Log processing methods, devices, storage media, and computer program products

Abstract

This application provides a log processing method, apparatus, storage medium, and computer program product. The method includes: acquiring network logs generated after any business work order is issued through a bypass deployment mode; parsing the network logs to obtain the user account and user address of the user who issued the business work order, the first work order number of the business work order, and the creation time of the first work order; determining a database log that is temporally associated with the network logs based on the first work order number and the creation time of the first work order; associating the database logs with the network logs based on the user address, user account, and first work order number; parsing the database logs that are temporally associated with the network logs to obtain at least one process number corresponding to the first work order number; for each process number, determining an industrial control log associated with the database logs based on the data acquisition gateway tag address corresponding to the process number; and associating the industrial control logs with the database logs to facilitate work order issuance and full-process monitoring and traceability.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and specifically to a log processing method, apparatus, storage medium, and computer program product. Background Technology

[0002] With the rapid development of industrial automation and internet technology, industrial control systems have evolved from simple equipment control to intelligent, networked, and automated production processes. However, this trend has also brought increasingly serious data security issues. Personnel send production plans and work orders from the ERP system to the MES system, which then sends them to the industrial control platform via a data acquisition gateway to control materials and industrial control parameters. This process is crucial to the entire industrial production process.

[0003] After a production plan work order is issued, network logs, database logs, and industrial control logs are generated. However, the fact that these logs are not collected in a bypass manner can affect the normal operation of the main network or database, impacting the performance and stability of the existing system. Furthermore, since these logs exist independently, it is difficult to provide evidence and proof if problems arise during work order distribution or industrial control, hindering work order distribution and end-to-end monitoring and traceability in the industrial internet. Summary of the Invention

[0004] The purpose of this application is to provide a log processing method, apparatus, storage medium, and computer program product to solve the problem of the independent existence of network logs, database logs, and industrial control logs in the prior art.

[0005] To achieve the above objectives, the first aspect of this application provides a log processing method, comprising:

[0006] Obtain network logs generated after any business work order is issued through bypass deployment mode;

[0007] Parse the network logs to obtain the user account and user address that issued any business work order, the first work order number of any business work order, and the creation time of the first work order;

[0008] The database logs that are time-series associated with the network logs are determined based on the first work order number and the first work order creation time;

[0009] Associate the database logs with the network logs based on the user address, user account, and first work order number;

[0010] Parse the database logs that are time-series correlated with the network logs to obtain at least one process number corresponding to the first work order number;

[0011] For each process number in at least one process number, determine the industrial control log associated with the database log based on the data acquisition gateway tag address corresponding to the process number;

[0012] Associate industrial control logs with database logs.

[0013] In this embodiment of the application, determining the database logs that are temporally associated with the network logs based on the first work order number and the first work order creation time includes: determining a time filtering interval for multiple database logs based on the first work order creation time; parsing each database log in the multiple database logs to obtain the second work order number and the second work order creation time of each database log; filtering out database logs whose second work order creation time is within the time filtering interval and whose second work order number is the first work order number; and determining the filtered database logs as the database logs that are temporally associated with the network logs.

[0014] In this embodiment of the application, the method further includes: parsing the network log to obtain the business web page address for issuing any business work order and the event identifier of the WEB event associated with any business work order; adding the business web page address, event identifier, user account, and user address to the database log that is time-series associated with the network log.

[0015] In this embodiment, determining the industrial control log associated with the database log based on the data acquisition gateway tag address corresponding to the at least one process number includes: determining the data acquisition gateway tag address corresponding to the process number for each process number; determining the corresponding gateway data address and the first register address corresponding to the gateway data address based on the data acquisition gateway tag address and the process number; parsing each industrial control log in the plurality of industrial control logs to obtain at least one register value in each industrial control log; determining the second register address of the industrial control log based on the at least one register value in each industrial control log; and determining the industrial control log whose second register address is the first register address corresponding to the gateway data address as the industrial control log associated with the database log.

[0016] In this embodiment of the application, the method further includes: after associating the industrial control log with the database log, receiving a data tracing request, the data tracing request carrying the user account to be traced and any time period; obtaining the network log, database log and industrial control log corresponding to the user account to be traced and any time period; and tracing the data of the user account to be traced within any time period based on the obtained network log, database log and industrial control log.

[0017] In this embodiment of the application, tracing the data of the user account to be traced within any time period based on the obtained network logs, database logs, and industrial control logs includes: determining the work order number, the process number corresponding to the work order number, the register address corresponding to the process number, and the point information of the register address issued by the user account to be traced within any time period based on the obtained network logs, database logs, and industrial control logs, so as to complete the data tracing of the user account to be traced within any time period.

[0018] In this embodiment of the application, the method further includes: displaying the user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the register address corresponding to each process number, and the point information of the register address.

[0019] A second aspect of this application provides a log processing apparatus, comprising:

[0020] The memory is configured to store instructions;

[0021] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned log processing method.

[0022] A third aspect of this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned log processing method.

[0023] The fourth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described log processing method.

[0024] By using the above technical solutions to collect logs in a bypass manner, the intrusive deployment of business system modifications to the network environment can be reduced, maximizing the continuity and effectiveness of business data and ensuring network data security to the greatest extent. Data association between network audit logs and data audit logs achieves a three-layer association from the client to the web server layer and the database layer. Integration and association between industrial control logs and data audit logs realizes the association between network logs, database logs, and industrial control logs, forming a complete lifecycle monitoring and traceability system for the work order production process. This provides strong support for subsequent accountability for production problems and is beneficial for work order issuance and full-process monitoring and traceability in the industrial internet.

[0025] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0026] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:

[0027] Figure 1 The schematic diagram illustrates a flow chart of a log processing method according to an embodiment of this application;

[0028] Figure 2 A schematic diagram illustrating the data tracing results according to an embodiment of this application is shown.

[0029] Figure 3 A schematic diagram of a log processing apparatus according to an embodiment of this application is shown.

[0030] Figure 4 The diagram illustrates the internal structure of a computer device according to an embodiment of this application. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0032] It should be noted that if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0033] Figure 1 A schematic flowchart of a log processing method according to an embodiment of this application is shown. Figure 1 As shown in one embodiment of this application, a log processing method is provided, including the following steps:

[0034] Step 101: Obtain the network logs generated after any business work order is issued through the bypass deployment mode.

[0035] The processor can acquire network logs generated after any business work order is issued through bypass deployment mode. In bypass deployment mode, the normal operation of the main network or database is not directly interfered with. Instead, logs are captured through mirroring or traffic offloading to ensure that the performance and stability of the original system are not affected.

[0036] Table 1 below illustrates a network log, which includes multiple keywords, each with a corresponding name and value type.

[0037] Table 1

[0038]

[0039]

[0040] Step 102: Parse the network logs to obtain the user account and user address that issued any business work order, the first work order number of any business work order, and the creation time of the first work order.

[0041] The processor can parse network logs to obtain the user account and address that issued any work order, the first work order number of any work order, and the creation time of the first work order. The network logs include the fields `s_http_account` (work order account), `s_http_xforwardedfor` (proxy client IP), `s_http_request_param` (HTTP request parameters), and `i_http_resp_time` (response time). When parsing the network logs, the `s_http_account` field can be parsed to obtain the user account that issued any work order, the `s_http_xforwardedfor` field can be parsed to obtain the user address that issued any work order, the `s_http_request_param` field can be parsed to obtain the first work order number of any work order, and the `i_http_resp_time` field can be parsed to obtain the creation time of the first work order of any work order.

[0042] Step 103: Determine the database log that is time-series associated with the network log based on the first work order number and the first work order creation time.

[0043] The processor can determine the database log that is time-series associated with the network log based on the first work order number and the first work order creation time.

[0044] In this embodiment of the application, determining the database logs that are temporally associated with the network logs based on the first work order number and the first work order creation time includes: determining a time filtering interval for multiple database logs based on the first work order creation time; parsing each database log in the multiple database logs to obtain the second work order number and the second work order creation time of each database log; filtering out database logs whose second work order creation time is within the time filtering interval and whose second work order number is the first work order number; and determining the filtered database logs as the database logs that are temporally associated with the network logs.

[0045] The processor can determine the time filtering range for multiple database logs based on the creation time of the first work order. For example, a preset time can be added to the creation time of the first work order as the upper limit of the time filtering range, and a preset time can be reduced from the creation time of the first work order as the lower limit of the time filtering range.

[0046] Table 2 below illustrates a database log, which includes multiple keywords, each with a corresponding name and value type.

[0047] Table 2

[0048]

[0049]

[0050]

[0051] The processor can parse each database log from multiple database logs to obtain the second work order number and the second work order creation time for each database log. Specifically, in parsing each database log, the second work order number can be obtained by parsing the s_db_sqlcmd field in each database log, and the second work order creation time can be obtained by parsing the d_db_responsetime field in each database log.

[0052] The processor can filter out database logs where the creation time of the second work order is within the time filtering range and the second work order number is the same as the first work order number. The filtered database logs are those that are time-series correlated with the network logs.

[0053] Step 104: Associate the database logs with the network logs based on the user address, user account, and first work order number.

[0054] The processor can associate the database logs, which are time-series related to the network logs, with the network logs based on the user address, user account, and first work order number, thereby forming a three-layer association data, namely the association between the WEB business system account layer, the WEB service layer, and the database layer.

[0055] Step 105: Parse the database logs that are time-series related to the network logs to obtain at least one process number corresponding to the first work order number.

[0056] The processor can parse database logs that are temporally correlated with network logs to obtain at least one process number corresponding to the first work order number. Specifically, when parsing database logs that are temporally correlated with network logs, the processor can parse the s_db_sqlcmd field in the database log to obtain at least one process number corresponding to the first work order number.

[0057] In this embodiment of the application, the method further includes: parsing the network log to obtain the business web page address for issuing any business work order and the event identifier of the WEB event associated with any business work order; adding the business web page address, event identifier, user account, and user address to the database log that is time-series associated with the network log.

[0058] By parsing the network logs, the `s_http_url` field can be parsed to obtain the business webpage address for issuing any business work order, and the `s_http_eventid` field can be parsed to obtain the event identifier of the web event associated with the business work order. Then, the parsed business webpage address, the event identifier of the web event associated with any business work order, the user account, and the user address can be added to the database logs that are time-series related to the network logs, thus achieving the fusion of network logs and database logs.

[0059] Step 106: For each process number in at least one process number, determine the industrial control log associated with the database log based on the data acquisition gateway tag address corresponding to the process number.

[0060] Step 107: Associate the industrial control logs with the database logs.

[0061] For each process number in at least one process number, the processor can determine the industrial control log associated with the database log based on the data acquisition gateway tag address corresponding to the process number.

[0062] In this embodiment, determining the industrial control log associated with the database log based on the data acquisition gateway tag address corresponding to the at least one process number includes: determining the data acquisition gateway tag address corresponding to the process number for each process number; determining the corresponding gateway data address and the first register address corresponding to the gateway data address based on the data acquisition gateway tag address and the process number; parsing each industrial control log in the plurality of industrial control logs to obtain at least one register value in each industrial control log; determining the second register address of the industrial control log based on the at least one register value in each industrial control log; and determining the industrial control log whose second register address is the first register address corresponding to the gateway data address as the industrial control log associated with the database log.

[0063] For each of the at least one process number, the processor can determine the data acquisition gateway tag address corresponding to the process number, and can determine the corresponding gateway data address and the first register address corresponding to the gateway data address based on the data acquisition gateway tag address and the process number.

[0064] The processor can parse each of multiple industrial control logs to obtain at least one register value from each log. While parsing each log, the processor can parse the `s_modbus_reg_val` field in each log to obtain at least one register value. For each log, the processor can determine the address of a second register in the log based on at least one register value.

[0065] The processor can identify the industrial control log whose second register address corresponds to the first register address of the gateway data address as the industrial control log associated with the database log. The processor can then associate the industrial control log associated with the database log with the database log that is time-series related, thereby achieving the association between network logs, database logs, and industrial control logs.

[0066] Table 3 below illustrates one type of industrial control log.

[0067] Table 3

[0068]

[0069]

[0070] Table 4 below illustrates one type of data acquisition gateway label address.

[0071] Table 4

[0072]

[0073]

[0074] In this embodiment of the application, the method further includes: after associating the industrial control log with the database log, receiving a data tracing request, the data tracing request carrying the user account to be traced and any time period; obtaining the network log, database log and industrial control log corresponding to the user account to be traced and any time period; and tracing the data of the user account to be traced within any time period based on the obtained network log, database log and industrial control log.

[0075] After associating the industrial control logs with the database logs, the processor can receive data tracing requests. These requests carry the user account to be traced and any given time period. The processor can then retrieve the network logs, database logs, and industrial control logs corresponding to the user account and the given time period. Based on the retrieved network logs, database logs, and industrial control logs, the processor can perform data tracing for the user account within that given time period.

[0076] In this embodiment of the application, tracing the data of the user account to be traced within any time period based on the obtained network logs, database logs, and industrial control logs includes: determining the work order number, the corresponding process number, the gateway data address, and the location information of the gateway data address issued by the user account to be traced within any time period based on the obtained network logs, database logs, and industrial control logs, so as to complete the data tracing of the user account to be traced within any time period.

[0077] The processor can parse the network logs to obtain the work order number issued by the user account to be traced within any time period, parse the database logs to obtain the process number corresponding to the work order number, and parse the industrial control logs to obtain the register data address corresponding to the process number, as well as the point information of the register data address, so as to complete the data tracing of the user account to be traced within any time period.

[0078] In this embodiment of the application, the method further includes: displaying the user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the gateway data address corresponding to each process number, and the location information of the gateway data address.

[0079] The processor can display the user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the gateway data address corresponding to each process number, and the location information of the gateway data address, so as to provide a visual display of the business work orders issued by the user account to be traced within any time period.

[0080] For example, such as Figure 2 As shown, taking data traceability in the steel manufacturing scenario as an example, a schematic diagram of data traceability results is provided.

[0081] When tracing the data of the user account "zhangsan" over a certain period of time, the following steps are included:

[0082] Q1: The user account "zhangsan" created order number 1000000656 through the ERP system;

[0083] Q2: The ERP system sends order number 1000000656 to the MES system to generate work order number 1000000656;

[0084] Q3: The MES system is split into the corresponding process number 23541;

[0085] Q4: Work process number 23541 is re-associated with the data acquisition gateway address 192.168.1.3. Through the industrial control audit MODBUS protocol, the point information set in the work process is displayed in a unified manner.

[0086] Q5: Steel manufacturing is carried out according to the process number.

[0087] Table 5 shows the data address of the data acquisition gateway that is used to assist in the display of Q4, and Table 6 shows the data displayed by the intelligent manufacturing PLC.

[0088] Table 5

[0089]

[0090]

[0091] Table 6

[0092]

[0093] By using the above technical solutions to collect logs in a bypass manner, the intrusive deployment of business system modifications to the network environment can be reduced, maximizing the continuity and effectiveness of business data and ensuring network data security to the greatest extent. Data association between network audit logs and data audit logs achieves a three-layer association from the client to the web server layer and the database layer. Integration and association between industrial control logs and data audit logs realizes the association between network logs, database logs, and industrial control logs, forming a complete lifecycle monitoring and traceability system for the work order production process. This provides strong support for subsequent accountability for production problems and is beneficial for work order issuance and full-process monitoring and traceability in the industrial internet.

[0094] Figure 1 This is a flowchart illustrating a log processing method in one embodiment. It should be understood that, although... Figure 1The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise explicitly stated herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0095] In one embodiment, a log processing apparatus is provided, comprising:

[0096] The memory is configured to store instructions;

[0097] The processor is configured to retrieve instructions from memory and, when executing instructions, to implement the aforementioned log processing method.

[0098] In one embodiment, such as Figure 3 The diagram shows a log processing device. This device includes a data acquisition module A1, a data correlation analysis module A2, a data task creation module A3, and a data display module A4.

[0099] The data acquisition module A1 can collect data via mirroring, encompassing traffic from all databases, networks, and industrial control systems. It records all access and operation behaviors based on SQL syntax and semantic parsing, HTTP restoration, and industrial control protocol parsing technologies. The data acquisition module A1 can also collect log information in a bypass mode to reduce the intrusive deployment of business system modifications to the industrial internet environment, maximizing the continuity and effectiveness of business data. The collected logs include database auditing, network auditing (DLP), and industrial control auditing. Bypass deployment enables real-time monitoring and recording of database activity, network HTTP requests, and industrial control protocol auditing. Bypass deployment does not directly interfere with the normal operation of the main network or database; instead, it captures data packets through mirroring or traffic splitting, ensuring that the performance and stability of the original system are not affected.

[0100] The Data Association Analysis Module A2 can associate source IP, destination IP, time, and sent requests in database logs and network audit DLP logs (network logs). It also associates application accounts, web client operation IPs, client request network content, and database logs, forming a three-tiered association relationship between the client, web server, and database operations. The Module A2 can refine the associated request content through work order fields, achieving a complete chain of work order accounts operating the server via source IPs. Furthermore, the Module A2 can parse industrial control protocol logs to associate process numbers with task order numbers in data audit logs. Ultimately, it can link the actual workflow and related material information of this work order within the industrial control environment, realizing the association between the data acquisition gateway work order number and the process number.

[0101] The data task creation module A3 allows users to create traceability tasks via a web-based interface. Created traceability tasks can include information such as task name, order issuing account, order issuance start time, order issuance end time, and task remarks. The data display module A4 can display, according to the created traceability tasks, the order numbers created by the ERP system account within the task time period, the work order numbers issued to the MES system, the process numbers converted at the MES data acquisition gateway, and the actual operations for each process.

[0102] The above technical solution is applicable to general industrial internet business scenarios, such as steel manufacturing, textile processing, equipment manufacturing, metallurgy, and mining. The log source is deployed in a bypass mode, while data audit logs, network audit logs, and industrial control audit logs are collected using syslog. This non-intrusive reconstruction of the entire data flow process minimizes disruption to business operations by converting complete orders into work orders. This provides a complete display of changes in process and corresponding location information on the industrial control side. From a data security perspective, this comprehensive closed-loop process traceability for industrial control maximizes overall data security for the industrial internet, providing strong support for subsequent production problem accountability. The network audit and data audit logs are linked in three layers, achieving a three-layer association between the client, web server, and database layers. Multiple layers of association, including source and destination IP addresses, order numbers, accounts, and times, connect independent logs, improving the accuracy of log associations. In the MES system, the work order number and work order process number are associated through the data audit log, and then the industrial control audit log is integrated and associated with the data audit log, thereby realizing the real-time association of the work order number and process number through bypass packet capture. Then, the data address of the data acquisition gateway is used to associate the industrial control audit log to obtain the entire process of the industrial Internet production of the order and the final set point value.

[0103] In one embodiment, a storage medium is provided on which a program is stored, which, when executed by a processor, implements the above-described log processing method.

[0104] In one embodiment, a processor is provided for running a program, wherein the program executes the above-described log processing method during runtime.

[0105] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor A01, a network interface A02, memory (not shown), and a database (not shown) connected via a system bus. The processor A01 provides computing and control capabilities. The memory includes internal memory A03 and a non-volatile storage medium A04. The non-volatile storage medium A04 stores an operating system B01, a computer program B02, and a database (not shown). The internal memory A03 provides an environment for the operation of the operating system B01 and the computer program B02 stored in the non-volatile storage medium A04. The database stores data such as logs. The network interface A02 communicates with external terminals via a network connection. When the computer program B02 is executed by the processor A01, it implements a log processing method.

[0106] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0107] This application provides a device including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: acquiring network logs generated after any work order is issued via a bypass deployment mode; parsing the network logs to obtain the user account and user address of the user who issued the work order, the first work order number of the work order, and the creation time of the first work order; determining a database log that is temporally associated with the network logs based on the first work order number and the creation time of the first work order; associating the database logs with the network logs based on the user address, user account, and first work order number; parsing the database logs that are temporally associated with the network logs to obtain at least one process number corresponding to the first work order number; for each of the at least one process number, determining an industrial control log associated with the database logs based on the data acquisition gateway tag address corresponding to the process number; and associating the industrial control logs with the database logs.

[0108] In one embodiment, determining the database logs that are temporally associated with the network logs based on the first work order number and the first work order creation time includes: determining a time filtering interval for multiple database logs based on the first work order creation time; parsing each database log in the multiple database logs to obtain a second work order number and a second work order creation time for each database log; filtering out database logs whose second work order creation time falls within the time filtering interval and whose second work order number is the first work order number; and determining the filtered database logs as the database logs that are temporally associated with the network logs.

[0109] In one embodiment, the method further includes: parsing network logs to obtain the business webpage address for issuing any business work order and the event identifier of the WEB event associated with any business work order; and adding the business webpage address, event identifier, user account, and user address to a database log that is time-series associated with the network logs.

[0110] In one embodiment, determining the industrial control log associated with the database log based on the data acquisition gateway tag address corresponding to the at least one process number includes: determining the data acquisition gateway tag address corresponding to the process number for each process number; determining the corresponding gateway data address and the first register address corresponding to the gateway data address based on the data acquisition gateway tag address and the process number; parsing each industrial control log in the plurality of industrial control logs to obtain at least one register value in each industrial control log; determining the second register address of the industrial control log based on the at least one register value in each industrial control log; and determining the industrial control log whose second register address is the first register address corresponding to the gateway data address as the industrial control log associated with the database log.

[0111] In one embodiment, the method further includes: after associating the industrial control logs with the database logs, receiving a data tracing request, the data tracing request carrying the user account to be traced and any time period; obtaining the network logs, database logs and industrial control logs corresponding to the user account to be traced and any time period; and tracing the data of the user account to be traced within any time period based on the obtained network logs, database logs and industrial control logs.

[0112] In one embodiment, tracing the data of the user account to be traced within any time period based on the acquired network logs, database logs, and industrial control logs includes: determining the work order number, the corresponding process number, the corresponding register address, and the location information of the register address issued by the user account to be traced within any time period based on the acquired network logs, database logs, and industrial control logs, so as to complete the data tracing of the user account to be traced within any time period.

[0113] In one embodiment, the method further includes displaying the user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the register address corresponding to each process number, and the point information of the register address.

[0114] This application also provides a computer program product that, when executed on a data processing device, is adapted to execute a program that initializes the above-described log processing method steps.

[0115] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0116] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0117] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0118] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0119] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0120] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0121] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0122] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0123] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A log processing method, characterized in that, The method includes: Obtain network logs generated after any business work order is issued through bypass deployment mode; Parse the network logs to obtain the user account and user address that issued any of the business work orders, the first work order number of any of the business work orders, and the creation time of the first work order; The database logs that are time-series associated with the network logs are determined based on the first work order number and the first work order creation time; The database log is associated with the network log based on the user address, the user account, and the first work order number; Parse the database logs that are temporally associated with the network logs to obtain at least one process number corresponding to the first work order number; For each of the at least one process number, the industrial control log associated with the database log is determined based on the data acquisition gateway tag address corresponding to the process number; Associate the industrial control logs with the database logs.

2. The log processing method according to claim 1, characterized in that, The step of determining the database logs that are temporally associated with the network logs based on the first work order number and the first work order creation time includes: Determine the time filtering range for multiple database logs based on the creation time of the first work order; Parse each database log in the multiple database logs to obtain the second work order number and the second work order creation time for each database log; Filter out database logs where the creation time of the second work order falls within the time filtering range and the second work order number is the same as the first work order number; The filtered database logs are identified as those that are temporally associated with the network logs.

3. The log processing method according to claim 1, characterized in that, The method further includes: Parse the network logs to obtain the business webpage address that issued any of the business work orders and the event identifier of the WEB event associated with any of the business work orders; Add the business webpage address, event identifier, user account, and user address to the database log that is time-series associated with the network log.

4. The log processing method according to claim 1, characterized in that, The step of determining the industrial control log associated with the database log based on the data acquisition gateway tag address corresponding to the at least one process number includes: For each of the at least one process number, determine the data acquisition gateway tag address corresponding to the process number; The corresponding gateway data address and the first register address corresponding to the gateway data address are determined based on the data acquisition gateway tag address and the process number. Parse each industrial control log from multiple industrial control logs to obtain at least one register value in each industrial control log; For each industrial control log, determine the address of the second register of the industrial control log based on at least one register value in the industrial control log; The industrial control log whose second register address corresponds to the first register address of the gateway data address is identified as the industrial control log associated with the database log.

5. The log processing method according to claim 1, characterized in that, The method further includes: After associating the industrial control log with the database log, a data tracing request is received, which carries the user account to be traced and any time period. Obtain network logs, database logs, and industrial control logs corresponding to the user account to be traced and any time period; The data of the user account to be traced is traced within any time period based on the obtained network logs, database logs, and industrial control logs.

6. The log processing method according to claim 5, characterized in that, The step of tracing the data of the user account to be traced within any time period based on the obtained network logs, database logs, and industrial control logs includes: Based on the obtained network logs, database logs, and industrial control logs, determine the work order number, the corresponding process number, the corresponding register address, and the location information of the register address issued by the user account to be traced within any time period, so as to complete the data tracing of the user account to be traced within any time period.

7. The log processing method according to claim 6, characterized in that, The method further includes: The user account, the work order number issued by the user account within any time period, at least one process number corresponding to the work order number, the register address corresponding to each process number, and the point information of the register address are displayed.

8. A log processing device, characterized in that, The device includes: The memory is configured to store instructions; A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the log processing method according to any one of claims 1 to 7.

9. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform the log processing method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the log processing method according to any one of claims 1 to 7.

Images