may refer to the number of times resource access behaviors are performed during the session. As shown Figure 7, the time taken during the first session is 16 seconds, the number of accesses is 1, the number of exceptions is 0, the number of operations is 7, the number of resources is 156, and the application at the start and end of the session is application Y1. The time taken during the second session is 17 seconds, the number of accesses is 1, the number of exceptions is 0, the number of operations is 0, the number of resources is 187, and the application at the start and end of the session is application Y2. The time taken during the third session is 20 seconds, the number of accesses is 4, the number of exceptions is 1, the number of operations is 0, the number of resources is 126, and the application at the start and end of the session is application Y1. When the computer device detects a selection operation for the session identifier of the third session in the session list 72a, in response to the selection operation, a session details page 74a is displayed. The session details page 74a reflects the behavior log of the third session. The session details page 74a also includes the session start time, end time, 3 page access behaviors ( Figure 7 The page access in the diagram shows the application programs (application programs Y1) corresponding to each page access behavior, as well as the execution time of each page access behavior. When a selection operation for any page access behavior is detected, the resource access request corresponding to the selected page access behavior and the time consumed for each resource access request can be displayed. For example, the resource access requests corresponding to the selected page access behavior include interface request q1, static resource request q2, static resource request q3, interface request q4, and interface request q5. The corresponding addresses (access addresses) of interface request q1, static resource request q2, static resource request q3, interface request q4, and interface request q5 are: address C1, address C2, address C3, address C4, and address C5, respectively.

[0129] In one embodiment, the computer device can respond to the selection operation of the resource access log in the above behavior log list, display the session link identifier in the selected resource access log; respond to the trigger operation of the above session link identifier, display the server end link corresponding to the triggered session link identifier. By visualizing the server end link, it is helpful to query the server processing during the session.

[0130] For example, Figure 8As shown, when a selection operation for a static resource request q4 is detected, the computing device can display a resource details page 81a, and the resource details page 81a includes a request display area 82a. The request display area 82a includes an operation identifier (D4), a link identifier (T4), a previous link identifier (T3), and a previous operation identifier (D3) in the static resource request q4. The previous link identifier is a link identifier of a resource access request whose execution order is before the static resource request q4, and the previous operation identifier is an operation identifier of a resource access request whose execution order is before the static resource request q4. The computer device detects a trigger operation for the link identifier of the static resource request q4, and can respond to the trigger operation to display a link details page 83a. The link details page 83a includes a server end link corresponding to the static resource request q4, and the server end link includes a client call, a server end called f1, a server end main call f2, a server end main call f3, a server end main call f4, and a server end main call f5. The client call reflects the client call log in the server sub-link; the server called f1, server main call f2, server main call f3, server main call f4, and server main call f5 reflect the server response log in the server sub-link.

[0131] See also Fig. 9 , is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. Fig. 9 As shown, the data processing device may include:

[0132] The acquisition module 911 is used to acquire a behavior sequence diagram reflecting the conversation process between the object and the application; the behavior sequence diagram reflects N behavior logs of the object with respect to the application during the conversation process, and the behavior association relationship between the N behavior logs, where N is an integer greater than 1;

[0133] A search module 912 is used to search for a resource access log from the N behavior logs reflected in the behavior sequence diagram; the resource access log reflects the resource access request of the object for the application during the session;

[0134] The first generating module 913 is used to obtain the link identifier corresponding to the resource access request from the resource access log, and generate a client call log carrying the link identifier according to the link identifier; the client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object;

[0135] The second generating module 914 is used to generate a server response log carrying the link identifier according to the resource access request after the server responds to the resource access request; the server response log reflects the response behavior of the server to the resource access request;

[0136] The third generation module 915 is used to generate a session link for the above-mentioned session process based on the server response log and the above-mentioned client call log carrying the above-mentioned link identifier, the above-mentioned N behavior logs reflected in the above-mentioned behavior timing diagram, and the above-mentioned behavior association relationship; the above-mentioned session link is used to query the cause of the above-mentioned abnormal event when an abnormal event occurs in the above-mentioned session process.

[0137] Optionally, the behavior time sequence diagram includes nodes reflecting the N behavior logs respectively, and the nodes corresponding to the behavior logs having behavior association relationships in the behavior time sequence diagram are connected;

[0138] The third generation module 915 is specifically used to report the server response log carrying the link identifier and the client call log carrying the link identifier to the detection component;

[0139] Generate a first node reflecting the server response log and a second node reflecting the client call log through the detection component;

[0140] Connecting the first node and the second node to obtain a service terminal link of the session process;

[0141] According to the above behavior association relationship, the third node in the above behavior sequence diagram is connected to the above service terminal link to obtain the session link of the above session process; the above third node reflects the above resource access log carrying the above link identifier in the above N behavior logs.

[0142] Optionally, the acquisition module 911 is specifically used for:

[0143] Obtaining, from the terminal, N behavior logs of the object regarding the application during the session;

[0144] Acquire conversation model data, and determine the behavior association relationship between the N behavior logs according to the expected association relationship reflected by the conversation model data; the conversation model data reflects the expected association relationship between different behavior logs;

[0145] N nodes reflecting the N behavior logs are generated, and the nodes corresponding to the behavior logs having behavior association relationships among the N nodes are connected to obtain a behavior sequence diagram reflecting the conversation process between the object and the application.

[0146] Optionally, the acquisition module 911 is specifically used for:

[0147] Reporting the behavior association relationship between the N behavior logs and the N behavior logs to the detection component;

[0148] Through the above detection component, N nodes reflecting the above N behavior logs are generated, and the nodes corresponding to the behavior logs with behavior association relationships among the above N nodes are connected to obtain a behavior timing diagram reflecting the session process between the above object and the above application.

[0149] Optionally, the N behavior logs include a first behavior log and a second behavior log;

[0150] Optionally, the acquisition module 911 is specifically used for:

[0151] When the conversation model data indicates that there is an expected correlation between the third behavior log and the fourth behavior log, obtaining the generation time corresponding to the first behavior log and the second behavior log respectively; the operation behavior indicated by the third behavior log is the same as the operation behavior indicated by the first behavior log, and the operation behavior indicated by the fourth behavior log is the same as the operation behavior indicated by the second behavior log;

[0152] Performing a difference processing on the generation time of the first behavior log and the generation time of the second behavior log to obtain the generation time interval between the first behavior log and the second behavior log;

[0153] When the generation time interval between the first behavior log and the second behavior log is less than the time interval threshold, it is determined that there is a behavior association relationship between the first behavior log and the second behavior log.

[0154] Optionally, the acquisition module 911 is specifically used for:

[0155] Obtaining behavior logs of at least two objects for the above application respectively;

[0156] Determining, according to the behavior logs respectively corresponding to the at least two objects, the preferred behavior paths of the at least two objects respectively for the application program;

[0157] Determining the expected correlation between different behavior logs according to the preferred behavior paths corresponding to the at least two objects;

[0158] Generates conversation model data that reflects the expected correlation between different behavior logs.

[0159] Optionally, the third generating module 915 is further used for:

[0160] When the N behavior logs reflected in the behavior sequence diagram include an abnormal behavior log, determining the event type corresponding to the abnormal event occurring during the session according to the abnormal behavior log;

[0161] When the event type is a page exception type, determining an abnormal code module in the application program that causes the abnormal event of the page exception type according to the N behavior logs and the behavior association relationship reflected in the session link;

[0162] According to the above-mentioned abnormal code module, the cause of occurrence of the abnormal event of the above-mentioned page abnormality type is generated.

[0163] Optionally, the third generating module 915 is specifically used for:

[0164] According to the behavior association relationship, query the fifth behavior log associated with the abnormal behavior log from the N behavior logs reflected by the session link;

[0165] According to the behavior association relationship, querying a sixth behavior log associated with the fifth behavior log from the N behavior logs reflected by the session link;

[0166] From the application, obtain candidate code modules respectively associated with the fifth behavior log and the sixth behavior log;

[0167] According to the candidate code modules respectively associated with the fifth behavior log and the sixth behavior log, an abnormal code module causing the abnormal event of the page abnormal type in the application program is determined.

[0168] Optionally, the device further includes a query module 916;

[0169] A query module 916, configured to determine an abnormal event of a resource abnormality type occurring during the session when the resource access log contains an abnormal field;

[0170] From the session link, query the server end link managed with the link identifier in the resource access log; the server end link is generated based on the server response log and the client call log carrying the link identifier;

[0171] According to the service terminal link, the cause of the abnormal event of the resource abnormality type is determined.

[0172] Optionally, the device further includes a display module 917;

[0173] Display module 917, used to display a session list through the detection component; the above session list includes a session identifier corresponding to at least one session process;

[0174] In response to a selection operation on a session identifier in the session list, an application access list is displayed; the application access list includes application programs accessed during the session corresponding to the selected session identifier;

[0175] In response to a selection operation on an application in the application access list, a behavior log list is displayed; the behavior log list includes the behavior log of the object for the selected application.

[0176] Optionally, the display module 917 is further configured to, in response to a selection operation on a resource access log in the above-mentioned behavior log list, display a session link identifier in the selected resource access log;

[0177] In response to the triggering operation on the above session link identifier, the service end link corresponding to the triggered session link identifier is displayed.

[0178] In the present application, a behavior sequence diagram is provided, which reflects the N behavior logs of the object for the application during the session, and the behavior association relationship between the N behavior logs, that is, the behavior sequence diagram can reflect the client log of the object for the application (that is, N behavior logs), and the association relationship between the client logs (that is, the behavior association relationship), and the operation path of the object for the application can be restored through the behavior sequence diagram. At the same time, through the link identifier in the resource access log, the client call log and the server response log with the link identifier are generated, and the session link in the session process is generated through the behavior sequence diagram, the client call log and the server response log. The session link realizes the connection between the client log and the server log (client call log and server response log) to ensure the integrity of the log. In the query process of abnormal events, not only can the operation path of the object be queried, but also the server sublink (including the link of the client call log and the server response log) can be queried, so as to improve the query efficiency and accuracy of abnormal events in the application.

[0179] See also Fig.10 , is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. Fig.10As shown, the above-mentioned computer device 1000 may refer to a terminal or a server, including: a processor 1001, a network interface 1004 and a memory 1005. In addition, the above-mentioned computer device 1000 may also include: a user interface 1003, and at least one communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. Among them, in some embodiments, the user interface 1003 may include a display screen (DiSPlay), a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or it may be a non-volatile memory (non-volatileMeMory), such as at least one disk storage. The memory 1005 may also be optionally at least one storage device away from the aforementioned processor 1001. As Fig.10 As shown, the memory 1005 as a computer-readable storage medium may include an operating system, a network communication module, a user interface module, and a computer program.

[0180] exist Fig.10 In the computer device 1000 shown, the network interface 1004 can provide a network communication function; the user interface 1003 is mainly used to provide an input interface; and the processor 1001 can be used to call the computer program stored in the memory 1005 to implement the following steps of the present application:

[0181] Obtaining a behavior sequence diagram reflecting a conversation process between an object and an application; the behavior sequence diagram reflects N behavior logs of the object with respect to the application during the conversation process, and behavior associations between the N behavior logs, where N is an integer greater than 1;

[0182] Find the resource access log from the N behavior logs reflected in the behavior sequence diagram; the resource access log reflects the resource access request of the object for the application during the session;

[0183] Obtaining a link identifier corresponding to the resource access request from the resource access log, and generating a client call log carrying the link identifier based on the link identifier; the client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object;

[0184] After the server responds to the resource access request, a server response log carrying the link identifier is generated according to the resource access request; the server response log reflects the response behavior of the server to the resource access request;

[0185] A session link of the session process is generated based on the server response log and the client call log carrying the link identifier, the N behavior logs reflected in the behavior sequence diagram, and the behavior association relationship; the session link is used to query the cause of an abnormal event when an abnormal event occurs during the session.

[0186] Optionally, the behavior time sequence diagram includes nodes reflecting the N behavior logs respectively, and the nodes corresponding to the behavior logs having behavior association relationships in the behavior time sequence diagram are connected;

[0187] The processor 1001 may be used to call the computer program stored in the memory 1005 to implement the following steps of the present application:

[0188] Report the server response log carrying the link identifier and the client call log carrying the link identifier to the detection component;

[0189] Generate a first node reflecting the server response log and a second node reflecting the client call log through the detection component;

[0190] Connecting the first node and the second node to obtain a service terminal link of the session process;

[0191] According to the above behavior association relationship, the third node in the above behavior sequence diagram is connected to the above service terminal link to obtain the session link of the above session process; the above third node reflects the above resource access log carrying the above link identifier in the above N behavior logs.

[0192] Optionally, the processor 1001 may be configured to call a computer program stored in the memory 1005 to implement the following steps of the present application:

[0193] Obtaining, from the terminal, N behavior logs of the object regarding the application during the session;

[0194] Acquire conversation model data, and determine the behavior association relationship between the N behavior logs according to the expected association relationship reflected by the conversation model data; the conversation model data reflects the expected association relationship between different behavior logs;

[0195] N nodes reflecting the N behavior logs are generated, and the nodes corresponding to the behavior logs having behavior association relationships among the N nodes are connected to obtain a behavior sequence diagram reflecting the conversation process between the object and the application.

[0196] Optionally, the processor 1001 may be configured to call a computer program stored in the memory 1005 to implement the following steps of the present application:

[0197] Reporting the behavior association relationship between the N behavior logs and the N behavior logs to the detection component;

[0198] Through the above detection component, N nodes reflecting the above N behavior logs are generated, and the nodes corresponding to the behavior logs with behavior association relationships among the above N nodes are connected to obtain a behavior timing diagram reflecting the session process between the above object and the above application.

[0199] Optionally, the N behavior logs include a first behavior log and a second behavior log;

[0200] The processor 1001 may be used to call the computer program stored in the memory 1005 to implement the following steps of the present application:

[0201] When the conversation model data indicates that there is an expected correlation between the third behavior log and the fourth behavior log, obtaining the generation time corresponding to the first behavior log and the second behavior log respectively; the operation behavior indicated by the third behavior log is the same as the operation behavior indicated by the first behavior log, and the operation behavior indicated by the fourth behavior log is the same as the operation behavior indicated by the second behavior log;

[0202] Performing a difference processing on the generation time of the first behavior log and the generation time of the second behavior log to obtain the generation time interval between the first behavior log and the second behavior log;

[0203] When the generation time interval between the first behavior log and the second behavior log is less than the time interval threshold, it is determined that there is a behavior association relationship between the first behavior log and the second behavior log.

[0204] The processor 1001 may be used to call the computer program stored in the memory 1005 to implement the following steps of the present application:

[0205] Obtaining behavior logs of at least two objects for the above application respectively;

[0206] Determining, according to the behavior logs respectively corresponding to the at least two objects, the preferred behavior paths of the at least two objects respectively for the application program;

[0207] Determining the expected correlation between different behavior logs according to the preferred behavior paths corresponding to the at least two objects;

[0208] Generates conversation model data that reflects the expected correlation between different behavior logs.

[0209] Optionally, the processor 1001 may be configured to call a computer program stored in the memory 1005 to implement the following steps of the present application:

[0210] When the N behavior logs reflected in the behavior sequence diagram include an abnormal behavior log, determining the event type corresponding to the abnormal event occurring during the session according to the abnormal behavior log;

[0211] When the event type is a page exception type, determining an abnormal code module in the application program that causes the abnormal event of the page exception type according to the N behavior logs and the behavior association relationship reflected in the session link;

[0212] According to the above-mentioned abnormal code module, the cause of occurrence of the abnormal event of the above-mentioned page abnormality type is generated.

[0213] Optionally, the processor 1001 may be configured to call a computer program stored in the memory 1005 to implement the following steps of the present application:

[0214] According to the behavior association relationship, query the fifth behavior log associated with the abnormal behavior log from the N behavior logs reflected by the session link;

[0215] According to the behavior association relationship, querying a sixth behavior log associated with the fifth behavior log from the N behavior logs reflected by the session link;

[0216] From the application, obtain candidate code modules respectively associated with the fifth behavior log and the sixth behavior log;

[0217] According to the candidate code modules respectively associated with the fifth behavior log and the sixth behavior log, an abnormal code module causing the abnormal event of the page abnormal type in the application program is determined.

[0218] Optionally, the processor 1001 may be configured to call a computer program stored in the memory 1005 to implement the following steps of the present application:

[0219] When the resource access log contains an abnormal field, determining that an abnormal event of a resource abnormality type occurs during the session;

[0220] From the session link, query the server end link managed with the link identifier in the resource access log; the server end link is generated based on the server response log and the client call log carrying the link identifier;

[0221] According to the service terminal link, the cause of the abnormal event of the resource abnormality type is determined.

[0222] Optionally, the processor 1001 may be configured to call a computer program stored in the memory 1005 to implement the following steps of the present application:

[0223] Displaying a session list through the detection component; the session list includes a session identifier corresponding to at least one session process;

[0224] In response to a selection operation on a session identifier in the session list, an application access list is displayed; the application access list includes application programs accessed during the session corresponding to the selected session identifier;

[0225] In response to a selection operation on an application in the application access list, a behavior log list is displayed; the behavior log list includes the behavior log of the object for the selected application.

[0226] Optionally, the processor 1001 may be configured to call a computer program stored in the memory 1005 to implement the following steps of the present application:

[0227] In response to a selection operation on a resource access log in the behavior log list, displaying a session link identifier in the selected resource access log;

[0228] In response to the triggering operation on the above session link identifier, the service end link corresponding to the triggered session link identifier is displayed.

[0229] It should be understood that the computer device described in the embodiments of the present application can execute the description of the above data processing method in the corresponding embodiments above, and can also execute the description of the above data processing device in the corresponding embodiments above, which will not be repeated here. In addition, the description of the beneficial effects of adopting the same method will not be repeated.

[0230] The data collection and processing in this application should be strictly in accordance with the requirements of relevant laws and regulations when applied in practice, and the informed consent or separate consent of the subject of the personal information should be obtained, and subsequent data use and processing should be carried out within the scope of authorization of laws and regulations and the subject of the personal information.

[0231] In the present application, a behavior sequence diagram is provided, which reflects the N behavior logs of the object for the application during the session, and the behavior association relationship between the N behavior logs, that is, the behavior sequence diagram can reflect the client log of the object for the application (that is, N behavior logs), and the association relationship between the client logs (that is, the behavior association relationship), and the operation path of the object for the application can be restored through the behavior sequence diagram. At the same time, through the link identifier in the resource access log, the client call log and the server response log with the link identifier are generated, and the session link in the session process is generated through the behavior sequence diagram, the client call log and the server response log. The session link realizes the connection between the client log and the server log (client call log and server response log) to ensure the integrity of the log. In the query process of abnormal events, not only can the operation path of the object be queried, but also the server sublink (including the link of the client call log and the server response log) can be queried, so as to improve the query efficiency and accuracy of abnormal events in the application.

[0232] In addition, it should be pointed out here that: the embodiment of the present application also provides a computer-readable storage medium, and the computer-readable storage medium stores a computer program executed by the data processing device mentioned above, and the computer program includes program instructions. When the processor executes the program instructions, it can execute the description of the data processing method in the corresponding embodiment above, so it will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer-readable storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application.

[0233] As an example, the above program instructions may be deployed on a computer device for execution, or deployed on at least two computer devices at one location for execution, or executed on at least two computer devices distributed at at least two locations and interconnected through a communication network. At least two computer devices distributed at at least two locations and interconnected through a communication network may constitute a blockchain network.

[0234] The computer-readable storage medium may be a data processing device provided in any of the aforementioned embodiments or a central storage unit of the computer device, such as a hard disk or a memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SMART Media card, SMC), a secure digital character (Secure digital, SD) card, a flash memory card (flaSh card), etc. equipped on the computer device. Further, the computer-readable storage medium may also include both a central storage unit of the computer device and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the computer device. The computer-readable storage medium may also be used to temporarily store data that has been output or is to be output.

[0235] The terms "first", "second", etc. in the description, claims, and drawings of the embodiments of the present application are used to distinguish between contents in different media, rather than to describe a specific order. In addition, the terms "including" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, device, product, or equipment that includes a series of steps or units is not limited to the listed steps or modules, but may optionally include steps or modules that are not listed, or may optionally include other step units inherent to these processes, methods, devices, products, or equipment.

[0236] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the function of the module or unit.

[0237] The data collection and processing in this application should be strictly in accordance with the requirements of relevant laws and regulations when applied in practice, and the informed consent or separate consent of the subject of the personal information should be obtained, and subsequent data use and processing should be carried out within the scope of authorization of laws and regulations and the subject of the personal information.

[0238] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the description of the above-mentioned data processing method and decoding method in the corresponding embodiment above, so it will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the embodiment of the computer program product involved in the present application, please refer to the description of the method embodiment of the present application.

[0239] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0240] The method and related apparatus provided by the embodiment of the present application are described with reference to the method flow chart and / or structural diagram provided by the embodiment of the present application. Specifically, each process and / or box in the method flow chart and / or structural diagram, as well as the combination of the processes and / or boxes in the flow chart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable network connection device to generate a machine, so that the instructions executed by the processor of the computer or other programmable network connection device generate instructions for implementing the process in the process. Figure 1 Schematic diagram of a process or multiple processes and / or structures Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable network-connected device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 Schematic diagram of a process or multiple processes and / or structures Figure 1 These computer program instructions can also be loaded onto a computer or other programmable network connected device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the functions specified in the process. Figure 1 The process or processes and / or structures illustrate the steps of the functions specified in one block or multiple blocks.

[0241] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data processing method, characterized in that: include: Obtaining a behavior sequence diagram reflecting a conversation process between an object and an application; the behavior sequence diagram reflects N behavior logs of the object with respect to the application during the conversation process, and a behavior association relationship between the N behavior logs, where N is an integer greater than 1; Searching for a resource access log from the N behavior logs reflected in the behavior sequence diagram; the resource access log reflects the resource access request of the object to the application during the session; Obtaining a link identifier corresponding to the resource access request from the resource access log, and generating a client call log carrying the link identifier according to the link identifier; The client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object; After the server responds to the resource access request, generating a server response log carrying the link identifier according to the resource access request; The server response log reflects the response behavior of the server to the resource access request; A session link of the session process is generated based on the server response log and the client call log carrying the link identifier, the N behavior logs reflected in the behavior timing diagram, and the behavior association relationship; the session link is used to query the cause of an abnormal event when an abnormal event occurs during the session.

2. The method according to claim 1, characterized in that The behavior time sequence diagram includes nodes that respectively reflect the N behavior logs, and the nodes corresponding to the behavior logs having behavior association relationships in the behavior time sequence diagram are connected; The generating of the session link of the session process according to the server response log and the client call log carrying the link identifier, the N behavior logs reflected by the behavior sequence diagram, and the behavior association relationship includes: Reporting the server response log carrying the link identifier and the client call log carrying the link identifier to the detection component; Generate, by means of the detection component, a first node reflecting the response log of the server and a second node reflecting the call log of the client; Connecting the first node and the second node to obtain a service terminal link of the session process; According to the behavior association relationship, the third node in the behavior sequence diagram is connected to the service terminal link to obtain the session link of the session process; the third node reflects the resource access log carrying the link identifier in the N behavior logs.

3. The method according to claim 1, characterized in that The obtaining of a behavior sequence diagram reflecting a conversation process between an object and an application program includes: Obtaining, from the terminal, N behavior logs of the object regarding the application during the session; Acquire conversation model data, and determine the behavior association relationship between the N behavior logs according to the expected association relationship reflected by the conversation model data; the conversation model data reflects the expected association relationship between different behavior logs; N nodes reflecting the N behavior logs are generated, and nodes corresponding to the behavior logs having behavior association relationships among the N nodes are connected to obtain a behavior sequence diagram reflecting the conversation process between the object and the application.

4. The method according to claim 3, characterized in that The generating of N nodes reflecting the N behavior logs, connecting the nodes corresponding to the behavior logs having behavior association relationships among the N nodes, and obtaining a behavior sequence diagram reflecting the conversation process between the object and the application program, includes: Reporting the behavior association relationship between the N behavior logs and the N behavior logs to the detection component; Through the detection component, N nodes reflecting the N behavior logs are generated, and the nodes corresponding to the behavior logs with behavior association relationships among the N nodes are connected to obtain a behavior timing diagram reflecting the conversation process between the object and the application.

5. The method according to claim 3, characterized in that The N behavior logs include a first behavior log and a second behavior log; The determining, according to the expected association relationship reflected by the conversation model data, the behavior association relationship between the N behavior logs includes: When the session model data indicates that there is an expected association relationship between the third behavior log and the fourth behavior log, obtaining the generation time corresponding to the first behavior log and the second behavior log respectively; the operation behavior indicated by the third behavior log is the same as the operation behavior indicated by the first behavior log, and the operation behavior indicated by the fourth behavior log is the same as the operation behavior indicated by the second behavior log; Performing a difference processing on the generation time of the first behavior log and the generation time of the second behavior log to obtain a generation time interval between the first behavior log and the second behavior log; When the generation time interval between the first behavior log and the second behavior log is less than a time interval threshold, it is determined that there is a behavior association relationship between the first behavior log and the second behavior log.

6. The method according to claim 3, characterized in that The method further comprises: Obtaining behavior logs of at least two objects respectively for the application; Determining, according to the behavior logs respectively corresponding to the at least two objects, the preferred behavior paths of the at least two objects respectively for the application program; Determining an estimated correlation relationship between different behavior logs according to the preferred behavior paths respectively corresponding to the at least two objects; Generates conversation model data that reflects the expected correlation between different behavior logs.

7. The method according to claim 1, characterized in that The method further comprises: When the N behavior logs reflected in the behavior sequence diagram include an abnormal behavior log, determining, according to the abnormal behavior log, an event type corresponding to the abnormal event occurring during the session; When the event type is a page exception type, determining an abnormal code module in the application program that causes an abnormal event of the page exception type according to the N behavior logs and the behavior association relationship reflected in the session link; According to the abnormal code module, the cause of the abnormal event of the page abnormality type is generated.

8. The method according to claim 7, characterized in that The determining, according to the N behavior logs and the behavior association relationship reflected in the session link, an abnormal code module causing an abnormal event of the page abnormal type in the application program includes: According to the behavior association relationship, querying a fifth behavior log having an association relationship with the abnormal behavior log from the N behavior logs reflected by the session link; According to the behavior association relationship, querying a sixth behavior log associated with the fifth behavior log from the N behavior logs reflected by the session link; Acquire, from the application program, candidate code modules respectively associated with the fifth behavior log and the sixth behavior log; An abnormal code module causing an abnormal event of the page abnormality type in the application is determined according to the candidate code modules respectively associated with the fifth behavior log and the sixth behavior log.

9. The method according to claim 1, characterized in that The method further comprises: When the resource access log contains an abnormal field, determining that an abnormal event of a resource abnormality type occurs during the session; From the session link, query the server terminal link managed with the link identifier in the resource access log; the server terminal link is generated based on the server response log and the client call log carrying the link identifier; According to the service terminal link, a cause of occurrence of the abnormal event of the resource abnormality type is determined.

10. The method according to claim 1, characterized in that The method further comprises: Displaying a conversation list by detecting the component; the conversation list includes a conversation identifier corresponding to at least one conversation process; In response to a selection operation on a session identifier in the session list, a behavior log list is displayed; the behavior log list includes a behavior log of a session process corresponding to the selected session identifier.

11. The method according to claim 10, characterized in that The method further comprises: In response to a selection operation on a resource access log in the behavior log list, displaying a session link identifier in the selected resource access log; In response to a triggering operation on the session link identifier, a service end link corresponding to the triggered session link identifier is displayed.

12. A data processing device, characterized in that: include: An acquisition module, used to acquire a behavior sequence diagram reflecting a conversation process between an object and an application; the behavior sequence diagram reflects N behavior logs of the object with respect to the application during the conversation process, and a behavior association relationship between the N behavior logs, where N is an integer greater than 1; A search module, used to search for a resource access log from the N behavior logs reflected in the behavior sequence diagram; the resource access log reflects the resource access request of the object to the application during the session; A first generating module is used to obtain a link identifier corresponding to the resource access request from the resource access log, and generate a client call log carrying the link identifier according to the link identifier; The client call log indicates that the resource access request is obtained by the server corresponding to the application from the terminal corresponding to the object; A second generating module is used to generate a server response log carrying the link identifier according to the resource access request after the server responds to the resource access request; The server response log reflects the response behavior of the server to the resource access request; The third generation module is used to generate a session link of the session process based on the server response log and the client call log carrying the link identifier, the N behavior logs reflected in the behavior timing diagram, and the behavior association relationship; the session link is used to query the cause of an abnormal event when an abnormal event occurs during the session.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 11 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images