Error log analysis solution method and device based on large model driving and medium
By deploying large models on the server and automatically analyzing software logs, the problem of time-consuming and labor-intensive manual analysis by operation and maintenance personnel in existing technologies is solved, and fast and secure log analysis and solution generation are achieved.
Patent Information
- Application Number
- CN202510882233.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-27
- Publication Date
- 2025-10-17
AI Technical Summary
In the existing technology, software log analysis tools are difficult to automatically analyze complex and changeable software anomalies, resulting in operations and maintenance personnel having to perform manual analysis, which is time-consuming and labor-intensive and poses challenges to data security and response speed.
The error log analysis method driven by a large model deploys a local large model on the server, automatically scans the error log using preset log monitoring parameters, generates prompt words, outputs solutions, and stores them in a specified file.
It reduces the tedious manual analysis process of operation and maintenance personnel, improves the speed of problem diagnosis, ensures data security, shortens the problem-solving time window, and forms a reusable knowledge base.
Smart Images
Figure CN120803779A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of log analysis, and in particular to a large model driven error log analysis solution, device and medium. BACKGROUND
[0002] With the development of the software industry, software system architecture is becoming increasingly complex, and functions are emerging. This trend has also increased the probability of software system errors, especially in the early stages of software operation, where problems occur frequently. In this context, error logs generated by software as a key means to quickly locate and solve problems, their effective analysis is particularly important in software operation and maintenance.
[0003] In existing software operation and maintenance practices, when software anomalies occur, operation and maintenance personnel usually log in to the server and search for error information in the software log file. This process often relies on the personal experience and professional knowledge of operation and maintenance personnel, who need to carefully read the log content and combine their own technical experience to infer the possible causes of software anomalies.
[0004] In traditional solutions, although some log analysis tools already exist, these tools mostly focus on log collection, storage and preliminary screening, and are still insufficient in terms of automated analysis of logs and generation of targeted solutions. In dealing with complex and variable software anomalies, these tools often fail to provide effective support, forcing operation and maintenance personnel to continue relying on manual analysis methods.
[0005] The traditional manual analysis of logs has exposed many drawbacks in the face of the complex demands of modern software operation and maintenance:
[0006] 1. The content of software logs is often lengthy and obscure, containing a large amount of technical details and error codes, which requires operation and maintenance personnel to have deep professional knowledge and rich practical experience to extract valuable information from them.
[0007] 2. The manual analysis process is time-consuming and labor-intensive, increasing operation and maintenance costs and potentially leading to problem amplification due to untimely analysis, affecting the stable operation of software. In addition, for classified or offline deployed software systems, traditional manual analysis methods also face the dual challenges of data security and response speed. SUMMARY
[0008] To solve the above problems, the present application proposes a large model driven error log analysis solution, including:
[0009] Based on the current server performance, deploy the corresponding local large model;
[0010] Scanning the server log to be analyzed according to a pre-set log monitoring parameter to obtain a corresponding error log;
[0011] According to the error log and a pre-set prompt word template, a corresponding prompt word is generated, and the prompt word is taken as an input to output a corresponding solution through the local large model;
[0012] Based on the file path of the error log, a specified file is created, and the solution is stored through the specified file.
[0013] In one example, based on the current server performance, a corresponding local large model is deployed, specifically including:
[0014] Deploying an open source cross-platform large model tool in the current server;
[0015] Starting the open source cross-platform large model tool, and obtaining a local large model corresponding to the current server performance through a corresponding execution command;
[0016] Setting the model parameters of the local large model to set the calling and using process of the local large model.
[0017] In one example, the model parameters of the local large model are set, specifically including:
[0018] Setting the port of the open source cross-platform large model tool and the model name of the local large model to call the local large model through the open source cross-platform large model tool;
[0019] Setting the prompt word template of the local large model to generate the prompt word corresponding to the local large model according to the prompt word template and the obtained error log;
[0020] Setting an upper limit of the analysis duration of the local large model, so that when the local large model exceeds the upper limit of the analysis duration in a single analysis process, the single analysis process is terminated and the single analysis process is recorded.
[0021] In one example, the method further includes:
[0022] Determining the prompt word, the local large model used in the terminated single analysis process recorded;
[0023] Optimizing the prompt word by adding a constraint condition to the prompt word, and trying to call the local large model again to analyze the error code through the optimized prompt word;
[0024] If the single analysis process corresponding to the attempt still exceeds the upper limit of the analysis duration, the local large model is switched to a lightweight large model or a high-performance large model according to the length of the error log, and the lightweight large model or the high-performance large model is called again to analyze the error code.
[0025] If the single analysis process corresponding to the attempt still exceeds the upper limit of the analysis duration, the error code is data-processed, and the lightweight large model or the high-performance large model is called again to analyze the data-processed error code; wherein the data-processing mode includes at least one of data blocking and abstract extraction.
[0026] In one example, the model parameters of the local large model are set, specifically including:
[0027] The temperature parameter of the local large model is set, and the value range of the temperature parameter is 0.2-0.4.
[0028] In one example, the pre-set log monitoring parameters are used to scan the server log to be analyzed to obtain the corresponding error log, specifically including:
[0029] The pre-set log monitoring parameters include: time interval, directory root path of the server log to be analyzed;
[0030] According to the time interval, the log files under the directory root path are scanned to obtain the server log to be analyzed;
[0031] According to the log type, the corresponding error log is obtained from the server log to be analyzed, and the file path corresponding to the error log is determined.
[0032] In one example, the prompt word is taken as input, and the corresponding solution is output by the local large model, specifically including:
[0033] When the local large model is multiple, the log field feature of the error log is determined, and the matching first local large model is selected from the multiple local large models according to the log field feature.
[0034] If the number of the first local large model is multiple, the complexity of the error log is determined according to the error type and log length of the error log, and the matching second local large model is selected from the first local large model according to the complexity.
[0035] In one example, the log field feature of the error log is determined, and the matching first local large model is selected from the multiple local large models according to the log field feature, specifically including:
[0036] keyword extraction is performed on the error log to determine whether the error log contains a preset keyword;
[0037] If yes, a first local large model is selected from a plurality of local large models according to a type of the keyword;
[0038] When the type of the keyword includes multiple types selected from a code framework identifier, an exception type, a code stack structure, and a code error pattern, a log field feature of the error log is determined to include a code error feature, and a code processing large model is selected as the first local large model from the plurality of local large models;
[0039] When the type of the keyword includes multiple types selected from a protocol identifier, a system call, a resource type, a network error, a system error, a network associated component, and a system associated component, the log field feature of the error log is determined to include a network error feature or a system error feature, and a general inference large model is selected as the first local large model from the plurality of local large models;
[0040] When the type of the keyword includes multiple types selected from a fixed-length string, an encryption identifier, an encryption algorithm name, an encryption algorithm protocol, and a sensitive marker, the log field feature of the error log is determined to include an encryption error feature, and a privacy protection large model is selected as the first local large model from the plurality of local large models.
[0041] In another aspect, the present application further provides a large model driven error log analysis solution device, comprising:
[0042] at least one processor; and
[0043] a memory in communication connection with the at least one processor; wherein
[0044] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the large model driven error log analysis solution method according to any one of the above examples.
[0045] In another aspect, the present application further provides a non-volatile computer storage medium storing computer executable instructions, which are configured to implement the large model driven error log analysis solution method according to any one of the above examples.
[0046] The large model driven error log analysis solution method provided by the present application can bring the following
[0047] Advantages:
[0048] 1. Automatically scan and extract error logs by preset log monitoring parameters, and generate solutions using large models, reducing the tedious process of manual search and analysis of logs by operation and maintenance personnel, thereby saving human resources and time cost.
[0049] 2. Generate structured input based on preset prompt word templates to guide large models to interpret obscure log content, output more accurate solutions, reduce misjudgment risk caused by lack of personal experience, and speed up problem diagnosis.
[0050] 3. Local deployment of large models ensures that log data does not need to be transmitted to external networks and is directly processed within the server, effectively solving the risk of data leakage in classified or offline environments and meeting strict privacy and security requirements.
[0051] 4. Automated processes can monitor logs in real time or near real time, generate and store solutions, shorten the time window from problem discovery to solution, and avoid problem expansion due to analysis delay.
[0052] 5. By creating a specified file to store solutions and associating it with the error log file path, it is convenient for operation and maintenance personnel to quickly review and trace back, and a reusable knowledge base is formed, improving team collaboration and problem solving sustainability. BRIEF DESCRIPTION OF DRAWINGS
[0053] The accompanying drawings described herein are used to provide further understanding of the present application, form a part of the present application, the illustrative embodiments of the present application and the description thereof are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:
[0054] Figure 1 The flowchart of the error log analysis solution method based on large model driving in the embodiments of the present application is shown.
[0055] Figure 2 The schematic diagram of the error log analysis solution device based on large model driving in the embodiments of the present application is shown. DETAILED DESCRIPTION
[0056] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme of the present application will be described in detail below in combination with specific embodiments of the present application and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.
[0057] The technical solutions provided by the embodiments of the present application will be described in detail below in combination with the drawings.
[0058] As Figure 1 shown, the embodiment of the application provides a large model driven error log analysis solution, which includes:
[0059] S101: based on the current server performance, deploy the corresponding local large model.
[0060] The local large model is mainly used for deployment in the server, for monitoring and analyzing error logs in the server, and giving corresponding solutions. Different local large models can be deployed for processing according to different server performances.
[0061] Specifically, an open source cross-platform large model tool is deployed in the current server. The open source cross-platform large model tool is mainly used to provide a way to obtain a local large model, for example, it can be Ollama.
[0062] Start the open source cross-platform large model tool, and obtain the local large model corresponding to the current server performance through the corresponding execution command. The server performance can include the performance of each hardware such as central processing unit, graphics processing unit, and memory, as well as the performance of software such as operating system and large model running environment. The execution command is set according to the different obtained local large models, for example, when the obtained local large model is qwen2.5:7b model, the execution command is ollama runqwen2.5:7b command.
[0063] The model parameters of the local large model are set to set the calling and using process of the local large model. The model parameters are set locally, so that the local large model can be called and can be applied to the local environment. For example, the temperature parameter of the local large model is set, and the value range of the temperature parameter is 0.2-0.4, which can make the model output more stable and deterministic answers.
[0064] S102: scan the server log to be analyzed to obtain the corresponding error log through the pre-set log monitoring parameter.
[0065] Specifically, the pre-set log monitoring parameter includes: time interval, directory root path of the server log to be analyzed. The time interval refers to how long the server log to be analyzed is scanned once to find the error log. A shorter interval time can improve the frequency of log scanning, but it will consume server resources. The directory root path of the server log to be analyzed is used to scan the range of the server log to be analyzed, which clearly indicates which path of the log is the server log to be analyzed.
[0066] According to the time interval, the log files under the directory root path are scanned to obtain the server log to be analyzed. According to the log type, the corresponding error log is obtained in the server log to be analyzed, and the file path corresponding to the error log is determined.
[0067] By monitoring the time interval of the log, all log files under the root path of the analyzed log directory are scanned. Generally, the logs generated by the Springboot log framework (such as Logback, Log4j2) are classified according to date, and a log file or folder is generated every day. Some logs will be continuously appended in a log file, and when the file size exceeds a certain size, a second log file will be generated. Regardless of which form of log generation, we only need to focus on the newly added log content in the error type log, and record the newly added content. The error type log may be a separate log file or mixed with other log files in the same file.
[0068] S103: According to the error log and the preset prompt word template, a corresponding prompt word is generated, and the prompt word is taken as input to output a corresponding solution through the local large model.
[0069] Specifically, when the local large model is multiple, the log field feature of the error log is determined, and according to the log field feature, a matching first local large model is selected from the multiple local large models. The log field feature refers to the field feature corresponding to the error log.
[0070] When obtaining the field feature, keyword extraction can be performed on the error log to determine whether the error log contains a preset keyword. If it contains, according to the type of the keyword, a matching first local large model is selected from the multiple local large models.
[0071] When the type of the keyword includes multiple types of code framework identification (such as Spring, Tomcat, Hibernate, JPA, Servlet), exception type (such as NullPointerException, BeanCreationException, TransactionException), code stack structure (such as java.lang, org.springframework contains a Java package path, or the class name contains a Controller / Service / Repository suffix), code error mode (such as dependency injection failure No qualifying bean, ORM operation exception HibernateException), the log domain feature of the error log is determined to include a code error feature, and a code processing large model is selected as the first local large model for matching from multiple local large models, such as a code-capable model such as DeepSeek-Coder.
[0072] When the type of the keyword includes multiple types of protocol identification (such as HTTP 503, SSLHandshake), system call (such as ECONNRESET, ENFILE), resource type (such as CPU 100%, Disk full), network error (such as Connection refused to [redis: 6379]), system error (such as Too many open files), network associated component (such as load balancer, firewall, DNS), system associated component (such as database connection pool, message queue), the log domain feature of the error log is determined to include a network error feature or a system error feature, and a general inference large model is selected as the first local large model for matching from multiple local large models, such as a general inference model such as Llama3.
[0073] When the type of the keyword includes multiple types of fixed-length strings (such as eyJhbGci...), encryption identification (such as BEGIN RSA PRIVATE KEY), encryption algorithm name (such as AES-256, PBKDF2), encryption algorithm protocol (such as TLS1.2 handshake failed), sensitive markers (such as token, secret, encrypted, or automatically masked password = ******), the log domain feature of the error log is determined to include an encryption error feature, and a privacy protection large model is selected as the first local large model for matching from multiple local large models, such as a large model with privacy protection capabilities deployed locally, such as a model.
[0074] Of course, if the number of first local large models is multiple, the complexity of the error log is determined according to the error type of the error log and the log length, and the matching second local large model is selected from the first local large model according to the complexity. Generally speaking, the longer the log length is, the higher the complexity is, and different complexities are set for different error types, such as single-line error, common exception and other simple error types, which are considered to have low complexity, and multi-thread deadlock, distributed system error, long stack trace and other complex error types are considered to have high complexity. Thus, the complexity of the error log is obtained, the high-performance second local large model can be selected for high complexity, and the lightweight first local large model can be selected for low complexity.
[0075] S104: Based on the file path of the error log, a specified file is created to store the solution through the specified file.
[0076] When the content of the error log file changes for the first time, a specified file for storing the solution is created in the current path, such as the monitored log file name error0501.log content is added, a new error0501-ai.txt file for storing the solution is created.
[0077] The content returned by the interface is appended in the solution file, and a timestamp and corresponding error information are added for easy reference by maintenance personnel.
[0078] 1. The pre-set log monitoring parameters are used to automatically scan and extract error logs, and the large model is used to generate solutions, reducing the tedious process of manual search and analysis of logs by operation and maintenance personnel, thereby saving human resources and time cost.
[0079] 2. Based on the pre-set prompt word template, structured input is generated to guide the large model to interpret obscure and difficult-to-understand log content, output more accurate solutions, reduce the risk of misjudgment due to lack of personal experience, and speed up problem diagnosis.
[0080] 3. The local deployment of the large model ensures that the log data does not need to be transmitted to the external network, and is directly processed inside the server, effectively solving the data leakage risk in the secret or offline environment, and meeting the strict privacy and security requirements.
[0081] 4. The automatic process can monitor logs in real time or near real time, generate and store solutions, shorten the time window from problem discovery to solution, and avoid the problem of problem expansion due to analysis delay.
[0082] 5. By creating a designated file storage solution and associating it with the error log file path, the operation and maintenance personnel can quickly review and trace back the history, and a reusable knowledge base is formed, improving team collaboration and problem solving sustainability.
[0083] In one embodiment, when setting the model parameters of the local large model, the port of the open source cross-platform large model tool and the model name of the local large model can be set to call the local large model through the open source cross-platform large model tool. For example, when using Springboot to write a system project, set the url and port number of Ollama for model interface request, and set the model name, such as wen2.5:7b, for calling the corresponding model.
[0084] The prompt word template of the local large model is set to generate the prompt word corresponding to the local large model according to the prompt word template and the obtained error log. Accurate prompt words can improve the accuracy of solutions. For example, the prompt word template can be: Please analyze the following server error log as a senior system operation and maintenance engineer / full-stack development engineer, locate the problem source and provide a practical solution. Analysis should be combined with log context, system environment and common fault modes to ensure the accuracy and operability of the solution. The error log is: {error_log}. Where {error_log} is a variable position for inputting the error log corresponding to the server.
[0085] The upper limit of the analysis duration of the local large model is set to terminate the single analysis process and record the single analysis process when the local large model exceeds the upper limit of the analysis duration in a single analysis process. The analysis duration refers to the time after inputting the prompt word. Analysis duration exceeding the analysis duration limit may be due to interface call exceptions or large model analysis process exceptions. When the model analysis exceeds the analysis duration limit, the request is terminated to avoid long-term occupation of server resources.
[0086] Further, when there is a single analysis process exceeding the analysis duration limit, the prompt word used in the terminated single analysis process and the local large model are determined.
[0087] By adding constraint conditions to the prompt word, the prompt word is optimized, and the local large model is called again to analyze the error code through the optimized prompt word. First, try to adjust the analysis process by optimizing the prompt word. The added constraint conditions can be analysis range constraints, error code type constraints, and output solution direction constraints, based on which the analysis range of the large model is reduced, thereby shortening the local analysis duration.
[0088] If the single analysis process corresponding to this attempt still exceeds the upper limit of the analysis time length, the local large model is switched to a lightweight large model or a high-performance large model according to the length of the error log, and the lightweight large model or the high-performance large model is called again to analyze the error code. If the single analysis process of the optimized prompt word still exceeds the upper limit of the analysis time length, the local large model is optimized. When there are multiple local large models, the complexity of the error log is estimated according to the length of the error log. When the length exceeds the preset length, the error log is considered to be a complex log, at this time, the high-performance large model (such as Llama3-8B, Qwen1.5-7B) is switched, so that the log analysis can be attempted through other local large models, and the inference ability can also be guaranteed. When the length is lower than the preset length, the error log is considered to be a simple log, at this time, it can be switched to a lightweight large model (such as Phi-3-mini, TinyLlama) to shorten the analysis time length.
[0089] If the single analysis process corresponding to this attempt still exceeds the upper limit of the analysis time length, the error code is data-processed, and the lightweight large model or the high-performance large model is called again to analyze the data-processed error code. The data processing mode includes at least one of data blocking and abstract extraction. If the lightweight large model is switched and the time length still exceeds, it is considered that it may be due to the error log, at this time, the data processing is performed on the error log, and then the lightweight large model is used for analysis. Data blocking refers to dividing the error log into multiple blocks, and the character amount in each block does not exceed a preset character amount. Each data block is analyzed by a local large model, and then the analysis results are integrated. Abstract extraction is to extract an abstract of the error log by a special local large model, and the extracted log abstract is used as an input of the prompt word and input into the large model for analysis and processing.
[0090] If the analysis time length still exceeds the upper limit at this time, an alarm can be given to the operation and maintenance personnel for manual analysis.
[0091] As shown in Figure 2 The embodiments of the present application also provide a large model-driven error log analysis solution device, which comprises:
[0092] at least one processor; and
[0093] a memory in communication connection with the at least one processor; wherein
[0094] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the large model-driven error log analysis solution method according to any one of the above embodiments.
[0095] The embodiment of the present application also provides a non-volatile computer storage medium, which stores computer executable instructions, and the computer executable instructions are configured to implement the large model driven error log analysis solution method.
[0096] The embodiments in the present application are described in a progressive manner, and the same or similar parts of the embodiments can be referred to each other. Each embodiment mainly describes the difference from other embodiments. Especially, the device and medium embodiments are described simply because they are basically similar to the method embodiments, and the related parts can be referred to the description of the method embodiments.
[0097] The device and medium provided by the embodiments of the present application are one-to-one corresponding to the method, and therefore, the device and medium also have the similar beneficial technical effects as the method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the device and medium will not be described here.
[0098] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROMs, optical storage media, etc.) containing computer-usable program code.
[0099] The present application is described with reference to the flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce the functions described in the flowcharts and / or block diagrams. Figure 1 The function of one flow or multiple flows and / or blocks Figure 1 The device for performing the function of one block or multiple blocks.
[0100] These computer program instructions can also be stored in a computer-readable memory capable of guiding the computer or other programmable data processing devices to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including instruction devices, which implement the functions described in the flowcharts and / or block diagrams. Figure 1 The function of one flow or multiple flows and / or blocks Figure 1the function(s) specified in the block or blocks.
[0101] These computer program instructions can also be loaded into computer or other programmable data processing devices to cause a series of operational steps to be performed on the computer or other programmable devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable devices provide steps for implementing the flowchart block(s) or flowchart flow(s) and / or portions thereof. Figure 1 the flowchart block(s) or flowchart flow(s) and / or portions thereof. Figure 1 the function(s) specified in the block or blocks.
[0102] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.
[0103] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the computer stores information about an operating system, application software, and / or the like. Memory is an example of computer readable media.
[0104] Computer readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium that can be used to store information that can be accessed by a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carriers.
[0105] It should also be noted that the terms "comprising", "including", or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.
[0106] The above merely provides an example of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application should be included in the scope of claims of the present application.
Claims
1. A large model-driven error log analysis solution, characterized in that: include: Deploy the corresponding local large model based on the current server performance; Scan the server logs to be analyzed using pre-set log monitoring parameters to obtain the corresponding error logs; Generate corresponding prompt words according to the error log and a preset prompt word template, and use the prompt words as input to output corresponding solutions through the local large model; A designated file is created based on the file path of the error log, and the solution is stored in the designated file.
2. The method according to claim 1, characterized in that Based on the current server performance, deploy the corresponding local large model, including: Deploy open source cross-platform large model tools in current servers; Launch the open source cross-platform large model tool and obtain the local large model corresponding to the current server performance through the corresponding execution command; The model parameters of the local large model are set to set the calling and using process of the local large model.
3. The method according to claim 2, characterized in that Setting the model parameters of the local large model specifically includes: Setting the port of the open source cross-platform big model tool and the model name of the local big model so as to call the local big model through the open source cross-platform big model tool; Setting a prompt word template of the local large model to generate a prompt word corresponding to the local large model according to the prompt word template and the obtained error log; An upper limit for the analysis time of the local large model is set, so that when the local large model exceeds the upper limit during a single analysis, the single analysis process is terminated and recorded.
4. The method according to claim 3, characterized in that The method further comprises: The prompt word and local large model used in the single analysis process to determine the termination of the record; By adding constraints to the prompt word, the prompt word is optimized, and using the optimized prompt word, an attempt is made to re-call the local large model to analyze the error code; If the analysis time limit is still exceeded during the single analysis process corresponding to the current attempt, the local large model is switched to a lightweight large model or a high-performance large model based on the length of the error log, and the lightweight large model or the high-performance large model is attempted to be re-called to analyze the error code. If the upper limit of the analysis time is still exceeded during the single analysis process corresponding to the attempt, data processing is performed on the error code, and the lightweight large model or the high-performance large model is attempted to be re-called to analyze the error code after data processing; wherein the data processing method includes at least one of data segmentation and summary extraction.
5. The method according to claim 2, characterized in that Setting the model parameters of the local large model specifically includes: The temperature parameter of the local large model is set, and the value range of the temperature parameter is 0.2 to 0.
4.
6. The method according to claim 1, characterized in that Scan the server logs to be analyzed using pre-set log monitoring parameters to obtain the corresponding error logs, including: Determine the pre-set log monitoring parameters including: time interval, directory root path of the server log to be analyzed; Scan the log files under the directory root path at the time interval to obtain the server log to be analyzed; According to the log type, the corresponding error log is obtained from the server log to be analyzed, and the file path corresponding to the error log is determined.
7. The method according to claim 1, characterized in that Taking the prompt word as input, outputting the corresponding solution through the local large model specifically includes: When there are multiple local large models, determining the log domain feature of the error log, and selecting a matching first local large model from the multiple local large models according to the log domain feature; If there are multiple first local large models, the complexity of the error log is determined according to the error type and log length of the error log, and a matching second local large model is selected from the first local large model according to the complexity.
8. The method according to claim 7, characterized in that Determining a log domain feature of the error log, and selecting a matching first local large model from a plurality of local large models based on the log domain feature, specifically comprising: Perform keyword extraction on the error log to determine whether the error log contains preset keywords; If included, selecting a first matching local large model from a plurality of local large models according to the type of the keyword; When the keyword type includes multiple types of code framework identifiers, exception types, code stack structures, and code error patterns, determining that the log domain feature of the error log includes a code error feature, and selecting a code processing big model from multiple local big models as a first local big model to be matched; When the type of the keyword includes multiple of a protocol identifier, a system call, a resource type, a network error, a system error, a network-related component, and a system-related component, determining that the log domain feature of the error log includes a network error feature or a system error feature, and selecting a general reasoning big model from the multiple local big models as a first local big model for matching; When the keyword type includes multiple types of fixed-length strings, encryption identifiers, encryption algorithm names, encryption algorithm protocols, and sensitive tags, it is determined that the log domain characteristics of the error log include encryption error characteristics, and a privacy protection large model is selected from multiple local large models as the first local large model for matching.
9. A large model-driven error log analysis and solution device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the error log analysis solution based on large model driving as described in any one of claims 1 to 8.
10. A non-volatile computer storage medium storing computer executable instructions, characterized in that: The computer executable instructions are configured to implement the error log analysis solution based on large model driving according to any one of claims 1 to 8.