A large model-based application log intelligent inspection method and system

Abstract

The application discloses a kind of based on big model's application log intelligent inspection method and system, it is related to big data analysis technical field, by sampling in the original log in preset time window;According to the data of pre-set target label, the mapping relationship of the original log and target label is established, and the log of key attention is identified;According to the dynamic vector of the key attention log and its context, the dynamic vector is embedded into the prompt word of big model, and the dynamic big model is obtained;The key attention log and its context are analyzed using the dynamic big model, and the log inspection result is obtained.Using the embodiment of the application, the preliminary automatic identification of abnormal log can be realized, and the subsequent identification process does not need to manually adjust the keyword frequently, the adaptive update of big model prompt word can be carried out, and has high universality.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of big data analysis, and particularly relates to an application log intelligent inspection method and system based on a large model. BACKGROUND

[0002] With the development of IT technology, the number and types of servers, routers, switches and other devices in enterprises and organizations increase, and the amount of log data generated is huge and continues to grow, which brings challenges to log management and analysis.

[0003] The existing log inspection method mainly uses log index data as the main part, supplemented by log text analysis. When analyzing abnormal logs, methods such as keyword search and template wildcard matching based on experience configuration are usually used, which has the problems of incomplete rule coverage, poor universality, and low intelligence, and is difficult to adapt to log analysis in various scenarios. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide an application log intelligent inspection method and system based on a large model, which can realize preliminary automatic identification of abnormal logs, does not need to manually adjust keywords frequently in the subsequent identification process, can adaptively update the large model prompt words, and has high universality.

[0005] The embodiments of the present application provide an application log intelligent inspection method based on a large model, which comprises:

[0006] Sampling original logs in a preset time window;

[0007] According to the data of the preset target label, a mapping relationship between the original logs and the target label is established, and a key attention log is identified;

[0008] According to the key attention log and its context, a dynamic vector is generated, the dynamic vector is embedded into the prompt word of the large model, and a dynamic large model is obtained;

[0009] The dynamic large model is used to analyze the key attention log and its context, and a log inspection result is obtained.

[0010] As an improvement of the above-mentioned scheme, the sampling of the original logs in the preset time window comprises:

[0011] According to a preset time interval, an inspection configuration is obtained, and an inspection task is started; the inspection configuration comprises a time range and an inspection target;

[0012] According to the inspection configuration, a log data list in the time range that meets the inspection target is queried, and an original log is obtained.

[0013] As an improvement of the above-mentioned scheme, the mapping relationship between the application log and the target label is established according to the preset target label data, and the key attention log is identified, including:

[0014] The preset target label data is converted into a target vector by using a vectorization service, and the application log is converted into a log vector;

[0015] The similarity between the log vector and each target vector is calculated, and the target label corresponding to the target vector with the highest similarity to the log vector is taken as the label value of the log vector;

[0016] According to the label value, the key attention log is identified.

[0017] As an improvement of the above-mentioned scheme, the label value includes an unexpected label, an error label and a message label, and the key attention log is identified according to the label value, including:

[0018] The original log with the label value as the unexpected label and the error label is marked as the key attention log;

[0019] If there is no original log with the unexpected label or the error label in the preset time window, the original log at the end of the preset time window is marked as the key attention log.

[0020] As an improvement of the above-mentioned scheme, the prompt word includes role definition, output target, input-output rule and dynamic placeholder; wherein the dynamic placeholder is used to embed a dynamic vector to prompt the large model.

[0021] As an improvement of the above-mentioned scheme, the dynamic vector is embedded into the prompt word of the large model according to the key attention log and its context to obtain a dynamic large model, including:

[0022] The context of the key attention log is obtained, and a key attention log set is obtained in combination with the key attention log;

[0023] The deployment application type and the associated database are obtained from the key attention log set, and a dynamic vector is generated according to the deployment application type and the associated database;

[0024] The dynamic vector is embedded into the prompt word of the large model to obtain a dynamic large model.

[0025] As an improvement of the above-mentioned scheme, the context of the key attention log is obtained, and a key attention log set is obtained in combination with the key attention log, including:

[0026] According to the time sequence, the n upper and lower original logs of the key attention log are obtained as the context; n is a preset context quantity;

[0027] The focus attention log and the context are dynamically aggregated, and repeated logs are removed to obtain a focus attention log set.

[0028] As an improvement of the above scheme, the focus attention log and its context are analyzed by the dynamic large model to obtain a log inspection result, including:

[0029] The focus attention log and its context are sorted in time sequence to obtain a log sequence.

[0030] In combination with a historical log inspection result, the dynamic large model is used to perform multi-round reasoning on the log sequence until the confidence is greater than a preset confidence threshold to obtain an output of the dynamic large model.

[0031] The abnormal level, log summary and solution output by the dynamic large model are assembled into a preset structure to obtain the log inspection result.

[0032] As an improvement of the above scheme, after the focus attention log and its context are analyzed by the dynamic large model to obtain a log inspection result, the application log intelligent inspection method based on a large model further includes:

[0033] If the abnormal level in the log inspection result is greater than a preset abnormal level threshold, the log inspection result is stored in a historical result database.

[0034] The embodiment of the application further provides an application log intelligent inspection system based on a large model, including:

[0035] A log sampling module is configured to sample original logs in a preset time window.

[0036] A log identification module is configured to establish a mapping relationship between the original logs and target labels according to data of preset target labels, and identify focus attention logs.

[0037] A vector embedding module is configured to generate a dynamic vector according to the focus attention logs and their contexts, embed the dynamic vector into a prompt word of a large model, and obtain a dynamic large model.

[0038] A log analysis module is configured to analyze the original logs by using the dynamic large model to obtain a log inspection result.

[0039] Compared with the prior art, the application discloses a kind of based on big model's application log intelligent inspection method and system, by sampling in preset time window original log;According to the data of preset target label, the mapping relationship of original log and target label is established, and the log of key attention is identified;According to the dynamic vector of key attention log and context, the dynamic vector is embedded into the prompt word of big model, and dynamic big model is obtained;The dynamic big model is used to analyze the key attention log and context, and log inspection result is obtained.Using the embodiment of the application, the preliminary automatic identification of abnormal log can be realized, and the subsequent identification process does not need to manually adjust the keyword frequently, can carry out the adaptive update of big model prompt word, with high universality. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 It is a step flow diagram of the application embodiment based on the application log intelligent inspection method of big model;

[0041] Figure 2 It is a structure diagram of the application embodiment based on the application log intelligent inspection system of big model. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the application will be described clearly and completely in the description of the application embodiments with reference to the drawings. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0043] In the description and claims of the specification, it should be understood that the terms first, second, etc. are only used to distinguish the description of the same technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features, nor necessarily describing the order or time sequence. In appropriate cases, the terms are interchangeable. Therefore, the features defined as "first", "second" can be explicitly or implicitly included at least one of the features.

[0044] The application embodiment provides a kind of based on big model's application log intelligent inspection method. Please see Figure 1 In the present embodiment, the application log intelligent inspection method based on big model is specifically executed by steps S1 to S4:

[0045] S1, sample original log in preset time window.

[0046] The original log in each preset time window is uniformly processed as a log inspection task. It should be noted that the size of the preset time window can be flexibly adjusted according to the business function corresponding to the original log, and can dynamically adapt to business changes.

[0047] S2, according to the data of the preset target label, a mapping relationship between the original log and the target label is established, and a key attention log is identified.

[0048] It should be noted that the data of the preset target label can be derived from historical data or simulated data, which meets the rules of the target label. The original log in the preset time window generally has several log data, each log data corresponds to different time or system state, based on the data of the target label, the data of each original log can be associated with the target label, so as to filter abnormal data, that is, the key attention log.

[0049] S3, according to the key attention log and its context, a dynamic vector is generated, the dynamic vector is embedded into the prompt word of the large model, and a dynamic large model is obtained.

[0050] Exemplarily, the large model is LLM (Large Language Model), which can itself perform semantic understanding and reasoning. In the prior art, the large model is generally caused to learn fixed keyword input or wildcard matching method, so as to meet the reasoning requirement. However, in the process of log analysis, the log business is complex and changeable, and a large amount of manpower is needed to maintain the keywords.

[0051] In the preferred embodiment of the present application, the required dynamic vector is quickly embedded in the form of template variable in the prompt word, the intelligent prompt word is automatically generated, and the log intelligent analysis business and the large model service are unified and encapsulated.

[0052] S4, the dynamic large model is used to analyze the key attention log and its context, and a log inspection result is obtained.

[0053] It should be noted that in the embodiment of the present application, since the key attention log has been screened, the dynamic large model only focuses on the key attention log and its context, thereby reducing the data processing amount of the large model and significantly improving the efficiency and accuracy of the large model for log analysis.

[0054] In the above scheme, by sampling the time window and establishing the mapping relationship with the target label, the key logs can be focused on; by the dynamic vector, the multi-dimensional information of the key logs in the current time window can be dynamically injected into the large model, and the adaptive update of the large model prompt word can be realized. The present embodiment has high universality, and compared with the existing fixed or simply adjusted prompt word mode, the efficiency and accuracy of the large model for log analysis can be significantly improved.

[0055] As a preferred embodiment, step S1, sampling the original log in the preset time window, comprises:

[0056] According to the preset time interval, the inspection configuration is obtained, and the inspection task is started; the inspection configuration comprises a time range and an inspection target;

[0057] According to the inspection configuration, the log data list meeting the inspection target in the time range is queried, and the original log is obtained.

[0058] Considering that the application log has multiple business sources, the user needs to pre-configure the log configuration information of the application log of each business. Exemplarily, the log configuration information comprises a cluster name to which the log belongs, a namespace name to which the log belongs, a deployment name to which the log belongs, whether to start polling, a configuration creation time and a configuration update time.

[0059] Based on whether to start polling and the configuration update time, the time range can be obtained as the preset time interval. For example, the application log of the first business starts polling, and the polling period is 10 min, so the preset time interval is 10 min, and at this time, the size of the preset time window is also 10 min. And when the configuration is updated, the preset time window is also updated.

[0060] Preferably, the inspection target comprises a target cluster, a target space and a target deployment name which need to be monitored. Exemplarily, based on the inspection target, a query request is sent in the ES log storage platform to filter out the log data list meeting the condition, and the original log is obtained.

[0061] Further, in the embodiment of the present application, if polling is started, a Celery timing task scheduler is used to trigger the inspection task according to the set time interval. Celery is a distributed task queue responsible for asynchronous task execution, which ensures that the inspection task does not block other business logic. The triggered task will be added to the task queue and start the specific inspection operation.

[0062] As a preferred embodiment, step S2, establishing the mapping relationship between the application log and the target label according to the data of the preset target label, identifying the key attention log, comprises:

[0063] The vectorization service converts data of preset target labels into target vectors and converts application logs into log vectors;

[0064] The similarity between the log vector and each target vector is calculated, and a target label corresponding to a target vector with the highest similarity to the log vector is taken as a label value of the log vector;

[0065] According to the label value, a log of focus is identified.

[0066] In some preferred embodiments, the vectorization service is implemented based on a GET general semantic vector. That is, data of preset target labels are converted into target vectors by calling a GTE vectorization service, and each application log is calculated as a 768-dimensional floating-point number log vector by calling the GTE vectorization service, and then a label is intelligently assigned to each log based on a KNN algorithm by using the similarity principle in a vector space, so as to quickly locate all abnormal logs in a log window.

[0067] Specifically, 100 logs are sent to the GTE vector calculation service as a batch to obtain vector embedding expressions of all current logs, and based on the similarity principle in the vector space, a label most similar to each log vector is found and assigned, so as to realize intelligent label recognition ability relying on the vector space.

[0068] The similarity principle of semantic vectors can be simply understood as that the cosine similarity of the vector results of the two words "king" and "queen" after being mapped to a vector space is much greater than the similarity of "king" and "benzene propylene". Based on this similarity principle, we can only know the content of the target label to realize fast label matching of general text content, so as to realize fast, general and intelligent identification ability of abnormal logs.

[0069] Further, in some preferred embodiments, the label value includes an unexpected label, an error label and a message label, and the identification of the log of focus according to the label value includes:

[0070] The original log with the label value of the unexpected label or the error label is marked as the log of focus;

[0071] If there is no original log with the unexpected label or the error label in a preset time window, the original log at the end of the preset time window is marked as the log of focus.

[0072] Exemplarily, the data of the label types of Exception (unexpected), Error (error), and Info (message) are built in, and the vector information of each label can be obtained after the label data is input into the GTE vector calculation service. The logs with the intelligent label values of Error or Exception in the window are found as the focus logs; and considering that there can be no abnormal logs in the entire time window, the latest log at the end of the log queue is preferentially sampled for analysis to ensure that the analysis result is the latest state.

[0073] As a preferred embodiment, the prompt word includes a role definition, an output target, an input-output rule, and a dynamic placeholder; wherein the dynamic placeholder is used to embed a dynamic vector to prompt the large model.

[0074] It should be noted that each part of the prompt word has its specific function and role. The role definition can help the large model to clearly define its core function; the output target is the specific task that the large model needs to complete, such as log analysis, summary production, and abnormal analysis; the core of the input-output rule is to define the operation process and output format that the model must follow, and through these rules, the large model can be limited within a specific task range to ensure the normativity and consistency of the output; the dynamic placeholder is used to dynamically add additional prompt content according to the focus logs and their context.

[0075] In a specific embodiment, the content of the role definition part in the prompt word is:

[0076] <text>

[0077] You are an application log analysis assistant that can help users analyze the raw log content input by the user

[0078] <\TEXT>

[0079] It makes the large model clear its role as "application log analysis assistant", and the core function is to process and analyze the raw log content provided by the user.

[0080] The content of the output target part in the prompt word is:

[0081] <text>

[0082] The user input is the original log content, you need to be faithful to the original log content and analyze the log content step by step:

[0083] Parse each content in the JSON log

[0084] Summarize the basic information contained in each log

[0085] Analyze the problems and exceptions of all the logs you receive

[0086] Do not output your thinking process, only return the final result

[0087] Ensure that the data you return is in the correct JSON format, do not add any explanatory words or special characters

[0088] <\TEXT>

[0089] The output target gives the core tasks that the large model needs to complete from the five dimensions of log parsing, summary generation, exception analysis, output requirements, and popularization.

[0090] The content of the input and output rules in the prompt word is:

[0091] <text>

[0092] The current system time is {{#get current time / {x}text#}}

[0093] The input data is in JSON format. Example data:

[0094] {

[0095] "projectName":"xxxx",

[0096] "app_id":"xxxxx",

[0097] "timestamp":"xx xx,xxxx@xx:xx:xx.xxx",

[0098] "cluster_name":"xxxx",

[0099] "kubernetes.namespace":"xx",

[0100] "kubernetes.node.name":"xxxxxx",

[0101] "kubernetes.pod.name":"xxxxxxxxxx",

[0102] "kubernetes.container.name":"xxxxxxxxx",

[0103] "container.id":"xxxxxxxxxxxx",

[0104] "message":"xxxxxxxxxxxxxxxxxxxxx"

[0105] }

[0106] Provide an overall summary of the user logs, within 500 words.

[0107] Determine if any anomalies exist in the logs, and provide a conclusion title and brief description.

[0108] The output data is in JSON format. Example output:

[0109] {

[0110] "ai_abstract":"xxxxxxxxx",

[0111] "ai_level":"Normal / Alarm / Critical",

[0112] "ai_title":"xxxxxxx",

[0113] "ai_description":"xxxxxxxxxxxxxxxx",

[0114] "ai_suggestion":"xxxxxxxxxxxxxxxx"

[0115] }

[0116] <\TEXT>

[0117] In the requirements of input rules, the timeliness of log analysis is ensured by dynamically obtaining the current system time, and it is further specified that the input must be in JSON format, and data samples containing project name (projectName), application ID (app_id), timestamp, cluster name (cluster_name), Kubernetes information (kubernetes.namespace), and log content are provided.

[0118] In the requirements of output rules, the overall content summary of large model logs (ai_abstract), the judgment of log exception level (ai_level), and the title (ai_title) and simple description (ai_description) are required, and the final output format must be JSON.

[0119] The content of the dynamic placeholder part in the prompt word is:

[0120] <text>

[0121] {{#start / {x}extra_prompt#}}

[0122] <\TEXT>

[0123] In specific calls, model developers can insert additional prompts here according to actual needs. For example, further optimize output requirements; add user-defined analysis rules in the configuration file; and pull system metadata through the system ledger, including the type of deployed application (tomcat, nginx, springboot) and the type of associated database (Redis, MySQL), etc.

[0124] Further, as a preferred implementation, step S3, generating a dynamic vector based on the key focus log and its context, and embedding the dynamic vector into the prompts of the large model to obtain the dynamic large model, includes:

[0125] Obtain the context of the key focus logs, and combine the key focus logs to obtain a set of key focus logs;

[0126] Obtain the deployment application type and associated database from the key focus log set, and generate a dynamic vector based on the deployment application type and the associated database;

[0127] The dynamic vectors are embedded into the prompts of the large model to obtain the dynamic large model.

[0128] It should be noted that analyzing only a single log entry for an anomaly may lead to a misjudgment of the anomaly type. For example, focusing on a log entry for connection timeout may not be accurate, as different timeouts, such as database connection timeout, API call timeout, and network timeout, manifest differently and require different solutions. Therefore, obtaining the context can clarify the scenario in which the anomaly occurred, capture the complete anomaly propagation chain, and trace the preceding anomalies.

[0129] For example, the application type is determined by the service identifier or container tag in the logs; the database connection string is extracted from the logs, and the SQL statement features are analyzed to identify the database type and the operation object. When generating the dynamic vector, semantic features of the log set are extracted based on text; the application type is encoded; database features are constructed according to the database type; time-series features are calculated based on log timestamps; topological features are calculated based on service dependencies; and an attention mechanism is used to fuse the semantic features, application type encoding, database features, time-series features, and topological features to obtain the dynamic vector.

[0130] Further, preferably, the context of the focus log is obtained, and a focus log set is obtained by combining the focus log, comprising:

[0131] In time sequence, n pieces of original logs above and below the focus log are obtained as the context; n is a preset context quantity;

[0132] The focus log and the context are dynamically aggregated to remove duplicate logs to obtain a focus log set.

[0133] By dynamically aggregating the focus log and the context, overlapping logs can be removed. In some embodiments, the number of context logs obtained is updated, and context logs are obtained again to ensure that the preset context quantity is met.

[0134] As a preferred embodiment, step S4, the focus log and its context are analyzed by the dynamic large model to obtain a log inspection result, comprising:

[0135] The focus log and its context are sorted in time sequence to obtain a log sequence;

[0136] In combination with historical log inspection results, the dynamic large model is used to perform multiple rounds of reasoning on the log sequence until the confidence is greater than a preset confidence threshold to obtain the output of the dynamic large model;

[0137] The abnormal level, log summary and solution output by the dynamic large model are assembled into a preset structure to obtain a log inspection result.

[0138] In the embodiments of the present application, the dynamic large model analyzes one or more JSON format log data, and each log contains project name, application ID, timestamp, cluster name, Kubernetes information (node, Pod, container) and specific log content (message).

[0139] The dynamic large model first parses the input JSON data and extracts key meta-information such as project name, application ID, and deployed application category. Then, the dynamic large model analyzes all log contents to determine whether there is an abnormality or problem. According to the abnormal level of the log content, the dynamic large model generates a corresponding conclusion.

[0140] Exemplarily, in a specific embodiment, the JSON log input into the dynamic large model is:

[0141] <json>

[0142] {

[0143] "projectName":"MyProject",

[0144] "app_id":"123456",

[0145] "timestamp":"10 Oct, 2023 @ 15:30:45.678",

[0146] "cluster_name":"ClusterA",

[0147] "kubernetes.namespace":"default",

[0148] "kubernetes.node.name":"node-01",

[0149] "kubernetes.pod.name":"pod-001",

[0150] "kubernetes.container.name":"container-001",

[0151] "container.id":"abc123def456",

[0152] "message":"Error: Server is down"

[0153] }

[0154] < / json>

[0155] The dynamic large model performs multi-round reasoning based on the prompt word embedded with the dynamic vector, and obtains the following log inspection result:

[0156] <json>

[0157] {

[0158] "ai_abstract":"MyProject's application logs show that there is a problem with the container-001 container in node-01 of pod-001 in ClusterA cluster."

[0159] "ai_level":"Severe",

[0160] "ai_title":"Server failure",

[0161] "ai_description":"The log content indicates that the server has crashed."

[0162] "ai_suggestion": "It is recommended to check the server status immediately and restart the service."

[0163] }

[0164] < / json>

[0165] It should be noted that in the embodiments of the present application, the dynamic large model not only supports the embedding of the dynamic vector in the prompt word, but also combines it with the user-defined rules and the system account (current). In addition, the dynamic large model also supports dynamic specification of specific models. By way of example, the default model is deepseek-r1, and in the case of logs containing obvious errors, the Qwen2.5-Coder model is used, which can speed up the processing of data.

[0166] As a preferred embodiment, the application log intelligent inspection method based on a large model further comprises the step S5 of storing the log inspection result in a historical result database if the abnormal level in the log inspection result is greater than a preset abnormal level threshold.

[0167] By storing the analyzed log inspection result in the historical result database, subsequent queries, screening and analysis can be facilitated. By way of example, in addition to the abnormal level, result title, log summary and solution suggestion in the log inspection result, the stored content also includes the inspection time, log window time, log cluster name, log space and log deployment name.

[0168] By using the application log intelligent inspection method based on a large model provided by the embodiments of the present application, the time window sampling and the mapping relationship with the target label can be established to focus on key logs. The dynamic vector can dynamically inject multi-dimensional information of the key logs in the current time window into the large model, which can realize adaptive updating of the large model prompt word, has high universality, and can significantly improve the efficiency and accuracy of the large model for log analysis compared with the existing fixed or simply adjusted prompt word method.

[0169] The embodiments of the present application provide an application log intelligent inspection system based on a large model. Please refer to Figure 2 The application log intelligent inspection system based on a large model comprises a log sampling module 11, a log recognition module 12, a vector embedding module 13 and a log analysis module 14, wherein:

[0170] The log sampling module 11 is used to sample the original logs in a preset time window;

[0171] The log recognition module 12 is used to establish a mapping relationship between the original logs and the target label according to the data of the preset target label, and to recognize the key attention logs;

[0172] The vector embedding module 13 is configured to generate a dynamic vector according to the focus log and its context, embed the dynamic vector into a prompt word of a large model, and obtain a dynamic large model.

[0173] The log analysis module 14 is configured to analyze the original log by using the dynamic large model, and obtain a log inspection result.

[0174] As a preferred implementation, the log sampling module 11 is specifically configured to:

[0175] According to a preset time interval, obtain an inspection configuration, and start an inspection task; the inspection configuration includes a time range and an inspection target.

[0176] According to the inspection configuration, query a log data list that meets the inspection target in the time range, and obtain an original log.

[0177] As a preferred implementation, the log identification module 12 includes:

[0178] The vectorization unit is configured to convert data of a preset target label into a target vector and convert an application log into a log vector by using a vectorization service.

[0179] The similarity calculation unit is configured to calculate the similarity between the log vector and each target vector, and take a target label corresponding to a target vector with the highest similarity to the log vector as a label value of the log vector.

[0180] The log identification unit is configured to identify a focus log according to the label value.

[0181] Further, preferably, the label value includes an unexpected label, an error label, and a message label, and the log identification unit is specifically configured to:

[0182] Mark an original log with the unexpected label or the error label as the focus log.

[0183] If there is no original log with the unexpected label or the error label in a preset time window, mark an original log at the end of the preset time window as the focus log.

[0184] As a preferred implementation, the prompt word includes a role definition, an output target, an input-output rule, and a dynamic placeholder; the dynamic placeholder is configured to embed a dynamic vector to prompt the large model.

[0185] As a preferred implementation, the vector embedding module 13 includes:

[0186] a context acquisition unit, configured to acquire a context of the focus log, and combine the focus log to obtain a focus log set;

[0187] a dynamic vector generation unit, configured to acquire a deployment application type and an associated database from the focus log set, and generate a dynamic vector according to the deployment application type and the associated database;

[0188] a dynamic vector embedding unit, configured to embed the dynamic vector into a prompt word of a large model to obtain a dynamic large model.

[0189] Further, preferably, the context acquisition unit is specifically configured to:

[0190] acquire n original logs before and after the focus log in time sequence as the context; n is a preset context quantity;

[0191] perform dynamic aggregation on the focus log and the context, and remove duplicate logs to obtain the focus log set.

[0192] As a preferred implementation, the log analysis module 14 is specifically configured to:

[0193] sort the focus log and the context in time sequence to obtain a log sequence;

[0194] perform multi-round reasoning on the log sequence by using the dynamic large model in combination with a historical log inspection result until a confidence is greater than a preset confidence threshold to obtain an output of the dynamic large model;

[0195] assemble an abnormal level, a log abstract, and a solution output by the dynamic large model into a preset structure to obtain a log inspection result.

[0196] As a preferred implementation, the application log intelligent inspection system based on a large model further includes a result storage module, configured to: if an abnormal level in the log inspection result is greater than a preset abnormal level threshold, store the log inspection result into a historical result database.

[0197] By using the application log intelligent inspection system based on a large model provided in the embodiments, a mapping relationship with a target label can be established through time window sampling, and key logs can be focused on; multi-dimensional information of focus logs in a current time window can be dynamically injected into a large model through a dynamic vector, adaptive update of a prompt word of the large model can be realized, the system has high universality, and compared with a fixed or simply adjusted prompt word, the system can also significantly improve efficiency and accuracy of log analysis of the large model.

[0198] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing relevant hardware, and the program can be stored in a computer readable storage medium. When the program is executed, the program can include the processes of the above-mentioned embodiment methods. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM), or the like.

[0199] The above is the preferred embodiment of the present application. It should be pointed out that those skilled in the art can make several improvements and refinements without departing from the principles of the present application, and these improvements and refinements are also considered to be within the scope of protection of the present application.< / text> < / text> < / text> < / text>

Claims

1. A large model-based application log intelligent inspection method, characterized in that, The method comprises the following steps: sampling original logs within a preset time window; establishing a mapping relationship between the original logs and target labels according to preset data of the target labels, and identifying focus logs; generating a dynamic vector according to the focus logs and their context, embedding the dynamic vector into a prompt word of a large model, and obtaining a dynamic large model; analyzing the focus logs and their context by using the dynamic large model to obtain log inspection results; The method comprises the following steps: using a vectorization service to convert preset data of target labels into target vectors and convert application logs into log vectors; calculating the similarity between the log vector and each target vector, and taking the target label corresponding to the target vector with the highest similarity with the log vector as the label value of the log vector; identifying focus logs according to the label value; The prompt word comprises role definition, output target, input-output rule and dynamic placeholder; wherein the dynamic placeholder is used to embed a dynamic vector to prompt the large model; The method comprises the following steps: obtaining the context of the focus logs, and obtaining a focus log set by combining the focus logs; obtaining a deployment application type and an associated database from the focus log set, and generating a dynamic vector according to the deployment application type and the associated database; embedding the dynamic vector into a prompt word of a large model to obtain a dynamic large model.

2. The large model-based application log intelligent inspection method of claim 1, wherein, The method comprises the following steps: According to a preset time interval, obtain an inspection configuration, and start an inspection task; the inspection configuration comprises a time range and an inspection target; According to the inspection configuration, query a log data list that meets the inspection target in the time range to obtain original logs.

3. The large model-based application log intelligent inspection method of claim 1, wherein, If the label value comprises an unexpected label, an error label and a message label, the method comprises the following steps: marking original logs with unexpected labels and error labels as focus logs; If there is no original log with an unexpected label or an error label in a preset time window, marking the original log at the end of the preset time window as a focus log.

4. The large model-based application log intelligent inspection method of claim 1, wherein, The method comprises the following steps: According to a time sequence, obtaining n original logs above and below the focus logs as context; n is a preset context quantity; dynamically aggregating the focus logs and the context to remove duplicate logs to obtain a focus log set.

5. The large model-based application log intelligent inspection method of claim 1, wherein, The method comprises the following steps: sorting the focus logs and their context in chronological order to obtain a log sequence; In combination with the historical log inspection result, the dynamic large model is used to perform multiple rounds of reasoning on the log sequence until the confidence is greater than a preset confidence threshold, and an output of the dynamic large model is obtained; The abnormal level, log summary and solution output by the dynamic large model are assembled into a preset structure to obtain a log inspection result.

6. The large model-based application log intelligent inspection method of claim 1, wherein, After the log inspection result is obtained by analyzing the key attention log and its context using the dynamic large model, the application log intelligent inspection method based on the large model further includes: If the abnormal level in the log inspection result is greater than a preset abnormal level threshold, the log inspection result is stored in a historical result database.

7. A large model-based application log intelligent inspection system, characterized in that, Comprise: A log sampling module for sampling original logs within a preset time window; A log identification module for establishing a mapping relationship between the original logs and target labels according to preset target label data, and identifying key attention logs; A vector embedding module for generating a dynamic vector according to the key attention logs and their context, embedding the dynamic vector into a prompt word of a large model, and obtaining a dynamic large model; A log analysis module for analyzing the original logs using the dynamic large model to obtain a log inspection result; The log identification module comprises: A vectorization unit for converting preset target label data into target vectors and converting application logs into log vectors using a vectorization service; A similarity calculation unit for calculating the similarity between the log vector and each target vector, and taking the target label corresponding to the target vector with the highest similarity to the log vector as the label value of the log vector; A log identification unit for identifying key attention logs according to the label value; The prompt word includes role definition, output target, input / output rule and dynamic placeholder; wherein the dynamic placeholder is used to embed a dynamic vector to prompt the large model; The vector embedding module comprises: A context acquisition unit for acquiring the context of the key attention logs, and obtaining a key attention log set in combination with the key attention logs; A dynamic vector generation unit for acquiring a deployment application type and an associated database from the key attention log set, and generating a dynamic vector according to the deployment application type and the associated database; A dynamic vector embedding unit for embedding the dynamic vector into a prompt word of a large model to obtain a dynamic large model.

Images