Log alignment method and device, electronic equipment and storage medium

Abstract

The invention discloses a log alignment method and device, electronic equipment and a storage medium, and relates to the technical field of data processing, and the log alignment method comprises the steps of obtaining a time calling list corresponding to a specified calling interval indicated by an alignment instruction in response to the alignment instruction, adjusting a timestamp of a first specified log in an operating system based on the time calling list, the first specified log and the second specified log with the timestamps adjusted are aligned according to the time sequence, a fused log is obtained, the second specified log is a system log recorded on the basis of a hardware clock, the problems that in the related technology, log alignment is low in efficiency and prone to errors are solved, and the log alignment efficiency is improved. Automatic and accurate log time synchronization is realized, and the log alignment efficiency and accuracy are improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to log alignment methods, apparatus, electronic devices, and storage media. Background Technology

[0002] In modern computer systems, especially servers and workstations using Linux operating environments, time synchronization and logging are crucial components for maintaining system stability and security. Log files provide detailed records of the system's operational status, helping system administrators track errors, monitor performance, and analyze system behavior. However, different timestamp recording methods in operating systems can lead to discrepancies in clocks across different logs, resulting in inconsistent timestamps and complicating system maintenance and troubleshooting.

[0003] In related technologies, log alignment methods mainly adopt manual alignment. However, this method has the problems of low efficiency and easy error in log alignment. Summary of the Invention

[0004] This application provides a log alignment method, apparatus, electronic device, and storage medium to at least solve the problems of inefficiency and error-proneness in log alignment in related technologies.

[0005] This application provides a log alignment method, comprising: in response to an alignment instruction, obtaining a time call list corresponding to a specified call interval indicated by the alignment instruction, wherein the time call list is used to indicate the time deviation value when a specified call instruction is invoked within the specified call interval, and the specified call instruction is a system call instruction in the operating system that causes a change in the system time of the operating system; adjusting the timestamp of a first specified log in the operating system based on the time call list, wherein the first specified log is a system log recorded based on the system clock of the operating system; aligning the timestamp-adjusted first specified log and a second specified log in chronological order to obtain a fused log, wherein the second specified log is a system log recorded based on a hardware clock, and the fused log includes the aligned first specified log and the aligned second specified log.

[0006] This application also provides a log alignment device, comprising: an acquisition module, configured to acquire, in response to an alignment instruction, a time call list corresponding to a specified call interval indicated by the alignment instruction, wherein the time call list is used to indicate a time deviation value when a specified call instruction is invoked within the specified call interval, and the specified call instruction is a system call instruction in an operating system that causes a change in the system time of the operating system; an adjustment module, configured to adjust the timestamp of a first specified log in the operating system based on the time call list, wherein the first specified log is a system log recorded based on the system clock of the operating system; and an alignment module, configured to align the timestamp-adjusted first specified log and a second specified log in chronological order to obtain a fused log, wherein the second specified log is a system log recorded based on a hardware clock, and the fused log includes the aligned first specified log and the aligned second specified log.

[0007] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing any of the above-described log alignment methods when executing the computer program.

[0008] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described log alignment methods.

[0009] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described log alignment methods.

[0010] This application addresses the issue of inefficiency and error-proneness in log alignment in response to an alignment instruction. The time call list indicates the time deviation when the specified instruction is invoked within the specified call interval. The specified instruction is a system call instruction in the operating system that causes a change in the operating system's system time. Based on the time call list, the timestamp of a first specified log in the operating system is adjusted. The first specified log is a system log recorded based on the operating system's system clock. The adjusted first and second specified logs are aligned in chronological order to obtain a merged log. The second specified log is a system log recorded based on the hardware clock. The merged log includes both the aligned first and second specified logs. This solution addresses the problems of low efficiency and high error rates in log alignment in related technologies, achieving automated and accurate log time synchronization and improving the efficiency and accuracy of log alignment. Attached Figure Description

[0011] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a schematic diagram illustrating an application scenario of a log alignment method according to an embodiment of this application;

[0013] Figure 2 This is a flowchart illustrating an optional log alignment method according to an embodiment of this application;

[0014] Figure 3 This is a schematic diagram of an optional log alignment method according to an embodiment of this application;

[0015] Figure 4 This is a schematic diagram of another optional log alignment method according to an embodiment of this application;

[0016] Figure 5 This is a schematic diagram of yet another optional log alignment method according to an embodiment of this application;

[0017] Figure 6 This is a schematic diagram of yet another optional log alignment method according to an embodiment of this application;

[0018] Figure 7 This is a structural block diagram of an optional log alignment device according to an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0020] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0021] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] According to one aspect of the embodiments of this application, a log alignment method is provided. Optionally, in this embodiment, the above-described log alignment method may be applied to, but is not limited to, methods such as... Figure 1 The hardware environment shown includes terminal device 102 and server 104. Server 104 can be connected to terminal device 102 via a network and can be used to provide services (e.g., application services, etc.) to terminal device 102 or clients installed on terminal device 102. A database can be set up on server 104 or independently of server 104 to provide data storage services for server 104.

[0023] The aforementioned network may include, but is not limited to, at least one of the following: wired network and wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: wide area network (WAN), metropolitan area network (MAN), and local area network (LAN). The aforementioned wireless network may include, but is not limited to, at least one of the following: Wireless Fidelity (WIFI) and Bluetooth. Terminal device 102 may be, but is not limited to, a personal computer (PC), mobile phone, tablet computer, etc. Server 104 may be, but is not limited to, a cloud server, server cluster, or other server types.

[0024] The log alignment method of this application embodiment can be executed by server 104, by terminal device 102, or by both server 104 and terminal device 102. Alternatively, the log alignment method of this application embodiment can be executed by a client installed on terminal device 102.

[0025] Taking the log alignment method in this embodiment as an example, which is executed by terminal device 102, Figure 2 This is a flowchart illustrating an optional log alignment method according to an embodiment of this application, as shown below. Figure 2 As shown, the process of this method may include the following steps:

[0026] Step S202: In response to the alignment instruction, obtain the time call list corresponding to the specified call interval indicated by the alignment instruction, wherein the time call list is used to indicate the time deviation value when the specified call instruction is called within the specified call interval, and the specified call instruction is a system call instruction in the operating system that causes a change in the system time of the operating system.

[0027] Step S204: Based on the time call list, adjust the timestamp of the first specified log in the operating system, wherein the first specified log is a system log recorded based on the operating system's system clock.

[0028] Step S206: Align the first designated log and the second designated log after timestamp adjustment according to time order to obtain the fused log. The second designated log is a system log recorded based on the hardware clock. The fused log includes the first designated log and the second designated log after alignment.

[0029] The log alignment method in this embodiment can be applied to the field of computer data processing, specifically to the operation and maintenance management of cloud server clusters or troubleshooting scenarios in high-performance computing environments, where log time consistency becomes particularly important. In Linux operating systems, common logging tools are used to record system operating status and event information. However, different timestamp recording methods in operating systems can lead to differences in clocks between different logs, resulting in inconsistent timestamps and posing challenges to system maintenance and fault diagnosis. Related technologies primarily employ manual alignment for log alignment; however, manual alignment struggles to address the challenges posed by log time inconsistencies, especially in environments involving large numbers of log files and frequent time adjustments. Manually correcting time deviations is not only time-consuming but also prone to errors. Therefore, related technologies suffer from inefficiency and error-proneness in log alignment.

[0030] To at least partially solve the aforementioned technical problems, in this embodiment, in response to an alignment command, the time deviation value caused by a specified call command within a specified call interval is obtained to form a time call list. The timestamp of the first specified log (a log recorded based on the system clock) is precisely adjusted using the time call list to ensure its alignment with the second specified log (a log based on the hardware clock) on the timeline, ultimately generating a fused log. This solves the problems of low efficiency and error-proneness in log alignment in related technologies, achieving automated and accurate log time synchronization and improving the efficiency and accuracy of log alignment.

[0031] It should be noted that alignment commands can be issued by operations and maintenance personnel or automated systems at preset intervals to trigger the alignment process of the operating system's log time. The specified call interval can be the period from operating system startup or the last time alignment completion to the issuance of the alignment command. Of course, this is still a custom call interval. The time call list can be used to record the time deviation value when the specified call command is invoked within the specified call interval. The specified call command can be a system call command in the operating system that causes a change in the operating system's system time, including but not limited to Network Time Protocol (NTP) synchronization, date and time setting commands, etc. Generally, commands that cause a change in the operating system's system time, i.e., specified call commands, can be initiated through certain specific services. Therefore, by monitoring a series of specific services, the existence of the specified call command can be determined.

[0032] Alternatively, time adjustment information can be obtained by capturing system calls (such as adjtimex, settimeofday, etc.).

[0033] Optionally, upon receiving an alignment instruction, a new driver can be used to read or generate a time call list within a specified call interval from storage, and then use this time call list to adjust the timestamp of the first specified log in the operating system. The first specified log can be a log in the operating system that relies on the system clock for recording.

[0034] Optionally, in the process of adjusting the timestamp of the first specified log in the operating system using the time call list, the timestamp of each log in the first specified log can be traversed, and the corresponding time deviation value can be determined in the time call list based on the timestamp of each log, so as to adjust the timestamp of each log according to the corresponding time deviation value determined in the time call list.

[0035] Optionally, when the operating system is Linux, the first specified log can be dmesg (displaymessage, display log information). By traversing the log timestamp of each log in dmesg, the time deviation value that needs to be adjusted for the log timestamp of each log can be determined.

[0036] Optionally, after adjusting the timestamp of the first specified log, a timestamp-adjusted first specified log is obtained. The timestamp-adjusted first and second specified logs are then aligned chronologically to merge them into a single log file, i.e., a fused log. By unifying logs from different sources and based on different clock mechanisms (such as system clock-based logs and hardware clock-based logs) to the same time base, time deviations caused by specified call instructions are eliminated, allowing all log records to be compared and analyzed on a consistent timeline. When system anomalies or failures occur, viewing the fused log makes it easier to trace the sequence of events and identify the root cause of the problem.

[0037] The second specified log can be a log recorded by the operating system that relies on a hardware clock. Optionally, in the case of a Linux operating system, the second specified log can include various logs, such as the / var / log / messages log and the BMC (Baseboard Management Controller) log.

[0038] In one example, such as Figure 3 As shown, taking Linux as the operating system, the first specified log is the dmesg log, the second specified log includes the third specified log and the fourth specified log, the third specified log is the / var / log / messages log, and the fourth specified log is the BMC log as an example, for explanation.

[0039] Step S302: Execute the log alignment command;

[0040] Step S304: Read the time call list through the driver;

[0041] Step S306: Read the first specified log;

[0042] Step S308: Adjust the timestamp of the first specified log according to the time call list;

[0043] Step S310: Read the third specified log;

[0044] Step S312: Read the fourth specified log;

[0045] Step S314: Output the first specified log, the third specified log, and the fourth specified log in chronological order.

[0046] In this embodiment, in response to an alignment instruction, a time call list corresponding to the specified call interval indicated by the alignment instruction is obtained. The time call list indicates the time deviation value when the specified call instruction is invoked within the specified call interval. The specified call instruction is a system call instruction in the operating system that causes a change in the operating system's system time. Based on the time call list, the timestamp of a first specified log in the operating system is adjusted. The first specified log is a system log recorded based on the operating system's system clock. The first specified log and the second specified log, after timestamp adjustment, are aligned in chronological order to obtain a fused log. The second specified log is a system log recorded based on the hardware clock. The fused log includes the aligned first specified log and the aligned second specified log. This solves the problems of low efficiency and error-proneness in log alignment in related technologies, achieving automated and accurate log time synchronization, and improving the efficiency and accuracy of log alignment.

[0047] In one exemplary embodiment, the time call list includes at least one time record pair, and each time record pair includes a time deviation value and a time reference value. The time record pairs in the time call list are sorted in ascending order of the time reference values. Before obtaining the time call list corresponding to the specified call interval indicated by the alignment instruction, the method further includes: monitoring a specified service, wherein the specified service is the service that calls the specified call instruction; if the specified call instruction is detected through the specified service, obtaining the time deviation value corresponding to the specified call instruction; and recording the time deviation value corresponding to the specified call instruction and the time reference value determined based on the hardware clock as a time record pair in the time call list.

[0048] It should be noted that the time call list can include at least one pair of time records. Each pair of time records can include a time deviation value and a time reference value. Each pair of time records in the time call list can be sorted in ascending order of the time reference values. Each time reference value corresponds to a time deviation value, which refers to the deviation between the system time and the actual time caused by executing the specified call instruction. The time reference value can refer to a point in time determined based on hardware time and can be used for subsequent association and sorting of time deviations.

[0049] Optionally, the invocation command can be triggered by specific services, i.e., a specific service can be specified. For example... Figure 4As shown, the specified services may include, but are not limited to, Network Time Protocol (NTP) services, time setting command (date-s) services, user process services, and system time control command (Timedatectl) services. By monitoring these specified services, the driver collects the time adjustment information issued by these system calls, thereby changing the OS operating system time. Optionally, the existence of a specified call command can be monitored through a specified interface of the specified service. By adding a new driver to monitor the specified interface of the specified service, the driver information of the time adjustment information issued by these system calls can be obtained. When the specified service is an NTP time synchronization service, the corresponding specified interface is the time conversion (Mktime) interface; when the specified service is date-s, the corresponding specified interface is the time adjustment (Adjtimex) interface; when the specified service is a user process service, the corresponding specified interface is the time setting (Settimeofday) interface; and when the specified service is Timedatectl, the corresponding specified interface is the clock setting (clock_settime).

[0050] Specifically, the four interfaces mktime, adjtimex, settimeofday, and clock_settime can be analyzed and recorded by a new driver. This driver acts like a central processing unit, serially intercepting and processing time adjustment requests from these interfaces, recording the correlation between each system time change and the boot time, i.e., the time deviation value, thus forming a time call list.

[0051] Optionally, by continuously monitoring the invocation status of a specified service, once a specified invocation instruction is identified within that service, the time deviation value of the invocation and the current hardware clock time reference value can be recorded. Specifically, by monitoring the invocation status of a specified service in the system in real time, the time information corresponding to the specified invocation instruction can be captured promptly and converted into a time record pair, ensuring the real-time performance and accuracy of the time invocation list.

[0052] Optionally, in this embodiment, event-based real-time monitoring can also be performed to further improve the update efficiency of the time call list. Specifically, specific events are monitored, which are events that can cause time adjustments. When a specific event is detected, a new driver is added to capture the current time deviation value (i.e., the difference between the system clock and the hardware clock) and the absolute time based on the hardware clock in real time as a time reference value, which is then added to the time call list. By introducing event-based real-time monitoring, the dynamic adaptability of the time call list can be enhanced, and the accuracy and efficiency of log time alignment can be improved.

[0053] This embodiment utilizes the monitoring mechanism of operating system service calls and hardware clock to form an efficient time deviation recording method, which can ensure that the update of the time call list is synchronized with the system time adjustment and improve the accuracy of log time alignment.

[0054] In an exemplary embodiment, obtaining the time deviation value corresponding to a specified call instruction includes: obtaining a first system time, wherein the first system time is the system time recorded when the specified call instruction is completed; and calculating the time deviation value corresponding to the specified call instruction based on the first system time and a first specified time, wherein the first specified time is the time of the hardware clock under the first system time.

[0055] It should be noted that the first system time can refer to the system time recorded after the specified call instruction has been executed, which refers to the latest state of the system clock after execution. Optionally, when the execution of the specified call instruction is detected, the operating system's system time at this time is immediately recorded as the first system time, and the operating system's system time is obtained through the operating system's system clock.

[0056] The time deviation value is calculated by comparing the first system time with a first specified time based on the hardware clock. The time deviation value reflects the degree of impact of a specified call instruction on the system time. The first specified time is the time of the hardware clock under the first system time, specifically the current time of the corresponding hardware clock under the first system time.

[0057] Optionally, if the time deviation value corresponding to the specified call instruction is less than the preset deviation value, it can be considered that the impact of the specified call instruction on log time alignment is almost negligible, and the operating system's system time can be directly modified. If the time deviation value corresponding to the specified call instruction is greater than or equal to the preset deviation value, the time deviation value needs to be recorded in the time call list, and the operating system's system time needs to be modified. Specifically, the preset deviation value is a very small value, for example, 1ms.

[0058] Optionally, the time deviation value can be calculated based on the time structure used to record time in the system. If the system uses a year-month-day-minute-second format for recording time, the time deviation value can be determined by the difference between two times (in year-month-day-minute-second format). If the system uses a direct offset format for recording time, the time deviation value can be recorded directly.

[0059] This embodiment ensures the high accuracy and timeliness of the time call list by calculating and recording the time deviation value in real time, thereby improving the efficiency and reliability of log time alignment.

[0060] In one exemplary embodiment, adjusting the timestamp of a first specified log in the operating system based on a time call list includes: sequentially using the log information in the first specified log in the operating system as the current log information and performing the following time adjustment operations, wherein the timestamp of the current log information is the current timestamp: searching for a time record pair corresponding to the current timestamp from the time call list based on the current timestamp; and, if a first specified time record pair corresponding to the current timestamp is found, using the first specified time record pair to adjust the current timestamp corresponding to the current log information.

[0061] It should be noted that the first specified log can be the log recorded by the system clock based on the operating system. In the case of a Linux operating system, the first specified log can be the dmesg log.

[0062] The first specified log contains at least one log message. When adjusting the timestamp of the first specified log, the log messages in the first specified log can be traversed to perform the time adjustment. Specifically, for the log messages in the first specified log, each log message can be treated as the current log message according to its recording order, and its timestamp can be used as the current timestamp. Based on the timestamp of the current log message, a time record pair corresponding to the current timestamp is searched in the time call list, that is, the time record pair closest to the current timestamp. If a first specified time record pair corresponding to the current timestamp is found, it is used to adjust the current timestamp of the current log message. The first specified time record pair can include at least one time record pair.

[0063] This embodiment achieves precise adjustment of log timestamps by traversing log information and finding the corresponding time record pairs in the time call list. It can automatically adjust log timestamps, reduce manual intervention, and improve the efficiency and accuracy of log time alignment.

[0064] In one exemplary embodiment, finding a specified time record pair corresponding to the current timestamp from the time call list based on the current timestamp includes: sequentially comparing the time reference value in the time record pair with the current timestamp from the beginning of the time call list; if a second specified time record pair exists, using the time record pair from the beginning of the time call list to the second specified time record pair as the first specified time record pair, wherein the second specified time record pair is a time record pair in the time call list whose time reference value is less than or equal to the time indicated by the current timestamp.

[0065] It should be noted that the time call list can be an ordered list of a series of time record pairs. In the time call list, each time record pair can contain relevant information about the system time adjustment at a certain moment, namely the time reference value and the time offset value.

[0066] Optionally, starting with the first element of the time call list, the time reference value in each time record pair is compared with the current log timestamp. If the time reference value of the current time record pair is less than or equal to the log timestamp, the comparison continues to the next time record pair. If the time reference value is greater than the log timestamp, the time record pair closest to the current timestamp is found. During the step-by-step search, if there is a time record pair with a time reference value greater than the current timestamp, the search process ends, and the previous time record pair becomes the second specified time record pair.

[0067] The first specified time record pair does not refer to a specific time record pair, but rather to the cumulative effect of all time record pairs and time deviations from the beginning of the time call list to the found second specified time record pair. Specifically, the first specified time record pair may include at least one second specified time record pair.

[0068] Optionally, a binary search method can be used to find the first specified time record pair corresponding to the current timestamp. Specifically, the initial search range can be the entire time call list, and the time record pair at the middle position of the current search range can be determined. The current timestamp is compared with the time reference value of the time record pair at the middle position. If the current timestamp is less than the time reference value of the time record pair, the search continues in the first half of the list; if the current timestamp is greater than or equal to the time reference value of the time record pair, the search range is updated to the second half of the list. The above process is repeated until a matching time record pair is found, or it is determined that the current timestamp is not within the time reference value range of any time record pair. Once a corresponding time record pair is found, the timestamp of the current log information is adjusted using the time deviation value contained in the time record pair.

[0069] Through the above embodiments, for large-scale time-based call lists, the time complexity of binary search is smaller than that of sequential search, which can improve search efficiency and significantly shorten the total time spent on log alignment.

[0070] In one example, such as Figure 5 As shown, taking Linux as the operating system, the first specified log is the dmesg log, the second specified log includes the third specified log and the fourth specified log, the third specified log is the / var / log / messages log, the fourth specified log is the BMC log, and the time call list is the cumulative time list recorded since the operating system boots up, this example will be used for explanation.

[0071] Step S502: Read the cumulative time list since system startup from the driver;

[0072] Step S504: Read the first specified log;

[0073] Step S506: Iterate through the timestamps of the first specified log, and based on the different time periods in the time call list, accumulate the time deviation value into the corresponding timestamp;

[0074] Step S508: Read the third specified log;

[0075] Step S510: Read the fourth specified log;

[0076] Step S512: Summarize and output the logs according to the timestamp order of the first specified log, the third specified log, and the fourth specified log.

[0077] In this embodiment, by searching from the beginning of the time call list, the time record pair corresponding to the current log information timestamp is determined, ensuring the accuracy of time adjustment and thus improving the efficiency and accuracy of log time alignment.

[0078] In an exemplary embodiment, the time record pair further includes a time adjustment direction. The first specified time record pair includes at least one time record pair. Adjusting the current timestamp corresponding to the current log information using the first specified time record pair includes: calculating the time adjustment value corresponding to the current log information based on the time deviation value in the first specified time record pair and the time adjustment direction in the first specified time record pair; and increasing or decreasing the current timestamp corresponding to the current log information based on the time adjustment value.

[0079] It should be noted that the first specified time record pair refers to the cumulative effect of all time record pairs and their time deviation values ​​from the beginning of the time call list up to the time record pair most relevant to the current log timestamp (i.e., the second specified time record pair). Optionally, determining the first specified time record pair can be done by searching and accumulating from the time call list to find all time adjustment information, i.e., time deviation values, that occurred before the current timestamp. After determining all time adjustment information that occurred before the current timestamp, the time adjustment value corresponding to the current log information is calculated based on the time adjustment direction of each time deviation value. The time adjustment value refers to the specific value used to correct the current log timestamp, calculated based on the time deviation value and adjustment direction of the first specified time record pair. A total time adjustment value is calculated based on the time deviation values ​​of all time record pairs in the first specified time record pair and their corresponding time adjustment directions. If the time adjustment direction is forward, the time deviation value is positive; conversely, if the time adjustment direction is backward, the time deviation value is negative. This adjustment value will be used for subsequent log timestamp correction.

[0080] Optionally, after determining the time deviation value of the first specified time record pair, corresponding addition and subtraction operations can be performed based on the sign (i.e., the time adjustment direction) of the determined time deviation value of the first specified time record pair to obtain the final time adjustment value. Subsequently, the current log timestamp is adjusted according to the time adjustment value.

[0081] Optionally, the current timestamp corresponding to the current log information refers to the system time point of the original record in the first specified log, which needs to be corrected according to the information in the time call list. The current log timestamp is adjusted based on the calculated time adjustment value. If the time adjustment value is positive, it means the timestamp needs to be adjusted forward; if the time adjustment value is negative, it means the timestamp needs to be adjusted backward to ensure consistency between the log timestamp and the actual time.

[0082] In one example, taking the time call list as [10:-3,20:4,30:-1], it indicates that the system has undergone three time adjustments in the time history after startup: the first adjustment occurs 10 time units after system startup, with the system clock adjusted backward by 3 time units; the second adjustment occurs 20 time units after system startup, with the system clock adjusted forward by 4 time units; and the third adjustment occurs 30 time units after system startup, with the system clock adjusted backward by 1 time unit again. The log times containing the log information in the first specified log are: [0]start; [3]init;

[11] read;

[19] write;

[22] send;

[33] recv. Specifically, since 11, 19, 22, and 33 are all greater than 10, -3 is required, meaning that all these timestamps occur after the first system time adjustment. Since timestamps 22 and 33 are both greater than 20, we need to add 4: After applying the first time adjustment, timestamps 22 and 33 also appear after the second time adjustment, which means we need to consider the impact of the second time adjustment, i.e., adjust forward by 4 time units. Since timestamp 33 is greater than 30, we need to subtract 1: Finally, timestamp 33 is still after the third time adjustment, so we need to subtract 1 time unit to completely offset the effects of all three time adjustments.

[0083] This embodiment improves the accuracy of log time alignment by adjusting the direction and log timestamps according to time.

[0084] In an exemplary embodiment, the method further includes: after detecting the existence of a specified call instruction through a specified service, controlling a specified lock to lock the time call list; and after recording the time deviation value corresponding to the specified call instruction and the time reference value determined based on the hardware clock as a time record pair into the time call list, controlling the specified lock to unlock the time call list.

[0085] It should be noted that when the system detects any call command that may affect the system time (i.e., a specified call command), it will trigger a locking operation on the time call list to prevent other tasks from affecting it, ensuring that the time call list is not interfered with by other processes during updates. Of course, if multiple specified call commands are identified, these commands will be executed sequentially.

[0086] A designated lock can be used to control access to shared resources (such as a time-based call list), ensuring that only one task can modify the resource at a time. Upon detecting a designated call instruction, the system automatically locks the time-based call list, preventing other read and write operations until the current operation is complete. Specifically, a designated lock can be a mutex lock or a read-write lock.

[0087] The time offset value reflects the impact of a specified call instruction on system time, while the time reference value is determined based on a hardware clock (such as an RTC) and represents the actual point in time when the specified call instruction is executed. With the time call list locked, the new time offset value and time reference value are combined into a time record pair and added to the time call list. After successfully adding the new time record pair to the time call list, the lock on the time call list is released, allowing other tasks to continue accessing or modifying the list.

[0088] This embodiment achieves concurrent control of the time call list through locking and unlocking operations, ensuring the safety of updating the time call list and improving the reliability of log time alignment.

[0089] Figure 6 This is a schematic diagram of the log alignment method in this optional example, such as... Figure 6 As shown, the log alignment method's process can include: capturing time adjustment instructions by listening for system call messages via the driver. Upon capturing a time adjustment instruction, a locking operation is performed to prevent concurrent operations from interfering with data recording. Based on the recorded timestamp `starttm` from system startup, the time structure in the driver is determined. If the time structure format is year-month-day-hour-second, the time deviation value `deltatm` is calculated based on the current system time. If the time structure format is a deviation format, the time deviation value is directly obtained. It is then determined whether the time deviation value exceeds 1 millisecond. If it exceeds 1 millisecond, it is considered a valid time deviation, and the combination of `starttm` and `deltatm` is added to the time deviation list. The lock is released, and monitoring of subsequent calls continues. Conversely, if it does not exceed 1 millisecond, the adjustment is considered a minor change, not recorded in the time deviation list, the lock is released, and the system time is updated.

[0090] This optional example demonstrates how the log alignment method improves the accuracy and efficiency of log time alignment by precisely filtering valid time deviations. This is particularly beneficial when dealing with large and complex systems, significantly reducing the workload of operations and maintenance personnel, accelerating troubleshooting, and providing a more reliable tool for system monitoring and maintenance. Simultaneously, by avoiding the recording of invalid, minute time variations, system resources are utilized more efficiently, enhancing overall stability and responsiveness.

[0091] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0092] According to another aspect of the embodiments of this application, a log alignment apparatus is also provided, which can be used to implement the log alignment method provided in the above embodiments, and will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0093] Embodiments of this application also provide a log alignment device, such as... Figure 7 As shown, the device includes:

[0094] The acquisition module 702 is used to acquire the time call list corresponding to the specified call interval indicated by the alignment instruction in response to the alignment instruction. The time call list is used to indicate the time deviation value when the specified call instruction is called within the specified call interval. The specified call instruction is a system call instruction in the operating system that causes a change in the system time of the operating system.

[0095] The adjustment module 704 is used to adjust the timestamp of the first specified log in the operating system based on the time call list, wherein the first specified log is a system log recorded based on the operating system's system clock;

[0096] Alignment module 706 is used to align the first specified log and the second specified log after timestamp adjustment according to time order to obtain a fused log. The second specified log is a system log recorded based on the hardware clock. The fused log includes the first specified log and the second specified log after alignment.

[0097] It should be noted that the acquisition module 702 in this embodiment can be used to perform the above step S202, the adjustment module 704 in this embodiment can be used to perform the above step S204, and the alignment module 706 in this embodiment can be used to perform the above step S206.

[0098] The embodiments provided in this application, in response to an alignment instruction, obtain a time call list corresponding to the specified call interval indicated by the alignment instruction. The time call list indicates the time deviation value when the specified call instruction is invoked within the specified call interval. The specified call instruction is a system call instruction in the operating system that causes a change in the operating system's system time. Based on the time call list, adjust the timestamp of a first specified log in the operating system. The first specified log is a system log recorded based on the operating system's system clock. Align the first specified log and the second specified log after timestamp adjustment according to time order to obtain a fused log. The second specified log is a system log recorded based on the hardware clock. The fused log includes the aligned first specified log and the aligned second specified log. This solves the problems of low efficiency and error-proneness in log alignment in related technologies, achieving automated and accurate log time synchronization, and improving the efficiency and accuracy of log alignment.

[0099] In one exemplary embodiment, the time call list includes at least one time record pair, and the time record pair in the at least one time record pair includes a time deviation value and a time reference value. The time record pairs in the time call list are sorted in ascending order of the time reference value.

[0100] The log alignment device further includes: a monitoring module, used to monitor a specified service before obtaining the time call list corresponding to the specified call interval indicated by the alignment instruction, wherein the specified service is the service that calls the specified call instruction;

[0101] The deviation value acquisition module is used to acquire the time deviation value corresponding to the specified call instruction when the specified call instruction is detected by the specified service.

[0102] The recording module is used to record the time deviation value corresponding to the specified call instruction and the time reference value determined based on the hardware clock as a time record pair into the time call list.

[0103] In an exemplary embodiment, the deviation value acquisition module is further configured to acquire a first system time, wherein the first system time is the system time recorded when the specified call instruction is completed; and calculate the time deviation value corresponding to the specified call instruction based on the first system time and a first specified time, wherein the first specified time is the time of the hardware clock under the first system time.

[0104] In an exemplary embodiment, the adjustment module 704 is further configured to: sequentially use the log information in the first specified log in the operating system as the current log information to perform the following time adjustment operations, wherein the timestamp of the current log information is the current timestamp: based on the current timestamp, search for a time record pair corresponding to the current timestamp from the time call list; if a first specified time record pair corresponding to the current timestamp is found, use the first specified time record pair to adjust the current timestamp corresponding to the current log information.

[0105] In an exemplary embodiment, the adjustment module 704 is further configured to: sequentially compare the time reference value in the time record pair with the current timestamp from the beginning of the time call list; if a second specified time record pair exists, use the time record pair from the beginning of the time call list to the second specified time record pair as the first specified time record pair, wherein the second specified time record pair is a time record pair in the time call list whose time reference value is less than or equal to the time indicated by the current timestamp.

[0106] In an exemplary embodiment, the time record pair further includes a time adjustment direction, and the first specified time record pair includes at least one time record pair. The adjustment module 704 is further configured to: calculate a time adjustment value corresponding to the current log information based on the time deviation value in the first specified time record pair and the time adjustment direction in the first specified time record pair; and increase or decrease the current timestamp corresponding to the current log information based on the time adjustment value.

[0107] In one exemplary embodiment, the log alignment apparatus further includes: a locking module, configured to control a specified lock to lock the time call list after detecting the existence of a specified call instruction through a specified service; and an unlocking module, configured to control the specified lock to unlock the time call list after recording the time deviation value corresponding to the specified call instruction and the time reference value determined based on the hardware clock as a time record pair into the time call list.

[0108] For a description of the features in the embodiment corresponding to the log alignment device, please refer to the relevant description of the embodiment corresponding to the log alignment method, which will not be repeated here.

[0109] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above-described log alignment method embodiments.

[0110] Embodiments of this application also provide a computer-readable storage medium storing a computer program configured to execute the steps in any of the above-described log alignment method embodiments at runtime.

[0111] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0112] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described log alignment method embodiments.

[0113] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above-described log alignment method embodiments.

[0114] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0115] The log alignment method, apparatus, electronic device, and storage medium provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A log alignment method, characterized in that, include: In response to an alignment instruction, a time call list corresponding to the specified call interval indicated by the alignment instruction is obtained, wherein the time call list is used to indicate the time deviation value when a specified call instruction is called within the specified call interval, and the specified call instruction is a system call instruction in the operating system that causes a change in the system time of the operating system; Based on the time call list, adjust the timestamp of the first specified log in the operating system, wherein the first specified log is a system log recorded based on the system clock of the operating system; The first and second designated logs, after timestamp adjustment, are aligned in chronological order to obtain a merged log. The second designated log is a system log recorded based on the hardware clock. The merged log includes the first designated log and the second designated log after alignment.

2. The method according to claim 1, characterized in that, The time call list includes at least one time record pair, and the time record pair in the at least one time record pair includes a time deviation value and a time reference value. The time record pairs in the time call list are sorted in ascending order of the time reference value. Before obtaining the time call list corresponding to the specified call interval indicated by the alignment instruction, the method further includes: Monitor a specified service, wherein the specified service is the service that invokes the specified invocation instruction; If the specified call instruction is detected through the specified service, the time deviation value corresponding to the specified call instruction is obtained; The time deviation value corresponding to the specified call instruction and the time reference value determined based on the hardware clock are recorded as a time record pair in the time call list.

3. The method according to claim 2, characterized in that, The step of obtaining the time deviation value corresponding to the specified invocation instruction includes: Obtain the first system time, wherein the first system time is the system time recorded when the specified call instruction is completed; Calculate the time deviation value corresponding to the specified call instruction based on the first system time and the first specified time, wherein the first specified time is the time of the hardware clock under the first system time.

4. The method according to claim 2, characterized in that, The step of adjusting the timestamp of the first specified log in the operating system based on the time call list includes: The log information in the first specified log in the operating system is used as the current log information to perform the following time adjustment operation, wherein the timestamp of the current log information is the current timestamp: Based on the current timestamp, find the time record pair corresponding to the current timestamp from the time call list; If a first specified time record pair corresponding to the current timestamp is found, the current timestamp corresponding to the current log information is adjusted using the first specified time record pair.

5. The method according to claim 4, characterized in that, The step of searching for a specified time record pair corresponding to the current timestamp from the time call list based on the current timestamp includes: Starting from the beginning of the time call list, the time reference value in each time record pair is compared with the current timestamp. If a second specified time record pair exists, the first specified time record pair is the one from the beginning of the time call list to the second specified time record pair, wherein the second specified time record pair is a time record pair in the time call list whose time reference value is less than or equal to the time indicated by the current timestamp.

6. The method according to claim 5, characterized in that, The time record pair also includes a time adjustment direction. The first specified time record pair includes at least one time record pair. Adjusting the current timestamp corresponding to the current log information using the first specified time record pair includes: Calculate the time adjustment value corresponding to the current log information based on the time deviation value in the first specified time record pair and the time adjustment direction in the first specified time record pair; Based on the time adjustment value, the current timestamp corresponding to the current log information is increased or decreased.

7. The method according to any one of claims 2 to 6, characterized in that, The method further includes: After detecting the existence of the specified call instruction through the specified service, control the specified lock to lock the time call list; After recording the time deviation value corresponding to the specified call instruction and the time reference value determined based on the hardware clock as a time record pair into the time call list, the specified lock is controlled to unlock the time call list.

8. A log alignment device, characterized in that, include: The acquisition module is configured to, in response to an alignment instruction, acquire a time call list corresponding to a specified call interval indicated by the alignment instruction, wherein the time call list is used to indicate the time deviation value when a specified call instruction is invoked within the specified call interval, and the specified call instruction is a system call instruction in the operating system that causes a change in the system time of the operating system; An adjustment module is used to adjust the timestamp of a first specified log in the operating system based on the time call list, wherein the first specified log is a system log recorded based on the system clock of the operating system. The alignment module is used to align the first and second specified logs after timestamp adjustment according to time order to obtain a fused log. The second specified log is a system log recorded based on the hardware clock. The fused log includes the first specified log and the second specified log after alignment.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the log alignment method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the log alignment method as described in any one of claims 1 to 7.

Images