Service interruption evaluation method and device based on log

Abstract

The invention discloses a log-based service interruption evaluation method and device. The method comprises the following steps: acquiring a first log file; acquiring at least one item of first interrupt information based on the first log file, wherein the first interrupt information comprises a first interrupt duration and a first interrupt sequence; based on a product of the first interruption duration and a first attenuation weight, determining an accumulative weighted interruption duration, the first attenuation weight being inversely proportional to the first interruption order; and service interruption evaluation is carried out based on the accumulated weighted interruption duration. By adopting the method, the frequency sensitivity of the high-frequency short-time interruption scene and the single-time long interruption scene is distinguished based on the attenuation weight, and the refined quantitative evaluation of different interruption modes is realized. And on the basis of the design of the attenuation weight, a user can adjust the sensitivity of the accumulated interruption duration to the interruption frequency by adjusting the attenuation rate of the attenuation weight on the basis of specific requirements, and the diversified interruption mode detection requirements of the distributed system are met.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a log-based service interruption assessment method and device. Background Art

[0002] With the rapid development of information technology and the popularization of the Internet, users have increasingly higher requirements for the stability and security of system services. Among them, log detection is crucial to ensuring system stability, security and performance.

[0003] Understanding the system's operating status, especially any interruptions, helps identify network issues promptly for timely response and schedule maintenance activities such as updates, backups, and system optimization, which typically need to be performed after the system is stable. Generally, electronic devices identify interruption events by determining whether the interruption duration exceeds a threshold. For example, if a single interruption or multiple cumulative interruptions exceed a 15-second threshold, an interruption is identified and a service failure alert is issued. This single detection method can only meet the simplest O&M needs and cannot handle complex interruption scenarios, resulting in a low interruption recognition rate.

[0004] Therefore, how to provide a log-based service interruption assessment method to improve the interruption recognition rate in complex interruption scenarios is a key research topic for those skilled in the art. Summary of the Invention

[0005] In a first aspect, the present application provides a log-based service interruption assessment method, the method comprising: obtaining a first log file; based on the first log file, obtaining at least one first interruption information, the first interruption information comprising a first interruption duration and a first interruption order; determining a cumulative weighted interruption duration based on the product of the first interruption duration and a first attenuation weight, the first attenuation weight being inversely proportional to the first interruption order; and performing a service interruption assessment based on the cumulative weighted interruption duration.

[0006] With the service interruption assessment method provided in the embodiment of the present application, the cumulative interruption duration is not simply added up, but an attenuation weight is introduced. Based on the characteristic that the attenuation weight is inversely proportional to the first interruption order, the frequency sensitivity of high-frequency short interruption scenarios and single long interruption scenarios is distinguished. In this way, single long interruption scenarios and high-frequency short interruption scenarios can be effectively identified, and instantaneous jitter scenarios can be effectively filtered, thereby realizing a refined quantitative evaluation of different interruption modes, meeting the operation and maintenance requirements of complex distributed systems, and improving the accuracy of the interruption recognition rate in complex scenarios.

[0007] In addition, the greater the decay rate of the decay weight, the more attention is paid to the first interruption, and the smaller the decay rate (the smaller the difference in the contribution weight of each interruption to the cumulative interruption duration), the effect of the cumulative interruption duration is similar to simple accumulation. The design of this decay weight allows users to adjust the sensitivity of the cumulative interruption duration to the interruption frequency by adjusting the decay rate of the decay weight based on specific needs, thereby meeting the diverse interruption mode detection needs of distributed systems. For example, for fast recovery systems or business scenarios (such as network jitter scenarios, normal business jitter caused by high concurrent requests during special time periods such as peak hours), increase the decay rate of the decay weight and focus on the first interruption. In simple systems that are not sensitive to interruption patterns (such as power control systems), reduce the decay rate of the decay weight.

[0008] In some possible implementations, determining the cumulative weighted interruption duration based on the product of the first interruption duration and the first attenuation weight includes: Determine the cumulative weighted interruption duration score1; wherein, k represents the order of the kth interruption, and T k Indicates the duration of the kth interruption, the α k-1 represents the attenuation weight corresponding to the k-th interruption, and α is greater than 0 and less than 1.

[0009] In this way, based on α k-1 (α is greater than 0 and less than 1) This implements intelligent weighting of interruption patterns, allowing the interruption weight to decay exponentially with the interruption frequency, preserving the complete interruption duration of the first interruption event and enhancing the integrity and intuitiveness of the interruption duration included in the cumulative weighted interruption duration in a single long interruption scenario. Furthermore, the closer α is to 0, the greater the rate of weight decay, with a focus on the first interruption. The closer α is to 1, the smaller the rate of weight decay, which is equivalent to accumulation. Based on specific scenario requirements, users can adjust the value of α to adjust the sensitivity of the cumulative interruption duration to the interruption frequency, meeting the diverse interruption pattern detection needs of distributed systems.

[0010] In some possible implementations, before calculating the above-mentioned cumulative weighted interruption duration, the electronic device may further adjust the value of α within a numerical range greater than 0 and less than 1 based on the interruption sensitivity of the first service program required by the first log file, and the value of α is proportional to the interruption sensitivity of the first service program required. If the current state of the first service program belongs to a network jitter scenario, the interruption sensitivity of the first service program required is low, and the value of α is reduced. If the first service program belongs to a database service system or a power control system, the interruption sensitivity of the first service program required is high, and the value of α is increased.

[0011] By adopting this method, the attenuation rate of the attenuation weight is intelligently and dynamically adjusted based on the characteristics of different service scenarios to meet the diverse interruption mode detection needs of distributed systems.

[0012] In some possible implementations, after obtaining at least one first interruption information, the method further includes: Determine the weighted maximum duration score2; wherein, β is a preset adjustment factor, W is a preset event bucket duration, and T max The maximum interruption duration among the at least one first interruption information and within the preset event bucket duration, the β is greater than 0 and less than 1; the service interruption assessment based on the cumulative weighted interruption duration includes: determining the final interruption score based on the formula score=score1+score2, and performing service interruption assessment based on the score.

[0013] Understandable, T max The proportion of The larger the value, the more likely the interruption corresponding to the maximum duration is to be a long interruption scenario. In this way, the final score of the interruption is introduced with the weighted maximum duration, based on the ratio of β and the maximum duration. The product of the maximum duration (that is, the weighted maximum duration) is used to increase the contribution weight of the maximum duration. As a result, it remains highly sensitive to interruptions with a large proportion of maximum duration, further improving the accuracy of service interruption pattern assessment.

[0014] In some possible implementations, the service interruption assessment based on the score includes: when it is determined that the score is less than a first duration threshold, determining that the service interruption mode is a normal mode, and the service health level is a healthy level; when it is determined that the score is greater than or equal to the first duration threshold and less than a second duration threshold, determining that the service interruption mode is a sub-healthy interruption mode, and the service health level is a sub-healthy level; when it is determined that the score is greater than or equal to the second duration threshold, determining that the service interruption mode is a fault interruption mode, and the service health level is a fault level.

[0015] In this way, the final score of the interruption is converted into the service interruption mode and / or service health level, which more intuitively reflects the system service status.

[0016] In some possible implementations, obtaining at least one first interruption information based on the first log file includes: determining at least one interruption event matching pair contained in the first log file based on a service interruption start mark and a service recovery mark, each of the interruption event matching pairs including a first service interruption event and a first service recovery event; wherein, the first service recovery event is the first service recovery event whose event time is later than the event time of the first service interruption event, and if there are two or more repeated service interruption events before the first service recovery event, then the first service interruption event is the service interruption event with the earliest event time among the two or more service interruption events; determining the at least one first interruption information based on the at least one interruption event matching pair.

[0017] Using this method, if there are two or more repeated service interruption events before the first service recovery event, the service interruption event with the earliest event time among the two or more service interruption events will be taken as the first service interruption event, thereby recording the longest interruption duration and eliminating the interference of repeated log events on interruption statistics.

[0018] In some possible implementations, determining at least one interruption event matching pair contained in the first log file includes: determining at least one interruption event matching pair corresponding to a preset sliding window in the first log file, where the preset sliding window is a preset default time window, or the preset sliding window is determined based on user input information; determining at least one interruption event matching pair corresponding to the preset sliding window in the first log file includes: when there is no service recovery event matching the first service interruption event in the preset sliding window in the first log file, increasing the duration of the preset sliding window, and determining whether there is a service recovery event matching the first service interruption event in the preset sliding window after the duration is increased; when it is determined that there is a first service recovery event matching the first service interruption event in the preset sliding window after the duration is increased, determining that the first service interruption event and the first service recovery event are an interruption event matching pair.

[0019] In this way, after sequentially reading the log events in the first log file, the electronic device can bucket the interruption events based on the default settings or based on the user's needs for the preset sliding window, and output the service interruption assessment result corresponding to the preset sliding window. On the one hand, when an interruption event occurs, the event bucketing method is helpful for operation and maintenance personnel to quickly locate the interruption window. On the other hand, the smaller the preset sliding window, the more sensitive it is to recent interruptions. The preset sliding window accepts custom settings, and users can adjust the time sensitivity of interruption detection through the preset sliding window to meet the user's diverse and personalized needs. On the other hand, it is allowed to set the preset sliding window without affecting the matching of the interruption start event and the service recovery event, reducing the impact of the preset sliding window on the interruption statistics and improving the accuracy of the service interruption assessment method.

[0020] In some possible implementations, before obtaining the first log file, the method also includes: collecting at least two log files from different log sources; filtering out archived log files carrying timestamps from the at least two log files, and retaining unarchived log files not carrying timestamps; obtaining the first log file includes: obtaining a reference log file from the unarchived log file, and using the reference log file as the first log file, the reference log file being a log file whose last occurrence time of a log event does not exceed a first duration threshold from the current time.

[0021] By adopting this method, on the one hand, the first log file is directly derived from the conventional system log collection library, which improves the compatibility of the log-based service interruption assessment method of this application. On the other hand, the archived log files that are not necessary for detection are automatically cleaned up, reducing the performance burden caused by invalid detection. On the other hand, the first log file is a log file in which the last occurrence time of the log event in the unarchived log file does not exceed the first duration threshold from the current time. The strategy of focusing on active log streams and ignoring long-term stagnant log files can reduce computing resources and reduce the load pressure caused by accessing historical files.

[0022] In some possible implementations, the method further includes: when it is determined that the unarchived log file contains a second log file, writing a first indication information into a periodic report, the second log file being a log file in which the last occurrence time of a log event exceeds the first duration threshold from the current time, the first indication information being used to indicate the duration of the interval between the last occurrence time of the second log file and the current time, and the periodic report does not belong to real-time alarm information.

[0023] In this way, the stagnant log notifies the user by outputting prompt information through low-priority channels (such as daily reports), preventing important alarm information from being overwhelmed by non-urgent information.

[0024] In a second aspect, the present application further provides a log-based service interruption assessment device, comprising a unit for executing any one of the log-based service interruption assessment methods in the first aspect.

[0025] In a third aspect, the present application further provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded by a processor and executing any one of the log-based service interruption assessment methods in the first aspect.

[0026] In a fourth aspect, an embodiment of the present application further provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute any one of the log-based service interruption assessment methods in the first aspect.

[0027] In a fifth aspect, an embodiment of the present application further provides a chip module, comprising a transceiver component and a chip, wherein the chip is used to execute any one of the log-based service interruption assessment methods in the first aspect.

[0028] It is understood that the log-based service interruption assessment device, computer storage medium, computer program, computer program product, and chip system provided above are all used to perform the method described in any implementation of the first aspect of the embodiments of this application. Therefore, the beneficial effects that can be achieved can be referenced to the beneficial effects of the corresponding method and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flow chart of a log-based service interruption assessment method provided by an embodiment of the present application;

[0030] Figure 2 This is a schematic diagram of outputting a periodic report provided by an embodiment of the present application;

[0031] Figure 3 This is a flow chart of another log-based service interruption assessment method provided by an embodiment of the present application;

[0032] Figure 4 Schematic diagram of a log-based service interruption assessment device provided in an embodiment of the present application;

[0033] Figure 5 Schematic diagram of another log-based service interruption assessment device provided in an embodiment of the present application;

[0034] Figure 6 This is a schematic diagram of another log-based service interruption assessment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described below with reference to the accompanying drawings.

[0036] Example 1:

[0037] See also Figure 1 , Figure 1 This is a flow chart of a log-based service interruption assessment method provided in an embodiment of the present application. Figure 1 As shown, the log-based service interruption assessment method includes the following steps:

[0038] S101: The electronic device obtains a first log file.

[0039] In some possible implementations, the first log file is a log file corresponding to a target log source that continuously generates active log streams, and the target log source is a service program whose service interruption status is to be evaluated.

[0040] In some possible implementations, before obtaining the first log file in step S101, the electronic device collects at least two log files from different log sources; and filters out archived log files with timestamps from the at least two log files, retaining unarchived log files without timestamps. S101 specifically includes: the electronic device obtains a reference log file from the unarchived log files, and uses the reference log file as the first log file, where the reference log file is a log file whose last log event occurred within a first duration threshold from the current time.

[0041] For example, a large system includes multiple sub-service programs (for example, multiple subsystems, each subsystem corresponds to a different sub-service program), and each service program generates a corresponding log file. The log detection system corresponding to the large system will perform conventional log collection, and the collected log files include all log files from different log sources belonging to the large system. Using the method provided in the embodiment of the present application, the electronic device can directly obtain the above-mentioned first log file from the conventional system log collection library.

[0042] By adopting this method, on the one hand, the log files containing timestamps in the file name or path (which belong to the complete historical archive logs cut by day) are screened out, the log files of unnecessary detection are automatically cleaned up, and the performance burden caused by invalid detection is reduced. On the other hand, the first log file is directly derived from the conventional system log collection library, and no additional log collection is required, thereby improving the compatibility of the log-based service interruption assessment method of this application. On the other hand, the first log file is a log file in which the last occurrence time of the log event in the unarchived log file does not exceed the first duration threshold from the current time. The strategy of focusing on active log streams and ignoring long-term stagnant log files can reduce computing resources and reduce the load pressure brought by accessing historical files.

[0043] In some possible implementations, after obtaining the above-mentioned unarchived log, the electronic device writes the first indication information into a periodic report if it determines that the unarchived log file contains a second log file. The second log file is a log file whose last occurrence time of a log event exceeds the first duration threshold from the current time. The first indication information is used to indicate the interval between the last occurrence time of the second log file and the current time. The periodic report does not constitute real-time alarm information. In some possible implementations, the first indication information may also carry a cleanup suggestion, which indicates the duration of log stagnation and recommends archiving.

[0044] For example, the electronic device may push the periodic report to the user based on the user's request or periodically. For example, the indication information included in the periodic report may be as follows: Figure 2 shown.

[0045] With this approach, only active log interruptions trigger real-time alerts, and stagnant logs notify users by outputting prompt messages through low-priority channels (such as daily reports), preventing operation and maintenance personnel from being overwhelmed by non-urgent information.

[0046] It should be noted that, based on user needs, the first log file may also be a log file of a log source whose log stream has stagnated for a certain period of time, or may also be some archived log files, and this application does not limit this.

[0047] S102: The electronic device obtains at least one item of first interruption information based on the first log file. The first interruption information includes a first interruption duration and a first interruption order.

[0048] In some possible implementations, the electronic device obtains at least one first interruption information based on the first log file, specifically including: determining at least one interruption event matching pair contained in the first log file based on a service interruption start marker and a service recovery marker, where each interruption event matching pair includes a first service interruption event and a first service recovery event. The first service recovery event is the first service recovery event whose event time is later than the event time of the first service interruption event. If there are two or more immediately overlapping service interruption events, the first service interruption event is the service interruption event with the earliest event time among the two or more service interruption events. The electronic device determines the at least one first interruption information based on the at least one interruption event matching pair.

[0049] Exemplarily, the electronic device sequentially reads the log event sequence in the first log file (including sequentially reading the incremental log events in the first log file), and performs log preprocessing based on the service interruption start mark and the service recovery mark. The log sequence L obtained after preprocessing is {log1, log2, ..., log p Each log entry contains a timestamp, service identifier, and event type. Event types include service interruption start (start), service recovery (end), and heartbeat (heartbeat). Service interruption start markers include "connection lost" or "timeout," service recovery markers include "service resumed" or "recovery completed," and heartbeat markers include "alive," "ping," "OK," or "status=200."

[0050] Specifically, the electronic device may use regular matching to determine that if log1 in the first log file contains a "connection lost" or "timeout" tag, the event type of log1 is "start"; if log2 in the first log file contains a "service resumed" or "recovery completed" tag, the event type of log2 is "end"; and if log3 in the first log file contains an "alive", "ping", "OK", or "status=200" tag, the event type of log3 is "heartbeat".

[0051] As an example, after completing log preprocessing, the electronic device determines at least one interrupt event matching pair included in the first log file through a stack matching method based on the event type in the preprocessed log sequence L.

[0052] For example, starting from the event with the earliest timestamp, if before the matching end type event occurs, the electronic device determines that there are multiple service interruption events with event type start that are repeated immediately and continuously, then the electronic device records the earliest service interruption event (for example, log1) in sequence to the interruption event matching table, and the electronic device reads the event sequence in the log sequence L in sequence, and records the first service recovery event with event type end (for example, log2) read after log1 in sequence to the interruption event matching table, indicating that an interruption event matching pair (that is, log1 and log2) is matched. The format of the interruption event matching table can be a stack structure or a queue structure, which is not limited in this article.

[0053] For another example, starting from the event with the earliest timestamp, the electronic device determines that the event type in L is a heartbeat type event (for example, log3), then further determines whether there are at least two reconnection events in the service program near the time corresponding to the timestamp of log3. If so, log3 is sequentially recorded in the interrupt event matching table. The first heartbeat type event read after log3, and the heartbeat event (for example, log4) whose corresponding time is near the timestamp and there is no reconnection event in the service program is sequentially recorded in the interrupt event matching table, indicating that an interrupt event matching pair (i.e., log3 and log4) is matched.

[0054] In some other possible implementations, the electronic device can also determine whether the service has entered an interruption state and an interruption recovery state through the three indicators of central processing unit (CPU) utilization, memory usage, and network traffic corresponding to the current service program. For example, case one: if the electronic device determines that these three indicators are simultaneously zeroed or frozen (CPU is approximately equal to 0%, memory usage remains unchanged, and network traffic is approximately equal to 0), the electronic device determines that the service is strongly interrupted. Case two: if the electronic device determines that the CPU utilization is zero and the network traffic is zero, even if the memory has not been released yet, it indicates that the process has lost its ability to respond, then the electronic device determines that the service is substantially interrupted. Case three: if the electronic device determines that the memory usage is frozen and the network traffic is zero, then the CPU may have a slight fluctuation (possibly a system process), but it still indicates that the target service has been interrupted, then the electronic device determines that the service is interrupted.

[0055] For example, the electronic device may generate a service interruption event (e.g., log5) based on the timestamp and start event type of the service interruption, and sequentially record it in the interruption event matching table. Furthermore, if it is determined that the current service is not in any of the three situations described above, the electronic device may generate a service recovery event (e.g., log6) based on the timestamp and end event type of the service recovery, and sequentially record it in the interruption event matching table, indicating that an interruption event matching pair (i.e., log5 and log6) has been matched.

[0056] By adopting this approach, we consider detecting service interruption initiation events and service recovery events from multiple channels, and covering multiple types of service interruption initiation events and service recovery events, to provide a reliable and accurate data basis for service interruption assessment and improve the accuracy of service interruption assessment.

[0057] It should be noted that the electronic device may also determine the service interruption initiation event and the service recovery event through other possible implementation methods, which are not limited in this document. For example, the loss of three consecutive heartbeats may be considered as the service interruption initiation event, and the restoration of the heartbeat may be considered as the service recovery event.

[0058] As an example, the electronic device determines the at least one first interruption information based on the interruption event matching pair in the above-mentioned interruption event matching table, wherein the information of an interruption event matching pair corresponds to a first interruption information, the first interruption duration of the first interruption information is the time difference of an interruption event matching pair, and the first interruption order of the first interruption duration is the position order of the interruption event matching pair in the interruption event matching table.

[0059] In some possible implementations, the electronic device determines at least one interruption event matching pair contained in the first log file, specifically including: determining at least one interruption event matching pair corresponding to a preset sliding window in the first log file. Exemplarily, the preset sliding window is a preset default time window, such as 1 minute, 5 minutes, 10 minutes, etc., or the preset sliding window is determined based on user input information, such as the electronic device provides the user with an entry for selecting the start time and end time of the preset sliding window, and obtains at least one interruption event matching pair corresponding to the preset sliding window in the first log file based on the time window selected by the user. In an embodiment of the present application, the duration of the preset sliding window may be equal to or different from the duration of the preset event bucket, and the time period corresponding to the preset sliding window may be the same as or different from the time period corresponding to the duration of the preset event bucket, which is not limited in this document.

[0060] In some possible implementations, the electronic device determines, in the first log file, that at least one interruption event matching pair corresponding to a preset sliding window includes: if there is no service recovery event matching the first service interruption event in the preset sliding window in the first log file, increasing the duration of the preset sliding window, and determining whether there is a service recovery event matching the first service interruption event in the preset sliding window after the increased duration; and if it is determined that there is a first service recovery event matching the first service interruption event in the preset sliding window after the increased duration, determining that the first service interruption event and the first service recovery event are an interruption event matching pair.

[0061] In this way, the electronic device can sequentially read the log events in the first log file based on the default settings or based on user needs, and bucket the interruption events based on the preset sliding window to detect the service interruption status corresponding to the preset sliding window. On the one hand, when an interruption event occurs, the event bucketing method is conducive to the operation and maintenance personnel to quickly locate the interruption window. On the other hand, the preset sliding window accepts custom settings, and the user can adjust the time sensitivity of the interruption detection through the preset sliding window. The smaller the preset sliding window, the more sensitive it is to recent interruptions, meeting the diverse and personalized needs of users, such as meeting the user's need for uninterrupted interruption detection in a specific time period, and meeting the operation and maintenance personnel's need to quickly locate the main interruption event concentrated window. On the other hand, setting the preset sliding window does not affect the matching of the interruption start event and the service recovery event, reducing the impact of the preset sliding window on the interruption statistics, avoiding the interruption duration belonging to the same interruption event being divided into two parts in the scenario where the interruption duration spans across windows, and improving the accuracy of the interruption event detection, thereby providing accurate and reliable basic data for the log-based service interruption assessment method provided by the present application, and improving the accuracy of the service interruption assessment method.

[0062] In some possible implementations, the electronic device determines that at least one interruption event matching pair corresponding to the preset sliding window in the first log file includes: if there is still no service recovery event matching the first service interruption event in the preset sliding window after determining the increased duration, determining the interruption duration of the interruption information corresponding to the first service interruption event based on the first service interruption event and a preset determination mechanism. Exemplarily, the preset determination mechanism is: setting the interruption duration of the first service interruption event to the total duration of the increased preset sliding window, or using the end time of the increased preset sliding window as the time of the service recovery event matching the first service interruption event. Thus, the interruption duration setting of diverse and complex interruption scenarios is considered from multiple aspects, further improving the accuracy of service interruption assessment.

[0063] S103: The electronic device determines a cumulative weighted interruption duration based on a product of the first interruption duration and a first decay weight, where the first decay weight is inversely proportional to the first interruption order.

[0064] In an embodiment of the present application, the cumulative weighted interruption duration is the sum of the first products corresponding to each first interruption information in the at least one first interruption information mentioned above, and the first product is the product of the first interruption duration corresponding to the first interruption information and the first attenuation weight.

[0065] S104: The electronic device performs a service interruption assessment based on the accumulated weighted interruption duration.

[0066] In some possible implementations, the electronic device performs a service interruption assessment based on the cumulative weighted interruption duration, specifically including: when it is determined that the cumulative weighted interruption duration is less than the third duration threshold, the electronic device determines that the service interruption mode is a normal mode. When it is determined that the cumulative weighted interruption duration is greater than or equal to the third duration threshold and less than the fourth duration threshold, the electronic device determines that the service interruption mode is a sub-healthy interruption mode, and outputs a service interruption alarm level as a warning level. When it is determined that the cumulative weighted interruption duration is greater than or equal to the fourth duration threshold, the electronic device determines that the service interruption mode is a fault interruption mode, and outputs a service interruption alarm level as an emergency level. It should be noted that the third duration threshold and the fourth duration threshold can be designed based on demand, and this application does not limit this. Exemplarily, the third duration threshold can be 1 second and the fourth duration threshold is 5 seconds.

[0067] Generally, electronic devices determine an interruption event by determining whether the interruption duration of a certain interruption exceeds a duration threshold (for example, a duration threshold of more than 15 seconds), or by determining whether the interruption duration obtained by simply accumulating multiple interruptions exceeds a duration threshold. This single determination method can only meet the simplest operation and maintenance needs, cannot cope with complex interruption scenarios, and has a low interruption recognition rate. For example, in a complex distributed system, the following interruption scenarios may occur in different time periods of the same service program or different service programs: scenarios where a single long interruption (such as a hardware failure) severely affects business services, scenarios where high-frequency short interruptions may affect business services, and scenarios where instantaneous jitter does not affect business services.

[0068] In the service interruption assessment method provided in the embodiment of the present application, the cumulative interruption duration is not simply added up, but an attenuation weight is introduced. The weight value decreases in sequence based on the interruption order. The attenuation weight is used to distinguish the frequency sensitivity of high-frequency short-term interruption scenarios and single long interruption scenarios.

[0069] On the one hand, it can effectively identify and distinguish single long interruption scenarios, high-frequency short interruption scenarios, and instantaneous jitter scenarios, realizing refined quantitative evaluation of different interruption modes, meeting the operation and maintenance requirements of complex distributed systems, and improving the accuracy of complex scenario interruption recognition rate.

[0070] For example, the weight decay method is exponential decay, with the weight of the first interruption equal to 1. For example, a single long interruption (1 interruption, duration 20 seconds) is highly sensitive to single long interruptions, and the duration of some high-frequency short interruptions (for example, 5 discontinuous interruptions, each interruption duration is 4 seconds) is weakened. Instantaneous jitter (for example, 20 instantaneous jitters, each interruption duration is 1 second) is strongly suppressed. The resulting cumulative weighted interruption duration is sorted from large to small as single long interruption, high-frequency short interruption, and instantaneous jitter. In this way, single long interruption scenarios, high-frequency short interruption scenarios, and instantaneous jitter scenarios are effectively identified and distinguished, achieving a refined quantitative evaluation of interruption patterns, improving the interruption recognition rate of complex interruption scenarios, and meeting the operation and maintenance requirements of complex distributed systems.

[0071] On the other hand, users can adjust the frequency sensitivity of interruption detection by adjusting the decay rate of the weight based on specific scenario requirements. Among them, the greater the decay rate of the weight, the more attention is paid to the first interruption. The smaller the decay rate of the weight, the smaller the difference in the contribution weight of each interruption to the cumulative interruption duration. For example, if the initial value of the weight is 1, the cumulative interruption duration effect is similar to simple accumulation. For example, for fast recovery systems or business scenarios (such as network jitter scenarios, normal business jitter caused by high concurrent requests in special time periods such as peak hours), increase the decay rate of the weight and focus on the first interruption. In simple systems that are not sensitive to interruption patterns (such as power control systems), reduce the decay rate of the weight. In this way, the diverse interruption pattern detection needs of distributed systems are met.

[0072] In some possible implementations, the electronic device determines the accumulated weighted interruption duration score1 based on the following formula 1.

[0073]

[0074] Where, k represents the kth interruption, T k represents the duration of the kth interruption, α k-1 It represents the attenuation weight corresponding to the k-th interruption. α is greater than 0 and less than 1. By adjusting the value of α, the frequency sensitivity of interruption detection can be adjusted.

[0075] For example, the value of α is set to 0.9, and different interruption scenarios and different scores are shown in Table 1 below.

[0076] Table 1

[0077] Interruption Scenario score1 Identification features Single long interruption 10 seconds 10 Full duration 10 consecutive interruptions of 1 second ≈6.5 Partial attenuation High-frequency jitter (10 milliseconds × 20 times) <1 Strong inhibition

[0078] Using this method, on the one hand, based on α k-1The weights of α that are greater than 0 and less than 1 decay exponentially with the interruption frequency, preserving the full duration of the first interruption and enhancing the intuitiveness of the duration of a single long interruption. On the other hand, it effectively identifies and distinguishes single long interruption scenarios, high-frequency short interruption scenarios, and instantaneous jitter scenarios, achieving a refined quantitative evaluation of interruption patterns and improving the accuracy of interruption recognition rates in complex scenarios. On the other hand, users can adjust the sensitivity of interruption detection to interruption frequency by adjusting the value of α based on specific scenario requirements. The closer α is to 0, the greater the rate at which the weight decays with the interruption frequency, focusing on the first interruption. The closer α is to 1, the smaller the rate at which the weight decays with the interruption frequency, which is equivalent to accumulation, meeting the diverse interruption pattern detection needs of distributed systems.

[0079] In some possible implementations, before calculating the above-mentioned cumulative weighted interruption duration, the electronic device may further adjust the value of α within a numerical range greater than 0 and less than 1 based on the interruption sensitivity of the first service program required by the first log file, and the value of α is proportional to the interruption sensitivity of the first service program required. If the current state of the first service program belongs to a network jitter scenario, the interruption sensitivity of the first service program required is low, and the value of α is reduced. If the first service program belongs to a database service system or a power control system, the interruption sensitivity of the first service program required is high, and the value of α is increased.

[0080] In some other possible implementations, the electronic device determines the weighted maximum duration score2 based on the following formula, and determines the final interruption score score based on the following formula 3, and performs service interruption evaluation based on the score.

[0081]

[0082] Among them, β is the preset adjustment factor, W is the preset event bucket length, and the T max The maximum interruption duration in at least one first interruption information item and within the preset event bucket duration, β is greater than 0 and less than 1. For example, the adjustment coefficient β is 0.3. In some possible implementations, the adjustment coefficient β can also range from greater than 0 to less than or equal to 0.5. Score 1 can also be understood as a frequency penalty, and score 2 can also be understood as a suddenness penalty.

[0083] In this way, the final score of the interruption introduces the above-mentioned weighted maximum duration, based on β and the maximum duration T max The proportion of Increase the contribution weight of the maximum duration. max The proportion of The larger the value is, the more likely the interruption corresponding to the maximum duration is to be a long interruption mode. In this case, the contribution weight of the maximum duration is increased through β, so as to maintain high sensitivity to interruptions with a large proportion of maximum duration, thereby further improving the accuracy of service interruption mode assessment.

[0084] In some possible implementations, the electronic device can determine the interruption mode based on the score and then map it to the service health level and the interruption warning level. For example, the mapping rules are shown in Table 2 below.

[0085] Table 2

[0086] score interval Interrupt Mode Service health level Alarm level [0，1) normal healthy —— [1，5) Sub-health Sub-health warn [5，∞) Fault Fault urgent

[0087] As an example, take α equal to 0.7, β equal to 0.3, and adopt the log-based service interruption assessment method provided in this application to evaluate the service health level of a service program in a large trading system based on the active log stream log file of the service program. The difference compared with the service health level of the service program evaluated based on the traditional method (single timing or simple accumulation) is shown in the following Table 3.

[0088] Table 3

[0089]

[0090] It should be noted that the electronic device can evaluate the interruption mode of the current service based on score1 or score, and further determine the service health level and / or interruption alarm level based on the interruption mode, or directly determine the service health level and / or interruption alarm level based on score1 or score. It is designed based on specific needs and this article does not limit this.

[0091] In some possible implementations, the electronic device can define the service interruption matching pair with the latest interruption time as the first interruption (which can also be understood as reverse counting) based on actual needs, thereby focusing on the interruption most recent to the current time and attenuating the impact of historical interruptions on the cumulative interruption duration.

[0092] In some possible implementations, the electronic device may also, based on actual needs, define the service interruption matching pair with the earliest interruption time as the first interruption and the service interruption event with the latest interruption time as the last interruption, focusing on the earliest interruption time (for example, which can be used to quickly restore the system).

[0093] It is understandable that the embodiment of the present application uses an electronic device as an example to illustrate the execution subject of the log-based service interruption assessment method provided by the present application. The electronic device can also be understood as the log-based service interruption assessment device shown in the embodiment of the present application. In the embodiment of the present application, the electronic device can be a microprocessor or computer for executing program code, etc. The electronic device that can be used to execute the method provided by the embodiment of the present application falls within the protection scope of the embodiment of the present application, and the present application does not impose any restrictions. For example, the electronic device can be a desktop computer, a portable notebook, a mobile terminal, a 32-bit microprocessor or a 64-bit microprocessor, etc., and the embodiment of the present application does not limit this.

[0094] Example 2:

[0095] The following combination Figure 3 , taking the scenario where the first log file is an unarchived log file whose last occurrence time of the acquired log event does not exceed the first time threshold from the current time among at least two log files collected by the electronic device from different log sources as an example, the implementation method of the log-based service interruption assessment method provided by this application is explained. Figure 3 As shown, the method includes the following steps.

[0096] S301, collecting system log data indiscriminately.

[0097] Specifically, the electronic device indiscriminately collects log data from various log sources of the associated system to obtain at least two log files, wherein the log files based on timestamps and the log files without timestamps are both collected objects.

[0098] Exemplarily, after the electronic device obtains at least two log files, it adds tag information to the log files. The tag information includes but is not limited to: service program name (appname), service program type tag (tag). For example, the appname of the log file of the online banking application is set to 'unionpay system' and the tag is set to 'bank'.

[0099] S302: Generate a log file sample dictionary.

[0100] In the embodiment of the present application, the log file sample dictionary is a dictionary table that records the last occurrence time of log events of each log source.

[0101] Exemplarily, the electronic device automatically creates a log file sample dictionary in a format such as CSV or KV dictionary based on the output lookup technology and the log data collected in S301 to generate a lookup table that records the last appearance time of each log file.

[0102] Exemplarily, the column names of the lookup table include a timestamp (last occurrence time) field, and an appname and / or tag field. The column names of the lookup table may also include, but are not limited to, one or more of appname, hostname, host Internet Protocol (IP) address, and source (log source path). Each row of data in the lookup table represents the last occurrence time of the corresponding log file, and each row of data is sorted in ascending order by timestamp.

[0103] For example, the following code statement generates the sample dictionary of the log file.

[0104] "fillnull value = "null" source; / / Replace null values in the source field with "null".

[0105] stats max(timestamp)as last_time by appname,tag,hostname,ip,source; / / Group by the specified field and find the latest timestamp for each group.

[0106] outputlookup log_monitor.csv; / / Output the results to the lookup table log_monitor.csv. "

[0107] S303: Filter out archived log files and retain unarchived log files.

[0108] Specifically, the electronic device filters out archived log files in the log file sample dictionary and retains unarchived log files. For example, the electronic device can read the lookup table generated in S302 through the inputlookup command and filter out log files merged in time format through the where conditional statement.

[0109] For example, the following code statement can be used to filter out log files that are merged in time format.

[0110] "inputlookup log_monitor.csv;

[0111] eval last_time = tonumber(last_time); / / Ensure that the timestamp is a numeric type

[0112] sortby+last_time; / / Sort in ascending order by the last record time, so that older records are displayed first, making it easier to observe the log source that has not been updated for the longest time.

[0113] where! match(source,".*20[0-9]{2}_[0-1][0-9]_[0-3][0-9].*")&&

[0114] ! match(source,".*20[0-9]{2}-[0-1][0-9]-[0-3][0-9].*")&&

[0115] ! match(source,".*20[0-9]{2}[0-1][0-9][0-3][0-9].*");

[0116] outputlookup log_monitor.csv. "

[0117] It should be noted that the electronic device may also filter out, from the log file sample dictionary, other log files that do not need to be determined whether they have been interrupted, in addition to the archived log files. This document does not limit this.

[0118] S304: Obtain a first log file.

[0119] Specifically, the electronic device obtains a first log file based on the unarchived file. Exemplarily, the first log file is a log file whose last occurrence time of a log event in the unarchived file is within a first duration threshold from the current time. Exemplarily, the first duration threshold is 7 days.

[0120] S305: Perform log preprocessing on the first log file.

[0121] Specifically, the electronic device performs log preprocessing on the first log file to obtain a log sequence L = {log1, log2, ..., log p Each log entry contains a timestamp, a service identifier, and an event type. Event types include service interruption start type (start), service recovery type (end), and heartbeat type (heartbeat).

[0122] Regarding how the electronic device specifically implements log preprocessing of the first log file, reference may be made to the relevant description in S102 above, which will not be described in detail here.

[0123] S306: Determine a preset sliding window.

[0124] Exemplarily, the preset sliding window is a preset default time window, or the preset sliding window is determined based on user input information.

[0125] In some possible implementations, when the electronic device determines that there is no service recovery event matching the first service interruption event within a preset sliding window in the first log file, the electronic device increases the length of the preset sliding window, and determines whether there is a service recovery event matching the first service interruption event within the preset sliding window after the increased length; when it is determined that there is a first service recovery event matching the first service interruption event within the preset sliding window after the increased length, the electronic device determines that the first service interruption event and the first service recovery event are an interruption event matching pair.

[0126] S307: Extract interrupt event matching pairs.

[0127] Specifically, the electronic device extracts interruption event matching pairs based on the preprocessed first log file and a preset sliding window.

[0128] Regarding how the electronic device specifically extracts the interruption event matching pairs based on the pre-processed first log file and records them into the interruption event matching table, reference may be made to the relevant description in S102 above, which will not be elaborated here.

[0129] S308: Obtain the interruption duration and interruption order of each interruption.

[0130] Specifically, the electronic device obtains the interruption duration and interruption order of each interruption based on the interruption event matching pairs in the interruption event matching table.

[0131] In the embodiment of the present application, the electronic device defines the service interruption matching pair with the latest interruption time as the first interruption, focusing on the interruption most recent to the current time.

[0132] Regarding how to obtain the interruption duration and interruption order of each interruption based on the interruption event matching pair, reference may be made to the relevant description in S102 above, which will not be described in detail here.

[0133] S309, calculating the final score of the interruption.

[0134] Specifically, the electronic device calculates the final score of the interruption based on the interruption duration and interruption order of each interruption and the calculation formula of the final score of the interruption. The score formula is (As shown in the above formula 3) For the detailed description of the parameters of the score calculation formula, please refer to the relevant descriptions of the above formulas 1 to 3, which will not be described in detail here.

[0135] S310, evaluate and output service health.

[0136] Regarding how the electronic device specifically evaluates and outputs the service health, reference may be made to the relevant descriptions of Table 2 and Table 3 in the above embodiments, which will not be detailed here.

[0137] S311 : For a second log file that is stagnant for more than a first time threshold, write first indication information into a periodic report.

[0138] S312, output periodic reports.

[0139] Exemplarily, the electronic device writes the first indication information into a periodic report based on the following code statement for a second log file that is stagnant for more than a first time threshold.

[0140] "inputlookup log_monitor.csv;

[0141] eval last_time=tonumber(last_time);

[0142] sort by + last_time;

[0143] eval S=round((now()-last_time) / 1000,0), d=floor(S / 60 / 60 / 24), h=floor(S%(3600*24) / 3600), m=floor(S%3600 / 60), s=S%60;

[0144] where d>7;

[0145] eval'system running time'=format("%.0f",d)+"days"+format("%.0f",h)+"hours"+format("%.0f",m)+"minutes"+format("%.0f",s)+"seconds";

[0146] fields appname,tag,hostname,ip,source,'System running time'"

[0147] Regarding how the electronic device specifically writes the first indication information into the periodic report and outputs the periodic report for the second log file that is stagnant for more than the first time threshold, reference can also be made to the description of S101 in the above embodiment. Figure 2 The relevant description will not be detailed here.

[0148] The log-based service interruption assessment method provided in the embodiment of the present application is used. On the one hand, the cumulative weighted duration is determined based on the product of the first interruption duration and the first decay weight (the first decay weight is inversely proportional to the first interruption order), and the cumulative weighted duration is determined by the preset adjustment factor β and the first decay weight. The weighted maximum duration is calculated by multiplying the product of and increasing the contribution weight of the maximum duration. This effectively identifies and distinguishes single long interruption scenarios, high-frequency short interruption scenarios, and instantaneous jitter scenarios, achieving refined quantitative evaluation of interruption patterns, improving the accuracy of complex scenario interruption recognition rates, while maintaining high sensitivity to interruptions with a relatively large maximum duration, further improving the accuracy of interruption recognition rates. On the other hand, the service interruption matching pair with the latest interruption time is defined as the first interruption, focusing on the interruption closest to the current time. On the other hand, it supports adjusting the value of α based on specific scenario requirements to achieve the effect of adjusting the frequency sensitivity of interruption detection, thereby meeting the interruption detection requirements of multiple interruption modes in distributed systems.

[0149] The embodiment of the present application also provides a log-based service interruption assessment device, comprising a device for executing Figure 1 and Figure 3 A unit that implements any log-based service outage assessment method.

[0150] Please refer to Figure 4 , which provides a structural diagram of a log-based service interruption assessment device according to an embodiment of the present application.

[0151] like Figure 4 As shown, the device may include:

[0152] A first acquiring unit 401 is configured to acquire a first log file;

[0153] A second obtaining unit 402 is configured to obtain at least one item of first interruption information based on the first log file, where the first interruption information includes a first interruption duration and a first interruption order;

[0154] A first determining unit 403 is configured to determine a cumulative weighted interruption duration based on a product of the first interruption duration and a first decay weight, wherein the first decay weight is inversely proportional to the first interruption order;

[0155] The evaluation unit 404 is configured to perform service interruption evaluation based on the accumulated weighted interruption duration.

[0156] like Figure 5 As shown, in some possible implementations, the determining unit 403 specifically includes:

[0157] The first determining subunit 4031 is used to determine the The accumulated weighted interruption duration score1 is determined.

[0158] In some possible implementations, the log-based service interruption assessment device provided in the embodiments of the present application may further include:

[0159] The second determining unit 405 is used to determine the Determine the weighted maximum duration score2; the evaluation unit 404 is specifically configured to determine a final interruption score based on the formula score=score1+score2, and perform service interruption evaluation based on the score.

[0160] In some possible implementations, the evaluation unit 404 specifically includes:

[0161] The second determining subunit 4041 is configured to determine that the service interruption mode is the normal mode and the service health level is the healthy level when the score is less than the first duration threshold;

[0162] The second determining subunit 4041 is further configured to determine that the service interruption mode is a sub-healthy interruption mode and the service health level is a sub-healthy level when the score is greater than or equal to the first duration threshold and less than the second duration threshold;

[0163] The second determining subunit 4041 is further configured to determine that the service interruption mode is a fault interruption mode and the service health level is a fault level when the score is greater than or equal to the second duration threshold.

[0164] In some possible implementations, the second obtaining unit 402 specifically includes:

[0165] A third determining subunit 4011 is configured to determine, based on the service interruption start flag and the service resumption flag, at least one interruption event matching pair included in the first log file;

[0166] The fourth determining subunit 4012 is configured to determine the at least one first interruption information based on the at least one interruption event matching pair.

[0167] In some possible implementations, the third determining subunit 4011 is specifically configured to determine at least one interruption event matching pair corresponding to a preset sliding window in the first log file.

[0168] In some possible implementations, the third determination subunit 4011 is specifically configured to, when there is no service recovery event matching the first service interruption event in the preset sliding window in the first log file, increase the duration of the preset sliding window, and determine whether there is a service recovery event matching the first service interruption event in the preset sliding window after the increased duration; and when it is determined that there is a first service recovery event matching the first service interruption event in the preset sliding window after the increased duration, determine that the first service interruption event and the first service recovery event are an interruption event matching pair.

[0169] In some possible implementations, the log-based service interruption assessment device provided in the embodiments of the present application may further include:

[0170] A collection unit 406 is configured to collect at least two log files from different log sources;

[0171] A screening unit 407 is configured to screen out archived log files carrying timestamps from the at least two log files, and retain unarchived log files not carrying timestamps;

[0172] The first obtaining unit 401 is specifically configured to obtain a reference log file from the unarchived log file, and use the reference log file as the first log file.

[0173] In some possible implementations, the log-based service interruption assessment device provided in the embodiments of the present application may further include:

[0174] The writing unit 408 is configured to write the first indication information into a periodic report when it is determined that the unarchived log files include the second log file.

[0175] In some possible implementations, the log-based service interruption assessment device provided in the embodiments of the present application may further include:

[0176] The weight adjustment unit 409 is configured to adjust the value of α within a range of greater than 0 and less than 1 based on the interruption sensitivity of the first service program required by the first log file. The value of α is proportional to the interruption sensitivity of the first service program required.

[0177] For the explanation of the relevant parameters in the formulas score1 and score2, the first interruption information, the interruption event matching pair, the preset sliding window, the reference log file, the second log file, the first indication information and other terms, please refer to the relevant description of the above method embodiment and will not be described in detail here.

[0178] In the embodiments of the present application, any implementation method mentioned in the method embodiments is also applicable to the log-based service interruption assessment device provided by the present application. The specific execution steps can be found in the description of the aforementioned method embodiments and will not be described in detail here.

[0179] The embodiment of the present application also provides a log-based service interruption assessment device, comprising a processor, the processor being configured to execute the following Figure 1 or Figure 3 Any log-based service interruption assessment method in .

[0180] Please refer to Figure 6 , is a structural diagram of another log-based service interruption assessment device provided in an embodiment of the present application, such as Figure 6 As shown, the log-based service interruption assessment device 600 may include: at least one processor 601, such as a CPU, at least one communication interface 603, a memory 604, and at least one communication bus 602. The communication bus 602 is used to implement connection and communication between these components. The communication interface 603 may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface or a Bluetooth interface, etc.). The memory 604 may be a high-speed RAM memory, or a non-volatile memory (non-volatile memory), such as at least one disk memory. The memory 604 may optionally also be at least one storage device located away from the aforementioned processor 601. As Figure 6 As shown, the memory 604 as a computer storage medium may include an operating system, a network communication module, and program instructions.

[0181] exist Figure 6 In the log-based service interruption assessment device 600 shown, the processor 601 may be configured to load program instructions stored in the memory 604 and specifically perform the following operations:

[0182] Get the first log file;

[0183] Based on the first log file, obtaining at least one item of first interruption information, where the first interruption information includes a first interruption duration and a first interruption order;

[0184] determining a cumulative weighted interruption duration based on a product of the first interruption duration and a first decay weight, wherein the first decay weight is inversely proportional to the first interruption order;

[0185] A service interruption assessment is performed based on the accumulated weighted interruption duration.

[0186] It should be noted that the specific execution process can be found in the specific description of the above method embodiment and will not be described in detail here.

[0187] The specific execution steps can be found in the description of the aforementioned method embodiment and will not be described in detail here.

[0188] An embodiment of the present application also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded by a processor and executing the log-based service interruption assessment method provided in the embodiment of the present application. The specific execution process can be found in the specific description of the method embodiment shown above, and will not be described in detail here.

[0189] An embodiment of the present application further provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the method steps of the method embodiment shown above.

[0190] An embodiment of the present application also provides a chip module, including a transceiver component and a chip, wherein the chip is used to execute the method steps of the method embodiment shown above.

[0191] It is understood that the log-based service interruption assessment device, computer storage medium, computer program, computer program product, and chip provided above are all used to execute the method shown in any implementation of the corresponding aspects of the embodiments of this application. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects of the corresponding methods and will not be described in detail here.

[0192] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it includes the processes of the embodiments of the above-mentioned methods.

[0193] The at least one (item) involved in this application indicates one (item) or more (items). More than one (item) refers to two (items) or more than two (items). "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. In addition, it should be understood that although the terms first, second, etc. may be used to describe each object in this application, these objects should not be limited to these terms. These terms are only used to distinguish each object from each other.

[0194] As mentioned above, the terms "includes" and "having" and any variations thereof, are intended to cover a non-exclusive inclusion.

[0195] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A log-based service interruption assessment method, characterized in that: The method comprises: Get the first log file; Based on the first log file, obtaining at least one item of first interruption information, where the first interruption information includes a first interruption duration and a first interruption order; determining a cumulative weighted interruption duration based on a product of the first interruption duration and a first decay weight, wherein the first decay weight is inversely proportional to the first interruption order; A service interruption assessment is performed based on the accumulated weighted interruption duration.

2. The method according to claim 1, wherein The determining of a cumulative weighted interruption duration based on the product of the first interruption duration and a first attenuation weight includes: Based on the formula Determine the cumulative weighted interruption duration score1; Wherein, k represents the order of the kth interruption, and T k Indicates the duration of the kth interruption, the α k-1 represents the attenuation weight corresponding to the k-th interruption, and α is greater than 0 and less than 1.

3. The method according to claim 2, wherein After obtaining at least one first interruption information, the method further includes: Based on the formula Determine the weighted maximum duration score2; Wherein, β is a preset adjustment factor, W is a preset event bucket duration, and T max is the maximum interruption duration in the at least one first interruption information and within the preset event bucket duration, and β is greater than 0 and less than 1; The performing of service interruption assessment based on the accumulated weighted interruption duration includes: Based on the formula score=score1+score2, a final score of the interruption is determined, and a service interruption assessment is performed based on the score.

4. The method according to claim 3, wherein The service interruption assessment based on the score includes: In a case where it is determined that the score is less than the first duration threshold, determining the service interruption mode to be a normal mode and / or determining the service health level to be a healthy level; When it is determined that the score is greater than or equal to the first duration threshold and less than the second duration threshold, determining that the service interruption mode is a sub-health interruption mode and / or determining that the service health level is a sub-health level; When it is determined that the score is greater than or equal to the second duration threshold, the service interruption mode is determined to be a fault interruption mode and / or the service health level is determined to be a fault level.

5. The method according to any one of claims 1 to 4, characterized in that The acquiring at least one first interruption information based on the first log file includes: Determining, based on a service interruption start marker and a service recovery marker, at least one interruption event matching pair included in the first log file, each of the interruption event matching pairs including a first service interruption event and a first service recovery event; The first service recovery event is the first service recovery event whose event time is later than the event time of the first service interruption event. If there are two or more repeated service interruption events before the first service recovery event, the first service interruption event is the service interruption event with the earliest event time among the two or more service interruption events. The at least one first interruption information is determined based on the at least one interruption event matching pair.

6. The method according to claim 5, wherein The determining of at least one interruption event matching pair included in the first log file comprises: Determining at least one interrupt event matching pair in the first log file corresponding to a preset sliding window, where the preset sliding window is a preset default time window, or the preset sliding window is determined based on user input information; Determining at least one interruption event matching pair corresponding to a preset sliding window in the first log file includes: If there is no service recovery event matching the first service interruption event within the preset sliding window in the first log file, increasing the length of the preset sliding window, and determining whether there is a service recovery event matching the first service interruption event within the preset sliding window after the increased length; When it is determined that there is a first service recovery event matching the first service interruption event in the preset sliding window after the increased duration, the first service interruption event and the first service recovery event are determined to be an interruption event matching pair.

7. The method according to any one of claims 1 to 6, wherein: Before obtaining the first log file, the method further includes: Collect at least two log files from different log sources; Filter out archived log files with timestamps from the at least two log files, and retain unarchived log files without timestamps; The obtaining of the first log file includes: A reference log file is obtained from the unarchived log file, and the reference log file is used as the first log file. The reference log file is a log file in which the last occurrence time of a log event does not exceed a first duration threshold from the current time.

8. The method according to claim 7, wherein The method further comprises: When it is determined that the unarchived log file contains a second log file, the first indication information is written into a periodic report, where the second log file is a log file in which the last occurrence time of a log event exceeds the first duration threshold from the current time, and the first indication information is used to indicate the interval between the last occurrence time of the second log file and the current time. The periodic report does not belong to real-time alarm information.

9. A log-based service interruption assessment device, characterized in that: Comprising means for performing the method according to any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store a computer program. When the computer program is executed, the method according to any one of claims 1 to 8 is performed.

Images