Log analysis method and device, electronic equipment and storage medium

Abstract

The application discloses a log analysis method and device, electronic equipment and a storage medium, and relates to the technical field of computers, which comprises the following steps: acquiring at least one target character matched with a key character set in a current log; determining target character causal trees corresponding to the at least one target character from a character causal tree set; acquiring the respective causal tree types of the at least one target character causal tree; and determining a log analysis result of the current log. Through the judgment of the causal tree type and the combination of the context association of the target character, comprehensive analysis of the log is realized, the context relationship of the key character in the log can be considered, the accuracy of log analysis is improved, and the problem of low accuracy of log analysis results in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a log analysis method, apparatus, electronic device, and storage medium. Background Technology

[0002] In related technologies, log analysis is often based on regular expressions. However, this method can only identify fixed, isolated keywords and cannot take into account the contextual relationship of keywords in the log. This results in incomplete log analysis results and low accuracy. Summary of the Invention

[0003] This application provides log analysis methods, apparatus, electronic devices, and storage media to at least address the problem of low accuracy in log analysis in related technologies.

[0004] This application provides a log analysis method, comprising: obtaining at least one target character in the current log that matches a set of key characters, wherein multiple key characters in the set of key characters respectively correspond to a character causal tree in a set of character causal trees, the character causal tree is used to indicate a log segment in a reference log, at least one cause node in the character causal tree is used to indicate a predecessor character associated with the key character in the reference log, and at least one result node in the character causal tree is used to indicate a successor character associated with the key character in the reference log; determining target character causal trees corresponding to at least one target character from the set of character causal trees; obtaining the causal tree type of each of the at least one target character causal tree; and determining the log analysis result of the current log, wherein the causal tree type is determined according to the log event type of the log segment indicated by the target character causal tree.

[0005] This application also provides a log analysis apparatus, comprising: a first acquisition unit, configured to acquire at least one target character in the current log that matches a set of key characters, wherein multiple key characters in the set of key characters respectively correspond to a character causal tree in a set of character causal trees, the character causal tree is used to indicate a log segment in a reference log, at least one cause node in the character causal tree is used to indicate a predecessor character associated with the key character in the reference log, and at least one result node in the character causal tree is used to indicate a successor character associated with the key character in the reference log; a determination unit, configured to determine, from the set of character causal trees, a target character causal tree corresponding to at least one of the target characters respectively; and a second acquisition unit, configured to acquire the causal tree type of each of the at least one target character causal tree and determine the log analysis result of the current log, wherein the causal tree type is determined according to the log event type of the log segment indicated by the target character causal tree.

[0006] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described log analysis methods.

[0007] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described log analysis methods.

[0008] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described log analysis methods.

[0009] This application obtains at least one target character in the current log that matches a set of key characters. Each key character in the key character set corresponds to a character causal tree in a character causal tree set. The character causal tree indicates a log segment in a reference log, where the cause and effect nodes indicate the predecessor and successor characters associated with the key character in the reference log, respectively. This step, through the correspondence between key characters and causal trees, overcomes the limitation of only identifying isolated keywords, associating keywords with their predecessors and successors in the context. Next, the target character causal trees corresponding to each of the at least one target character are determined from the character causal tree set. This allows the target character in the current log to find a corresponding reference structure containing contextual associations such as predecessors and successors, providing a concrete basis for analyzing the target character's context in the current log and avoiding the one-sidedness of relying solely on fixed keywords. Finally, the causal tree type of each of the at least one target character causal tree is obtained, thereby determining the log analysis results for the current log. By determining the cause-effect tree type and combining it with the contextual relationship of the target character, a comprehensive analysis of the log is achieved. This takes into account the contextual relationship of key characters in the log, thereby improving the accuracy of log analysis and solving the problem of low accuracy of log analysis results in existing technologies. Attached Figure Description

[0010] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A hardware structure block diagram of a server device for a log analysis method provided in an embodiment of this application;

[0012] Figure 2 This is a schematic diagram of one of the optional log analysis methods according to an embodiment of this application;

[0013] Figure 3 This is a second schematic diagram of an optional log analysis method according to an embodiment of this application;

[0014] Figure 4 This is a third schematic diagram of an optional log analysis method according to an embodiment of this application;

[0015] Figure 5 This is a fourth schematic diagram of an optional log analysis method according to an embodiment of this application;

[0016] Figure 6 This is a fifth schematic diagram of an optional log analysis method according to an embodiment of this application;

[0017] Figure 7 This is a schematic diagram of an optional log analysis method according to an embodiment of this application;

[0018] Figure 8 This is a schematic diagram (seventh) of an optional log analysis method according to an embodiment of this application;

[0019] Figure 9 This is a schematic diagram of an optional log analysis method according to an embodiment of this application;

[0020] Figure 10 This is a schematic diagram of an optional log analysis method according to an embodiment of this application;

[0021] Figure 11 This is a structural block diagram of a log analysis device according to an embodiment of this application;

[0022] Figure 12 This is a schematic diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0024] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0025] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0026] The methods and embodiments provided in this application can be executed on a server device or a similar computing device. Taking running on a server device as an example, Figure 1 This is a hardware structure block diagram of a computer device for a log analysis method according to an embodiment of this application. For example... Figure 1 As shown, the server device may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The server device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the server equipment described above. For example, the server equipment may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0027] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the log analysis method in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thus implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to server devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0028] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider for the server device. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0029] This embodiment provides a log analysis method. Figure 2 This is a flowchart of a log analysis method according to an embodiment of this application, such as... Figure 2 As shown, the process includes the following steps:

[0030] S202, obtain at least one target character in the current log that matches the set of key characters, wherein multiple key characters in the set of key characters correspond to a character causal tree in the character causal tree set, the character causal tree is used to indicate the log paragraph in the reference log, at least one cause node in the character causal tree is used to indicate the predecessor character associated with the key character in the reference log, and at least one effect node in the character causal tree is used to indicate the successor character associated with the key character in the reference log;

[0031] Optionally, in this embodiment, the key character set may refer to, but is not limited to, a set of multiple key characters, where each key character corresponds to a character causal tree in the character causal tree set. This causal tree can serve as a matching benchmark to locate the core character to be analyzed in the current log. For further example, in a log text from a server, the key character set may include "error," "warning," "success," etc., each corresponding to a different character causal tree.

[0032] Optionally, in this embodiment, the target character may refer to, but is not limited to, a character in the current log that matches the set of key characters. Its function is to determine the objects in the current log that need to be analyzed in detail. For example, if the character "error" is matched in the current log, and "error" is a key character in the set of key characters, then "error" is the target character.

[0033] Optionally, in this embodiment, the character causal tree set may refer to, but is not limited to, a set composed of multiple character causal trees. Each character causal tree corresponds to a key character and can store the preceding and succeeding characters of the key character in the reference log as the context association of the key character, providing a reference framework for analyzing the current log. For further example, assuming the key character is "error", its corresponding causal tree may include its preceding node "connection timeout" and its succeeding node "service interruption", etc.

[0034] Optionally, in this embodiment, the character causal tree may refer to, but is not limited to, a tree structure containing cause nodes and effect nodes for indicating log segments in a reference log. Cause nodes can be used to indicate the preceding character associated with the key character in the reference log, while effect nodes can be used to indicate the succeeding character. Through contextual relationships, the meaning and impact of the key character in the current log can be accurately identified. For further example, in a causal tree where the key character is "success", the cause node could be "user login request", and the effect node could be "session establishment".

[0035] Optionally, in this embodiment, a character that matches any key character in the key character set is first found in the current log. If it is a matching function, then the character in the current log is used as the target character.

[0036] To further illustrate, suppose the set of key characters is {"error" "success"}, each corresponding to a separate cause-effect tree. If "error" appears in the current log, then "error" is the target character, and its corresponding cause-effect tree could have a cause node of "disk read / write failure" and an effect node of "data loss warning".

[0037] S204, determine the target character causal tree corresponding to at least one target character from the character causal tree set;

[0038] Optionally, in this embodiment, based on the matched target character, a target causal tree corresponding to the target character is found from the character causal tree set, thereby providing a specific reference for subsequent analysis of the contextual association of the target character.

[0039] To illustrate further, if the target character is "success", then the causal tree corresponding to "success" is found from the character causal tree set. In this tree, the cause node can be "file transfer request" and the effect node can be "transfer completion confirmation".

[0040] S206, obtain the causal tree type of each of the at least one target character causal tree, and determine the log analysis result of the current log, wherein the causal tree type is determined according to the log event type of the log segment indicated by the target character causal tree.

[0041] Optionally, in this embodiment, the causal tree type may refer to, but is not limited to, the type determined based on the log event type of the log segment indicated by the target character causal tree, and can be used to determine whether a log event is normal or abnormal, etc. Its function is to serve as a basis for determining the nature of the current log event. For example, if the log event type indicated by the causal tree is "system error," then the causal tree type is an error type; if it is "normal operation completed," then it is a normal type.

[0042] Optionally, in this embodiment, the log analysis results may refer to, but are not limited to, the analysis conclusions of the current log determined based on the causal tree type of the target character causal tree, which can clearly define the current log status such as normal or abnormal, and can provide a basis for log processing and system maintenance.

[0043] Optionally, in this embodiment, the log event type corresponding to the causal tree of each target character is analyzed to obtain the causal tree type, and the current log status is determined accordingly, such as whether the log contains normal information or abnormal information, and then the final analysis result related to the current log is obtained to clarify the nature or information of the current log.

[0044] To illustrate further, suppose the log event type indicated by the target character causal tree is "normal login completed", then the causal tree type is normal, and the analysis result of the current log is "normal login operation"; if the causal tree indicates "database connection failed", then the causal tree type is abnormal, and the analysis result is "database connection abnormal".

[0045] It should be noted that by matching key characters, associating causal trees, and determining the type of causal tree, the current log is analyzed to determine the system status reflected in the log. This fully utilizes the contextual information of key characters in the causal tree as a reference log, improving the accuracy and comprehensiveness of log analysis and providing a reliable basis for system maintenance and troubleshooting.

[0046] This application's embodiments obtain at least one target character in the current log that matches a set of key characters. Each key character in the key character set corresponds to a character causal tree in a character causal tree set. The character causal tree indicates a log segment in a reference log, where the cause and effect nodes indicate the predecessor and successor characters associated with the key character in the reference log, respectively. This step, through the correspondence between key characters and causal trees, overcomes the limitation of only identifying isolated keywords, associating keywords with their predecessors and successors in the context. Next, target character causal trees corresponding to at least one target character are determined from the character causal tree set. This allows the target character in the current log to find a corresponding reference structure containing contextual associations such as predecessors and successors, providing a concrete basis for analyzing the target character's context in the current log and avoiding the one-sidedness of relying solely on fixed keywords. Finally, the causal tree type of each of the at least one target character causal tree is obtained, thereby determining the log analysis result of the current log. By determining the cause-effect tree type and combining it with the contextual relationship of the target character, a comprehensive analysis of the log is achieved. This takes into account the contextual relationship of key characters in the log, thereby improving the accuracy of log analysis and solving the problem of low accuracy of log analysis results in existing technologies.

[0047] As an optional approach, before determining at least one entity object associated with the target hardware and the interaction relationships between at least one entity object from the embedded knowledge graph based on the parsing results of the request description text, the method further includes:

[0048] S1, obtain the reference log, wherein the reference log includes multiple log segments, each corresponding to a log event type;

[0049] S2, determine at least one sample log window based on the reference log, wherein the sample log window is used to segment the reference log, the length of the sample log window is less than or equal to the maximum number of words in each line of the reference log, and the width of the sample log window is less than or equal to the number of lines in the reference log.

[0050] S3, traverse at least one sample log window, and construct at least one first sample causal tree corresponding to the current sample log window based on the current sample log window;

[0051] S4. Construct a set of character causal trees based on the first sample causal tree corresponding to at least one sample log window.

[0052] Optionally, in this embodiment, the sample log window may refer to, but is not limited to, a local area used to segment the reference log. Its length does not exceed the maximum number of words per line of the reference log, and its width does not exceed the number of lines of the reference log. It can segment continuous reference logs into processable local units, making it easier to extract key information and contextual relationships from them.

[0053] Optionally, in this embodiment, the first sample causal tree may refer to, but is not limited to, a causal tree constructed based on a single sample log window, which includes key information, cause nodes of the preceding content corresponding to the key information, and result nodes of the following content corresponding to the key information, and is used to form a character causal tree set.

[0054] Optionally, in this embodiment, reference logs are collected as the analysis benchmark. Each reference log consists of multiple log segments, and each segment can correspond to a specific log event type, such as error events, normal operation events, etc.

[0055] Next, sample log windows are divided in the reference log. The length of the window does not exceed the maximum number of words per line of the reference log, and the width does not exceed the total number of lines in the reference log. This is used to segment the reference log to extract local information. By dividing the continuous reference log into processable local windows, it is easier to extract key information and contextual relationships from them, providing local analysis units for the construction of the causal tree.

[0056] Then, each sample log window is processed one by one, and a corresponding first sample causal tree is constructed based on the information within the window. The causal tree contains key information, cause nodes, and effect nodes. By mining key information and its contextual causal relationships from each local window, the scattered log information can be transformed into a structured causal tree.

[0057] Finally, the first sample causal trees corresponding to all sample log windows are integrated to form a character causal tree set containing multiple causal trees. Each causal tree corresponds to the causal relationship between a specific key character and its entity. By summarizing all extracted causal relationships, a reusable structured set is formed, thus providing a standardized reference for subsequent analysis of the current logs.

[0058] It should be noted that by obtaining the original reference log, then dividing the reference log into analyzable sample windows based on sample windows, and then extracting causal relationships from each window to construct a sample causal tree, and finally integrating them into a set of character causal trees, the transformation from the original log to a structured set of causal relationships is achieved. This provides a standardized and reusable foundation for subsequent log analysis using causal trees, thereby improving the comprehensiveness and accuracy of log analysis.

[0059] This application's embodiments involve obtaining a reference log, where each of the reference log's multiple log segments corresponds to a log event type; determining at least one sample log window based on the reference log, where the sample log window is used to segment the reference log, the length of the sample log window is less than or equal to the maximum number of words per line in the reference log, and the width of the sample log window is less than or equal to the number of lines in the reference log; traversing at least one sample log window, and constructing at least one first sample causal tree corresponding to the current sample log window; and constructing a character causal tree set based on the first sample causal trees corresponding to each of the at least one sample log window. By obtaining the original reference log, segmenting it into analyzable sample windows based on the sample windows, extracting causal relationships from each window to construct sample causal trees, and finally integrating them into a character causal tree set, the transformation from the original log to a structured causal relationship set is achieved. This provides a standardized and reusable foundation for subsequent log analysis using causal trees, thereby improving the comprehensiveness and accuracy of log analysis.

[0060] As an optional approach, at least one sample log window is traversed, and at least one first sample causal tree corresponding to the current sample log window is constructed based on the current sample log window, including:

[0061] S1, through the current sample log window, traverse from left to right starting from the first row and first column of the reference log;

[0062] S2, if the current sample log window is not at the bottom of the reference log and the current line traversal is finished, move the current sample log window down one line from its current position and start traversing from left to right from the first column of the reference log;

[0063] S3, if the current sample log window is at the bottom of the last line of the reference log and the current line traversal is finished, end the traversal of the reference log by the current sample log window and obtain at least one sample window information corresponding to the current sample log window.

[0064] S4. Based on at least one sample window information, construct at least one first sample causal tree corresponding to the current sample log window.

[0065] Optionally, in this embodiment, the current sample log window refers to a local analysis unit used to segment the reference log. It has a specific length and width, and slides through the reference log according to rules to locate and extract local information, providing basic data for subsequent causal tree construction. A reference log can have multiple sample log windows simultaneously. For example, a reference log with a length of 16 and a width of 20 can have multiple reference log windows of different sizes, such as sample log windows with a length of 2 and a width of 3, sample log windows with a length of 5 and a width of 4, or sample log windows of other lengths and widths.

[0066] Optionally, in this embodiment, the first row and the first column may be, but are not limited to, the starting position of the reference log, and may also be, but are not limited to, the starting point of the upper left corner of the log content, in order to determine the initial coordinates for traversing the sample log window.

[0067] Optionally, in this embodiment, the last line may be, but is not limited to, the end line of the reference log, or it may be, but is not limited to, the bottom line of the log content, serving as a termination marker for the vertical traversal of the sample log window, ensuring that the traversal completely covers the log content. When the current sample log traverses from the first row and first column of the reference log to the last row and last column, it can be determined that the current sample log window has completed the traversal of the reference log, obtaining at least one sample window information.

[0068] Optionally, in this embodiment, the sample window information may be, but is not limited to, the local log content extracted during the traversal of the current sample log window, and may include, but is not limited to, words, characters and their positional relationships within the window, recording key information and contextual information of the local log. For further example, a sample window may contain content such as "disk read / write failure, data loss" and their positional relationships.

[0069] Optionally, in this embodiment, using the current sample log window as a tool, starting from the beginning position of the reference log, such as the first row and first column, the log content covered by the window is traversed from left to right to obtain the sample window information. This allows the starting point and initial direction of the traversal to be determined, ensuring that the sample log window can cover the horizontal content of the reference log. Further, as an example, optionally... Figure 3 As shown, this is a schematic diagram of this embodiment, wherein, as Figure 3 As shown in (a), the sample log window 304 is a window with a length of 2 and a width of 2, which can be understood as being able to hold 2×2 characters. The sample log window 304 traverses from the first row and first column of the reference log 302, which has a length of 5 and a width of 5; as Figure 3 As shown in (b), the sample log window 304 slides from left to right along the current row and slides one column to the right.

[0070] Next, when the sample log window has completed traversing the current line (covering the valid range of that line), and the bottom of the window has not reached the last line of the reference log, the entire window is moved down one line, and the horizontal traversal starts again from the first column of the new line. By sliding the window vertically, multiple lines of the reference log content are covered, avoiding the omission of cross-line and column context information and ensuring comprehensive traversal. Further examples can be optionally provided, such as... Figure 4 As shown, this is another schematic diagram in this embodiment, wherein, as Figure 4 As shown in (a), the sample log window 404 is a window with a width of 2, which can be understood as being able to hold 2×2 characters. After finishing traversing the first line of the reference log 402, it is optional to... Figure 4 As shown in (b), the sample log window 404 moves down one line and continues to traverse from the first column of the reference log 402.

[0071] Then, if the bottom of the sample log window has reached the last line of the reference log and the traversal of that line is completed, the traversal process of the window is stopped. At the same time, all local log contents extracted during the traversal are collected as sample window information, thereby completing the traversal of the reference log by the sample log window, ensuring that the traversal covers all the contents of the reference log, and obtaining at least one sample window information.

[0072] Finally, based on the content of the sample window information, the corresponding first sample causal tree is constructed. By transforming the scattered content in the sample window information into structured causal relationships, the establishment of causal relationships from local log information is realized.

[0073] It should be noted that by systematically sliding windows and extracting information, the local correlations in the reference logs are transformed into structured causal trees, which provides a foundation for the formation of subsequent character causal tree sets. This solves the problem of difficulty in capturing contextual correlations in traditional log analysis and improves the structuring and accuracy of log analysis.

[0074] In this embodiment, the current sample log window is traversed from left to right, starting from the first row and first column of the reference log. If the current sample log window is not at the bottom of the last row of the reference log and the current row traversal ends, the current sample log window is moved down one row, and the traversal starts from the first column of the reference log again. If the current sample log window is at the bottom of the last row of the reference log and the current row traversal ends, the traversal of the reference log by the current sample log window ends, and at least one sample window information corresponding to the current sample log window is obtained. Based on at least one sample window information, at least one first sample causal tree corresponding to the current sample log window is constructed. Through systematic window sliding and information extraction, local associations in the reference log are transformed into structured causal trees, providing a foundation for the formation of subsequent character causal tree sets, thereby improving the accuracy of log analysis.

[0075] As an optional approach, based on at least one sample window information, at least one first sample causal tree corresponding to the current sample log window is constructed, including:

[0076] S1, traverse at least one sample window information and determine the character at the center of the current sample window information as the key character corresponding to the current sample window information;

[0077] S2, for at least one target sample window information with the same target key character, based on the positional relationship of the predecessor character and the positional relationship of the successor character of the target key character in each target sample window information, at least one target cause node and at least one target effect node corresponding to the target key character are determined, wherein the target cause node is used to indicate the predecessor character associated with the target key character in the reference log, and the target effect node is used to indicate the successor character associated with the target key character in the reference log.

[0078] S3, by determining the causal tree corresponding to the target key character through the horizontal and vertical deviations between the target cause node and the target key character, wherein at least one first sample causal tree includes a causal tree;

[0079] S4, by determining the fruit tree corresponding to the target key character through the horizontal and vertical deviations between the target fruit node and the target key character, wherein at least one first sample causal tree includes a fruit tree.

[0080] Optionally, in this embodiment, the key character: the core character determined from the information center position of the sample window, is the core node of the causal tree, which can serve as the association center between the cause node and the effect node, connecting the causal relationships in the local log.

[0081] Optionally, in this embodiment, the target key character may refer to, but is not limited to, the same key character in multiple sample window information, which can be used to group the sample window information, thereby realizing centralized analysis of the same type of key characters, and facilitating the construction of a unified causal relationship model.

[0082] Optionally, in this embodiment, the lateral deviation may refer to, but is not limited to, the difference in position between the target cause node or effect node and the key character in the horizontal direction. This determines the left-right distribution of nodes in the cause tree or effect tree, reflecting the lateral positional relationship. For example, if the key character is in the 2nd column and the predecessor character is in the 1st column, then the lateral deviation can be 1.

[0083] Optionally, in this embodiment, the vertical deviation may refer to, but is not limited to, the positional difference in the vertical direction between the target cause node or effect node and the key character. This determines the hierarchy of nodes in the cause tree or effect tree, reflecting the vertical positional relationship. For example, if the key character is in the 2nd row and its successor is in the 3rd row, then the vertical deviation can be 1.

[0084] Optionally, in this embodiment, the cause tree may refer to, but is not limited to, a tree structure constructed based on the positional deviation between the target cause node and the key character, reflecting the predecessor associations of the key character. This structured display of the reasons for the occurrence of the key character provides a causal reference for log analysis.

[0085] Optionally, in this embodiment, the fruit tree may refer to, but is not limited to, a tree structure constructed based on the positional deviation between the target fruit node and the key character, reflecting the subsequent association relationship of the key character. Its function is to structurally display the results caused by the key character, providing causal reference for log analysis.

[0086] Optionally, in this embodiment, the sample window information is processed one by one, and the character at the geometric center of each window is identified as the key character corresponding to that window. This quickly locates the core characters in the sample window, identifies the core nodes for subsequent causal relationship analysis, and simplifies the key information extraction process.

[0087] Next, sample window information with the same key character is grouped together. Based on the positional relationship between the key character and its predecessor and successor characters within the group, the target cause node and target effect node corresponding to the key character are extracted. Furthermore, in this embodiment, if in the first and second sample window information with the same key character, the characters to the left of the key character are all a specific character, since this character is a predecessor character in the key information, it is determined as the cause of the key information.

[0088] Then, based on the horizontal position difference between the target cause node and the target key character, the horizontal deviation is used, and the vertical position difference is used as the vertical deviation. The cause nodes are organized into a tree structure according to left and right and hierarchy, and the cause tree is a component of the first sample causal tree. Based on the horizontal and vertical deviations of the target result node relative to the target key character, the result nodes are organized into a tree structure according to left and right and hierarchy, and the result tree is a component of the first sample causal tree.

[0089] It should be noted that by transforming scattered local log information into a structured causal relationship model, the foundation is laid for the subsequent formation of a character causal tree set, enabling log analysis to more accurately capture the causal relationships of key characters and improve the accuracy of log analysis.

[0090] In this embodiment, at least one sample window is traversed, and the character at the center of the current sample window is identified as the key character corresponding to the current sample window. For at least one target sample window with the same target key character, based on the positional relationship of the target key character's predecessor and successor characters in each target sample window, at least one target cause node and at least one target effect node corresponding to the target key character are determined. The target cause node indicates the predecessor character associated with the target key character in the reference log, and the target effect node indicates the successor character associated with the target key character in the reference log. Through the horizontal and vertical deviations between the target cause node and the target key character, a causal tree corresponding to the target key character is determined, wherein at least one first sample causal tree includes a cause tree. Similarly, through the horizontal and vertical deviations between the target effect node and the target key character, an effect tree corresponding to the target key character is determined, wherein at least one first sample causal tree includes an effect tree. By transforming scattered local log information into a structured causal relationship model, a foundation is laid for the formation of subsequent character causal tree sets, enabling log analysis to more accurately capture the causal relationships of key characters and improving the accuracy of log analysis.

[0091] As an optional approach, after obtaining at least one sample window information corresponding to the current sample log window, at least one of the following is included:

[0092] S1, perform normalization processing on at least one sample window information, wherein the normalization processing is used to convert information of different formats into the same format;

[0093] S2, perform noise reduction processing on at least one sample window information, wherein the noise reduction processing is used to remove meaningless information from the information;

[0094] S3, perform data cleaning on at least one sample window of information, wherein data cleaning is used to remove incomplete information.

[0095] Optionally, in this embodiment, normalization processing may refer to, but is not limited to, the process of converting sample window information of different formats into a unified format, which can eliminate the analysis interference caused by format differences, ensure the consistency of data format in subsequent processing, and facilitate the comparison and integration of information.

[0096] Optionally, in this embodiment, noise reduction processing may refer to, but is not limited to, the process of removing meaningless information from the sample window information. This can filter out redundant content that does not affect the extraction of key information, reduce data interference, and highlight effective information. For example, removing punctuation marks, spaces, and specific device codes from logs.

[0097] Optionally, in this embodiment, data cleaning may refer to, but is not limited to, the process of removing incomplete information from the sample window information, which can ensure the integrity and reliability of the data and avoid the negative impact of incomplete information on the construction of the causal tree. For example, removing content containing only words that are missing some characters.

[0098] It should be noted that by normalizing the format, removing redundancy through noise reduction, and cleaning the data to ensure its integrity, the quality of the sample window information is improved. This solves the problems of messy format, excessive redundant information, and incomplete data in the reference log, thereby improving the accuracy and effectiveness of causal relationship analysis of the log through character causal tree sets.

[0099] This application's embodiments perform normalization processing on at least one sample window information, whereby normalization processing converts information of different formats into the same format; noise reduction processing is performed on at least one sample window information, whereby noise reduction processing removes meaningless information from the information; and data cleaning is performed on at least one sample window information, whereby data cleaning removes incomplete information. By unifying the format through normalization processing, removing redundancy through noise reduction processing, and ensuring integrity through data cleaning, the quality of the sample window information is improved, thereby solving problems such as messy formats, excessive redundant information, and incomplete data in the reference log, and further improving the accuracy and effectiveness of causal relationship analysis of logs using character causal tree sets.

[0100] As an optional approach, after constructing at least one first sample causal tree corresponding to the current sample log window based on at least one sample window information, the following steps are included:

[0101] S1, Obtain at least one second sample causal tree corresponding to the reference log;

[0102] S2, if the first key character corresponding to the first sample causal tree is the same as the second key character corresponding to the second sample causal tree, merge the first sample causal tree and the second sample causal tree.

[0103] Optionally, in this embodiment, the second sample causal tree may refer to, but is not limited to, other causal trees corresponding to the reference log, which may come from different sample log windows or different paragraphs of the reference log. It can serve as a comparison and supplementary object for merging causal trees, enriching the coverage of causal relationships.

[0104] Optionally, in this embodiment, a second sample causal tree is obtained from a reference log. When the first key character of the first sample causal tree is the same as the second key character of the second sample causal tree, the cause and effect trees of the two are integrated, duplicate cause and effect nodes are merged, and new nodes are added to form a more complete causal tree.

[0105] To further illustrate, when the first and second key characters are the same, their cause and effect trees are integrated, merging duplicate nodes and adding new nodes to form a more comprehensive cause-effect tree. This integrates the causal relationships of similar key characters, avoids duplicate storage, and expands the coverage of the cause-effect tree. For example, merging two cause-effect trees with "error" as the key character adds a "network latency" node to the cause tree and a "service degradation" node to the effect tree.

[0106] It should be noted that by merging character causal trees with the same key characters, more causal relationships associated with the key characters are supplemented, making the causal tree more comprehensively reflect the contextual relationships of key characters in the reference log. This provides a more comprehensive causal tree for the construction of the character causal tree set, improving the accuracy and comprehensiveness of log analysis.

[0107] In the embodiments of this application, S1, at least one second sample causal tree corresponding to the reference log is obtained; if the first key character corresponding to the first sample causal tree is the same as the second key character corresponding to the second sample causal tree, the first sample causal tree and the second sample causal tree are merged. By merging the character causal trees with the same key character, more causal relationships associated with the key character are supplemented, making the causal tree more comprehensively reflect the contextual association of the key character in the reference log, providing a more comprehensive causal tree for the construction of the character causal tree set, and improving the accuracy and comprehensiveness of log analysis.

[0108] As an optional approach, based on at least one causal tree, the causal tree type of each of the at least one target character causal tree is obtained, and the log analysis result of the current log is determined, including:

[0109] S1, traverse the target characters in the current log, and when the current target character is reached, obtain at least one log window corresponding to the current target character, wherein the log window includes the current target character;

[0110] S2, traverse each log window of the current target character, and when traversing to the current log window, obtain the context information corresponding to the current log window. The context information is used to indicate the predecessor and successor characters of the target character.

[0111] S3 matches all context information corresponding to the current target character with the target character causal tree corresponding to the current target character, and determines the log analysis result based on the matching result.

[0112] Optionally, in this embodiment, the log window may, but is not limited to, refer to a local log area containing the current target character, with a specific length and width, used to extract the context information of the target character. Its function is to define the context range of the target character, ensuring that its preceding and succeeding characters can be accurately obtained. For example, a 3x3 log window centered on "error".

[0113] Optionally, in this embodiment, context information may refer to, but is not limited to, the preceding characters to the left and above the target character, the succeeding characters to the right and below the target character in the log window, and their positional relationship with the target character. It reflects the actual contextual association of the target character in the current log and is direct data matched with the causal tree of the target character. For example, the context information for "error" may include the preceding "memory overflow" and the succeeding "program crash".

[0114] Optionally, in this embodiment, target characters in the current log are examined one by one. When a target character is encountered, at least one log window containing that character is extracted to represent the local log area surrounding the target character. This locates the position of the target character in the log and defines its context range through the log window, preparing for the extraction of contextual information.

[0115] Next, each log window containing the current target character is processed sequentially. The characters to the left and above the target character are extracted as predecessor characters, and the characters to the right and below are determined as successor characters, thus obtaining context information. By acquiring the actual contextual association of the target character in the current log, data is provided for subsequent matching with the target character's causal tree.

[0116] The system compares all context information of the current target character with the corresponding causal tree of the target character, and determines the system state reflected in the log based on the degree of matching. By verifying whether the context of the target character in the current log conforms to the causal pattern in the reference log, the analysis conclusion is finally drawn.

[0117] To further illustrate, suppose the target character is "error". In its corresponding cause-effect tree, the cause nodes are "memory overflow" and "disk failure", and the effect nodes are "program crash" and "data loss". The predecessor of the current context information is "memory overflow" and the successor is "program crash", which perfectly matches the cause-effect tree. The log analysis result is "matches the expected error pattern and is judged as a system anomaly".

[0118] It should be noted that by constructing a causal tree based on the target character in the reference log, the actual context of the current log is compared with the expected causal relationship. This solves the problem of relying on a single keyword and making it difficult to combine context in traditional log analysis, improving the accuracy and logic of log analysis. It can effectively identify the normal operating status or abnormal events of the system and provide a reliable basis for system maintenance.

[0119] In this embodiment, the target characters in the current log are traversed. When the target character is reached, at least one log window corresponding to the target character is obtained, wherein the log window includes the target character. Each log window of the target character is traversed. When the target window is reached, the context information corresponding to the current log window is obtained, wherein the context information is used to indicate the predecessor and successor characters of the target character. All context information corresponding to the target character is matched with the target character causal tree corresponding to the target character, and the log analysis result is determined based on the matching result. By comparing the actual context of the current log with the expected causal relationship based on the target character causal tree constructed in the reference log, the problem of relying on a single keyword and difficulty in combining context judgment in traditional log analysis is solved, improving the accuracy and logic of log analysis, and effectively identifying the normal operating status or abnormal events of the system.

[0120] As an optional approach, after matching all context information corresponding to the current target character with the target character causal tree corresponding to the current target character, and determining the log analysis result based on the matching result, the method further includes at least one of the following:

[0121] S1, if the log analysis results indicate that there is security anomaly information in the current log, send a first prompt message, wherein the first prompt message is used to instruct the device associated with the current log to modify the security policy;

[0122] S2, if the log analysis results indicate that there is performance anomaly information in the current log, send a second prompt message, wherein the second prompt message is used to instruct the device associated with the current log to perform load balancing;

[0123] S3, if the log analysis results indicate that there is abnormal operation information in the current log, send a third prompt message, wherein the second prompt message is used to instruct the device associated with the current log to perform data backup.

[0124] Optionally, in this embodiment, security anomaly information may refer to, but is not limited to, anomalies related to device security reflected in the current log, such as unauthorized access or virus intrusion, which can trigger a prompt to adjust security policies and ensure device security.

[0125] Optionally, in this embodiment, the first prompt message may refer to, but is not limited to, a prompt sent when the analysis result indicates a security anomaly. This prompt instructs the device associated with the log to modify its security policy, reminding the user to adjust security settings promptly and prevent security risks. For example, the first prompt message could be used to indicate "An unauthorized login attempt has been detected; it is recommended to update the firewall rules immediately."

[0126] Optionally, in this embodiment, the performance anomaly information may refer to, but is not limited to, device performance-related anomalies reflected in the current log, such as high CPU usage or response latency, which can trigger load balancing prompts and optimize device performance.

[0127] Optionally, in this embodiment, the second prompt message may refer to, but is not limited to, a prompt sent when the analysis result indicates a performance anomaly. It is generated based on the analysis result and log type, and is used to instruct the device to perform load balancing, providing guidance to alleviate performance pressure through load distribution and ensure stable device operation. For example, the second prompt message may be used to indicate "The server CPU utilization rate continues to exceed 90%, it is recommended to offload some tasks to a backup server."

[0128] Optionally, in this embodiment, the abnormal operation information may refer to, but is not limited to, abnormal situations in the device operation process reflected in the current log, such as program crashes, data read / write errors, etc., which can trigger data backup prompts to prevent data loss.

[0129] Optionally, in this embodiment, the third prompt message may refer to, but is not limited to, a prompt sent when the analysis result indicates an operational anomaly. It is generated based on the analysis result and log type, and is used to instruct the device to perform data backup. This reminds users to back up data promptly, reducing the risk of data loss due to anomalies. For example, the third prompt message could be used to indicate "Frequent database connection interruptions; it is recommended to perform a full data backup immediately."

[0130] It should be noted that after identifying security anomalies, performance anomalies, or operational anomalies based on the analysis results, corresponding prompts are sent to guide relevant devices to perform operations such as modifying security policies, load balancing, or data backup. This achieves a closed loop from log analysis to proactive response, solving the problem that traditional log analysis only focuses on discovering problems without providing targeted handling suggestions. It can quickly respond to various anomalies, reduce security risks, ensure stable device performance, prevent data loss, and improve the timeliness and effectiveness of system operation and maintenance.

[0131] In this embodiment of the application, when the log analysis result indicates that there is security anomaly information in the current log, a first prompt message is sent, wherein the first prompt message is used to instruct the device associated with the current log to modify the security policy; when the log analysis result indicates that there is performance anomaly information in the current log, a second prompt message is sent, wherein the second prompt message is used to instruct the device associated with the current log to perform load balancing; when the log analysis result indicates that there is operational anomaly information in the current log, a third prompt message is sent, wherein the second prompt message is used to instruct the device associated with the current log to perform data backup.

[0132] As an alternative approach, the method also includes:

[0133] S1, If ​​the target character is not included in the current log, input the current log into the type analysis model and obtain the judgment result output by the type analysis model;

[0134] S2, Based on the judgment result, construct at least one third sample causal tree that matches the current log, wherein the judgment result is used to indicate the log type to which each log segment in the current log belongs;

[0135] S3, add the third sample causal tree to the character causal tree set.

[0136] Optionally, in this embodiment, the type analysis model may refer to, but is not limited to, a model capable of analyzing log content and determining the type of log segments. When the current log does not contain the target character, the model can process the log and output a determination result, providing a basis for type judgment for logs without target characters. For example, it can determine whether there is an error in the log without target characters. If there is no error, the log belongs to the correct type; if there is an error, the log belongs to the incorrect type.

[0137] Optionally, in this embodiment, the determination result may refer to, but is not limited to, the output information obtained by the type analysis model after processing the current log, explicitly indicating the specific log type to which each log segment in the current log belongs. Its purpose is to provide a classification basis for the subsequent construction of the third-sample causal tree, making the construction of the causal tree more targeted.

[0138] Optionally, in this embodiment, the third sample causal tree may refer to, but is not limited to, a causal tree constructed based on the judgment result that matches the logs currently without target characters. It includes key characters, cause nodes, and effect nodes, reflecting the causal relationships between characters in this type of log. Its function is to supplement the character causal tree set, enabling it to cover more log types without target characters and improving the completeness of the set.

[0139] It should be noted that by determining the log type through the type analysis model, constructing a third sample causal tree based on the type, and adding it to the character causal tree set, the limitations of relying solely on target characters for log analysis are overcome. This enables effective processing of all types of logs, continuously expands the coverage of the character causal tree set, and makes the character causal tree set more comprehensive and complete.

[0140] In this embodiment, when the target character is not present in the current log, the current log is input into a type analysis model to obtain a determination result output by the type analysis model. Based on the determination result, at least one third-sample causal tree matching the current log is constructed, where the determination result indicates the log type to which each log segment belongs. The third-sample causal tree is then added to the character causal tree set. By determining the log type through a type analysis model, constructing a third-sample causal tree based on the type, and adding it to the character causal tree set, the limitations of relying solely on the target character for log analysis are overcome. This achieves effective processing of all log types, continuously expands the coverage of the character causal tree set, and makes the character causal tree set more comprehensive and complete.

[0141] As an optional solution, in order to better understand the process of the above log analysis method, the following describes the execution flow of the above log analysis method in conjunction with optional embodiments, but it is not intended to limit the technical solution of the embodiments of this application.

[0142] This embodiment proposes a standardized method for constructing a key information model library based on causal trees for various types of logs, focusing on the construction of a key information model library during the extraction of key information from logs. The key information model library is used for log analysis, abandoning the original line-by-line regular expression matching method, which facilitates more efficient and comprehensive analysis by combining log causal relationships. For various error log information, the construction of the key information model library is completed in four steps: sliding the log window set, comparing the content of each window to capture two-dimensional suspicious information, constructing a causal tree based on the suspicious information, and building the key information model library.

[0143] Specifically, it includes the following: (1) Sliding the log window set. For each error log information: ① Divide the window. The minimum length of the window is 1 and the maximum is the number of keywords in each line of the log. The minimum width of the window is 1 and the maximum is the number of lines in the log. The length and width of the window cannot be 1 at the same time. ② Slide the window to get the log information. Slide the window from the upper left to the lower right in the log content. Each block of the window can contain one log information (each word, number, and text separated by a space can be regarded as a log information). ③ Get the window set. Window information of the same size can be regarded as a set.

[0144] (2) Compare the contents of each window to capture two-dimensional suspicious information. The log information located in the middle of the window by default is the key (the key can be one log information or multiple log information). The log information to the left and above the key is the cause, and the log information to the right and below the key is the effect. Filter the key with high frequency and its associated cause and effect. For all window sets: ① Noise reduction of window log content, removing all meaningless information such as punctuation marks, spaces, and specific device codes in the window information; ② Compare all log information in each window set, and filter the key with high frequency and its associated cause and effect as suspicious information; ③ Record the content and location of all suspicious information.

[0145] (3) Construct a causal tree based on the suspicious information. Based on the suspicious information filtered out from all the error information: ① group all suspicious information with the same key into one group; ② construct an IC tree based on all the factors in each group, determine whether each factor element is in the left or right child node of the IC tree based on the horizontal deviation of each factor element relative to the key, and determine the level of the IC tree based on the vertical deviation of the factor element relative to the key; ③ construct an OC tree based on all the results in each group, and the construction principle is the same as that of the IC tree.

[0146] (4) Expand the key information model library. For each key and its corresponding IC tree and OC tree, if the current key value is not contained in the model library, it is directly stored in the model library. If the current key value is already contained in the model library, the new IC tree and OC tree are merged with the IC tree and OC tree in the library. The construction and expansion of the key information model library are now complete.

[0147] Further examples, such as Figure 5 The flowchart shown is a flowchart of this embodiment, which specifically includes the following:

[0148] S502, Input error log information, the error log is shown below. Figure 6 As shown, error log 602 is a 5×5 log, with each square representing a character or word;

[0149] S504, divide the window. The minimum length of the window is 1, and the maximum is the number of keywords per line in the log. The minimum width of the window is 1, and the maximum is the number of lines in the log. The length and width of the window cannot both be 1. Further examples will be provided, continuing based on... Figure 6 Optional, such as Figure 7 As shown, there is a 3×3 window 702 in error log 602;

[0150] S506, slide the window to get log information. Slide the window from the top left to the bottom right in the log content. Each block of the window can contain a log information (each word, number, and text separated by a space can be regarded as a log information). Record the information of each window.

[0151] S508, Get window set, information about windows of the same size can be regarded as a set;

[0152] S510, window content noise reduction, removes all meaningless information such as punctuation marks, spaces, and specific device codes from window information. Optionally, Figure 8 This is a noise reduction diagram in this embodiment, where (a) is window information without noise reduction processing, and after noise reduction processing, (b) is obtained, where (b) is window information after noise reduction processing, with meaningless commas removed;

[0153] S512, retrieve suspicious information, compare all log information in each window set, and filter out frequently occurring keys and their associated causes and effects as suspicious information. Optionally, Figure 9 This is a schematic diagram of obtaining suspicious information in this embodiment, where (a) is window information 902, (b) is window information 904, and (c) is suspicious information 906. In the process of obtaining suspicious information 906 based on window information 902 and window information 904, since the key of both window information 902 and window information 904 is "f", and in window information 902, the right side of "f" is "v" and the lower left corner of "f" is "z", while in window information 904, the right side of "f" is "m" and the lower left corner of "f" is "v", and other information is the same, therefore... Figure 9 The suspicious information 906 shown in (c) does not contain the parts that are different from those in window information 902 and window information 904, but only retains the same content. In the suspicious information 906, the cause of "f" is "n", "ds", "n", and the result of "f" is "m" and "d".

[0154] S514 records the content and location of suspicious information. The key's location is denoted as tl (upper left), tr (upper right), bl (lower left), and br (lower right). The first index represents the vertical distance relative to the key, and the second index represents the horizontal distance relative to the key. For example... Figure 9 The suspicious information 906 represented by (c) in the figure can be represented as follows, with key f, because: (tl 11 ,n),(tl 01 ,n), (tr 10 ,ds), the result is: (bl 10 ,m), (bl 11 ,d).

[0155] S516, Suspicious Information Grouping: Group all suspicious information with the same key into one group, such as... Figure 10 The diagram shown is a schematic diagram of suspicious information with the same key in this embodiment. (a) is suspicious information 1002 and (b) is suspicious information 1004. Suspicious information 1002 and suspicious information 1004 both use f as the key value, so suspicious information 1002 and suspicious information 1004 can be divided into a group of suspicious information.

[0156] S518, construct the IC tree. Construct the IC tree based on all factors in each group of suspicious information. Determine whether each factor element is in the left or right child node of the IC tree based on the horizontal deviation of the factor element relative to the key. Determine the level in the IC tree based on the vertical deviation of the factor element relative to the key.

[0157] S520 constructs the OC tree; the construction of the OC tree and the IC tree use the same principle.

[0158] S522, expand the key information database model. For each key and its corresponding IC tree and OC tree, if the current key value is not contained in the model database, it is directly stored in the model database. If the current key value is already contained in the model database, the new IC tree and OC tree are merged with the IC tree and OC tree in the database. At this point, the model database is complete.

[0159] S504, S506, and S508 are steps for dividing log windows; S510, S512, and S514 are steps for capturing two-dimensional suspicious information; S516, S518, and S520 are steps for constructing a causal tree; and S522 is a step for expanding the key information database.

[0160] It should be noted that this embodiment proposes a standardized key information model library construction method based on causal trees for various types of logs, which is aimed at the construction of key information model library in the process of extracting key information from logs. By combining error log context information with a sliding window approach, the original one-dimensional keywords (regular expressions) are expanded into two-dimensional error information (causal trees). It not only includes the error information content, but also the keywords, causes and results of each error information, which greatly reduces manual intervention and significantly increases the amount of information contained in the error model. The key information model library is expanded in an automated manner, which is convenient, has a wide coverage and high accuracy.

[0161] Through the embodiments of this application, the original one-dimensional keywords (regular expressions) are expanded into two-dimensional error information (causal tree) by combining error log context information in a sliding window manner. It not only includes the error information content, but also the keywords, causes and results of each error information, which greatly reduces manual intervention and significantly increases the amount of information contained in the error model. It expands the key information model library in an automated way, which is convenient, has a wide coverage and high accuracy.

[0162] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0163] Based on this understanding, the technical solution of this application, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of this application.

[0164] This embodiment also provides a log analysis device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0165] Figure 11 This is a structural block diagram of a log analysis device according to an embodiment of this application; as shown... Figure 11 As shown, it includes:

[0166] The first acquisition unit 1102 is used to acquire at least one target character in the current log that matches the set of key characters, wherein multiple key characters in the set of key characters correspond to a character causal tree in the character causal tree set, the character causal tree is used to indicate a log segment in the reference log, at least one cause node in the character causal tree is used to indicate the predecessor character associated with the key character in the reference log, and at least one effect node in the character causal tree is used to indicate the successor character associated with the key character in the reference log.

[0167] The determining unit 1104 is used to determine, from the character causal tree set, the target character causal tree corresponding to at least one target character respectively;

[0168] The second acquisition unit 1106 is used to acquire the causal tree type of each of at least one target character causal tree and determine the log analysis result of the current log, wherein the causal tree type is determined according to the log event type of the log segment indicated by the target character causal tree.

[0169] As an optional solution, the determining unit 1104 includes: a first acquisition module for acquiring a reference log, wherein the reference log includes multiple log segments, each corresponding to a log event type; a determining module for determining at least one sample log window based on the reference log, wherein the sample log window is used to segment the reference log, the length of the sample log window is less than or equal to the maximum number of words per line in the reference log, and the width of the sample log window is less than or equal to the number of lines in the reference log; a first construction module for traversing at least one sample log window and constructing at least one first sample causal tree corresponding to the current sample log window; and a second construction module for constructing a character causal tree set based on the first sample causal trees corresponding to each of the at least one sample log window.

[0170] As an optional approach, the first construction module includes: a traversal submodule, used to traverse the reference log from left to right, starting from the first row and first column, through the current sample log window; a shift submodule, used to shift the current sample log window down one row from its current position and traverse the reference log from left to right, if the current sample log window is not at the bottom of the last row of the reference log and the current row traversal has ended; an end submodule, used to end the traversal of the reference log by the current sample log window if the current sample log window is at the bottom of the last row of the reference log and the current row traversal has ended, and obtain at least one sample window information corresponding to the current sample log window; and a construction submodule, used to construct at least one first sample causal tree corresponding to the current sample log window based on the at least one sample window information.

[0171] As an optional approach, a submodule is constructed, including: a first determining subunit, used to traverse at least one sample window information and determine the character at the center position of the current sample window information as the key character corresponding to the current sample window information;

[0172] The second determining subunit is used to determine at least one target cause node and at least one target effect node corresponding to the target key character based on the positional relationship of the predecessor character and the positional relationship of the successor character of the target key character in each target sample window information with the same target key character. The target cause node is used to indicate the predecessor character associated with the target key character in the reference log, and the target effect node is used to indicate the successor character associated with the target key character in the reference log. The third determining subunit is used to determine the cause tree corresponding to the target key character by the horizontal and vertical deviations between the target cause node and the target key character. The first sample cause tree includes the cause tree. The fourth determining subunit is used to determine the effect tree corresponding to the target key character information by the horizontal and vertical deviations between the target effect node and the target key character. The first sample cause tree includes the effect tree.

[0173] As an optional approach, the termination submodule includes: a first processing subunit for performing normalization processing on at least one sample window information, wherein the normalization processing is used to convert information of different formats into the same format; a second processing subunit for performing noise reduction processing on at least one sample window information, wherein the noise reduction processing is used to remove meaningless information from the information; and a third processing subunit for performing data cleaning on at least one sample window information, wherein the data cleaning is used to remove incomplete information.

[0174] As an optional approach, a submodule is constructed, including: an acquisition subunit for acquiring at least one second sample causal tree corresponding to the reference log; and a merging subunit for merging the first sample causal tree and the second sample causal tree if the first key character corresponding to the first sample causal tree is the same as the second key character corresponding to the second sample causal tree.

[0175] As an optional solution, the second acquisition unit 1106 includes: a second acquisition module, used to traverse the target characters in the current log, and when the current target character is reached, acquire at least one log window corresponding to the current target character, wherein the log window includes the current target character; a third acquisition module, used to traverse each log window of the current target character, and when the current log window is reached, acquire context information corresponding to the current log window, wherein the context information is used to indicate the predecessor and successor characters of the target character; and a matching module, used to match all the context information corresponding to the current target character with the target character causal tree corresponding to the current target character, and determine the log analysis result based on the matching result.

[0176] As an optional solution, the second acquisition unit 1106 includes: a first sending module, configured to send a first prompt message when the analysis result indicates that there is security anomaly information in the current log, wherein the first prompt message is used to instruct the device associated with the current log to modify its security policy; a second sending module, configured to send a second prompt message when the analysis result indicates that there is performance anomaly information in the current log, wherein the second prompt message is used to instruct the device associated with the current log to perform load balancing; and a third sending module, configured to send a third prompt message when the analysis result indicates that there is operational anomaly information in the current log, wherein the third prompt message is used to instruct the device associated with the current log to perform data backup.

[0177] As an optional solution, the device further includes: an input unit, used to input the current log into a type analysis model when the target character is not present in the current log, and obtain a determination result output by the type analysis model; a construction unit, used to construct at least one third sample causal tree matching the current log based on the determination result, wherein the determination result is used to indicate the log type to which each log segment in the current log belongs; and an adding unit, used to add the third sample causal tree to the character causal tree set.

[0178] For a description of the features in the embodiment corresponding to the log analysis device, please refer to the relevant description in the embodiment corresponding to the log analysis method, which will not be repeated here.

[0179] Embodiments of this application also provide an electronic device. Figure 12 This is a schematic diagram of an electronic device according to an embodiment of this application, such as... Figure 12 As shown, the electronic device includes a memory and a processor, the memory storing a computer program, and the processor being configured to run the computer program to perform the steps in any of the above-described log analysis method embodiments.

[0180] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0181] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0182] Embodiments of this application also provide a computer-readable storage medium storing a computer program configured to execute the steps in any of the above-described log analysis method embodiments at runtime.

[0183] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0184] Embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the methods in various embodiments of this application; the computer program product further includes a non-volatile computer-readable storage medium storing the computer program, which, when executed by a processor, implements the steps of the log analysis method in various embodiments of this application.

[0185] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0186] The log analysis method provided in this application has been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A log analysis method, characterized in that, include: Obtain a reference log, wherein the reference log includes multiple log segments, each corresponding to a log event type; At least one sample log window is determined based on the reference log, wherein the sample log window is used to segment the reference log, the length of the sample log window is less than or equal to the maximum number of words in each line of the reference log, and the width of the sample log window is less than or equal to the number of lines in the reference log; Traverse at least one of the sample log windows and construct at least one first sample causal tree corresponding to the current sample log window based on the current sample log window; Based on the first sample causal tree corresponding to at least one of the sample log windows, construct a character causal tree set; Obtain at least one target character in the current log that matches a set of key characters, wherein multiple key characters in the set of key characters correspond to a character causal tree in the set of character causal trees, the character causal tree is used to indicate a log segment in a reference log, at least one cause node in the character causal tree is used to indicate a predecessor character associated with the key character in the reference log, and at least one result node in the character causal tree is used to indicate a successor character associated with the key character in the reference log; From the set of character causal trees, determine the target character causal tree corresponding to at least one of the target characters; Iterate through the target characters in the current log. When the current target character is reached, obtain at least one log window corresponding to the current target character, wherein the log window includes the current target character. Traverse at least one of the log windows, and extract the characters to the left and above the target character from the current log window being traversed to determine the predecessor character, and the characters to the right and below the target character to determine the successor character; Match all the preceding characters and all the succeeding characters corresponding to the current target character with the target character causal tree corresponding to the current target character, and determine the log analysis result based on the matching result; The step of traversing at least one of the sample log windows and constructing at least one first sample causal tree corresponding to the current sample log window includes: The character at the center of the target log window is identified as the key character, the log information to the left and above the key character is identified as the target cause, and the log information to the right and below the key character is identified as the target effect. A first sample causal tree corresponding to the target log window is established based on the key character, the target cause, and the target effect, wherein at least one of the sample log windows includes the target log window.

2. The method according to claim 1, characterized in that, Traverse at least one of the sample log windows and construct at least one first sample causal tree corresponding to the current sample log window, including: Through the current sample log window, traverse from left to right, starting from the first row and first column of the reference log; If the current sample log window is not located at the bottom of the last line of the reference log and the current line traversal ends, the current sample log window is moved down one line from its current position, and the traversal starts from the first column of the reference log from left to right. If the current sample log window is located at the bottom of the last line of the reference log and the current line traversal is completed, the traversal of the reference log by the current sample log window is completed, and at least one sample window information corresponding to the current sample log window is obtained. Based on at least one of the sample window information, construct at least one first sample causal tree corresponding to the current sample log window.

3. The method according to claim 2, characterized in that, Based on at least one of the sample window information, construct at least one first sample causal tree corresponding to the current sample log window, including: Traverse at least one of the sample window information and determine the character at the center of the current sample window information as the key character corresponding to the current sample window information; For at least one target sample window information with the same target key character, based on the positional relationship of the predecessor character and the positional relationship of the successor character of the target key character in each target sample window information, at least one target cause node and at least one target effect node corresponding to the target key character are determined, wherein the target cause node is used to indicate the predecessor character associated with the target key character in the reference log, and the target effect node is used to indicate the successor character associated with the target key character in the reference log; By using the horizontal and vertical deviations between the target cause node and the target key character, a cause tree corresponding to the target key character is determined, wherein the at least one first sample cause tree includes the cause tree; By using the lateral and vertical deviations between the target fruit node and the target key character, the fruit tree corresponding to the target key character is determined, wherein the at least one first sample causal tree includes the fruit tree.

4. The method according to claim 2, characterized in that, After obtaining at least one sample window information corresponding to the current sample log window, including at least one of the following: Normalization processing is performed on at least one of the sample window information, wherein the normalization processing is used to convert information of different formats into the same format; Denoising processing is performed on at least one of the sample window information, wherein the denoising processing is used to remove meaningless information from the information; Data cleaning is performed on at least one of the sample window information, wherein the data cleaning is used to remove incomplete information.

5. The method according to claim 2, characterized in that, After constructing at least one first sample causal tree corresponding to the current sample log window based on at least one of the sample window information, the process includes: Obtain at least one second sample causal tree corresponding to the reference log; If the first key character corresponding to the first sample causal tree is the same as the second key character corresponding to the second sample causal tree, the first sample causal tree and the second sample causal tree are merged.

6. The method according to claim 1, characterized in that, After matching all the preceding characters and all the succeeding characters corresponding to the current target character with the target character causal tree corresponding to the current target character, and determining the log analysis result based on the matching result, the method further includes at least one of the following: If the log analysis result indicates that there is security anomaly information in the current log, a first prompt message is sent, wherein the first prompt message is used to instruct the device associated with the current log to modify the security policy; If the log analysis result indicates that there is performance anomaly information in the current log, a second prompt message is sent, wherein the second prompt message is used to instruct the device associated with the current log to perform load balancing; If the log analysis results indicate that there is abnormal operation information in the current log, a third prompt message is sent, wherein the second prompt message is used to instruct the device associated with the current log to perform data backup.

7. The method according to any one of claims 1 to 6, characterized in that, Also includes: If the target character is not included in the current log, the current log is input into the type analysis model to obtain the judgment result output by the type analysis model; Based on the determination result, at least one third sample causal tree matching the current log is constructed, wherein the determination result is used to indicate the log type to which each log segment in the current log belongs; Add the third sample causal tree to the character causal tree set.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the log analysis method as described in any one of claims 1 to 7.

Images