Log processing method and device, storage medium and computer program product

Abstract

The embodiment of the invention provides a log processing method and device, a storage medium and a computer program product. The method comprises the following steps: acquiring a weblog generated after any business work order is issued through a bypass deployment mode; analyzing the weblog to obtain a user account and a user address for issuing any business work order, and a first work order number and first work order creation time of any business work order; determining a database log associated with the weblog in time sequence according to the first work order number and the first work order creation time; associating the database log with the weblog according to the user address, the user account and the first work order number; analyzing a database log associated with the weblog in time sequence to obtain at least one process number corresponding to the first work order number; for each process number in the at least one process number, determining an industrial control log associated with the database log according to a data acquisition gateway label address corresponding to the process number; and the industrial control log is associated with the database log, so that work order issuing and whole-process monitoring traceability are facilitated.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and specifically to a log processing method, device, storage medium and computer program product. Background Art

[0002] With the rapid development of industrial automation and Internet technology, industrial control systems have evolved from single equipment control to the intelligence, networking and automation of the entire production process. However, this development trend has also brought about increasingly serious data security issues. Personnel send production plan work orders to the MES system through the ERP system, and then send them to the industrial control platform through the data acquisition gateway to achieve material and industrial control parameter control. This process is related to the entire industrial control production process.

[0003] After the production plan work order is issued, network logs, database logs and industrial control logs will be generated. However, if the network logs, database logs and industrial control logs are not collected in a bypass mode, it will affect the normal operation of the main network or database, and affect the performance and stability of the original system. In addition, the network logs, database logs and industrial control logs exist independently. If there is a problem with the work order distribution or the industrial control part, it will be difficult to provide a basis and judgment proof later, which is not conducive to the monitoring and traceability of the work order distribution and the whole process in the industrial Internet. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a log processing method, device, storage medium and computer program product to solve the problem of independent existence of network logs, database logs and industrial control logs in the prior art.

[0005] In order to achieve the above objectives, the first aspect of the present application provides a log processing method, comprising:

[0006] Obtain the network logs generated after any business work order is issued through the bypass deployment mode;

[0007] Parse the network log to obtain the user account and user address that issued any business work order, the first work order number of any business work order, and the creation time of the first work order;

[0008] Determine a database log that is temporally associated with the network log according to the first work order number and the creation time of the first work order;

[0009] Associating the database log with the network log based on the user address, user account, and first work order number;

[0010] Parsing a database log that is temporally associated with the network log to obtain at least one process number corresponding to the first work order number;

[0011] For each process number of at least one process number, determine the industrial control log associated with the database log according to the data acquisition gateway tag address corresponding to the process number;

[0012] Associate industrial control logs with database logs.

[0013] In an embodiment of the present application, determining a database log that is temporally associated with a network log based on a first work order number and a first work order creation time includes: determining a time filtering interval for multiple database logs based on the first work order creation time; parsing each of the multiple database logs to obtain a second work order number and a second work order creation time for each database log; filtering out database logs whose second work order creation time is within the time filtering interval and whose second work order number is the first work order number; and determining the filtered database logs as database logs that are temporally associated with the network log.

[0014] In an embodiment of the present application, the method also includes: parsing the network log to obtain the business web page address for issuing any business work order and the event identifier of the WEB event associated with any business work order; adding the business web page address, event identifier, user account and user address to the database log that is temporally associated with the network log.

[0015] In an embodiment of the present application, for each process number among at least one process number, determining the industrial control log associated with the database log according to the digital acquisition gateway tag address corresponding to the process number includes: for each process number among at least one process number, determining the digital acquisition gateway tag address corresponding to the process number; determining the corresponding gateway data address and the first register address corresponding to the gateway data address according to the digital acquisition gateway tag address and the process number; parsing each industrial control log among multiple industrial control logs to obtain at least one register value in each industrial control log; for each industrial control log, determining the second register address of the industrial control log according to at least one register value in the industrial control log; and determining the industrial control log whose second register address is the first register address corresponding to the gateway data address as the industrial control log associated with the database log.

[0016] In an embodiment of the present application, the method also includes: after associating the industrial control log with the database log, receiving a data tracing request, the data tracing request carrying the user account to be traced and any time period; obtaining the network log, database log and industrial control log corresponding to the user account to be traced and any time period; tracing the data of the user account to be traced within any time period based on the obtained network log, database log and industrial control log.

[0017] In an embodiment of the present application, tracing the data of the user account to be traced within any time period based on the obtained network logs, database logs and industrial control logs includes: determining the work order number issued by the user account to be traced within any time period, the process number corresponding to the work order number, the register address corresponding to the process number, and the point information of the register address based on the obtained network logs, database logs and industrial control logs, so as to complete the data tracing of the user account to be traced within any time period.

[0018] In an embodiment of the present application, the method also includes: displaying the user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the register address corresponding to each process number, and the point information of the register address.

[0019] A second aspect of the present application provides a log processing device, including:

[0020] a memory configured to store instructions;

[0021] The processor is configured to call instructions from the memory and implement the above-mentioned log processing method when executing the instructions.

[0022] A third aspect of the present application provides a machine-readable storage medium, on which instructions are stored. When the instructions are executed by a processor, the processor is configured to execute the above-mentioned log processing method.

[0023] A fourth aspect of the present application provides a computer program product, including a computer program, which implements the above-mentioned log processing method when executed by a processor.

[0024] Through the above technical solution, logs are collected in a bypass manner, which can reduce the intrusive deployment of business system transformation on the network environment, maximize the continuity and effectiveness of business data, and maximize the security of network data. The network review log and the digital review log are associated with each other to achieve a three-layer association from the client to the WEB server layer and the database layer. The industrial control log and the digital review log are integrated and associated to achieve the association between network logs, database logs and industrial control logs, forming a complete life cycle monitoring and traceability of the work order production process, providing a strong guarantee for the subsequent accountability of production problems, and is conducive to the issuance of work orders and the monitoring and traceability of the entire process in the Industrial Internet.

[0025] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0027] Figure 1 The following is a schematic diagram showing a flow chart of a log processing method according to an embodiment of the present application;

[0028] Figure 2 A schematic diagram schematically shows a data tracing result according to an embodiment of the present application;

[0029] Figure 3 A schematic diagram of a log processing device according to an embodiment of the present application is schematically shown;

[0030] Figure 4 The internal structure of a computer device according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0032] It should be noted that if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0033] Figure 1 The following is a schematic diagram showing a flow chart of a log processing method according to an embodiment of the present application. Figure 1 As shown, in one embodiment of the present application, a log processing method is provided, comprising the following steps:

[0034] Step 101: Obtain the network log generated after any business work order is issued through the bypass deployment mode.

[0035] The processor can obtain the network logs generated after issuing any business work order through the bypass deployment mode. Among them, the bypass deployment mode does not directly interfere with the normal operation of the main network or database, but captures the logs through mirroring or diversion to ensure that it does not affect the performance and stability of the original system.

[0036] As shown in the following Table 1, a network log is illustrated, which includes multiple keywords, each keyword corresponding to a name and a value type.

[0037] Table 1

[0038]

[0039]

[0040] Step 102: parse the network log to obtain the user account and user address of issuing any business work order, the first work order number of any business work order, and the creation time of the first work order.

[0041] The processor can parse the network log to obtain the user account and user address of any business work order, the first work order number of any business work order, and the creation time of the first work order. Among them, the network log includes the s_http_account field (business account), the s_http_xforwardedfor field (proxy client IP), the s_http_request_param field (HTTP request parameters) and the i_http_resp_time field (response time). When parsing the network log, the s_http_account field in the network log can be parsed to obtain the user account of any business work order, the s_http_xforwardedfor field in the network log can be parsed to obtain the user address of any business work order, the s_http_request_param field in the network log can be parsed to obtain the first work order number of any business work order, and the i_http_resp_time field in the network log can be parsed to obtain the creation time of the first work order of any business work order.

[0042] Step 103: Determine a database log that is temporally associated with the network log according to the first work order number and the first work order creation time.

[0043] The processor may determine a database log that is temporally associated with the network log according to the first work order number and the creation time of the first work order.

[0044] In an embodiment of the present application, determining a database log that is temporally associated with a network log based on a first work order number and a first work order creation time includes: determining a time filtering interval for multiple database logs based on the first work order creation time; parsing each of the multiple database logs to obtain a second work order number and a second work order creation time for each database log; filtering out database logs whose second work order creation time is within the time filtering interval and whose second work order number is the first work order number; and determining the filtered database logs as database logs that are temporally associated with the network log.

[0045] The processor may determine a time filter interval for the plurality of database logs according to the first work order creation time. For example, a preset time may be added based on the first work order creation time as an upper limit of the time filter interval, and a preset time may be reduced based on the first work order creation time as a lower limit of the time filter interval.

[0046] As shown in Table 2 below, a database log is illustrated, which includes multiple keywords, each keyword having a corresponding name and value type.

[0047] Table 2

[0048]

[0049]

[0050]

[0051] The processor may parse each of the plurality of database logs to obtain a second work order number and a second work order creation time of each database log. Specifically, when parsing each database log, the s_db_sqlcmd field in each database log may be parsed to obtain the second work order number, and the d_db_responsetime field in each database log may be parsed to obtain the second work order creation time.

[0052] The processor may filter out database logs whose second work order creation time is within a time filter interval and whose second work order number is the first work order number, and the filtered database logs are database logs that are temporally associated with the network logs.

[0053] Step 104: Correlate the database log with the network log according to the user address, the user account and the first work order number.

[0054] The processor can associate the database log that is temporally associated with the network log with the network log according to the user address, user account and the first work order number, thereby forming three layers of associated data, namely, the association between the WEB business system account layer, the WEB service layer and the database layer.

[0055] Step 105: Parse the database log that is temporally associated with the network log to obtain at least one process number corresponding to the first work order number.

[0056] The processor may parse the database log associated with the network log in time sequence to obtain at least one process number corresponding to the first work order number. Specifically, when parsing the database log associated with the network log in time sequence, the s_db_sqlcmd field in the database log may be parsed to obtain at least one process number corresponding to the first work order number.

[0057] In an embodiment of the present application, the method also includes: parsing the network log to obtain the business web page address for issuing any business work order and the event identifier of the WEB event associated with any business work order; adding the business web page address, event identifier, user account and user address to the database log that is temporally associated with the network log.

[0058] When parsing the network log, the s_http_url field in the network log can be parsed to obtain the business webpage address for issuing any business work order, and the s_http_eventid field in the network log can be parsed to obtain the event identifier of the WEB event associated with the business work order. Afterwards, the parsed business webpage address, the event identifier of the WEB event associated with any business work order, the user account, and the user address can be added to the database log that is temporally associated with the network log, thereby realizing the fusion of the network log and the database log.

[0059] Step 106: For each process number of at least one process number, determine the industrial control log associated with the database log according to the data acquisition gateway tag address corresponding to the process number.

[0060] Step 107: Correlate the industrial control log with the database log.

[0061] For each process number of the at least one process number, the processor may determine the industrial control log associated with the database log according to the data acquisition gateway tag address corresponding to the process number.

[0062] In an embodiment of the present application, for each process number among at least one process number, determining the industrial control log associated with the database log according to the digital acquisition gateway tag address corresponding to the process number includes: for each process number among at least one process number, determining the digital acquisition gateway tag address corresponding to the process number; determining the corresponding gateway data address and the first register address corresponding to the gateway data address according to the digital acquisition gateway tag address and the process number; parsing each industrial control log among multiple industrial control logs to obtain at least one register value in each industrial control log; for each industrial control log, determining the second register address of the industrial control log according to at least one register value in the industrial control log; and determining the industrial control log whose second register address is the first register address corresponding to the gateway data address as the industrial control log associated with the database log.

[0063] For each of the at least one process number, the processor can determine the data acquisition gateway tag address corresponding to the process number, and can determine the corresponding gateway data address and the first register address corresponding to the gateway data address based on the data acquisition gateway tag address and the process number.

[0064] The processor may parse each of the multiple industrial control logs to obtain at least one register value in each industrial control log. When parsing each industrial control log, the processor may parse the s_modbus_reg_val field in each working condition log to obtain at least one register value in each industrial control log. For each industrial control log, the processor may determine a second register address of the industrial control log according to at least one register value in the industrial control log.

[0065] The processor may determine the industrial control log whose second register address is the first register address corresponding to the gateway data address as the industrial control log associated with the database log. The processor may associate the industrial control log associated with the database log with the database log associated in time sequence, thereby realizing the association between the network log, the database log and the industrial control log.

[0066] As shown in Table 3 below, an industrial control log is illustrated.

[0067] Table 3

[0068]

[0069]

[0070] As shown in Table 4 below, a data acquisition gateway label address is illustrated.

[0071] Table 4

[0072]

[0073]

[0074] In an embodiment of the present application, the method also includes: after associating the industrial control log with the database log, receiving a data tracing request, the data tracing request carrying the user account to be traced and any time period; obtaining the network log, database log and industrial control log corresponding to the user account to be traced and any time period; tracing the data of the user account to be traced within any time period based on the obtained network log, database log and industrial control log.

[0075] After associating the industrial control log with the database log, the processor may receive a data tracing request. The data tracing request carries the user account to be traced and any time period. The processor may obtain the network log, database log, and industrial control log corresponding to the user account to be traced and any time period. The processor may trace the data of the user account to be traced within any time period based on the obtained network log, database log, and industrial control log.

[0076] In an embodiment of the present application, tracing the data of the user account to be traced within any time period based on the obtained network logs, database logs and industrial control logs includes: determining the work order number issued by the user account to be traced within any time period, the process number corresponding to the work order number, the gateway data address corresponding to the process number, and the point information of the gateway data address based on the obtained network logs, database logs and industrial control logs, so as to complete the data tracing of the user account to be traced within any time period.

[0077] The processor can parse the obtained network log to obtain the work order number issued by the user account to be traced within any time period, can parse the obtained database log to obtain the process number corresponding to the work order number, can parse the obtained industrial control log to obtain the register data address corresponding to the process number, and the point information of the register data address, so as to complete the data tracing of the user account to be traced within any time period.

[0078] In an embodiment of the present application, the method also includes: displaying the user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the gateway data address corresponding to each process number, and the point information of the gateway data address.

[0079] The processor can display the user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the gateway data address corresponding to each process number, and the point information of the gateway data address, so as to facilitate the visual display of the business work order issued by the traceable user account within any time period.

[0080] For example, Figure 2 As shown, taking data traceability in a steel manufacturing scenario as an example, a schematic diagram of data traceability results is provided.

[0081] When tracing the data source of the account of user zhangsan in a certain period of time, the following steps are included:

[0082] Q1: The user account zhangsan creates order number 1000000656 through the ERP system;

[0083] Q2: The ERP system sends the order number 1000000656 to the MES system to form the work order number 1000000656;

[0084] Q3: The MES system is split into corresponding process number 23541;

[0085] Q4: Process number 23541 is again associated with the data acquisition gateway data address 192.168.1.3, and the point information of the process setting is uniformly displayed through the industrial control audit MODBUS protocol;

[0086] Q5: Steel manufacturing is carried out according to process number.

[0087] Among them, Table 5 illustrates the data address of the data acquisition gateway assisted by Q4, and Table 6 illustrates the data displayed by the intelligent manufacturing PLC.

[0088] Table 5

[0089]

[0090]

[0091] Table 6

[0092]

[0093] Through the above technical solution, logs are collected in a bypass manner, which can reduce the intrusive deployment of business system transformation on the network environment, maximize the continuity and effectiveness of business data, and maximize the security of network data. The network review log and the digital review log are associated with each other to achieve a three-layer association from the client to the WEB server layer and the database layer. The industrial control log and the digital review log are integrated and associated to achieve the association between network logs, database logs and industrial control logs, forming a complete life cycle monitoring and traceability of the work order production process, providing a strong guarantee for the subsequent accountability of production problems, and is conducive to the issuance of work orders and the monitoring and traceability of the entire process in the Industrial Internet.

[0094] Figure 1 FIG. 1 is a flow chart of a log processing method in an embodiment. It should be understood that although Figure 1The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0095] In one embodiment, a log processing device is provided, comprising:

[0096] a memory configured to store instructions;

[0097] The processor is configured to call instructions from the memory and implement the above-mentioned log processing method when executing the instructions.

[0098] In one embodiment, Figure 3 As shown, a schematic diagram of a log processing device is provided. The log processing device includes a data collection module A1, a data association analysis module A2, a data task creation module A3 and a data display and presentation module A4.

[0099] Among them, the data source of the data acquisition module A1 can be collected in a mirroring manner, including all database, network and industrial control traffic, and all access and operation behaviors recorded based on SQL syntax and semantic parsing technology, HTTP restoration technology, and industrial control protocol parsing technology. The data acquisition module A1 can collect log information in a bypass manner to reduce the intrusive deployment of the business system transformation to the industrial Internet environment and maximize the continuity and effectiveness of business data. Among them, the collected logs include database audits, network audits DLP and industrial control audits. Through bypass deployment, real-time monitoring and recording of database activities, network HTTP requests and industrial control protocol audits can be achieved. Bypass deployment does not directly interfere with the normal operation of the main network or database, but captures data packets through mirroring or diversion to ensure that the performance and stability of the original system are not affected.

[0100] The data association analysis module A2 can associate the database log with the source IP, destination IP, time and sending request in the network audit DLP log (network log), and associate the application account, WEB client operation IP, client request network content with the database log, thereby forming a three-layer association relationship between the client, WEB server and database operation. The data association analysis module A2 can refine the association request content through the work order field, so as to achieve a complete serial relationship between the work order account of the account operating the server through the source IP. The data association analysis module A2 can parse the industrial control protocol log to associate the process number with the task order number in the data audit log, and finally associate the actual workflow of this work order in the industrial control environment and the material information involved, so as to realize the association between the work order number and the process number of the digital acquisition gateway.

[0101] The data task creation module A3 can create a traceability task through a page. The created traceability task can include task name, order issuing account, order issuing start time, order issuing end time, order task notes and other information. The data display and presentation module A4 can display the order number created by the ERP system account within the task time period, the work order number issued to the MES system, the process number converted in the MES data acquisition gateway, and the actual operation of each process according to the created traceability task.

[0102] The above technical solution can be applied to general business scenarios of the Industrial Internet, such as steel manufacturing, textile processing, equipment manufacturing, smelting and mining, and other full industrial scenarios. The collection log source is deployed in bypass mode, and the digital audit log, network audit log, and industrial control audit log are collected in syslog mode. The entire data flow process is restored non-invasively, which maximizes the impact on the business and converts the complete order into a work order, so that the process and corresponding point information changes on the industrial control side are fully displayed. The complete closed-loop process traceability of industrial control is deeply considered from the perspective of data security, which maximizes the overall data security of the Industrial Internet and provides strong guarantees for the accountability of subsequent production problems. The network audit and digital audit logs are associated with three layers of data, thereby realizing the three-layer association of the client, WEB server layer, and database layer. The independent logs are serially associated through the multi-layer association of the source IP order number and the account number and time, which improves the accuracy of the association between logs. In the MES system, the work order number and the work order process number are associated through the digital audit log, and then the industrial control audit log is integrated and associated with the digital audit log, so as to achieve real-time association of the work order number and the process number through bypass packet capture, and then the industrial control audit log is associated with the data address of the digital acquisition gateway to obtain the entire process and final set point value of the actual production of the order by the Industrial Internet.

[0103] In one embodiment, a storage medium is provided, on which a program is stored, and when the program is executed by a processor, the above-mentioned log processing method is implemented.

[0104] In one embodiment, a processor is provided, and the processor is used to run a program, wherein the above-mentioned log processing method is executed when the program is running.

[0105] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor A01, a network interface A02, a memory (not shown in the figure) and a database (not shown in the figure) connected via a system bus. Among them, the processor A01 of the computer device is used to provide computing and control capabilities. The memory of the computer device includes an internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02 and a database (not shown in the figure). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 in the non-volatile storage medium A04. The database of the computer device is used to store data such as logs. The network interface A02 of the computer device is used to communicate with an external terminal through a network connection. When the computer program B02 is executed by the processor A01, a log processing method is implemented.

[0106] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0107] An embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: obtaining a network log generated after any business work order is issued through a bypass deployment mode; parsing the network log to obtain a user account and user address for issuing any business work order, a first work order number of any business work order, and a creation time of the first work order; determining a database log that is temporally associated with the network log according to the first work order number and the creation time of the first work order; associating the database log with the network log according to the user address, the user account, and the first work order number; parsing the database log that is temporally associated with the network log to obtain at least one process number corresponding to the first work order number; for each process number in the at least one process number, determining an industrial control log associated with the database log according to a digital acquisition gateway tag address corresponding to the process number; and associating the industrial control log with the database log.

[0108] In one embodiment, determining a database log that is temporally associated with a network log based on a first work order number and a first work order creation time includes: determining a time filtering interval for multiple database logs based on the first work order creation time; parsing each of the multiple database logs to obtain a second work order number and a second work order creation time for each database log; filtering out database logs whose second work order creation time is within the time filtering interval and whose second work order number is the first work order number; and determining the filtered database logs as database logs that are temporally associated with the network log.

[0109] In one embodiment, the method also includes: parsing the network log to obtain the business web page address for issuing any business work order and the event identifier of the WEB event associated with any business work order; adding the business web page address, event identifier, user account and user address to the database log that is temporally associated with the network log.

[0110] In one embodiment, for each process number among at least one process number, determining the industrial control log associated with the database log according to the digital acquisition gateway tag address corresponding to the process number includes: for each process number among at least one process number, determining the digital acquisition gateway tag address corresponding to the process number; determining the corresponding gateway data address and the first register address corresponding to the gateway data address according to the digital acquisition gateway tag address and the process number; parsing each industrial control log among multiple industrial control logs to obtain at least one register value in each industrial control log; for each industrial control log, determining the second register address of the industrial control log according to at least one register value in the industrial control log; and determining the industrial control log whose second register address is the first register address corresponding to the gateway data address as the industrial control log associated with the database log.

[0111] In one embodiment, the method also includes: after associating the industrial control log with the database log, receiving a data tracing request, the data tracing request carries the user account to be traced and any time period; obtaining the network log, database log and industrial control log corresponding to the user account to be traced and any time period; tracing the data of the user account to be traced within any time period based on the obtained network log, database log and industrial control log.

[0112] In one embodiment, tracing the data of the user account to be traced within any time period based on the obtained network logs, database logs and industrial control logs includes: determining the work order number issued by the user account to be traced within any time period, the process number corresponding to the work order number, the register address corresponding to the process number, and the point information of the register address based on the obtained network logs, database logs and industrial control logs, so as to complete the data tracing of the user account to be traced within any time period.

[0113] In one embodiment, the method further includes: displaying the user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the register address corresponding to each process number, and the point information of the register address.

[0114] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program initialized with the above-mentioned log processing method steps.

[0115] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0116] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0119] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0120] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0121] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0122] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0123] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A log processing method, characterized in that: The method comprises: Obtain the network logs generated after any business work order is issued through the bypass deployment mode; Parsing the network log to obtain the user account and user address of issuing any of the business work orders, the first work order number of any of the business work orders, and the creation time of the first work order; Determine, according to the first work order number and the creation time of the first work order, a database log that is temporally associated with the network log; associating the database log with the network log according to the user address, the user account, and the first work order number; Parsing a database log that is temporally associated with the network log to obtain at least one process number corresponding to the first work order number; For each process number of the at least one process number, determining the industrial control log associated with the database log according to the data acquisition gateway tag address corresponding to the process number; The industrial control log is associated with the database log.

2. The log processing method according to claim 1, characterized in that: The step of determining the database log associated with the network log in time sequence according to the first work order number and the first work order creation time includes: Determining a time screening interval for multiple database logs according to the creation time of the first work order; Parsing each database log of the plurality of database logs to obtain a second work order number and a second work order creation time of each database log; Filter out the database logs whose second work order creation time is within the time screening interval and whose second work order number is the first work order number; The filtered database logs are determined as database logs that are temporally associated with the network logs.

3. The log processing method according to claim 1, characterized in that: The method further comprises: Parsing the network log to obtain the business webpage address for issuing any business work order and the event identifier of the WEB event associated with any business work order; The business web page address, event identifier, user account and user address are added to a database log that is temporally associated with the network log.

4. The log processing method according to claim 1, characterized in that: For each process number of the at least one process number, determining the industrial control log associated with the database log according to the data acquisition gateway tag address corresponding to the process number includes: For each process number of the at least one process number, determining a data acquisition gateway tag address corresponding to the process number; Determine the corresponding gateway data address and the first register address corresponding to the gateway data address according to the data acquisition gateway tag address and the process number; Parsing each of the plurality of industrial control logs to obtain at least one register value in each of the industrial control logs; For each industrial control log, determining a second register address of the industrial control log according to at least one register value in the industrial control log; The industrial control log whose second register address is the first register address corresponding to the gateway data address is determined as the industrial control log associated with the database log.

5. The log processing method according to claim 1, characterized in that: The method further comprises: After associating the industrial control log with the database log, receiving a data tracing request, the data tracing request carrying a user account to be traced and any time period; Obtaining network logs, database logs, and industrial control logs corresponding to the user account to be traced and any time period; The data of the user account to be traced within any time period is traced according to the obtained network logs, database logs and industrial control logs.

6. The log processing method according to claim 5, characterized in that: The tracing of the data of the user account to be traced within any time period according to the obtained network log, database log and industrial control log includes: Based on the acquired network logs, database logs and industrial control logs, determine the work order number issued by the user account to be traced within any time period, the process number corresponding to the work order number, the register address corresponding to the process number, and the point information of the register address to complete the data tracing of the user account to be traced within any time period.

7. The log processing method according to claim 6, characterized in that: The method further comprises: The user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the register address corresponding to each process number, and the point information of the register address are displayed.

8. A log processing device, characterized in that: The device comprises: a memory configured to store instructions; A processor is configured to call the instruction from the memory and implement the log processing method according to any one of claims 1 to 7 when executing the instruction.

9. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions, which are used to enable a machine to execute the log processing method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the log processing method according to any one of claims 1 to 7.

Images