System log processing method and device, readable storage medium and electronic equipment

Abstract

The invention provides a system log processing method and device, a readable storage medium and electronic equipment. The method comprises the steps that address information of a code of a log recording function in a system source code in the system source code is determined according to a compiled code, parameters in the log recording function comprise an identifier and a feature value, the identifier is used for identifying a class of objects, and the feature value is a feature parameter identifying a certain object in the class of objects; the compiled code is obtained by compiling a system source code; storing the address information and the characteristic value in a system log file; and generating a problem pointing file according to the system log file and the mapping relation file, so as to position the vulnerability in the system source code by adopting the problem pointing file. Problem positioning is achieved through logs under the condition that system source codes are not changed, and the space of the system log file is saved by storing the address information and the feature values which occupy small space in the system log file. The method is especially suitable for an embedded system.

Description

Technical Field

[0001] The present application relates to the field of system log processing, and in particular, to a system log processing method, device, computer-readable storage medium and electronic device. Background Art

[0002] Various problems may occur during system operation. In order to restore the system operation process and locate the cause of the problem, we need to record relevant information in real time during system operation. This information is generally transmitted to the host computer through the network or internal communication, and stored in the file system in the form of files. These files are generally called log files. Developers use the relevant information in the log files to analyze and locate the cause of the problem.

[0003] The log processing method in the prior art is: use a log dotting tool to scan all source codes before compilation, and replace the log records with a dotting information file including a log ID and a formatted string, and locate the problem based on the dotting information file. However, this method requires modifying the source code. Summary of the invention

[0004] The main purpose of the present application is to provide a system log processing method, device, computer-readable storage medium and electronic device, so as to at least solve the problem that source code needs to be modified when using logs to locate problems.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a system log processing method is provided, comprising: determining the address information of the code of a logging function in a system source code in the system source code according to a compiled code, the parameters in the logging function including an identifier and a characteristic value, the identifier being used to identify a class of objects, the characteristic value being a characteristic parameter identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code; storing the address information and the characteristic value in a system log file; generating a problem pointing file according to the system log file and a mapping relationship file, so as to locate the vulnerability in the system source code using the problem pointing file, wherein the problem pointing file includes the identifier and the characteristic value, and the mapping relationship file represents the relationship between the address information and the identifier.

[0006] Optionally, determining address information of the code of a logging function in a system source code based on the compiled code includes: obtaining compilation address information of a target compiled code in the compiled code corresponding to the code of the logging function; and determining address information of the code of the logging function in the system source code based on the compilation address information.

[0007] Optionally, a problem pointing file is generated based on the system log file and the mapping relationship file, including: extracting target address information and target feature value from the system log file; determining a target identifier corresponding to the target address information based on the target address information and the mapping relationship file; and generating the problem pointing file including the target identifier and the target feature value.

[0008] Optionally, generating the question pointing file including the target identifier and the target feature value includes: determining a distribution rule, the distribution rule indicating a positional relationship between the target identifier and the target feature value and a segmentation identifier between the target identifier and the target feature value; and generating the question pointing file including the target identifier and the target feature value based on the distribution rule.

[0009] Optionally, extracting the target address information and the target feature value from the system log file includes: using a log parsing toolkit to parse the system log file to obtain the target address information and the target feature value; and / or determining the target identifier corresponding to the target address information based on the target address information and the mapping relationship file, including: using the log parsing toolkit to parse the mapping relationship file based on the target address information to obtain the target identifier corresponding to the target address information.

[0010] Optionally, a log parsing toolkit is used to parse the system log file to obtain the target address information and the target feature value, including: using the log parsing toolkit to parse the system log file to obtain the starting element and the ending element of the target address information, and obtain the starting element and the ending element of the target feature value; extracting the target address information from the system log file according to the starting element and the ending element of the target address information; extracting the target feature value from the system log file according to the starting element and the ending element of the target feature value.

[0011] Optionally, before generating a problem pointing file based on the system log file and the mapping relationship file, the method further includes: constructing a log dotting toolkit; using the log dotting toolkit to scan the compiled code to obtain the mapping relationship file; and / or, after obtaining the compiled code after the system source code is compiled, the method further includes: storing feature information in the compiled code in a preset register, the feature information including at least one of the following: information for indicating a position, information for indicating a pointer, and information for indicating a calculation result.

[0012] According to another aspect of the present application, a system log processing device is provided, comprising: a determination unit, configured to determine address information of a code of a logging function in a system source code in the system source code according to a compiled code, wherein parameters in the logging function include an identifier and a characteristic value, wherein the identifier is used to identify a class of objects, and the characteristic value is a characteristic parameter identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code; a first storage unit, configured to store the address information and the characteristic value in a system log file; a generation unit, configured to generate a problem pointing file according to the system log file and a mapping relationship file, so as to locate the vulnerability in the system source code by using the problem pointing file, wherein the problem pointing file includes the identifier and the characteristic value, and the mapping relationship file represents the relationship between the address information and the identifier.

[0013] According to another aspect of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute any one of the system log processing methods.

[0014] According to another aspect of the present application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing any one of the system log processing methods.

[0015] By applying the technical solution of the present application, the address information of the code of the logging function in the system source code is determined according to the compiled code, and then the address information and the characteristic value are stored in the system log file. Finally, a problem pointing file is generated according to the system log file and the mapping relationship file, so as to locate the vulnerability in the system source code by using the problem pointing file. The problem location is realized by using the log without changing the source code, and the space of the system log file is saved by storing the address information and characteristic value which takes up less space in the system log file. It is particularly suitable for embedded systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1A hardware structure block diagram of a mobile terminal for executing a system log processing method provided in an embodiment of the present application is shown;

[0018] Figure 2 A schematic diagram of a process flow of a system log processing method provided according to an embodiment of the present application is shown;

[0019] Figure 3 A flow chart of a method for determining address information provided according to an embodiment of the present application is shown;

[0020] Figure 4 A flow chart of a method for generating a question pointing file provided according to an embodiment of the present application is shown;

[0021] Figure 5 A flowchart of a specific method for generating a question pointing file provided according to an embodiment of the present application is shown;

[0022] Figure 6 A structural block diagram of a system log processing device provided according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0023] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0027] System log files: Files that record system logs, which are used to record information about hardware, software, and system problems in the system, and can also monitor events that occur in the system. Users can use system log files to check the cause of errors or find traces left by attackers when attacked. System logs include system logs, application logs, and security logs.

[0028] As introduced in the background technology, the prior art requires modifying the source code when using logs to locate problems. To solve the problem that the source code needs to be modified when using logs to locate problems, the embodiments of the present application provide a system log processing method, device, computer-readable storage medium and electronic device.

[0029] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0030] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a system log processing method according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is for illustration only and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0031] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the display method of device information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0032] In this embodiment, a system log processing method running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] Figure 2 1 is a flow chart of a system log processing method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0034] Step S201, determining the address information of the code of the logging function in the system source code according to the compiled code, wherein the parameters in the logging function include an identifier and a characteristic value, wherein the identifier is used to identify a class of objects, and the characteristic value is a characteristic parameter for identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code;

[0035] Specifically, the system in this application can be a common program running system or an embedded system;

[0036] The system source code may be a code written in C language, a code written in Java language, a code written in C++ language, a code written in Python language, a code written in assembly language, etc. The system source code is compiled by a compiler to obtain a language understandable by a machine, such as a binary language. Of course, it may also be other languages ​​understandable by a machine, i.e., compiled codes.

[0037] For example, the log recording function is Log("cell id:",3);, where "cell id" refers to the cell number, which is applicable to the communication field, and 3 refers to the cell number 3. For example, the log recording function is Log("vehicleid:",0001);, where "vehicle id" refers to the vehicle number, and 0001 refers to the vehicle number 0001. "Cell id" and "vehicle id" are identifiers, which are specifically used to identify a class of objects. "3" and "0001" are characteristic values ​​that specifically identify the characteristic parameters of an object in a class of objects. Log("cell id:",3) and Log("vehicle id:",0001) uniquely specify an object. ("cell id:",3) specifies the cell with cell number 3; ("vehicle id:",0001) specifies the vehicle with vehicle number 0001.

[0038] Specifically, the binary language obtained after compiling the system source code with a compiler records the compilation results of all code lines in the system source code, and the address information of the code lines in the system source code in the above system source code is determined according to the compilation results. There is no need to modify the source code, which saves the step of modifying the source code and the need to store the modified source code, thereby improving the efficiency of problem locating.

[0039] Step S202, storing the address information and the feature value in a system log file;

[0040] Generally speaking, the address information and the above-mentioned characteristic values ​​are both small files and do not occupy a large storage space. Therefore, storing the address information and characteristic values ​​in the system log file will not cause incomplete storage due to the small space of the system log file. The identifier is generally a large file. Compared with the solution of directly storing the characteristic value and the identifier, this solution saves the space of the system log file.

[0041] Specifically, the address information and the above-mentioned characteristic values ​​corresponding to the code lines can be stored in the system log file according to the position order of the code lines, or the address information and the above-mentioned characteristic values ​​corresponding to the code lines can be stored in the system log file according to the compilation order of the code lines. It can be adjusted according to actual needs, and the address information and the above-mentioned characteristic values ​​can be stored in pairs in the system position. Specifically, an array can be used to store a group of address information and the above-mentioned characteristic values.

[0042] Step S203, generating a problem pointing file according to the system log file and the mapping relationship file, so as to locate the vulnerability in the system source code by using the problem pointing file, wherein the problem pointing file includes the identifier and the feature value, and the mapping relationship file represents the relationship between the address information and the identifier.

[0043] In some cases, the problem pointing file consists of an identifier and a characteristic value;

[0044] Specifically, the mapping relationship file can be expressed in the form shown in Table 1:

[0045] Table 1 Mapping relationship file table

[0046]

[0047]

[0048] That is to say, by constructing a mapping relationship between the address information and the above identifier, and then generating a problem pointing file based on the mapping relationship and the system log file, the problem pointing file actually includes the identifier and the above feature value to achieve accurate positioning of the problem.

[0049] The system log processing method of the present application first determines the address information of the code of the log recording function in the system source code according to the compiled code, then stores the address information and characteristic values ​​in the system log file, and finally generates a problem pointing file according to the above system log file and the mapping relationship file, so as to locate the vulnerability in the above system source code by using the above problem pointing file. The problem location is realized by using the log without changing the source code, and the space of the system log file is saved by storing the address information and characteristic values ​​which occupy a small space in the system log file. It is particularly suitable for embedded systems.

[0050] To achieve accurate determination of address information, in some implementations, such as Figure 3 As shown, step S201, determining the address information of the code of the logging function in the system source code in the system source code according to the compiled code, can be implemented as follows:

[0051] Step S2011, obtaining the compilation address information of the target compiled code corresponding to the code of the logging function in the compiled code;

[0052] Specifically, the compilation address information of the target compiled code in the above compiled code may be marked in the compiled code; of course, the compilation address information of the target compiled code in the above compiled code may also be stored in a file associated with the compiled code;

[0053] Step S2012: determining the address information of the code of the logging function in the system source code according to the compilation address information.

[0054] For example, the compilation address information of the target compiled code in the above compiled code is line 100. According to the line correspondence between the compiled code and the source code, the address information of the corresponding code in the above system source code is determined to be line 96, line 92, and line 88. Line 96 means that the address of the code of the corresponding logging function in the system source code differs by four lines from the compilation address of the target compiled code in the compiled code.

[0055] For example, the compilation address information of a compiled code in the above compiled code is XXX, and the system is a 32-bit system. It can be determined that the address information of the corresponding log recording function code in the above system source code is XXX-4 bytes; the compilation address information of a compiled code in the above compiled code is YYY, and the system is a 64-bit system. It can be determined that the address information of the corresponding log recording function code in the above system source code is YYY-8 bytes.

[0056] This solution obtains the compilation address information of the target compilation code corresponding to the code of the logging function in the compiled code, and then determines the address information of the code of the logging function in the above system source code based on the above compilation address information, thereby realizing the accurate determination of the address information of the code of the logging function in the above system source code based on the compiled code.

[0057] More specifically, Figure 4 As shown, step S203, generating a problem pointing file according to the above system log file and the mapping relationship file, includes:

[0058] Step S2031, extracting target address information and target feature value from the above system log file;

[0059] Since multiple sets of address information and feature values ​​are stored in the system log file in advance, it is convenient to extract the target address information and target feature values ​​from the multiple sets of address information and feature values ​​when locating the problem later;

[0060] Step S2032, determining a target identifier corresponding to the target address information according to the target address information and the mapping relationship file;

[0061] Since the mapping relationship between the target address information and the target identifier is stored in the mapping relationship file, the target identifier corresponding to the target address information can be quickly determined based on the target address information and the mapping relationship file;

[0062] Step S2033: Generate a problem pointing file including a target identifier and a target feature value. That is, the problem pointing file may include other information in addition to the target identifier and the target feature value.

[0063] In some schemes, the problem pointing file consists of a target identifier and a target feature value.

[0064] The determined target identifier and the target feature value extracted from the system log file are combined to obtain a problem pointing file that can be used for rapid problem location.

[0065] To further generate problem pointing files, some solutions, such as Figure 5 As shown, step S2033 generates a problem pointing file including a target identifier and a target feature value, including:

[0066] Step S20331, determining a distribution rule, wherein the distribution rule indicates a positional relationship between the target identifier and the target feature value and a segmentation mark between the target identifier and the target feature value;

[0067] For example, the target identifier and the target feature value are arranged in a row, wherein the target identifier is in front, or the target feature value is in front; a semicolon, a colon, or the like are used to distinguish the target identifier and the target feature value, for example: cellid:3;

[0068] For example, the target identifier and the target feature value are arranged in a column, wherein the target identifier is in the first row, or the target feature value is in the second row;

[0069] Step S20332: Generate a question pointing file including a target identifier and a target feature value based on the distribution rule.

[0070] In some schemes, the target identifier and the target feature value are combined based on the distribution rule to obtain the problem pointing file, that is, the target identifier and the target feature value are combined using the selected distribution rule to obtain the problem pointing file, which is convenient for users to locate the problem.

[0071] In some more specific schemes, step S2031, extracting the target address information and the target characteristic value from the system log file, includes: using a log parsing toolkit to parse the system log file to obtain the target address information and the target characteristic value; step S2032, determining the target identifier corresponding to the target address information according to the target address information and the mapping relationship file, includes: using the log parsing toolkit to parse the mapping relationship file based on the target address information to obtain the target identifier corresponding to the target address information. That is, a log parsing toolkit is created to implement the parsing of the system log file and the mapping relationship file.

[0072] Specifically, a common construction toolkit method may be adopted, for example, the tools Ant, Maven and Gradle in Java may be used to create a log parsing toolkit;

[0073] Specifically, since the log parsing toolkit has a parsing function and is integrated with a parsing function, the log parsing toolkit can be used to parse the system log file and the mapping relationship file;

[0074] Furthermore, in order to obtain the target address information and the target feature value, a log parsing toolkit is used to parse the system log file to obtain the target address information and the target feature value, including:

[0075] The system log file is parsed using the log parsing toolkit to obtain the starting element and the ending element of the target address information, and the starting element and the ending element of the target feature value;

[0076] Specifically, the format of the target address information stored in the system log file is different from the format of the target feature value, so the target address information and the target feature value can be extracted according to the different formats;

[0077] In addition, when the target address information and the target characteristic value are stored in groups in the system log file, a separator can be set between the two; based on the separator, the starting element and the ending element of the target address information and the starting element and the ending element of the target characteristic value can be quickly located;

[0078] Extracting the target address information from the system log file according to the start element and the end element of the target address information;

[0079] The target feature value is extracted from the system log file according to the starting element and the ending element of the target feature value.

[0080] That is to say, the extraction of the system log file and the target characteristic value is realized based on the starting element and the ending element, so as to prevent the omission of information and ensure the complete extraction of the information of the system log file and the target characteristic value.

[0081] In some optional embodiments, in order to obtain the mapping relationship file before generating the problem pointing file according to the system log file and the mapping relationship file, the method further includes:

[0082] Build a log management toolkit;

[0083] Scan the compiled code using the log management toolkit to obtain the mapping relationship file.

[0084] Specifically, the compiled code is scanned with a log management toolkit to obtain an identifier, and then the address information of the code of the logging function in the system source code that has been determined before is retrieved in the system source code, thereby generating a mapping relationship file.

[0085] Specifically, a common build toolkit method may be used, for example, the Java tools Ant, Maven, and Gradle may be used to create a log management toolkit;

[0086] In some optional embodiments, the method further includes: storing the characteristic information in the compiled code in a preset register, the characteristic information including at least one of the following: information indicating a position, information indicating a pointer, and information indicating a calculation result. Then, the address information of the code line in the system source code can be determined in the system source code according to the characteristic information (information indicating a position) stored in the register.

[0087] The existing solutions generally adopt the following methods to locate the problem:

[0088] Taking the recording of "cellid:3" as an example, the system generally completes it through the following pseudo code:

[0089] Log("cell id:",3);

[0090] In order not to record the "cell id:" information, the general approach is to develop a logging tool. The logging tool scans all source code before version compilation and replaces the logging code with the following form:

[0091] Log_B(LOG_ID_1,3); that is, the existing solution needs to parse the source code and modify the source code, while the solution of this application parses the compiled code without modifying the source code;

[0092] LOG_ID_1 is the log ID, which is globally encoded by the log management tool. Each place where a log is recorded is assigned an ID. The log management tool will eventually generate a management information file, which contains Table 2:

[0093] Table 2 Dot information file table

[0094] Log ID Formatting Strings LOG_ID_1 "cell id:" … …

[0095] Only two pieces of information, LOG_ID_1 and 3, are recorded in the log file. However, this solution stores the address information (i.e., address information) and the characteristic value in the system log file, which saves space and can find the corresponding identifier based on the address information;

[0096] At the same time, a matching log parsing tool is developed. The log parsing tool can parse log files and matching dot information files, and can find the formatted log string corresponding to a log ID through the dot information file, so that LOG_ID_1 and 3 can be restored to the form of "cellid:3" and presented to the problem location personnel. The solution of this application restores addr1 and 3 to the form of "cellid:3" and presents it to the problem location personnel. Problem location is also achieved.

[0097] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the system log processing method of the present application will be described in detail below in conjunction with specific embodiments.

[0098] This embodiment relates to a specific system log processing method, including the following steps:

[0099] Step S1: determining the address information of the code of the log recording function in the system source code according to the compiled code;

[0100] Step S2: storing the address information and feature value in a system log file;

[0101] Step S3: extracting target address information and target feature value from the system log file;

[0102] Step S4: determining a target identifier corresponding to the target address information according to the target address information and the mapping relationship file;

[0103] Step S5: Combine the target identifier and the target feature value to obtain a problem pointing file.

[0104] This embodiment implements problem location using logs without changing the source code, and saves space in the system log file by storing the address information and the above-mentioned characteristic values ​​which occupy a relatively small space. It is particularly suitable for embedded systems.

[0105] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0106] The embodiment of the present application also provides a system log processing device. It should be noted that the system log processing device of the embodiment of the present application can be used to execute the system log processing method provided by the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions thereof will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0107] The following is an introduction to the system log processing device provided in an embodiment of the present application.

[0108] Figure 6 Schematic diagram of a system log processing device according to an embodiment of the present application. Figure 6 As shown, the device comprises:

[0109] The determining unit 61 determines address information of the code of the logging function in the system source code according to the compiled code, wherein the parameters in the logging function include an identifier and a characteristic value, wherein the identifier is used to identify a class of objects, and the characteristic value is a characteristic parameter for identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code;

[0110] A first storage unit 62 is configured to store the address information and the characteristic value in a system log file;

[0111] The generation unit 63 is configured to generate a problem pointing file based on the above-mentioned system log file and the mapping relationship file, so as to locate the vulnerability in the above-mentioned system source code using the above-mentioned problem pointing file, wherein the above-mentioned problem pointing file includes the above-mentioned identifier and the above-mentioned feature value, and the above-mentioned mapping relationship file represents the relationship between the above-mentioned address information and the above-mentioned identifier.

[0112] The system log processing device of the present application has a determination unit that determines the address information of the code line in the system source code in the above system source code according to the compiled code, the first storage unit stores the above address information and the above characteristic value in the system log file, and the generation unit generates a problem pointing file according to the above system log file and the mapping relationship file, so as to locate the vulnerability in the above system source code using the above problem pointing file. The problem location is realized by using logs without changing the source code, and the space of the system log file is saved by storing the address information and the above characteristic value in the system log file which occupy a smaller space. It is particularly suitable for embedded systems.

[0113] To achieve accurate determination of the address information, in some implementations, the determination unit includes an acquisition module and a first determination module.

[0114] The acquisition module is configured to acquire the compilation address information of the target compiled code corresponding to the code of the logging function in the compiled code; the first determination module is configured to determine the address information of the code of the logging function in the system source code according to the compilation address information.

[0115] This solution obtains the compilation address information of the compiled code line corresponding to the above code line in the above compiled code, and then determines the address information of the above code line in the above system source code based on the above compilation address information, thereby realizing accurate determination of the address information of the code line in the above system source code based on the compiled code.

[0116] In some embodiments, the generating unit includes an extracting module, a second determining module and a combining module.

[0117] The extraction module is configured to extract target address information and target feature values ​​from the above system log file;

[0118] The second determination module is configured to determine a target identifier corresponding to the target address information according to the target address information and the mapping relationship file;

[0119] The generation module is configured to generate a problem pointing file including a target identifier and a target feature value. That is, the problem pointing file may include other information in addition to the target identifier and the target feature value.

[0120] In some schemes, the problem pointing file consists of a target identifier and a target feature value.

[0121] The determined target identifier and the target feature value extracted from the system log file are combined to obtain a problem pointing file that can be used for rapid problem location.

[0122] In order to further generate the problem pointing file, in some schemes, the generation module includes a determination submodule and a generation submodule.

[0123] The determination submodule is configured to determine a distribution rule, wherein the distribution rule indicates a positional relationship between the target identifier and the target feature value and a segmentation identifier between the target identifier and the target feature value;

[0124] The combination submodule is configured to generate a problem pointing file including a target identifier and a target feature value based on the distribution rule.

[0125] In some schemes, the target identifier and the target feature value are combined based on the distribution rule to obtain the problem pointing file, that is, the target identifier and the target feature value are combined using the selected distribution rule to obtain the problem pointing file, which is convenient for users to locate the problem.

[0126] In some embodiments, the extraction module includes a first parsing submodule, which is configured to parse the system log file using a log parsing toolkit to obtain the target address information and the target feature value; the second determination module includes a second parsing submodule, which is configured to parse the mapping relationship file based on the target address information using the log parsing toolkit to obtain the target identifier corresponding to the target address information. That is, a log parsing toolkit is created to implement the parsing of the system log file and the mapping relationship file.

[0127] Furthermore, in order to obtain the target address information and the target feature value, the first parsing submodule includes a third parsing submodule, a first extraction submodule and a second extraction submodule.

[0128] The third parsing submodule is configured to parse the system log file using the log parsing toolkit to obtain the starting element and the ending element of the target address information, and obtain the starting element and the ending element of the target feature value;

[0129] The first extraction submodule is configured to extract the target address information from the system log file according to the start element and the end element of the target address information;

[0130] The second extraction submodule is configured to extract the target feature value from the system log file according to the start element and the end element of the target feature value.

[0131] That is to say, the extraction of the system log file and the target characteristic value is realized based on the starting element and the ending element, so as to prevent the omission of information and ensure the complete extraction of the information of the system log file and the target characteristic value.

[0132] In some optional embodiments, in order to obtain the mapping relationship file, the above device further includes a construction unit and a scanning unit, and / or a second storage unit.

[0133] The construction unit is configured to construct a log management toolkit before generating a problem pointing file according to the system log file and the mapping relationship file;

[0134] The scanning unit is configured to use the above-mentioned log dotting toolkit to scan the above-mentioned compiled code to obtain the above-mentioned mapping relationship file; specifically, by using the log dotting toolkit to scan the above-mentioned compiled code, an identifier can be obtained, and then the address information of the code line in the system source code that has been previously determined in the system source code can be retrieved, and then the mapping relationship file can be generated.

[0135] The second storage unit is configured to store characteristic information in the compiled code in a preset register after obtaining the compiled code of the system source code, wherein the characteristic information includes at least one of the following: information indicating a position, information indicating a pointer, and information indicating a calculation result. Then, the address information of the code line in the system source code can be determined according to the characteristic information (information indicating a position) stored in the register.

[0136] The system log processing device includes a processor and a memory. The determination unit, the first storage unit, the generation unit, etc. are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The modules are all located in the same processor; or, the modules are located in different processors in any combination.

[0137] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and the problem can be located without changing the source code by adjusting the kernel parameters.

[0138] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0139] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is running, a device where the computer-readable storage medium is located is controlled to execute a system log processing method.

[0140] Specifically, the system log processing method includes:

[0141] Step S201, determining the address information of the code of the logging function in the system source code according to the compiled code, wherein the parameters in the logging function include an identifier and a characteristic value, wherein the identifier is used to identify a class of objects, and the characteristic value is a characteristic parameter for identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code;

[0142] Step S202, storing the address information and the feature value in a system log file;

[0143] Step S203, generating a problem pointing file according to the system log file and the mapping relationship file, so as to locate the vulnerability in the system source code by using the problem pointing file, wherein the problem pointing file includes the identifier and the feature value, and the mapping relationship file represents the relationship between the address information and the identifier.

[0144] Optionally, determining address information of the code of the logging function in the system source code based on the compiled code includes: obtaining compilation address information of the target compiled code in the compiled code corresponding to the code of the logging function; and determining address information of the code of the logging function in the system source code based on the compilation address information.

[0145] Optionally, a problem pointing file is generated based on a system log file and a mapping relationship file, including: extracting target address information and target feature values ​​from the system log file; determining a target identifier corresponding to the target address information based on the target address information and the mapping relationship file; and generating a problem pointing file including a target identifier and a target feature value.

[0146] Optionally, generating a question pointing file including a target identifier and a target feature value includes: determining a distribution rule, the distribution rule indicating a positional relationship between the target identifier and the target feature value and a segmentation identifier between the target identifier and the target feature value; generating a question pointing file including the target identifier and the target feature value based on the distribution rule.

[0147] Optionally, extracting target address information and target feature values ​​from a system log file includes: using a log parsing toolkit to parse the system log file to obtain the target address information and target feature values; and / or determining a target identifier corresponding to the target address information based on the target address information and a mapping relationship file, including: using a log parsing toolkit to parse the mapping relationship file based on the target address information to obtain a target identifier corresponding to the target address information.

[0148] Optionally, a log parsing toolkit is used to parse the system log file to obtain target address information and target feature values, including: using the log parsing toolkit to parse the system log file to obtain the starting element and ending element of the target address information, and obtain the starting element and ending element of the target feature value; extracting the target address information from the system log file according to the starting element and ending element of the target address information; extracting the target feature value from the system log file according to the starting element and ending element of the target feature value.

[0149] Optionally, before generating a problem pointing file based on the system log file and the mapping relationship file, the method also includes: building a log dotting toolkit; using the log dotting toolkit to scan the compiled code to obtain the mapping relationship file; and / or, after obtaining the compiled code after the system source code is compiled, the method also includes: storing feature information in the compiled code in a preset register, the feature information including at least one of the following: information for indicating a position, information for indicating a pointer, and information for indicating a calculation result.

[0150] An embodiment of the present invention provides a processor, which is used to run a program, wherein a system log processing method is executed when the program is running.

[0151] Specifically, the system log processing method includes:

[0152] Step S201, determining the address information of the code of the logging function in the system source code according to the compiled code, wherein the parameters in the logging function include an identifier and a characteristic value, wherein the identifier is used to identify a class of objects, and the characteristic value is a characteristic parameter for identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code;

[0153] Step S202, storing the address information and the feature value in a system log file;

[0154] Step S203, generating a problem pointing file according to the system log file and the mapping relationship file, so as to locate the vulnerability in the system source code by using the problem pointing file, wherein the problem pointing file includes the identifier and the feature value, and the mapping relationship file represents the relationship between the address information and the identifier.

[0155] The present application also provides an electronic device, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing a system log processing method. The device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0156] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0157] Step S201, determining the address information of the code of the logging function in the system source code according to the compiled code, wherein the parameters in the logging function include an identifier and a characteristic value, wherein the identifier is used to identify a class of objects, and the characteristic value is a characteristic parameter for identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code;

[0158] Step S202, storing the address information and the feature value in a system log file;

[0159] Step S203, generating a problem pointing file according to the system log file and the mapping relationship file, so as to locate the vulnerability in the system source code by using the problem pointing file, wherein the problem pointing file includes the identifier and the feature value, and the mapping relationship file represents the relationship between the address information and the identifier.

[0160] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0161] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0162] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0163] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0164] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0165] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0166] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0167] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0168] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0169] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0170] 1) The system log processing method of the present application first determines the address information of the code of the log recording function in the system source code according to the compiled code, then stores the address information and characteristic values ​​in the system log file, and finally generates a problem pointing file according to the above system log file and the mapping relationship file, so as to locate the vulnerability in the above system source code using the above problem pointing file. The problem location is realized by using logs without changing the source code, and the space of the system log file is saved by storing the address information and characteristic values ​​that occupy a small space in the system log file. It is especially suitable for embedded systems.

[0171] 2) In the system log processing device of the present application, the determination unit determines the address information of the code line in the system source code in the above system source code according to the compiled code, the first storage unit stores the above address information and the above characteristic value in the system log file, and the generation unit generates a problem pointing file according to the above system log file and the mapping relationship file, so as to locate the vulnerability in the above system source code by using the above problem pointing file. The problem location is realized by using logs without changing the source code, and the space of the system log file is saved by storing the address information and the above characteristic value which occupy a smaller space in the system log file. It is especially suitable for embedded systems.

[0172] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A system log processing method, characterized in that: include: Determine address information of a code of a logging function in a system source code in the system source code according to the compiled code, wherein the parameters in the logging function include an identifier and a characteristic value, wherein the identifier is used to identify a class of objects, and the characteristic value is a characteristic parameter for identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code; storing the address information and the characteristic value in a system log file; A problem pointing file is generated according to the system log file and the mapping relationship file, so as to locate the vulnerability in the system source code by using the problem pointing file, wherein the problem pointing file includes the identifier and the feature value, and the mapping relationship file represents the relationship between the address information and the identifier.

2. The method according to claim 1, characterized in that: Determining address information of a code of a logging function in a system source code in the system source code according to the compiled code includes: Obtain compilation address information of the target compiled code corresponding to the code of the logging function in the compiled code; The address information of the code of the logging function in the system source code is determined according to the compilation address information.

3. The method according to claim 1, characterized in that Generate a problem pointing file according to the system log file and the mapping relationship file, including: Extracting target address information and target feature values ​​from the system log file; Determine a target identifier corresponding to the target address information according to the target address information and the mapping relationship file; The problem pointing file including the target identifier and the target feature value is generated.

4. The method according to claim 3, characterized in that Generating the problem pointing file including the target identifier and the target feature value comprises: Determining a distribution rule, wherein the distribution rule indicates a positional relationship between the target identifier and the target feature value and a segmentation identifier between the target identifier and the target feature value; The question pointing file including the target identifier and the target feature value is generated based on the distribution rule.

5. The method according to claim 3, characterized in that: Extracting target address information and target feature values ​​from the system log file includes: Parsing the system log file using a log parsing toolkit to obtain the target address information and the target feature value; and / or, Determining a target identifier corresponding to the target address information according to the target address information and the mapping relationship file includes: The log parsing toolkit is used to parse the mapping relationship file based on the target address information to obtain the target identifier corresponding to the target address information.

6. The method according to claim 5, characterized in that The system log file is parsed using a log parsing toolkit to obtain the target address information and the target feature value, including: The system log file is parsed using the log parsing toolkit to obtain the starting element and the ending element of the target address information, and the starting element and the ending element of the target feature value; Extracting the target address information from the system log file according to the start element and the end element of the target address information; The target feature value is extracted from the system log file according to the start element and the end element of the target feature value.

7. The method according to claim 1, characterized in that Before generating a problem pointing file according to the system log file and the mapping relationship file, the method further includes: Build a log management toolkit; Scanning the compiled code using the log management toolkit to obtain the mapping relationship file; and / or, After obtaining the compiled code of the system source code after being compiled, the method further includes: The characteristic information in the compiled code is stored in a preset register, wherein the characteristic information includes at least one of the following: information for indicating a position, information for indicating a pointer, and information for indicating a calculation result.

8. A system log processing device, characterized in that: include: a determining unit configured to determine address information of a code of a logging function in a system source code in the system source code according to a compiled code, wherein a parameter in the logging function includes an identifier and a characteristic value, wherein the identifier is used to identify a class of objects, and the characteristic value is a characteristic parameter for identifying a certain object in the class of objects, wherein the compiled code is obtained after compiling the system source code; A first storage unit is configured to store the address information and the characteristic value in a system log file; A generation unit is configured to generate a problem pointing file based on the system log file and the mapping relationship file, so as to locate the vulnerability in the system source code using the problem pointing file, wherein the problem pointing file includes the identifier and the feature value, and the mapping relationship file represents the relationship between the address information and the identifier.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the system log processing method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing the system log processing method described in any one of claims 1 to 7.

Images