Log processing method and device, electronic equipment and computer readable storage medium

Abstract

The invention discloses a log processing method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of computers.The method comprises the steps that logs of a server before and after a test case is executed are obtained, and then the logs generated in the process of executing the test case are obtained through comparison; matching a log generated in the process of executing the test case with a rule base to obtain a first target log and a second target log; the first target log is a log which is matched with a rule of a rule base and has a matched log analysis result, and the second target log is a log which is not matched with the rule of the rule base and does not have a matched log analysis result; and associating the first target log with the matched log analysis result. According to the method, the test site can be restored when the BUG problem is reproduced, the analysis efficiency can be improved, and the analysis omission can be reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a log processing method, device, electronic device, and computer-readable storage medium. Background Art

[0002] In the field of computer technology, logs are an important tool for recording various information during system operation. They are usually stored in the form of text files or databases, recording events, operations, errors, warnings, and other information that occurs during system operation. Log analysis can be used for troubleshooting, performance monitoring, security audits, system behavior analysis, etc. However, related technical solutions cannot restore the test site when bugs are reproduced, and log analysis often relies on manual analysis, which is inefficient and prone to omissions. Therefore, how to solve the above technical shortcomings has become a technical problem that needs to be solved urgently by those skilled in the art. Summary of the Invention

[0003] The present application provides a log processing method, device, electronic device and computer-readable storage medium to at least solve the problems in the related art that when a BUG problem recurs, the test site cannot be restored, the analysis efficiency is low, and analysis omissions are easily generated.

[0004] This application provides a log processing method, including: Get the server log before executing the test case and get the first log; Obtaining a log of the server after executing the test case to obtain a second log; Comparing the first log with the second log to obtain a log generated during the execution of the test case; Matching the logs generated during the execution of the test case with the rule base to obtain a first target log and a second target log; the first target log is a log that matches the rules of the rule base and has a matching log analysis result, and the second target log is a log that does not match the rules of the rule base and does not have a matching log analysis result; The first target log is associated with the matching log analysis result.

[0005] This application also provides a log processing device, including: A first acquisition module is used to obtain the log of the server before executing the test case to obtain a first log; A second acquisition module is used to obtain the log of the server after executing the test case to obtain a second log; A comparison module, configured to compare the first log with the second log to obtain a log generated during the execution of the test case; A matching module is configured to match the logs generated during the execution of the test case with the rule base to obtain a first target log and a second target log; the first target log is a log that matches the rules of the rule base and has a matching log analysis result, and the second target log is a log that does not match the rules of the rule base and does not have a matching log analysis result; An associating module is used to associate the first target log with the matching log analysis result.

[0006] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned log processing methods when executing the computer program.

[0007] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned log processing methods are implemented.

[0008] The present application also provides a computer program product, including a computer program, which implements the steps of any of the above-mentioned log processing methods when executed by a processor.

[0009] The log processing method provided by this application does not clear the server logs before executing the test case. Instead, it uses a method of analyzing the difference logs of the server logs before and after executing the test case. This can effectively preserve the original logs from being destroyed, and can restore the test site when the BUG problem reappears later. In addition, the log processing method provided by this application uses a rule base matching method to match the logs generated during the execution of the test case with the rule base, filter out known logs and unknown logs, and associate known logs with log analysis results. This can effectively improve the efficiency of log analysis, reduce manual input, improve the accuracy of analysis, and reduce the problem of omissions in analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0011] Figure 1 A flow chart of a log processing method provided in an embodiment of the present application; Figure 2 A schematic diagram of a specific log processing method provided in an embodiment of the present application; Figure 3 A schematic diagram of a comparison between a log and a rule base provided in an embodiment of the present application; Figure 4 A schematic diagram of unknown log processing provided in an embodiment of the present application; Figure 5 A schematic diagram of a log processing device provided in an embodiment of the present application; Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0013] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0014] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0015] The embodiments of the present application provide a log processing method, and the method is described in detail in conjunction with the execution flow of the log processing method.

[0016] Please refer to Figure 1 , the log processing method provided by the embodiment of the present application includes: S101: Obtain the server log before executing the test case to obtain a first log.

[0017] S102: Obtain the log of the server after executing the test case to obtain a second log.

[0018] S103: Compare the first log and the second log to obtain the log generated during the execution of the test case.

[0019] The first log refers to the server log collected before the server executes the test case. The second log refers to the server log collected after the server executes the test case. The full log of the server is collected and stored before and after the server executes the test case. The full log includes the BMC (Baseboard Management Controller) log and the OS (Operating System) log. The differential log of the server log collected before and after the server executes the test case is taken to obtain the log generated during the test process, that is, the execution of the test case. This embodiment does not clear the server log before and after the test case is executed, but adopts the method of taking the differential log of the server log before and after the test case is executed for analysis, so that the original log can be effectively preserved from being damaged, and the test site can be restored when the BUG problem recurs later.

[0020] S104: Match the log generated during the execution of the test case with the rule base to obtain a first target log and a second target log; the first target log is a log that matches the rules of the rule base and has a matching log analysis result, and the second target log is a log that does not match the rules of the rule base and does not have a matching log analysis result.

[0021] S105: Associating the first target log with the matching log analysis result.

[0022] The logs generated during the execution of the test case are matched with the rule base to screen out the first target log and the second target log. The first target log, i.e., the known log, refers to a log that matches the rules of the rule base and has a corresponding matching log analysis result (including the cause of the log appearance and the solution, etc.). After the first target log is screened out, the first target log is associated with the corresponding matching log analysis result. The second target log, i.e., the unknown log, refers to a log that cannot be matched with the rules of the rule base and does not have a matching log analysis result. The log analysis result of the second target log can be obtained through manual analysis. This embodiment adopts a rule base matching method to match the logs generated during the execution of the test case with the rule base, screen out known logs and unknown logs, and associate the known logs with the log analysis results. This can effectively improve the efficiency of log analysis, reduce manual input, improve the accuracy of analysis, and reduce the problem of omissions in analysis.

[0023] The log processing method provided in this embodiment can be implemented by a log analysis system. The log analysis system includes a log collection module, a rule base comparison and analysis module, a log storage module, and a log re-entry module. Figure 2As shown, before the server executes the test case, the full log of the server is collected by the log collection module and stored in the log storage module. After the server executes the test case, the log collection module collects the full log of the server again and stores it in the log storage module. The log analysis and comparison module takes the difference log of the two full logs before and after the test to obtain the log generated during the test. The log analysis and comparison module matches the logs generated during the test with the rule base maintained by the system to obtain analyzed logs and unanalyzed logs. The analyzed logs are automatically associated with the log analysis results. The unanalyzed logs are analyzed by the test engineer and manually associated with the log analysis results. The unanalyzed logs can be extracted through the log re-entry module to extract the corresponding rules, and then maintained in the rule base of the log analysis and comparison module, so that the rule base is continuously expanded and enriched.

[0024] Matching the logs generated during the test case execution with the rule base includes: The logs generated during the execution of the test cases are matched with the rule bases at each level step by step; among them, the logs retained after matching with the rule base of the previous level are matched with the rule base of the next level.

[0025] The rule base can include a blacklist library, a whitelist library, etc. By performing log comparison and filtering at each level, you can achieve refined comparative analysis of logs and improve accuracy.

[0026] In some embodiments, matching the logs generated during the execution of the test case with the rule bases at each level step by step includes: Match the logs generated during the execution of the test case with the blacklist library, retain the logs that match the blacklist library, and determine that the logs that do not match the blacklist library are traffic logs and ignore them; Match the logs that match the blacklist library with the whitelist library, retain the logs that do not match the whitelist library, and determine that the logs that match the whitelist library are traffic logs and ignore them; Matching the logs that do not match the whitelist library with the ignorable problem library, retaining the logs that do not match the ignorable problem library, and determining the logs that match the ignorable problem library as traffic logs and ignoring them; Matching the logs that do not match the ignorable question library with the common question library, retaining the logs that match the common question library; retaining the logs that do not match the common question library, and obtaining the second target logs; Match the logs that match the common problem library with the common ignorable problem library, retain the logs that do not match the common ignorable problem library, obtain the first target log, and determine that the logs that match the common ignorable problem library are traffic logs and ignore them.

[0027] In this embodiment, the log comparison is implemented based on a multi-level rule base, which mainly includes a blacklist base, a whitelist base, an ignorable problem base, a common problem base, and a common ignorable problem base. The blacklist base stores log rules that are known to be irrelevant or low-priority (such as debug logs and traffic logs). The whitelist base stores log rules for expected normal behaviors (such as successful connections and normal operations). The ignorable problem base stores log rules that are known to be harmless but frequently appear (such as non-critical alarms). The common problem base stores high-frequency error log rules and their solutions (such as system crashes and network interruptions). The common ignorable problem base stores error logs that contain error keywords and can be ignored.

[0028] Refined matching of differential logs with rule bases at all levels can improve accuracy.

[0029] refer to Figure 3 As shown in the figure, the log comparison and analysis process includes: The logs generated during the test are compared with the blacklist database. Those that match are retained, and those that do not match are judged as traffic logs and ignored.

[0030] Compare the logs retained in the previous step with the whitelist library. Those that match are considered to be ignored by the whitelist, and those that do not match are retained.

[0031] Compare the logs retained in the previous step with the ignorable question library. Those that match are determined to be traffic logs and ignored, and those that do not match are retained.

[0032] The logs retained in the previous step are compared with the common problem library. Matches are determined as common problem logs and retained. Mismatches are determined as unknown errors, i.e., the second target logs, and retained. Unknown errors are displayed to test engineers for manual analysis.

[0033] The common problem logs retained in the previous step are compared with the common ignorable problem library. Matched ones are determined to be traffic logs and ignored. Mismatched ones are retained as known errors, i.e., the first target logs, and the log analysis results are automatically associated.

[0034] Among them, reference Figure 4 As shown, after the test engineer analyzes the unknown error, two actions can be taken. One is to manually correlate the log analysis results and backfill them into the use case analysis results. For example, if the log analysis result is "fail," the backfill use case analysis result is "fail." The other is to re-extract rules and improve them into the rule base at all levels.

[0035] Test engineers manually analyze unmatched logs to identify their categories and solutions. They extract keywords, regular expressions, or templates from the manual analysis results and update the new rules to the corresponding rule base (such as blacklists and common problem bases).

[0036] In some embodiments, matching the logs generated during the execution of test cases with a rule library includes: Performing keyword matching on the logs generated during the execution of test cases; Converting the logs generated during the execution of test cases into templates; Calculating the similarity between the converted template and the templates in the rule library; Determining whether the similarity exceeds a threshold; If the similarity exceeds the threshold, it is determined that the logs generated during the execution of test cases match the logs in the rule library.

[0037] Each rule in the rule library includes keywords, regular expressions, and templates. The log must contain keywords or phrases (such as "ERROR"). Regular expressions are used to match complex log patterns (such as "Received block \d+ from \d+"). Replace variables in the log (such as IP addresses, timestamps) with wildcards to generate a unified template.

[0038] Among them, in keyword matching, a string matching algorithm (such as the KMP algorithm) can be used to quickly determine whether the log contains keywords.

[0039] Using a string matching algorithm to determine whether a log contains keywords includes: constructing a partial match table (next array): setting the pattern string as P[0...m - 1], with a length of m, and defining an array next[0...m - 1]. Among them: next[i] = the length of the longest common prefix and suffix (that is, P[0...k - 1] = P[i - k...i - 1], and k < i).

[0040] Initialization: next[0] = 0, j = 0.

[0041] The recurrence from i = 1 to m - 1 is shown in Table 1: Table 1

[0042] Let the main string be S[0...n - 1], with a length of n, and the pattern string be P. The matching process is as follows: Initializing pointers i = 0 (main string position), j = 0 (pattern string position); When i < n and j < m: {if S[i] = P[j], i i + 1, j j + 1; else, if j > 0, j next[j - 1], else, i i + 1} if S[i]=P[j], else,i i+1,j j+1,if j>0,j next[j-1],i i+1.

[0043] If j=m, the match is successful and im is returned.

[0044] For example, use the kmp algorithm to determine that 90% of disk usage contains the keyword "disk usage log".

[0045] Construct the next array of the pattern string "Disk usage": Pattern string: "Disk usage" (length m = 10, including spaces); The next array represents the length of the longest common prefix and suffix. The construction process is shown in Table 2: Table 2

[0046] This pattern has no common prefix or suffix, so all next[i] = 0.

[0047] Matching process: Main string: "Disk usage 90%" (length n = 13).

[0048] Pattern string: "Disk usage" (length m = 10).

[0049] Matching steps: Initialize i = 0 (main string pointer), j = 0 (mode string pointer).

[0050] Compare the characters one by one: The first 10 characters of the main string "Disk usage 90%" exactly match the pattern string "Disk usage".

[0051] When j = 10, the pattern string has been fully matched and the matching position i - m = 0 is returned.

[0052] Logs matching the keyword are considered to contain alarm information. Next, they are matched with the logs in the log library to determine the error type. Specifically, the matching method can be used to calculate template similarity: After the log is converted into a template, similarity calculation is performed with the template in the rule base.

[0053] In some embodiments, calculating the similarity between the template obtained by log conversion and the template in the rule base includes: Calculate the length of the longest common subsequence between the template obtained by log transformation and the template in the rule base; According to the calculated length of the longest common subsequence, the length of the template obtained by log conversion, and the length of the template in the rule base, the harmonic mean similarity between the template obtained by log conversion and the template in the rule base is calculated.

[0054] If the harmonic mean similarity exceeds a threshold (eg, 0.8), the match is considered successful.

[0055] The formula for calculating harmonic mean similarity is as follows: .

[0056] Similarity represents the harmonic mean similarity. LCS length represents the length of the longest common subsequence, len(X) represents the length of sequence X, and len(Y) represents the length of sequence Y.

[0057] For example, X="ABCD", Y="ACD".

[0058] Similarity=2×3 / (4+3)≈0.857.

[0059] LCS (Longest Common Subsequence) is used to find the longest common subsequence between two sequences (the subsequences do not need to be continuous, but the order must match). The core calculation method and formula are as follows: Suppose two sequences are X=x1x2...xn and Y=y1y2...ym, and define a two-dimensional array dp[i][j] to represent the LCS length of X[1..i] and Y[1..j].

[0060] The recursive formula is as follows: .

[0061] Initialization: When i=0 or j=0, dp[0][j]=0, and dp[i][0]=0. This is because the empty sequence has no common subsequence.

[0062] Calculation steps: 1. Construct a dynamic planning table: From i=1 to n, j=1 to m, fill in the table according to the recursive formula.

[0063] 2. Backtrack to find the specific subsequence: Starting from dp[n][m], reverse the path: If xi=yj, the character belongs to LCS and moves to the upper left (i i-1, j j-1).

[0064] If not equal, move in the larger direction (left or up).

[0065] For example, assuming X="ABCBDAB" and Y="BDCAB", its dynamic programming table is shown in Table 3 (partial): Table 3

[0066]

[0067] The longest common subsequence is "BCAB" or "BDAB", both of which have a length of 4.

[0068] This embodiment processes logs in a templated manner, and achieves accurate matching of logs through keyword matching and template similarity calculation, thereby improving accuracy.

[0069] In some embodiments, further comprising: Predict the abnormal type of the second target log, and improve the rule base according to the second target log.

[0070] Wherein, improving the rule base according to the second target log includes: Group the second target logs and generate a new template; Extract keywords and variables from the second target log to generate new rules.

[0071] For unknown logs (i.e., logs that don't match existing rules), this embodiment automatically extracts rules and adds them to the rule base. Matching the rule base is primarily based on keyword filtering. Automatically improving the rule base eliminates analysis omissions if the keywords are sufficiently comprehensive.

[0072] In some embodiments, extracting new rules according to the second target log includes: Predicting the anomaly type of the second target log; Group the second target logs and generate a new template; Extract keywords and variables from the second target log.

[0073] For logs that don't match existing rules, machine learning analysis is performed, using LSTM (Long Short-Term Memory) or BERT (Bidirectional Encoder Representations from Transformers) models to predict the log's anomaly type. For example, the log message "Network latency exceeded 200ms" can be classified as "Network latency anomaly."

[0074] For logs that do not match existing rules, clustering and pattern mining are performed. The second target logs can be grouped using the LogCluster or IPLoM (Iterative Partitioning Log Mining) algorithm to generate new templates.

[0075] For example, "Disk usage 90%" and "Disk usage 85%" are clustered into "Disk usage <*>%".

[0076] For logs that do not match existing rules, dynamic rule generation is performed to extract keywords and variables from the logs, generate new rules, and update them to the rule base.

[0077] For example, extract the rule "Receivedblock \d+ from \d+" from the log "Received block 123 from 192.168.1.1".

[0078] In some embodiments, the stored logs of the server are associated with projects, models, and test cases.

[0079] In this embodiment, each log that enters the corresponding repository has an accompanying label, including the project, model, test case number, and corresponding rules, to associate the log with the project, model, and test case. This makes it easy to filter key logs based on conditions such as projects, models, and test cases, making it easier to analyze logs.

[0080] In summary, the log processing method provided by this application does not clear the server logs before executing the test case, but instead adopts a method of taking the differential logs of the server logs before and after executing the test case for analysis. This can effectively preserve the original logs from being destroyed, and can restore the test site when the BUG problem reappears later. In addition, the log processing method provided by this application adopts a rule base matching method to match the logs generated during the execution of the test case with the rule base, screen out known logs and unknown logs, and associate known logs with log analysis results, which can effectively improve the efficiency of log analysis, reduce manual input, improve the accuracy of analysis, and reduce the problem of omissions in analysis.

[0081] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0082] The embodiment of the present application also provides a log processing device, referring to Figure 5 As shown, the log processing device includes: A first acquisition module 10 is used to obtain the log of the server before executing the test case to obtain a first log; A second acquisition module 20 is used to obtain the log of the server after executing the test case to obtain a second log; A comparison module 30 is configured to compare the first log with the second log to obtain a log generated during the execution of the test case; The matching module 40 is configured to match the logs generated during the execution of the test case with the rule base to obtain a first target log and a second target log; the first target log is a log that matches the rules of the rule base and has a matching log analysis result, and the second target log is a log that does not match the rules of the rule base and does not have a matching log analysis result; The association module 50 is configured to associate the first target log with the matching log analysis result.

[0083] Based on the above embodiment, as a specific implementation, the matching module 40 is used to: The logs generated during the execution of the test cases are matched with the rule bases at each level step by step; among them, the logs retained after matching with the rule base of the previous level are matched with the rule base of the next level.

[0084] Based on the above embodiment, as a specific implementation, the matching module 40 includes: a first matching unit, configured to match logs generated during the execution of a test case with a blacklist library, retain logs that match the blacklist library, and determine that logs that do not match the blacklist library are traffic logs and ignore them; a second matching unit, configured to match the logs that match the blacklist library with the whitelist library, retain the logs that do not match the whitelist library, and determine that the logs that match the whitelist library are traffic logs and ignore them; a third matching unit, configured to match logs that do not match the whitelist library with an ignorable problem library, retain logs that do not match the ignorable problem library, and determine that logs that match the ignorable problem library are traffic logs and ignore them; a fourth matching unit, configured to match the logs that do not match the ignorable question library with the common question library, retain the logs that match the common question library; retain the logs that do not match the common question library, and obtain the second target logs; The fifth matching unit is used to match the logs that match the common problem library with the common ignorable problem library, retain the logs that do not match the common ignorable problem library, obtain the first target log, and determine that the logs that match the common ignorable problem library are traffic logs and ignore them.

[0085] Based on the above embodiment, as a specific implementation, the matching module 40 includes: Keyword matching unit, used to perform keyword matching on logs generated during the execution of test cases; The conversion unit is used to convert the logs generated during the execution of the test case into templates; A calculation unit, configured to calculate the similarity between the converted template and the template in the rule base; A judging unit, configured to judge whether the similarity exceeds a threshold; The determination unit is configured to determine whether the log generated during the execution of the test case matches the log in the rule base if the similarity exceeds a threshold.

[0086] Based on the above embodiment, as a specific implementation method, the following is also included: The prediction and improvement module is used to predict the abnormal type of the second target log and improve the rule base according to the second target log.

[0087] Based on the above embodiment, as a specific implementation method, the prediction and improvement module includes: a grouping unit, configured to group the second target logs and generate a new template; The extraction unit is configured to extract keywords and variables from the second target log and generate new rules.

[0088] Based on the above embodiment, as a specific implementation method, the stored logs of the server are associated with projects, models and test cases.

[0089] For the description of the features in the embodiment corresponding to the log processing device, please refer to the relevant description of the embodiment corresponding to the log processing method, and will not be repeated here.

[0090] The embodiment of the present application also provides an electronic device, referring to Figure 6 As shown, the electronic device includes a memory 1 and a processor 2. The memory 1 stores a computer program, and the processor 2 is configured to run the computer program to execute the steps in any one of the above-mentioned log processing method embodiments.

[0091] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any of the above-mentioned log processing method embodiments when running.

[0092] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0093] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of any of the above-mentioned log processing method embodiments are implemented.

[0094] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned log processing method embodiments are implemented.

[0095] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] The above is a detailed introduction to a log processing method, device, electronic device and computer-readable storage medium provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core ideas of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A log processing method, characterized in that: include: Get the server log before executing the test case and get the first log; Obtaining a log of the server after executing the test case to obtain a second log; Comparing the first log with the second log to obtain a log generated during the execution of the test case; Matching the logs generated during the execution of the test case with the rule base to obtain a first target log and a second target log; the first target log is a log that matches the rules of the rule base and has a matching log analysis result, and the second target log is a log that does not match the rules of the rule base and does not have a matching log analysis result; The first target log is associated with the matching log analysis result.

2. The log processing method according to claim 1, characterized in that: Matching the logs generated during the test case execution with the rule base includes: The logs generated during the execution of the test cases are matched with the rule bases at each level step by step; among them, the logs retained after matching with the rule base of the previous level are matched with the rule base of the next level.

3. The log processing method according to claim 2, characterized in that: Matching the logs generated during the execution of test cases with the rule bases at each level includes: Match the logs generated during the execution of the test case with the blacklist library, retain the logs that match the blacklist library, and determine that the logs that do not match the blacklist library are traffic logs and ignore them; Match the logs that match the blacklist library with the whitelist library, retain the logs that do not match the whitelist library, and determine that the logs that match the whitelist library are traffic logs and ignore them; Matching the logs that do not match the whitelist library with the ignorable problem library, retaining the logs that do not match the ignorable problem library, and determining the logs that match the ignorable problem library as traffic logs and ignoring them; Matching the logs that do not match the ignorable question library with the common question library, retaining the logs that match the common question library; retaining the logs that do not match the common question library, and obtaining the second target logs; Match the logs that match the common problem library with the common ignorable problem library, retain the logs that do not match the common ignorable problem library, obtain the first target log, and determine that the logs that match the common ignorable problem library are traffic logs and ignore them.

4. The log processing method according to claim 1, wherein: Matching the logs generated during the test case execution with the rule base includes: Perform keyword matching on the logs generated during the execution of test cases; Convert the logs generated during the execution of test cases into templates; Calculating the similarity between the converted template and the template in the rule base; Determining whether the similarity exceeds a threshold; If the similarity exceeds a threshold, it is determined that the log generated during the execution of the test case matches the log in the rule base.

5. The log processing method according to claim 1, wherein: Also includes: Predict the abnormal type of the second target log, and improve the rule base according to the second target log.

6. The log processing method according to claim 5, characterized in that: Improving the rule base according to the second target log includes: Group the second target logs and generate a new template; Extract keywords and variables from the second target log to generate new rules.

7. The log processing method according to claim 1, wherein: The stored logs of the server are associated with projects, models, and test cases.

8. A log processing device, characterized in that: include: A first acquisition module is used to obtain the log of the server before executing the test case to obtain a first log; A second acquisition module is used to obtain the log of the server after executing the test case to obtain a second log; A comparison module, configured to compare the first log with the second log to obtain a log generated during the execution of the test case; A matching module is configured to match the logs generated during the execution of the test case with the rule base to obtain a first target log and a second target log; the first target log is a log that matches the rules of the rule base and has a matching log analysis result, and the second target log is a log that does not match the rules of the rule base and does not have a matching log analysis result; An associating module is used to associate the first target log with the matching log analysis result.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the log processing method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the log processing method according to any one of claims 1 to 7 are implemented.

Images