Operation and maintenance log analysis method and device, equipment, program product and storage medium

Abstract

The embodiment of the invention discloses an operation and maintenance log analysis method, device and equipment, a program product and a storage medium, relates to the technical field of artificial intelligence and can also be applied to the field of financial science and technology, and the method comprises the following steps: receiving an application service log sent by a business system; classifying the application service logs based on a preset log template and a pre-trained classification model to obtain a classification result of the application service logs; wherein the classification result comprises a log type corresponding to each log; performing retrieval enhancement generation judgment on the application service log according to a pre-established operation and maintenance knowledge base and the log classification result to obtain each operation and maintenance object and operation and maintenance operation; and performing operation and maintenance on each operation and maintenance object based on the operation and maintenance operation. According to the method, deep mining and intelligent analysis can be automatically carried out on the log data, the accuracy and efficiency of log analysis are improved, and therefore more efficient and reliable operation and maintenance services are provided.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of artificial intelligence technology and may also be applicable to the field of financial technology, and in particular, to an operation and maintenance log analysis method, device, equipment, program product and storage medium. Background Art

[0002] In today's big data era, with the rapid development of information technology and the continuous expansion of business scale, enterprises are facing the challenge of massive data, especially the management and analysis of log data. In the field of financial technology, operation and maintenance logs, as an important carrier for recording key information such as system operation status and abnormal events, play an irreplaceable role in ensuring system stability, optimizing performance, improving user experience, and troubleshooting. However, traditional log processing methods often rely on manual collection, parsing and analysis, which is not only inefficient, but also prone to errors and difficult to meet real-time requirements.

[0003] Most current log analysis methods use real-time log collection, parsing, and conversion, and then persist them to the storage engine for storage and indexing. This method combines distributed search capabilities with visualization tools for monitoring, so that manual intervention can be carried out in a timely manner when anomalies occur. This method improves the ability to automatically analyze logs to a certain extent, but the analysis of logs by this method still relies on manually defined rules or patterns in the storage engine. The rules are usually manually written based on historical data and experience, and it is difficult to cover all possible abnormal situations. As a result, this method has problems such as low efficiency, prone to errors, and strong subjectivity. Summary of the invention

[0004] The embodiments of the present invention provide an operation and maintenance log analysis method, apparatus, device, program product and storage medium, which can automatically perform deep mining and intelligent analysis on log data, improve the accuracy and efficiency of log analysis, and thus provide more efficient and reliable operation and maintenance services for application services.

[0005] In a first aspect, an embodiment of the present invention provides an operation and maintenance log analysis method, comprising:

[0006] Receive application service logs sent by business systems;

[0007] Classifying the application service log based on a preset log template and a pre-trained classification model to obtain a classification result of the application service log; wherein the classification result includes a log type corresponding to each log;

[0008] According to the pre-established operation and maintenance knowledge base and the log classification result, the application service log is searched, enhanced, generated and judged to obtain each operation and maintenance object and operation and maintenance operation;

[0009] Based on the operation and maintenance operation, each operation and maintenance object is operated and maintained.

[0010] In a second aspect, an embodiment of the present invention provides an operation and maintenance log analysis device, the device comprising:

[0011] Information receiving module, receiving application service logs sent by the business system;

[0012] A log classification module, used to classify the application service log based on a preset log template and a pre-trained classification model to obtain a classification result of the application service log; wherein the classification result includes a log type corresponding to each log;

[0013] An information determination module is used to search, enhance, generate and determine the application service log according to a pre-established operation and maintenance knowledge base and the log classification result, and obtain various operation and maintenance objects and operation and maintenance operations;

[0014] The application operation and maintenance module is used to perform operation and maintenance on each operation and maintenance object based on the operation and maintenance operation.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an operation and maintenance log analysis method as described in any one of the embodiments of the present invention is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an operation and maintenance log analysis method as described in any one of the embodiments of the present invention.

[0017] In a fifth aspect, an embodiment of the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements an operation and maintenance log analysis method as described in any one of the embodiments of the present invention.

[0018] In an embodiment of the present invention, an application service log sent by a business system is received; the application service log is classified based on a pre-set log template and a pre-trained classification model to obtain a classification result of the application service log; wherein the classification result includes the log type corresponding to each log; the application service log is searched, enhanced, generated, and judged according to a pre-established operation and maintenance knowledge base and the log classification result to obtain each operation and maintenance object and operation and maintenance operation; and each operation and maintenance object is operated and maintained based on the operation and maintenance operation. The method of the embodiment of the present invention can automatically and quickly classify and process application service logs through a pre-set log template and classification model, thereby reducing the need for manual intervention and improving the processing efficiency of log analysis. By searching, enhancing, and generating judgments on the application service log based on the operation and maintenance knowledge base and the log classification result, more precise and targeted operation and maintenance suggestions can be obtained, thereby improving the accuracy and efficiency of log analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A first flow chart of an operation and maintenance log analysis method provided by an embodiment of the present invention;

[0021] Figure 2 A second flow chart of an operation and maintenance log analysis method provided by an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of the structure of an operation and maintenance log analysis device provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0025] Figure 1The first flow chart of an operation and maintenance log analysis method provided in an embodiment of the present invention. The method of the embodiment of the present invention can automatically perform deep mining and intelligent analysis on log data, improve the accuracy and efficiency of log analysis, and thus provide efficient and reliable operation and maintenance services for application services. The information collected in the method of the embodiment of the present invention is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse. The method can be executed by an operation and maintenance log analysis device provided in an embodiment of the present invention, and the device can be implemented in software and / or hardware. The following embodiments will be described by taking the device integrated in an electronic device as an example. The electronic device can be a server or a computer device, etc., with reference to Figure 1 , the method may specifically include the following steps:

[0026] Step 101: Receive application service logs sent by the business system.

[0027] Among them, the application service log is a record generated by the application during operation. The application service log is used to describe the behavior, state changes, events, errors and other information of the application. The application service log includes operation records: recording the operation of the user or system on the application, such as login, logout, data query and data update, etc.; performance indicators: recording the performance-related data of the application, such as response time, processing speed and resource consumption, etc.; exception and error information: recording the abnormal conditions and error information in the application, including error type, error message and stack trace, etc.; security events: recording events related to application security, such as failed login attempts, permission changes and sensitive data access, etc. In an optional implementation, when the application of the business system generates a certain amount of application service logs during operation, the server can obtain the application service logs generated by the business system in order to analyze the application service logs.

[0028] Step 102: classify the application service log based on the preset log template and the pre-trained classification model to obtain the classification result of the application service log.

[0029] Among them, the log template is a tool used to describe and record common patterns and structures in logs. The log template in this solution is a predetermined fixed pattern or structure extracted from a large amount of log data. The server can extract key information from the application service log by identifying and applying the log template, which is convenient for subsequent analysis and processing. The classification model is a model that is pre-trained by the server based on a large amount of historical application service data and is used to classify application service logs. The classification result of the service log is an exception log or an error log.

[0030] Specifically, after obtaining the application service log, the key information of the application service log can be extracted according to the log template. The application service log is classified according to the key information of the application service log using the classification model to obtain the classification result of the application service log. In an optional implementation, after obtaining the application service log, data preprocessing is performed on the application service log to obtain a standardized log corresponding to the application service log; template information is extracted from the standardized log according to the log template to obtain log template information corresponding to the application service log; key information in the log template information is identified, and feature extraction is performed based on the key information to obtain input features of the classification model; the input features are input into the classification model, and the input features are classified through multiple decision trees of the classification model to obtain the classification result of the application service log.

[0031] Step 103: Search, enhance, and generate judgments on application service logs based on a pre-established operation and maintenance knowledge base and log classification results to obtain various operation and maintenance objects and operation and maintenance operations.

[0032] Among them, the operation and maintenance knowledge base is a database obtained by integrating knowledge based on operation and maintenance troubleshooting documents, emergency manuals, product manuals, and interface documents. The operation and maintenance knowledge base can classify, label, or manage various types of operation and maintenance knowledge in a metadata manner, so that the server can quickly retrieve and locate operation and maintenance knowledge. Retrieval-enhanced generation is a technology that combines information retrieval and natural language generation. The retrieval-enhanced generation in this solution retrieves relevant information of the application service log from the external knowledge base and the operation and maintenance knowledge base, and inputs it as a prompt to the large model, and obtains various operation and maintenance objects and operation and maintenance operations based on the information output by the large model. Operation and maintenance objects are objects that need to be maintained and adjusted, such as a specific server, application, or database. Operation and maintenance operations are specific measures to maintain operation and maintenance objects, such as restarting services, updating configurations, or fixing vulnerabilities.

[0033] Specifically, after obtaining the log classification results, different types of application service logs are analyzed using retrieval enhancement generation technology according to the operation and maintenance knowledge base to obtain operation and maintenance objects and operation and maintenance operations. In an optional implementation, when the log type is an exception log, the abnormal state keywords in the log template information are extracted; the abnormal solution corresponding to the abnormal state keywords is searched in the operation and maintenance knowledge base and the pre-acquired general knowledge base; the operation and maintenance objects and operation are determined based on the abnormal solution. When the log type is an error log, the application service log is analyzed based on the operation and maintenance knowledge base and the general knowledge base to obtain the error log analysis results; wherein the analysis results at least include the cause of the error and the error repair suggestion; the operation and maintenance objects and operation are determined based on the error log analysis results.

[0034] Step 104: Perform operation and maintenance on each operation and maintenance object based on the operation and maintenance operation.

[0035] Specifically, after obtaining the operation and maintenance object and the operation and maintenance operation, the server can implement the operation and maintenance operation on the corresponding operation and maintenance object to ensure that the system or application can resume normal operation or achieve the expected performance state. For example, the operation and maintenance object is an application, and the operation and maintenance operation is to update configuration A to configuration B. The server can update configuration A in the application to configuration B and reload the configuration to make the change effective.

[0036] The technical solution of this embodiment receives application service logs sent by the business system; classifies the application service logs based on a pre-set log template and a pre-trained classification model to obtain classification results of the application service logs; wherein the classification results include the log type corresponding to each log; retrieves, enhances, generates and judges the application service logs according to a pre-established operation and maintenance knowledge base and the log classification results to obtain various operation and maintenance objects and operation and maintenance operations; and operates and maintains each operation and maintenance object based on the operation and maintenance operations. The technical solution of this embodiment can automatically and quickly classify and process application service logs through pre-set log templates and classification models, thereby reducing the need for manual intervention and improving the processing efficiency of log analysis. Retrieving, enhancing and generating judgments on application service logs based on the operation and maintenance knowledge base and the log classification results can obtain more precise and targeted operation and maintenance suggestions, thereby improving the accuracy and efficiency of log analysis.

[0037] Figure 2 The second flow chart of an operation and maintenance log analysis method provided by an embodiment of the present invention is a refinement of the above embodiment. The specific method can be as follows Figure 2 As shown, the method may include the following steps:

[0038] Step 201: Receive application service logs sent by the business system.

[0039] Step 202: perform data preprocessing on the application service log to obtain a standardized log corresponding to the application service log.

[0040] Among them, data preprocessing is used to clean the application service logs, so as to convert the application service log data from different sources into a unified format for subsequent processing and analysis. Data preprocessing includes operations such as removing invalid or redundant information, filling missing values, and unifying log formats. Specifically, after obtaining the application service logs, remove invalid or redundant information from the application service logs, such as identifying and deleting duplicate log entries. Detect whether there are missing values ​​in the key fields of the application service logs (such as timestamps). If there are missing values, they can be filled according to the context or other relevant information to ensure the integrity of the data. Convert all application service logs into a unified format to facilitate the subsequent classification of the application service logs.

[0041] Step 203: Extract template information from the standardized log according to the log template to obtain log template information corresponding to the application service log.

[0042] Among them, the log template is a tool for describing and recording common patterns and structures in logs. The log template in this solution is a predetermined fixed pattern or structure extracted from a large amount of log data. In this solution, optionally, generating a log template includes: obtaining historical service logs generated by the business system in a historical period; performing log sample analysis on the historical service logs according to pre-set log keywords to obtain log sample analysis results; and defining a log template based on the log sample analysis results.

[0043] Among them, the log keywords at least include log level and abnormal feature words. Log level is used to indicate different contents of application service logs. The log levels in this solution may include: Debug level: used to record detailed information during the development process to help developers understand the execution process and status of the program. Information level: records general operation events, such as user requests or service responses, for daily monitoring and troubleshooting. Warning level: records potential problems or uncertain behaviors that may require attention but have not yet affected the normal operation of the service. Error level: records error information, indicating that an abnormal situation occurred during program execution and needs to be handled in a timely manner. Fatal level: records serious error information, which usually causes the program to crash or be unable to continue execution. Trace level: records the most detailed log information, usually used to track the system call link to help developers understand the execution path of the program. Abnormal feature words are used to analyze the key fields or keywords of the log. For example, "failure" or "error" in the application service log.

[0044] Specifically, after obtaining the historical service logs of the historical period, summarize the historical service logs to ensure the integrity and consistency of the data. Perform log sample analysis on the historical service logs based on log keywords, such as using automated tools to scan historical service logs and identify log entries containing specific keywords. Record the frequency and context of each log keyword and its correlation with other log keywords. Define a log template based on the analysis results of the historical service logs. The log template should contain all necessary fields in the historical service logs for subsequent feature extraction and classification. For example, timestamp, log level, message content, and exception type.

[0045] In an optional implementation, after obtaining the standardized log, regular expressions and pattern matching techniques are used to automatically identify the patterns and structures in the standardized log. For example, the static part (such as timestamp, log level, etc.) and dynamic part (such as error code, etc.) in the log data are extracted according to the log template, and the log template information corresponding to the application service log is obtained. According to the characteristics of the application service log in the historical period, a log template capable of extracting key information of the log is accurately established, so that the server can more easily identify and extract key information, while improving the storage, retrieval and monitoring efficiency of the log.

[0046] Step 204: Classify the log template information based on the classification model to obtain a classification result of the application service log.

[0047] Among them, the classification model is a model that is pre-trained by the server based on a large amount of historical application service data and is used to classify application service logs. The classification model in this solution can be a classification model established based on a decision tree algorithm. Specifically, after obtaining the log template information, the log template information is input into the classification model to obtain the classification result of the application service log output by the classification model. In this solution, optionally, the log template information is classified based on the classification model to obtain the classification result of the application service log, including: identifying key information in the log template information, and extracting features based on the key information to obtain input features of the classification model; inputting the input features into the classification model, classifying the input features through multiple decision trees of the classification model, and obtaining the classification result of the application service log.

[0048] Among them, the key information includes timestamp, log level, error code and keywords. Specifically, after obtaining the log template information, feature mapping is performed on the log template information according to the key information to obtain input features including various characteristics. The input features are input into the random forest model, which includes multiple decision trees. Each decision tree can judge whether the application service log is abnormal based on the characteristics of the application service log (input features). For example, if a decision tree finds that a log contains the keyword "error", the decision tree may mark it as an abnormal log. Further, the classification result of the application service log is determined according to the classification result of each decision tree. The complexity and diversity of log data can be handled by multiple decision trees, and each decision tree learns different aspects of features to jointly improve the overall classification performance. The classification model can continuously learn and improve based on feedback and new data, and continuously improve the classification performance and adaptability. Using the classification model to classify the application service log not only improves the processing efficiency and accuracy, but also enhances the scalability and maintainability of the system, providing strong technical support for operation and maintenance work.

[0049] Step 205: When the log type is an abnormal log, extract abnormal status keywords in the log template information.

[0050] The abnormal state keyword is information predetermined by the server and used to determine the specific abnormal situation of the abnormal log. After obtaining the log type, if the log type is an abnormal log, the abnormal state keyword in the log template information is extracted from the abnormal log by regular expression matching or string search.

[0051] Step 206: Search the operation and maintenance knowledge base and the pre-acquired general knowledge base for the abnormal state keyword corresponding to the abnormal solution; determine the operation and maintenance object and the operation and maintenance operation based on the abnormal solution.

[0052] Among them, the operation and maintenance knowledge base contains a large amount of operation and maintenance experience and solutions to help operation and maintenance personnel quickly locate and solve problems. Specifically, after obtaining the abnormal state keywords, match the abnormal state keywords with the entries in the operation and maintenance knowledge base to find the solutions or suggestions most relevant to the abnormal state keywords, and determine the best solution for the operation and maintenance object (the object that generates the abnormal log or the object pointed to by the abnormal log) based on the solution or suggestion, including the operation steps or repair suggestions for handling the exception. If no completely matching solution is found in the operation and maintenance knowledge base, the server can determine the solution strategy or guidance direction corresponding to the abnormal state keywords from the knowledge base containing domain big data. According to the determined exception solution, the objects that need to be operated and maintained (such as servers, applications, databases, etc.) and specific operation and maintenance operations (such as restarting services, updating configurations, fixing vulnerabilities, etc.) are clarified.

[0053] Step 207: When the log type is an error log, log analysis is performed on the application service log based on the operation and maintenance knowledge base and the general knowledge base to obtain an error log analysis result; and an operation and maintenance object and an operation and maintenance operation are determined based on the error log analysis result.

[0054] The analysis results include at least the cause of the error and suggestions for error repair. When the log type is an error log, the server can perform in-depth log analysis on the error log based on the relevant information in the operation and maintenance knowledge base and the general knowledge base, including tracing the cause of the error, evaluating the impact of the error, and exploring potential solutions. After analyzing the error log, an error log analysis result including the cause of the log error, the scope of impact, the urgency, and recommended solutions is obtained. According to the recommended solutions in the error log analysis results, determine the objects that need to be operated and maintained and the specific operation and maintenance operations.

[0055] In this solution, the server can also use data visualization tools to intuitively display the log anomaly analysis process in the form of charts or dashboards, etc. It also provides users with a flexible query interface to achieve interactive query, supporting users to quickly retrieve and analyze log data as needed.

[0056] Step 208: Perform operation and maintenance on each operation and maintenance object based on the operation and maintenance operation.

[0057] In the technical solution of this embodiment, an application service log sent by a business system is received. Data preprocessing is performed on the application service log to obtain a standardized log corresponding to the application service log. Template information is extracted from the standardized log according to the log template to obtain log template information corresponding to the application service log. The log template information is classified based on the classification model to obtain the classification result of the application service log. When the log type is an abnormal log, the abnormal state keywords in the log template information are extracted; the abnormal solution corresponding to the abnormal state keywords is searched in the operation and maintenance knowledge base and the pre-acquired general knowledge base; the operation and maintenance object and the operation and maintenance operation are determined based on the abnormal solution. When the log type is an error log, log analysis is performed on the application service log based on the operation and maintenance knowledge base and the general knowledge base to obtain the error log analysis result; the operation and maintenance object and the operation and maintenance operation are determined based on the error log analysis result. Among them, the analysis result at least includes the cause of the error and the error repair suggestion. Operation and maintenance are performed on each operation and maintenance object based on the operation and maintenance operation. The technical solution of this embodiment ensures the quality and consistency of the log data by preprocessing the application service log, reduces the noise and errors in the subsequent processing, and thus improves the data processing efficiency of the log analysis. The random forest-based classification model can automatically classify logs and quickly identify abnormal and error logs, reducing the workload and subjective errors of manual classification. According to different log types, the corresponding solutions can be quickly found in the operation and maintenance knowledge base to automate the operation and maintenance process, improve the efficiency of log analysis, and thus improve the efficiency and accuracy of operation and maintenance.

[0058] Figure 3 The structure diagram of an operation and maintenance log analysis device provided in an embodiment of the present invention is suitable for executing the operation and maintenance log analysis method provided in an embodiment of the present invention. Figure 3 As shown, the device may specifically include:

[0059] Information receiving module 301, receiving application service logs sent by the business system;

[0060] The log classification module 302 is used to classify the application service log based on a preset log template and a pre-trained classification model to obtain a classification result of the application service log; wherein the classification result includes a log type corresponding to each log;

[0061] The information determination module 303 is used to perform search enhancement generation and determination on the application service log according to the pre-established operation and maintenance knowledge base and the log classification result, and obtain various operation and maintenance objects and operation and maintenance operations;

[0062] The application operation and maintenance module 304 is used to perform operation and maintenance on each operation and maintenance object based on the operation and maintenance operation.

[0063] Optionally, the log classification module 302 is specifically used to: perform data preprocessing on the application service log to obtain a standardized log corresponding to the application service log;

[0064] Extracting template information from the standardized log according to the log template to obtain log template information corresponding to the application service log;

[0065] The log template information is classified based on the classification model to obtain a classification result of the application service log.

[0066] Optionally, the log classification module 302 is further used to: identify key information in the log template information, and perform feature extraction based on the key information to obtain input features of the classification model;

[0067] The input features are input into the classification model, and the input features are classified through multiple decision trees of the classification model to obtain classification results of the application service log.

[0068] Optionally, the information determination module 303 is specifically configured to: when the log type is the abnormal log, extract abnormal state keywords in the log template information;

[0069] Searching for an abnormality solution corresponding to the abnormal state keyword in the operation and maintenance knowledge base and the pre-acquired general knowledge base;

[0070] The operation and maintenance object and the operation and maintenance operation are determined based on the exception resolution method.

[0071] Optionally, the information determination module 303 is further used to: when the log type is the error log, perform log analysis on the application service log based on the operation and maintenance knowledge base and the general knowledge base to obtain an error log analysis result; wherein the analysis result at least includes an error cause and an error repair suggestion;

[0072] The operation and maintenance object and the operation and maintenance operation are determined based on the error log analysis result.

[0073] Optionally, the information determination module 303 is further used to: obtain historical service logs generated by the business system in a historical period;

[0074] Performing log sample analysis on the historical service log according to a preset log keyword to obtain a log sample analysis result; wherein the log keyword at least includes a log level and an abnormal characteristic word;

[0075] The log template is defined based on the log sample analysis result.

[0076] The operation and maintenance log analysis device provided in the embodiment of the present invention can execute the operation and maintenance log analysis method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For the contents not described in detail in this embodiment, reference can be made to the description in any method embodiment of the present invention.

[0077] An embodiment of the present invention also provides a computer program product.

[0078] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include: being implemented in one or more computer program products, which can include one or more computer programs, which can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor, which can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0079] Figure 4 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, referring to Figure 4 , Figure 4 The electronic device 12 shown is only an example and should not limit the functions and scope of use of the embodiments of the present application. Figure 4 As shown, the electronic device 12 is in the form of a general purpose computing device. The components of the electronic device 12 may include, but are not limited to: one or more processors or processing units 16, a system memory 28, and a bus 18 that connects various system components (including the system memory 28 and the processing unit 16).

[0080] Bus 18 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. By way of example, these architectures include, but are not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MAC) bus, an Enhanced ISA bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0081] The electronic device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the electronic device 12, including volatile and non-volatile media, removable and non-removable media.

[0082] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The electronic device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be used to read and write non-removable, non-volatile magnetic media ( Figure 4 not shown, usually called a "hard drive"). Although Figure 4 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical medium) may be provided. In these cases, each drive may be connected to the bus 18 via one or more data medium interfaces. The memory 28 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present application.

[0083] A program / utility 40 having a set (at least one) of program modules 46 may be stored, for example, in the memory 28, such program modules 46 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 46 generally perform the functions and / or methods of the embodiments described herein.

[0084] The electronic device 12 may also communicate with one or more external devices 14 (e.g., keyboards, pointing devices, displays 24, etc.), may communicate with one or more devices that enable a user to interact with the electronic device 12, and / or may communicate with any device that enables the electronic device 12 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may be performed via an input / output (I / O) interface 22. Furthermore, the electronic device 12 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 20. As shown, the network adapter 20 communicates with other modules of the electronic device 12 via the bus 18. It should be understood that although Figure 4Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 12, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0085] The processing unit 16 executes various functional applications and data processing by running the program stored in the system memory 28, for example, implementing an operation and maintenance log analysis method provided in an embodiment of the present invention: receiving an application service log sent by a business system; classifying the application service log based on a preset log template and a pre-trained classification model to obtain a classification result of the application service log; wherein the classification result includes a log type corresponding to each log; searching, enhancing, generating and judging the application service log according to a pre-established operation and maintenance knowledge base and the log classification result to obtain various operation and maintenance objects and operation and maintenance operations; and operating and maintaining each operation and maintenance object based on the operation and maintenance operation.

[0086] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an operation and maintenance log analysis method as provided in all the embodiments of the present invention: receiving an application service log sent by a business system; classifying the application service log based on a preset log template and a pre-trained classification model to obtain a classification result of the application service log; wherein the classification result includes a log type corresponding to each log; performing retrieval enhancement and generation judgment on the application service log according to a pre-established operation and maintenance knowledge base and the log classification result to obtain various operation and maintenance objects and operation and maintenance operations; and operating and maintaining each operation and maintenance object based on the operation and maintenance operation. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but is not limited to, an electronic device, device or device of electrical, magnetic, optical, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction-executing electronic device, apparatus, or device.

[0087] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction-executing electronic device, apparatus, or device.

[0088] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0089] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0090] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for analyzing operation and maintenance logs, characterized in that: The method comprises: Receive application service logs sent by business systems; Classifying the application service log based on a preset log template and a pre-trained classification model to obtain a classification result of the application service log; wherein the classification result includes a log type corresponding to each log; According to the pre-established operation and maintenance knowledge base and the log classification result, the application service log is searched, enhanced, generated and judged to obtain each operation and maintenance object and operation and maintenance operation; Based on the operation and maintenance operation, each operation and maintenance object is operated and maintained.

2. The method according to claim 1, characterized in that The application service log is classified based on a preset log template and a pre-trained classification model to obtain a classification result of the application service log, including: Performing data preprocessing on the application service log to obtain a standardized log corresponding to the application service log; Extracting template information from the standardized log according to the log template to obtain log template information corresponding to the application service log; The log template information is classified based on the classification model to obtain a classification result of the application service log.

3. The method according to claim 2, characterized in that Classifying the log template information based on the classification model to obtain a classification result of the application service log includes: Identifying key information in the log template information, and performing feature extraction based on the key information to obtain input features of the classification model; The input features are input into the classification model, and the input features are classified through multiple decision trees of the classification model to obtain classification results of the application service log.

4. The method according to claim 1, characterized in that: The log type is an error log or an exception log; the application service log is searched, enhanced, generated and judged according to a pre-established operation and maintenance knowledge base and the log classification result to obtain various operation and maintenance objects and operation and maintenance operations, including: When the log type is the abnormal log, extracting abnormal status keywords in the log template information; Searching for an abnormality solution corresponding to the abnormal state keyword in the operation and maintenance knowledge base and the pre-acquired general knowledge base; The operation and maintenance object and the operation and maintenance operation are determined based on the exception resolution method.

5. The method according to claim 4, characterized in that The method further comprises: When the log type is the error log, log analysis is performed on the application service log based on the operation and maintenance knowledge base and the general knowledge base to obtain an error log analysis result; wherein the analysis result at least includes an error cause and an error repair suggestion; The operation and maintenance object and the operation and maintenance operation are determined based on the error log analysis result.

6. The method according to claim 1, characterized in that Before receiving the application service log sent by the business system, the method further includes: Obtain historical service logs generated by the business system during historical periods; Performing log sample analysis on the historical service log according to a preset log keyword to obtain a log sample analysis result; wherein the log keyword at least includes a log level and an abnormal characteristic word; The log template is defined based on the log sample analysis result.

7. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements an operation and maintenance log analysis method according to any one of claims 1 to 6.

8. An operation and maintenance log analysis device, characterized in that: include: Information receiving module, receiving application service logs sent by the business system; A log classification module, used to classify the application service log based on a preset log template and a pre-trained classification model to obtain a classification result of the application service log; wherein the classification result includes a log type corresponding to each log; An information determination module is used to search, enhance, generate and determine the application service log according to a pre-established operation and maintenance knowledge base and the log classification result, and obtain various operation and maintenance objects and operation and maintenance operations; The application operation and maintenance module is used to perform operation and maintenance on each operation and maintenance object based on the operation and maintenance operation.

9. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the operation and maintenance log analysis method as described in any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the operation and maintenance log analysis method as described in any one of claims 1 to 6 is implemented.

Images