Distributed system equipment log management system

Abstract

The invention relates to the technical field, and discloses a distributed system equipment log management system which comprises a terminal log management module, a distributed log service module and a log analysis module. The terminal log management module is used for collecting system key logs and performing packaging and formatting processing to generate formatted logs; log timestamp generation and log storage management and control are carried out based on system counting time and static time information; the distributed log service module is used as a log unified management center of the distributed system, receives and uniformly stores reported logs, and provides a standardized open interface as an external log access interface; and the log analysis module is used for performing log escape analysis to generate a readable log report, positioning a fault source, identifying a terminal device which generates a fault log earliest in the whole system and performing diffusion path tracing, so that the troubleshooting efficiency and reliability are improved.

Description

Technical Field

[0001] This invention relates to the field of system log service technology, and more specifically to a distributed system device log management system. Background Technology

[0002] In systems where general-purpose input / output debugging devices cannot be connected, in relatively closed environments where debugging windows cannot be provided for each distributed system device, or in situations where it is inconvenient to remove devices from the operating environment to the laboratory environment for problem localization and verification—for example, when devices are highly integrated or deployed in special locations, making it inconvenient to remove them from the operating environment to the laboratory for fault localization and verification—if a device or network node fails, it is impossible to quickly obtain the operating status and fault information at the time of the failure, resulting in the inability to quickly locate and analyze the fault, leading to a dilemma of "faults that cannot be traced back to their source and low localization efficiency." Summary of the Invention

[0003] In view of the technical problems existing in the prior art, the purpose of this invention is to provide a distributed system device log management system, which can provide a log storage and retrieval method for systems that cannot connect to general input / output debugging devices, in relatively closed environments that cannot provide debugging windows for each distributed system device, and in situations where it is inconvenient to remove devices from the operating environment to the laboratory environment for problem localization and verification, thereby realizing the location and analysis services for individual device system failures and distributed system failures.

[0004] According to a first aspect of the present invention, a distributed system device log management system is proposed, which can be applied to computer equipment, communication network cards, MCU-based terminal devices and various distributed network nodes, to achieve low-power log collection, high-precision recording, secure storage and efficient fault tracing analysis.

[0005] As an optional embodiment, the distributed system device log management system includes: The terminal log management module is integrated into the terminal devices of the distributed system. It is used to collect critical system logs, encapsulate and format them to generate formatted logs, and generate log timestamps and manage log storage based on system counting time and static time information. The distributed log service module, serving as the unified log management center of the distributed system, is deployed within the log service device of the distributed system and maintains network communication connections with each terminal device. The distributed log service module is configured to receive and uniformly store logs reported from various terminal devices, and provides a standardized open interface as an external log access interface. This interface is used to return logs within a specified time range from the entire network log database based on a network-wide log read request initiated by an external device, and to forward instructions to the terminal log management module of the target terminal based on a specified terminal log read request, obtain the local logs of the target terminal, and return them to the external device. The log analysis module is deployed in the terminal devices and log service devices of the distributed system. It is used to perform log escaping and parsing to generate readable log reports, as well as fault root cause location, identify the terminal device that first generated the fault log in the entire system, and mark the fault root cause device.

[0006] As an optional implementation, the terminal log management module identifies the log source of the terminal device, receives key event information, status change information, operation fault information and corresponding log codes and key data sent by the log source, and completes log encapsulation according to the preset structure of system calculation time + log source identifier + log code + key data to generate standardized formatted logs.

[0007] As an optional implementation, the generation of log timestamps based on system counting time and static time information includes: After the terminal device is powered on, the terminal log management module obtains the current static calendar time and static system count time, and stores the two as the initial time base. When the terminal device completes clock synchronization through an external clock source, the terminal log management module updates the synchronized calendar time plus the system count time to the new time base. When logs are generated, the terminal log management module calculates the difference between the current system count time and the time base, and converts it with the static calendar time in the time base to generate a precise calendar timestamp for the log.

[0008] As an optional implementation, the storage management of the logs includes: Using NVRAM as the local log storage medium, for consecutively generated identical logs, the criterion is that both the log code and key data are consistent. In this case, the terminal log management module executes an initial complete record + subsequent statistical merging mechanism. The first generated log is stored in NVRAM. For the same log generated within a set time, only the number of times it is repeated is counted. After the timeout, the log code and the number of times it is repeated are merged into a single log entry for storage. When the NVRAM storage space is exhausted, the terminal log management module automatically triggers a circular overwrite mechanism to delete the oldest stored log to retain the latest log, and records the storage location of the last log for subsequent log reading and parsing to locate the starting point.

[0009] As an optional implementation, the distributed log service module receives formatted logs and heartbeat logs reported by the terminal log management modules of each terminal device, adds a device source identifier to each log, identifies it according to the unique ID of the terminal device, and stores the logs of the entire network in the local large-capacity storage medium in the order of receipt according to the two-dimensional index of receiving time + device source identifier, forming a network log library. Among them, when the terminal log management module of each terminal device reports formatted logs, it is configured to install a preset policy to send them, and periodically generates heartbeat logs to record its own running status.

[0010] As an optional implementation, the distributed log service module is equipped with a clock synchronization module, which configures a clock synchronization service and periodically sends clock synchronization instructions to all terminal devices to ensure that the time base of all terminal devices in the network is consistent, thereby realizing unified timeline recording of logs in a distributed scenario.

[0011] As an optional implementation, the distributed log service module is equipped with a terminal status monitoring module, which generates a terminal log management module operation status table based on the heartbeat logs reported by the terminal devices, and records the online / offline status, remaining storage capacity, and log reporting frequency information of each terminal module. If a terminal device fails to report a heartbeat log for n consecutive heartbeat cycles, the terminal device is marked as offline / abnormal, and a status change log is generated and stored in the network log database.

[0012] As an optional implementation, the log analysis module is equipped with a log escaping and parsing module, which reads local logs and calls the log parsing rule base to escape the log codes in the logs into natural language descriptions, generating a readable log report with timestamp + device identifier + event type + event description + key data.

[0013] As an optional implementation, the log analysis module is equipped with a fault root cause location module, which is used to analyze the timeline log stream, identify the terminal device that generates the earliest fault log in the entire system by comparing the fault log time sequence and analyzing the correlation between fault types, and mark the fault root cause device; at the same time, it associates the fault root cause device with the network logs before and after the device failure, generates a fault propagation path diagram and a table of associated fault events, and outputs a fault location analysis report.

[0014] The distributed system device log management system described in the above embodiments of the present invention achieves end-to-end control of logs from collection to analysis through a three-tier architecture consisting of a terminal log management module, a distributed log service module, and a log analysis module. The terminal log management module is integrated into the terminal devices of the distributed system, supports multi-hardware carrier adaptation, and can run on the computer module, communication network card module, or MCU of the terminal device. It realizes local log collection, generation, and reporting, and supports local log reading and status feedback. The distributed log service module is deployed in a dedicated log service device within the distributed system, serving as the unified management center for all system logs and providing log management services. The log analysis module adopts both local deployment (integrated into the application end of the terminal device, analyzing only local logs) and distributed deployment (integrated into the log service device, analyzing logs across the entire network). It realizes log escaping and parsing, timeline log organization, and fault root cause location, generating fault propagation path diagrams and associated fault event tables, quickly and accurately obtaining complete output fault location analysis results.

[0015] Compared with existing technologies, the significant advantages of the distributed system device log management system of the present invention are: 1) Adapting to the fault location needs of special scenarios, it solves the log reading problem in scenarios where there is no debugging equipment, closed environment, or inconvenient to disassemble the equipment, and realizes fast and accurate log acquisition and location after a fault. 2) High-precision timestamps ensure time sequence traceability: Based on a static time base and a timestamp generation mechanism that converts differences, the log time accuracy is guaranteed to be at the microsecond level. In distributed scenarios, the time axis of the entire network logs is unified, avoiding misjudgment of fault timing due to time deviation. 3) Low resource consumption optimizes storage efficiency: Through intelligent storage mechanisms such as continuous repetitive log merging, NVRAM power failure protection, and cyclic overwrite storage, the log storage resource consumption is reduced, while avoiding log loss due to power failure. 4) Distributed collaboration enables system-wide source tracing: Based on the distributed log service module's network-wide log management and the log analysis module's fault correlation analysis, the root cause location and propagation path tracing of distributed system faults are realized, greatly improving the efficiency and reliability of fault diagnosis.

[0016] It should be understood that all combinations of the foregoing concepts and the additional concepts described in more detail below may be considered part of the inventive subject matter of this disclosure, provided that such concepts do not contradict each other. Furthermore, all combinations of the claimed subject matter are considered part of the inventive subject matter of this disclosure.

[0017] The foregoing and other aspects, embodiments, and features of the teachings of the present invention will be more fully understood from the following description in conjunction with the accompanying drawings. Other additional aspects of the invention, such as features and / or beneficial effects of exemplary embodiments, will become apparent from the following description or may be learned through practice of specific embodiments according to the teachings of the present invention. Attached Figure Description

[0018] The accompanying drawings are not intended to be drawn to scale. In the drawings, each identical or nearly identical component shown in the various figures may be denoted by the same reference numeral. For clarity, not every component is labeled in each figure. Embodiments of various aspects of the invention will now be described by way of example and with reference to the accompanying drawings.

[0019] Figure 1 This is a schematic diagram illustrating the local storage and retrieval of a single-device log management service according to an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of a distributed system device log management service according to an embodiment of the present invention.

[0021] Figure 3 This is a schematic diagram of a distributed system device log recording and analysis system according to an embodiment of the present invention. Detailed Implementation

[0022] To better understand the technical content of the present invention, specific embodiments are described below in conjunction with the accompanying drawings.

[0023] Various aspects of the invention are described in this disclosure with reference to the accompanying drawings, which illustrate numerous illustrative embodiments. The embodiments of this disclosure are not necessarily intended to encompass all aspects of the invention. It should be understood that the various concepts and embodiments described above, as well as those described in more detail below, can be implemented in any of many ways, because the concepts and embodiments disclosed herein are not limited to any particular implementation. Furthermore, some aspects of the invention disclosed may be used alone or in any suitable combination with other aspects of the invention disclosed.

[0024] {Example 1} Combined with appendix Figure 1-3 As shown, the distributed system device log management system according to an embodiment of the present invention can be applied to computer equipment, communication network cards, MCU-based terminal devices and various distributed network nodes to achieve low-power log collection, high-precision recording, secure storage and efficient fault tracing analysis.

[0025] As an optional embodiment, the distributed system device log management system includes: The terminal log management module is integrated into the terminal devices of the distributed system. It is used to collect critical system logs, encapsulate and format them to generate formatted logs, and generate log timestamps and manage log storage based on system counting time and static time information. The distributed log service module, serving as the unified log management center of the distributed system, is deployed within the log service device of the distributed system and maintains network communication connections with each terminal device. The distributed log service module is configured to receive and uniformly store logs reported from various terminal devices, and provides a standardized open interface as an external log access interface. This interface is used to return logs within a specified time range from the entire network log database based on a network-wide log read request initiated by an external device, and to forward instructions to the terminal log management module of the target terminal based on a specified terminal log read request, obtain the local logs of the target terminal, and return them to the external device. The log analysis module is deployed in the terminal devices and log service devices of the distributed system. It is used to perform log escaping and parsing to generate readable log reports, as well as fault root cause location, identify the terminal device that first generated the fault log in the entire system, and mark the fault root cause device.

[0026] As an optional implementation, the terminal log management module identifies the log source of the terminal device, receives key event information, status change information, operation fault information and corresponding log codes and key data sent by the log source, and completes log encapsulation according to the preset structure of system calculation time + log source identifier + log code + key data to generate standardized formatted logs.

[0027] As an optional implementation, the generation of log timestamps based on system counting time and static time information includes: After the terminal device is powered on, the terminal log management module obtains the current static calendar time and static system count time, and stores the two as the initial time base. When the terminal device completes clock synchronization through an external clock source, the terminal log management module updates the synchronized calendar time plus the system count time to the new time base. When logs are generated, the terminal log management module calculates the difference between the current system count time and the time base, and converts it with the static calendar time in the time base to generate a precise calendar timestamp for the log.

[0028] As an optional implementation, the storage management of the logs includes: Using NVRAM as the local log storage medium, for consecutively generated identical logs, the criterion is that both the log code and key data are consistent. In this case, the terminal log management module executes an initial complete record + subsequent statistical merging mechanism. The first generated log is stored in NVRAM. For the same log generated within a set time, only the number of times it is repeated is counted. After the timeout, the log code and the number of times it is repeated are merged into a single log entry for storage. When the NVRAM storage space is exhausted, the terminal log management module automatically triggers a circular overwrite mechanism to delete the oldest stored log to retain the latest log, and records the storage location of the last log for subsequent log reading and parsing to locate the starting point.

[0029] As an optional implementation, the distributed log service module receives formatted logs and heartbeat logs reported by the terminal log management modules of each terminal device, adds a device source identifier to each log, identifies it according to the unique ID of the terminal device, and stores the logs of the entire network in the local large-capacity storage medium in the order of receipt according to the two-dimensional index of receiving time + device source identifier, forming a network log library. Among them, when the terminal log management module of each terminal device reports formatted logs, it is configured to install a preset policy to send them, and periodically generates heartbeat logs to record its own running status.

[0030] As an optional implementation, the distributed log service module is equipped with a clock synchronization module, which configures a clock synchronization service and periodically sends clock synchronization instructions to all terminal devices to ensure that the time base of all terminal devices in the network is consistent, thereby realizing unified timeline recording of logs in a distributed scenario.

[0031] As an optional implementation, the distributed log service module is equipped with a terminal status monitoring module, which generates a terminal log management module operation status table based on the heartbeat logs reported by the terminal devices, and records the online / offline status, remaining storage capacity, and log reporting frequency information of each terminal module. If a terminal device fails to report a heartbeat log for n consecutive heartbeat cycles (e.g., n=3), the terminal device is marked as offline / abnormal, and a status change log is generated and stored in the network log database.

[0032] As an optional implementation, the log analysis module is equipped with a log escaping and parsing module, which reads local logs and calls the log parsing rule base to escape the log codes in the logs into natural language descriptions, generating a readable log report with timestamp + device identifier + event type + event description + key data.

[0033] As an optional implementation, the log analysis module is equipped with a fault root cause location module, which is used to analyze the timeline log stream, identify the terminal device that generates the earliest fault log in the entire system by comparing the fault log time sequence and analyzing the correlation between fault types, and mark the fault root cause device; at the same time, it associates the fault root cause device with the network logs before and after the device failure, generates a fault propagation path diagram and a table of associated fault events, and outputs a fault location analysis report.

[0034] {Example 2} In this embodiment, we combine Figure 1 , 2 As shown in Figures 3 and 4, the implementation of each part of the present invention will be described in more detail.

[0035] I. Terminal Log Management Module The terminal log management module is deployed and integrated into the terminal devices of the distributed system. It supports adaptation to multiple hardware carriers and can run in the computer module, communication network card module or MCU of the terminal device.

[0036] The terminal log management module is used for log collection and formatting, high-precision timestamp generation, intelligent storage and management of log data, and local log interaction and status feedback.

[0037] ① Log collection and formatting: The module identifies the log source of the terminal device (such as CPU, network card, sensor, etc.), receives the "key event information (such as device start / stop), status change information (such as network connection / disconnection), and operation failure information (such as hardware abnormality)" sent by the log source, as well as the corresponding log code + key data, and completes the log encapsulation according to the preset structure of system calculation time + log source identifier + log code + key data to generate standardized formatted logs.

[0038] ② High-precision timestamp generation: After the terminal device is powered on, the module immediately obtains the current "static calendar time" (e.g., "2024-10-01 08:00:00") and "static system count time" (e.g., the device's internal clock count "100000us"), and stores them as the initial time base. When the terminal device completes clock synchronization through an external clock source (e.g., NTP server, GPS clock, etc.), the module updates the synchronized calendar time + system count time to the new time base. When the log is generated, the module calculates the difference between the current system count time and the time base, and converts it with the static calendar time in the time base to generate a precise calendar timestamp for the log (with the same precision as the system count time, reaching the microsecond level).

[0039] ③ Intelligent storage management: NVRAM (non-volatile random access memory) is used as the local log storage medium, and its automatic storage feature when power is off ensures that logs are not lost; for consecutively generated identical logs (log codes and key data are consistent), the module executes an initial complete recording + subsequent statistical merging mechanism: the first generated log is completely stored in NVRAM, and the identical logs generated in a subsequent set time (e.g., 10s) are only counted for the number of repetitions. After the timeout, the log code + the number of repetitions are merged into a single log entry for storage; When the NVRAM storage space is exhausted, the module automatically triggers a circular overwrite mechanism to delete the oldest stored log to retain the latest log, and records the storage location of the last log for subsequent log reading and parsing to locate the starting point.

[0040] ④ Log interaction and status feedback: Supports local log reading. When the terminal device receives a local log reading request, the module can directly read the log stream data in NVRAM, or parse it and write it to the terminal file system, or report it to the local terminal application. Local terminal devices send formatted logs to the distributed log service module via the network according to preset strategies (such as real-time reporting and periodic reporting), and at the same time generate heartbeat logs periodically (such as every 60 seconds), record the module's own operating status (such as normal / abnormal, remaining storage capacity, etc.), and report them to the distributed log service module.

[0041] II. Distributed Log Service Module The distributed log service module is deployed in a dedicated log service device within the distributed system. It serves as the unified management center for all system logs and maintains network connectivity with all terminal devices.

[0042] The distributed log service module is used for log reception and unified storage, network-wide clock synchronization and coordination, providing external log access interfaces, and monitoring the status of terminal devices.

[0043] ① Log reception and unified storage: Receive formatted logs and heartbeat logs reported by the terminal log management module of each terminal device, add a device source identifier (such as the unique ID of the terminal device) to each log, and store the logs of the entire network in the order of reception to a local large-capacity storage medium (such as a hard disk array) to form a network-wide log library.

[0044] ② Network-wide clock synchronization and collaboration: Equipped with a clock synchronization service (such as NTP service), clock synchronization commands are periodically sent to all terminal devices to ensure that the time base of all terminal devices on the network is consistent, thereby realizing unified timeline recording of all logs in a distributed scenario.

[0045] ③ External Log Access Interface: Provides a standardized open interface to support portable debugging devices (such as laptops and industrial tablets) to access via wired / wireless means; external devices can initiate two types of requests through this interface: one is a network-wide log read request to obtain logs within a specified time range from the network-wide log library; the other is a specified terminal log read request. After receiving the request, the module forwards the instruction to the terminal log management module of the target terminal to obtain the local logs of the target terminal and return them to the external device.

[0046] ④ Terminal Status Monitoring: Based on the heartbeat logs reported by the terminal devices, a terminal log management module operation status table is generated, recording the online / offline status, remaining storage capacity, log reporting frequency, etc. of each terminal module; when a terminal fails to report heartbeat logs for 3 consecutive heartbeat cycles, the module marks the terminal as offline / abnormal and generates a status change log, which is stored in the network log database for subsequent system health analysis.

[0047] III. Log Analysis Module The log analysis module supports two deployment modes: local deployment (integrated into the application on the terminal device, analyzing only local logs) and distributed deployment (integrated into the log service device, analyzing logs across the entire network). It requires log read permissions and a log parsing rule base (storing the mapping relationship between log codes and readable descriptions).

[0048] The log analysis module is used for log escaping parsing and fault location.

[0049] ① Log escaping and parsing: Read local logs (from terminal NVRAM) or network logs (from the network log library of the distributed log service module), call the log parsing rule library, and escape the log codes in the logs into natural language descriptions (such as escaping log code "0x001" to network card connection timeout failure), and generate a readable log report with timestamp + device identifier + event type + detailed description + key data.

[0050] ② Timeline Log Analysis: Based on the precise timestamps of the logs, sort the logs of a single device or the entire network in ascending / descending order by time to generate a timeline log stream; support users to input a time range (such as "2024-10-01 08:00-09:00") to filter target logs within that time period and quickly focus on key data during the period when the fault occurred.

[0051] ③ Fault Root Cause Location: For distributed system faults, the module analyzes the timeline log stream, and through fault log time sequence comparison and fault type correlation analysis (such as the propagation path of a certain fault type), identifies the terminal device that generates the earliest fault log in the entire system and marks the fault root cause device; at the same time, it associates the logs of the entire network before and after the fault of the device to generate a fault propagation path diagram and associated fault event table, outputs a fault location analysis report, and completes the fault location analysis.

[0052] {Example 3} To make the technical solution of this invention clearer, the operation flow of this system is described in detail below in conjunction with two typical application scenarios: Scenario 1: Local log management on a single device Combined with appendix Figure 1 As shown, this applies to stand-alone terminal devices without distributed collaboration requirements. The specific process is as follows: Log collection and storage: After the terminal device is powered on, the terminal log management module immediately obtains the static calendar time (e.g., 2024-10-01 08:00:00) + static system count time (e.g., 100000us) as the initial time base and stores it in NVRAM; when the device network card experiences a connection timeout failure, the log source sends "log code 0x001 + key data (timeout time 5s)" to the module. The module encapsulates the log according to "system calculation time (100000us + 5000us = 105000us) + log source (network card) + log code 0x001 + key data (5s)", generates the timestamp "2024-10-01 08:00:05" through difference conversion, and stores the log completely in NVRAM; if the same fault log is generated 3 times in a row within the next 10s, the module only counts the number of repetitions "3", and stores "log code 0x001 + number of repetitions 3" after the timeout.

[0053] Local log reading and analysis: Maintenance personnel connect to the debugging device through the local interface (such as USB interface) of the terminal device and initiate a local log reading request; the "Terminal Log Management Module" reads the log in NVRAM, parses it and writes it to the terminal file system; the "Log Analysis Module" (locally deployed) reads the file, calls the parsing rule base to escape "log code 0x001" to "network card connection timeout fault", generates a readable log report, and sorts out the fault sequence according to the timestamp, locating the fault occurrence period as "2024-10-01 08:00:05-08:00:15".

[0054] Scenario 2: Distributed System Log Management Combination Figure 2 , Figure 3 As shown, this is applicable to a distributed monitoring system consisting of one log service device and multiple terminal devices. The specific process is as follows: Network-wide clock synchronization: The distributed log service module of the log service device starts the NTP service and sends a clock synchronization command to multiple terminal devices every 30 minutes; after receiving the command, the terminal log management module of the terminal device updates the synchronized "calendar time + system count time" to the new time base to ensure that the time deviation of all devices in the network is ≤1ms.

[0055] Log reporting and unified storage: When terminal device 1 experiences a "sensor data anomaly" fault, its terminal log management module generates a formatted log (including timestamp "2024-10-01 09:10:00", log code "0x002", and device identifier "Dev001") and reports it to the distributed log service module in real time. This module adds "device source identifier Dev001", stores the log in the network-wide log database, and records the heartbeat log of terminal 1 (status "normal").

[0056] Troubleshooting and Source Tracing: After a large-scale data anomaly occurred in the system, maintenance personnel connected to the distributed log service module via a portable device and initiated a "2024-10-01 09:00-09:20 Full Network Log Read Request". The module returned the full network logs for that period. The log analysis module (distributed deployment) parsed and sorted the logs by timeline, and found that the earliest fault log was the sensor data anomaly log of terminal 1 (09:10:00). Subsequently, terminals 2-10 generated fault logs one after another due to receiving abnormal data from terminal 1. The module generated a fault location report, marked "The root cause device of the fault is Dev001", and output the fault propagation path "Dev001→Dev002→…→Dev10", providing maintenance personnel with accurate troubleshooting basis and improving fault troubleshooting efficiency.

[0057] While the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the invention. Those skilled in the art can make various modifications and refinements without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention shall be determined by the claims.

Claims

1. A distributed system device log management system, characterized in that, include: The terminal log management module is integrated into the terminal devices of the distributed system. It is used to collect critical system logs, encapsulate and format them to generate formatted logs, and generate log timestamps and manage log storage based on system counting time and static time information. The distributed log service module, serving as the unified log management center of the distributed system, is deployed within the log service device of the distributed system and maintains network communication connections with each terminal device. The distributed log service module is configured to receive and uniformly store logs reported from various terminal devices, and provides a standardized open interface as an external log access interface. This interface is used to return logs within a specified time range from the entire network log database based on a network-wide log read request initiated by an external device, and to forward instructions to the terminal log management module of the target terminal based on a specified terminal log read request, obtain the local logs of the target terminal, and return them to the external device. The log analysis module is deployed in the terminal devices and log service devices of the distributed system. It is used to perform log escaping and parsing to generate readable log reports, as well as fault root cause location, identify the terminal device that first generated the fault log in the entire system, and mark the fault root cause device.

2. The distributed system device log management system according to claim 1, characterized in that, The terminal log management module runs on the computer module, communication network card module, or MCU of the terminal device.

3. The distributed system device log management system according to claim 1, characterized in that, The terminal log management module identifies the log source of the terminal device, receives key event information, status change information, operation fault information and corresponding log codes and key data sent by the log source, and completes log encapsulation according to the preset structure of system calculation time + log source identifier + log code + key data to generate standardized formatted logs.

4. The distributed system device log management system according to claim 1, characterized in that, The generation of log timestamps based on system counting time and static time information includes: After the terminal device is powered on, the terminal log management module obtains the current static calendar time and static system count time, and stores the two as the initial time base. When the terminal device completes clock synchronization through an external clock source, the terminal log management module updates the synchronized calendar time plus the system count time to the new time base. When logs are generated, the terminal log management module calculates the difference between the current system count time and the time base, and converts it with the static calendar time in the time base to generate a precise calendar timestamp for the log.

5. The distributed system device log management system according to claim 1, characterized in that, The storage management of the logs includes: Using NVRAM as the local log storage medium, for consecutively generated identical logs, the criterion is that both the log code and key data are consistent. In this case, the terminal log management module executes an initial complete record + subsequent statistical merging mechanism. The first generated log is stored in NVRAM. For the same log generated within a set time, only the number of times it is repeated is counted. After the timeout, the log code and the number of times it is repeated are merged into a single log entry for storage. When the NVRAM storage space is exhausted, the terminal log management module automatically triggers a circular overwrite mechanism to delete the oldest stored log to retain the latest log, and records the storage location of the last log for subsequent log reading and parsing to locate the starting point.

6. The distributed system device log management system according to claim 1, characterized in that, The distributed log service module receives formatted logs and heartbeat logs reported by the terminal log management modules of each terminal device, adds a device source identifier to each log, identifies it by the unique ID of the terminal device, and stores the logs of the entire network in the order of receipt to a local large-capacity storage medium to form a network log library. Among them, when the terminal log management module of each terminal device reports formatted logs, it is configured to install a preset policy to send them, and periodically generates heartbeat logs to record its own running status.

7. The distributed system device log management system according to claim 6, characterized in that, The distributed log service module is equipped with a clock synchronization module, which configures a clock synchronization service and periodically sends clock synchronization instructions to all terminal devices to ensure that the time base of all terminal devices in the network is consistent, thereby realizing a unified timeline recording of logs in a distributed scenario.

8. The distributed system device log management system according to claim 6, characterized in that, The distributed log service module is equipped with a terminal status monitoring module, which generates a terminal log management module operation status table based on the heartbeat logs reported by the terminal devices, and records the online / offline status, remaining storage capacity, and log reporting frequency information of each terminal module. If a terminal device fails to report a heartbeat log for n consecutive heartbeat cycles, the terminal device is marked as offline / abnormal, and a status change log is generated and stored in the network log database.

9. The distributed system device log management system according to claim 6, characterized in that, The log analysis module is equipped with a log escaping and parsing module, which reads local logs and calls the log parsing rule base to escape the log codes in the logs into natural language descriptions, generating a readable log report with timestamp, device identifier, event type, event description, and key data.

10. The distributed system device log management system according to claim 6, characterized in that, The log analysis module is equipped with a fault root cause location module, which is used to analyze the time-axis log stream. By comparing the fault log time sequence and analyzing the correlation between fault types, it identifies the terminal device that generates the earliest fault log in the entire system and marks the fault root cause device. At the same time, it associates the fault root cause device with the network logs before and after the device failure, generates a fault propagation path diagram and a table of associated fault events, and outputs a fault location analysis report.

Images