Abnormal log analysis method and device, equipment, medium and product
By using similarity algorithms and historical databases to analyze anomaly logs within a microservice architecture, the problem of low efficiency in manual inspections is solved, enabling accurate location and efficient diagnosis of anomaly logs and reducing the risk of resource consumption.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-03-24
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
In a microservice architecture, manual transaction log inspection is inefficient, difficult to accurately locate anomalies, and poses a risk of resource consumption. It also lacks an effective inheritance mechanism, resulting in wasted manpower and low inspection efficiency.
By identifying the set of abnormal logs from the log database, calculating the similarity of context logs using a preset similarity algorithm, filtering out the context abnormal log sequences, and combining the analysis results with the historical abnormal log database, the accurate location and classification of abnormal logs can be achieved.
It improves log inspection efficiency, reduces the amount of logs to be analyzed, lowers the difficulty of abnormal log analysis, and enables accurate location and efficient diagnosis of abnormal logs.
Smart Images
Figure CN121722729A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] Embodiments of the present disclosure relate to the field of automation, and in particular, to an abnormal log analysis method, device, equipment, medium and product. BACKGROUND
[0002] In the context of a company system based on a micro-service architecture, the transaction logs generated usually contain business error information and system error information. At present, the subsystem-level transaction log inspection work is usually carried out in an artificial manner, and the main purpose is to actively monitor possible abnormal situations in the system transaction running process. However, this artificial transaction log inspection method has many defects. On the one hand, the amount of transaction logs is extremely large and distributed relatively dispersedly, and it is difficult to classify the abnormal transaction logs. Since the company's internal system adopts a micro-service design, the interaction between systems is frequent, and the number of servers is large. In these transaction logs, various types of transaction output information are interwoven, and various types of error information are also mixed. It is not only difficult for humans to distinguish these logs, but also easy to miss abnormal transaction analysis. In addition, frequent login to production servers to view logs also has the risk of executing commands to seize memory resources, thereby affecting the stability of the engineering running. On the other hand, the problem analysis conclusions obtained by artificial inspection lack an effective inheritance mechanism, and known problems often need to be analyzed repeatedly. This situation not only wastes human resources, but also further reduces the overall efficiency of the inspection work. SUMMARY
[0003] Embodiments of the present disclosure provide an abnormal log analysis method, device, equipment, medium and product, which provide a basis for abnormal diagnosis, realize accurate positioning of abnormal logs, and improve the inspection efficiency of logs.
[0004] In a first aspect, an abnormal log analysis method is provided, comprising:
[0005] determining, from a log database, an abnormal log set corresponding to a current service instance; the abnormal log set comprising at least one abnormal log group; each abnormal log group comprising a reference abnormal log and at least one comparison abnormal log;
[0006] for any one abnormal log group, using a preset similarity algorithm to calculate the similarity between each context log in a context log set of each comparison abnormal log in the abnormal log group and each context log in a context log set corresponding to the reference abnormal log;
[0007] for any one comparison abnormal log, based on the time corresponding to the comparison abnormal log, using the similarities to filter the context log set corresponding to the comparison abnormal log to determine a context abnormal log sequence corresponding to the comparison abnormal log;
[0008] Based on the contextual anomaly log sequence corresponding to each of the aforementioned anomaly logs and the historical anomaly log database, the analysis results of each of the aforementioned anomaly logs are determined; the historical anomaly log database includes each historical anomaly log and its corresponding anomaly cause.
[0009] Secondly, an analysis device for anomaly logs is provided, comprising:
[0010] An exception log group determination module is used to determine the exception log set corresponding to the current service instance from the log database; the exception log set includes at least one exception log group; each exception log group includes a baseline exception log and at least one comparison exception log;
[0011] The similarity calculation module is used to calculate, for any abnormal log group, the similarity between each context log in the context log set of each comparison abnormal log in the abnormal log group and each context log in the context log set corresponding to the baseline abnormal log using a preset similarity algorithm.
[0012] The context log abnormal log sequence determination module is used to, for any comparison abnormal log, filter the context log set corresponding to the comparison abnormal log based on the time corresponding to the comparison abnormal log and use the similarity of each comparison abnormal log to determine the context abnormal log sequence corresponding to the comparison abnormal log.
[0013] The analysis result determination module is used to determine the analysis result of each of the comparative anomaly logs based on the context anomaly log sequence corresponding to each of the comparative anomaly logs and the historical anomaly log database; the historical anomaly log database includes each historical anomaly log and its corresponding anomaly cause.
[0014] Thirdly, an electronic device is provided, comprising:
[0015] At least one processor; and,
[0016] A memory communicatively connected to the at least one processor; wherein,
[0017] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the abnormal log analysis method as described in the first aspect above.
[0018] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method for analyzing exception logs as described in the first aspect above.
[0019] Fifthly, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the exception log analysis method as described in the first aspect above.
[0020] This disclosure provides a method, apparatus, device, medium, and product for analyzing abnormal logs. The method includes: determining an abnormal log set corresponding to a current service instance from a log database; the abnormal log set includes at least one abnormal log group; each abnormal log group includes a baseline abnormal log and at least one comparative abnormal log; for any abnormal log group, calculating the similarity between each context log in the context log set of each comparative abnormal log in the abnormal log group and each context log in the context log set corresponding to the baseline abnormal log using a preset similarity algorithm; for any comparative abnormal log, filtering the context log set corresponding to the comparative abnormal log based on the time corresponding to the comparative abnormal log using the similarity values to determine the context abnormal log sequence corresponding to the comparative abnormal log; determining the analysis result of each comparative abnormal log based on the context abnormal log sequence corresponding to each comparative abnormal log and a historical abnormal log database; the historical abnormal log database includes each historical abnormal log and its corresponding abnormal cause. This technical solution first determines an abnormal log set containing a baseline abnormal log and comparative abnormal logs from the log database based on a preset similarity algorithm, achieving accurate identification and classification of similar abnormal logs and avoiding the problem of repeatedly checking similar error information. Next, the similarity between the context log set of the comparison anomaly log and the context log set of the baseline anomaly log is calculated, and the context anomaly log sequence is filtered out based on the time information of the comparison anomaly log. Finally, by combining the context anomaly log sequence and historical data in the historical anomaly log database, the analysis results of the comparison anomaly log are determined, providing a basis for anomaly diagnosis, improving log inspection efficiency, achieving accurate location of anomaly logs, reducing the volume of logs to be analyzed, and reducing the difficulty of anomaly log analysis.
[0021] It should be understood that the description in this section is not intended to identify key or important features of the embodiments of this disclosure, nor is it intended to limit the scope of the embodiments of this disclosure. Other features of the embodiments of this disclosure will become readily apparent from the following description. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0023] Figure 1 This is a flowchart of an anomaly log analysis method provided in Embodiment 1 of this disclosure;
[0024] Figure 2 This is a schematic diagram of the structure of an anomaly log analysis device provided in Embodiment 2 of this disclosure;
[0025] Figure 3 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of this disclosure. Detailed Implementation
[0026] To enable those skilled in the art to better understand the solutions of the embodiments of this disclosure, the technical solutions of the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this disclosure, and not all embodiments. Based on the embodiments of this disclosure, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the protection scope of the embodiments of this disclosure.
[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0028] Example 1
[0029] Figure 1 This is a flowchart illustrating an anomaly log analysis method provided in Embodiment 1 of this disclosure. This embodiment is applicable to situations involving the analysis and processing of anomaly logs. The method can be executed by an anomaly log analysis device, which can be implemented in hardware and / or software. This device can be configured in an electronic device, including but not limited to computers, PCs, electronic devices, and servers, which are devices with data processing capabilities. Figure 1 As shown, the method includes:
[0030] S110. Determine the set of exception logs corresponding to the current service instance from the log database; the set of exception logs includes at least one exception log group; each exception log group includes a baseline exception log and at least one comparison exception log.
[0031] In this embodiment, the log database can be used to store log information generated during system operation. Log information typically includes various event records during system operation, such as collection time, operation records, error messages, performance metrics, etc. For example, taking the log information of any project as an example, the log information may include: project name, log timestamp, log level, and process ID. The server name, thread number, program information, and log details are required. The program information may also include the full package name, program name, and the line number corresponding to the specific log output. The initial set of exception logs for the current service instance can be retrieved from the log database. A service instance can refer to a specific instance of a service (such as a project) during runtime. The set of exception logs corresponding to the current service instance can be determined from the log database.
[0032] As described above, the anomaly log set includes at least one anomaly log group, and each anomaly log group may include a baseline anomaly log and at least one comparison anomaly log. For example, the anomaly log set includes 100 anomaly log groups, and each anomaly log group may include one baseline anomaly log and 99 comparison anomaly logs. The baseline anomaly log can be a log within the anomaly log group used as a benchmark. The baseline anomaly log can be randomly selected and used for similarity comparison with other comparison logs to help identify and classify similar anomaly logs. The comparison anomaly logs can be other logs compared to the baseline anomaly log, and the comparison anomaly logs can be randomly selected. An anomaly log can be randomly selected from the anomaly log group as the baseline anomaly log, and the others as comparison anomaly logs.
[0033] S120. For any abnormal log group, use a preset similarity algorithm to calculate the similarity between each context log in the context log set of each comparison abnormal log in the abnormal log group and each context log in the context log set corresponding to the baseline abnormal log.
[0034] It is known that any anomaly log group can include a baseline anomaly log and at least one comparison anomaly log. Each anomaly log has a context log set, which contains log information surrounding the anomaly log. For example, for any anomaly log in the anomaly log group (either the comparison anomaly log or the baseline anomaly log), log information from the log database for the two minutes before and after the anomaly log is collected based on the anomaly log's occurrence time, server and service instance number (thread number). If the number of log entries exceeds 80, the 80 log entries most recent to the transaction occurrence time are retained as the context log information set.
[0035] As described above, using a preset similarity algorithm, the similarity is calculated between each context log in the context log set of each comparison anomaly log and each context log in the context log set corresponding to the baseline anomaly log. That is, the preset similarity algorithm compares the similarity between the context logs of the comparison anomaly log and the context logs of the baseline anomaly log one by one.
[0036] S130. For any comparison anomaly log, based on the time corresponding to the comparison anomaly log, filter the context log set corresponding to the comparison anomaly log using each similarity to determine the context anomaly log sequence corresponding to the comparison anomaly log.
[0037] Specifically, each context log in the context log set contains a corresponding time. For any comparison exception log, the time corresponding to that exception log can be used as the starting time to sort the context log set corresponding to the exception log, resulting in a sorted context log set.
[0038] As described above, the obtained similarity scores can be used to filter the context logs in the sorted context log set to determine the context anomaly log sequence corresponding to the compared anomaly logs. For example, context logs with similarity scores higher than a preset threshold can be used to form a context log sequence.
[0039] S140. Based on the contextual anomaly log sequence corresponding to each comparative anomaly log and the historical anomaly log database, determine the analysis results of each comparative anomaly log; the historical anomaly log database includes each historical anomaly log and its corresponding anomaly cause.
[0040] Specifically, after obtaining the contextual anomaly log sequences corresponding to each comparison anomaly log, for the contextual anomaly log sequence corresponding to the current comparison anomaly log, natural language similarity calculation can be performed between the current comparison anomaly log and the historical anomaly logs in the historical anomaly log database. The analysis results of the historical anomaly logs whose similarity meets a preset threshold are determined as the analysis results corresponding to the current comparison anomaly log, and thus the analysis results of each comparison anomaly log can be determined. If a historical anomaly log with a similarity higher than the preset similarity threshold can be identified in the historical anomaly log database, the anomaly cause of the identified historical anomaly log can be used as the anomaly cause of the comparison anomaly log. If no historical anomaly log with a similarity higher than the preset similarity threshold exists in the historical anomaly log database, the current comparison anomaly log can be identified as a new anomaly.
[0041] For example, the contextual anomaly log sequence corresponding to the current anomaly log can be used as a list to be confirmed. The historical anomaly log database is traversed, and natural language similarity calculations are performed between the list to be confirmed and each historical anomaly log in the database. If a similar log is found (i.e., the similarity is higher than a set threshold), the conclusion can be directly synchronized, such as synchronizing the anomaly transaction log status confirmation, anomaly transaction log analysis conclusion feedback, and anomaly transaction log analysis timestamp. The latest results are then updated in the anomaly transaction log repository, and the log is removed from the list of logs to be confirmed. If no similar log is found, it is marked as a new anomaly. It should be noted that historical anomaly log data within a set time period can also be obtained from the historical anomaly log database, and natural language similarity calculations are performed between the list to be confirmed and each historical anomaly log within that time period. The conclusion of the historical anomaly log with the highest similarity exceeding the set threshold is synchronized to the analysis results corresponding to the current anomaly log. If no historical anomaly log data within the set time period is found with a similarity higher than the set threshold, it is determined to be a new anomaly.
[0042] This embodiment provides a method for analyzing abnormal logs, including: determining an abnormal log set corresponding to the current service instance from a log database; the abnormal log set includes at least one abnormal log group; each abnormal log group includes a baseline abnormal log and at least one comparative abnormal log; for any abnormal log group, using a preset similarity algorithm, calculating the similarity between each context log in the context log set of each comparative abnormal log in the abnormal log group and each context log in the context log set corresponding to the baseline abnormal log; for any comparative abnormal log, based on the time corresponding to the comparative abnormal log, filtering the context log set corresponding to the comparative abnormal log using the similarity values to determine the context abnormal log sequence corresponding to the comparative abnormal log; based on the context abnormal log sequences corresponding to each comparative abnormal log and a historical abnormal log database, determining the analysis results of each comparative abnormal log; the historical abnormal log database includes each historical abnormal log and its corresponding abnormal cause. This technical solution provides a basis for anomaly diagnosis, improves log inspection efficiency, achieves accurate location of abnormal logs, reduces the volume of logs to be analyzed, and reduces the difficulty of abnormal log analysis.
[0043] As an optional implementation of this embodiment, the method for analyzing exception logs provided in this embodiment, wherein determining the set of exception logs corresponding to the current service instance from the log database includes:
[0044] 1) Obtain the initial set of exception logs corresponding to the current service instance from the log database.
[0045] In this embodiment, the initial set of exception logs corresponding to the current service instance can be obtained from the log database. The initial set of exception logs can be a collection of exception logs collected at a specific point in time or within a specific time period. The initial set of exception logs can include exception logs that occur during system operation, such as errors and warnings.
[0046] 2) Determine the feature value corresponding to each abnormal log in the initial abnormal log set.
[0047] It is known that after obtaining the initial set of exception logs, the feature values corresponding to each exception log in the initial set can be extracted. For example, the feature values of each exception log can be extracted according to the principle of "extracting the first line of the JDK exception stack trace as the root cause of the error".
[0048] 3) Based on each of the aforementioned feature values, the initial abnormal log set is grouped according to the preset similarity algorithm and the preset threshold to determine a first abnormal log set, wherein the first abnormal log set includes at least one first abnormal log group.
[0049] Specifically, after obtaining the feature values of each abnormal log, a preset similarity algorithm can be used to determine the similarity between the feature values of each abnormal log. Based on the determined similarity and a preset threshold, the abnormal logs are then grouped. The preset similarity algorithm can be a natural language similarity algorithm.
[0050] Specifically, during the grouping process, if the current grouping list is empty, meaning no initial abnormal logs have been grouped, the first abnormal log will be directly added to a new abnormal log set. However, if the grouping list is not empty, the entire list may be iterated through, and a preset similarity algorithm may be used to calculate the similarity between the feature values of the current abnormal log and the feature values of all existing logs in the grouping list. The similarity result is then compared with a preset threshold. If the result is higher than the threshold, it means the current abnormal log has a sufficiently high similarity to an existing group, and the current abnormal log will be assigned to that existing group. If the result is lower than the threshold, it means the current abnormal log has insufficient similarity to any existing group, and the current abnormal log will be added to a new group. Through this grouping process, the resulting first abnormal log groups can be obtained, and each first abnormal log group can include various similar abnormal logs. These first abnormal log groups can constitute a first abnormal log set.
[0051] 4) Filter each of the first abnormal log groups based on preset quantity filtering conditions to determine the abnormal log set.
[0052] Specifically, after obtaining each first abnormal log group, a preset quantity filtering condition can be used to filter each first abnormal log group. It can be determined whether the total number of abnormal logs contained in each first abnormal log group meets the preset quantity filtering condition. First abnormal log groups that meet the preset quantity filtering condition can be directly identified as abnormal log groups in the abnormal log set; first abnormal log groups that do not meet the preset quantity filtering condition can be processed, and the processed abnormal log groups can be identified as abnormal log groups in the abnormal log set.
[0053] If the conditions are not met, the abnormal log groups that do not meet the preset quantity filtering criteria can be set as pending abnormal log groups, and random sampling can be performed on these pending abnormal log groups to obtain processed abnormal log groups that meet the preset quantity filtering criteria. If the conditions are met, the first abnormal log group whose total quantity meets the preset quantity filtering criteria can be included as an abnormal log group in the abnormal log set.
[0054] As an optional implementation of this embodiment, the step of filtering each of the first abnormal log groups based on a preset quantity filtering condition to determine the abnormal log set further includes:
[0055] 1) Based on the preset quantity filtering conditions, each of the first abnormal log groups is filtered to determine the second abnormal log group and the third abnormal log group; the second abnormal log group is the abnormal log group that does not meet the preset quantity filtering conditions, and the third abnormal log group is the abnormal log group that meets the preset quantity filtering conditions.
[0056] Specifically, the preset quantity filtering condition can be that the total number of abnormal logs is less than or equal to a preset quantity threshold. The first abnormal log group can be filtered based on the preset quantity filtering condition to obtain a second abnormal log group and a third abnormal log group. The second abnormal log group is the abnormal log group that does not meet the preset quantity filtering condition, and the third abnormal log group is the abnormal log group that does meet the preset quantity filtering condition.
[0057] 2) Randomly sample the log data in the second abnormal log group to obtain a fourth abnormal log group that meets the preset quantity filtering conditions.
[0058] It is known that the abnormal log data in the second abnormal log group can be randomly sampled to obtain a fourth abnormal log group that meets the preset quantity filtering conditions. For example, the preset quantity threshold can be 100. If the total number of abnormal logs contained in the second abnormal log group exceeds 100, 100 logs can be randomly sampled from the second abnormal log group as the processed fourth abnormal log group.
[0059] 3) Determine the abnormal log set based on the fourth abnormal log group and the third abnormal log group.
[0060] Specifically, after obtaining the processed fourth exception log group, the fourth exception log group and the third exception log group can be combined to form an exception log set.
[0061] As an optional implementation of this embodiment, the similarity includes a first similarity and a second similarity; the step of calculating the similarity between each context log in the context log set corresponding to each comparison anomaly log in the anomaly log group and each context log in the context log set corresponding to the baseline anomaly log using a preset similarity algorithm includes:
[0062] 1) For any comparison daily log, parse the context log set corresponding to the comparison anomaly log to obtain a first program information column and a first specific content column; the first program information column includes the first program information corresponding to each context log in the context log set of the comparison anomaly log; the first specific content column includes the first specific content corresponding to each context log in the context log set of the comparison anomaly log.
[0063] In this embodiment, for any comparison anomaly log, regular expression rules can be used to parse the context log set of the comparison anomaly log. Specifically, each context log in the context log set is parsed into program information and specific content. Summarizing the program information and specific content obtained from each context log yields a first program information column and a first specific content column. The first program information column includes the first program information corresponding to each context log in the comparison anomaly log set; the first specific content column includes the first specific content corresponding to each context log in the comparison anomaly log set.
[0064] For example, parsing the first context log in the context log set of the comparison exception log can yield the first program information in the first program information column.
[0065] 2) Parse the context log set corresponding to the benchmark anomaly log to obtain a second program information column and a second specific content column; the second program information column includes the second program information corresponding to each context log in the context log set of the benchmark anomaly log; the second specific content column includes the second specific content corresponding to each context log in the context log set of the benchmark anomaly log.
[0066] In this embodiment, for the baseline anomaly log, regular expression rules can be used to parse the context log set of the baseline anomaly log. Specifically, each context log in the context log set is parsed into program information and specific content. Summarizing the program information and specific content obtained from each context log yields a second program information column and a second specific content column. The second program information column includes the second program information corresponding to each context log in the baseline anomaly log set; the second specific content column includes the second specific content corresponding to each context log in the baseline anomaly log set.
[0067] For example, parsing the first context log in the context log set of the baseline exception log can yield the first program information in the second program information column.
[0068] 3) Determine each program information pair based on the sequential positional correspondence between each first program information in the first program information column and each second program information in the second program information column.
[0069] Specifically, each piece of program information in the first and second program information columns has a sequential position. For example, the first piece of program information in the first column and the first piece of program information in the second column have the same sequential position, and therefore can be paired to form a program information pair. In this way, based on the correspondence of the sequential positions of the two columns of program information, all possible program information pairs can be determined.
[0070] 4) Based on each program information pair, the first similarity corresponding to each context log in the context log set of the comparison anomaly log is determined by the preset similarity algorithm.
[0071] It is known that a preset similarity algorithm can be used to calculate the first similarity between each context log in the context log set of the comparison anomaly log and the context log of the baseline anomaly log. Specifically, for each pair of program information, the preset similarity algorithm can be used to calculate the similarity between the program information pairs, and this similarity can be referred to as the first similarity.
[0072] For example, the first program information in the first program information column is obtained by parsing the first context log in the context log set of the comparison exception log, and the first program information in the second program information column is obtained by parsing the first context log in the context log set of the benchmark exception log. Therefore, the similarity between the first program information in the first program information column and the first program information in the second program information column can be used as the first similarity between the first context log in the context log set of the comparison exception log and the first context log in the context log set of the benchmark exception log.
[0073] 5) Determine each specific content pair based on the sequential positional correspondence between each first specific content in the first specific content column and each second specific content in the second specific content column.
[0074] Specifically, each item in the first and second content columns has a sequential position. For example, the first item in the first column and the first item in the second column have the same sequential position, and therefore can be paired to form a content pair. In this way, based on the sequential position correspondence of the content in the two columns, all possible content pairs can be determined.
[0075] 6) Based on each specific content pair, the second similarity corresponding to each context log in the context log set of the comparison anomaly log is determined by the preset similarity algorithm.
[0076] It is known that a pre-defined similarity algorithm can be used to calculate the second similarity between each context log in the context log set of the comparison anomaly log and each context log in the context log set of the baseline anomaly log. Specifically, for each specific content pair, the pre-defined similarity algorithm can be used to calculate the similarity between the specific content pairs, and this similarity can be referred to as the second similarity.
[0077] For example, the first specific content in the first specific content column is obtained by parsing the first context log in the context log set of the comparison anomaly log, and the first specific content in the second specific content column is obtained by parsing the first context log in the context log set of the benchmark anomaly log. Therefore, the similarity between the first specific content in the first specific content column and the first specific content in the second specific content column can be used as the second similarity between the first context log in the context log set of the comparison anomaly log and the first context log in the context log set of the benchmark anomaly log.
[0078] For example, if the context log set of the comparison anomaly log contains 80 context logs, then the parsed first program information column and first specific content column will also have 80 rows (each program information in the first program information column can be represented as A1 (80 in total), and each specific content in the first specific content column can be represented as A2 (80 in total)), with each row corresponding to the 80 context logs. Similarly, if the context log set of the baseline anomaly log contains 80 context logs, then the parsed second program information column and second specific content column will also have 80 rows (each program information in the second program information column can be represented as B1 (80 in total), and each specific content in the second specific content column can be represented as B2 (80 in total)), with each row corresponding to the 80 context logs. Furthermore, the similarity between each A1 and B1 (first similarity) and the similarity between each A2 and B2 (second similarity) can be calculated separately.
[0079] As an optional implementation of this embodiment, the step of filtering the context log set corresponding to the compared anomaly log based on the time corresponding to the compared anomaly log, using the similarity of each log, to determine the context anomaly log sequence corresponding to the compared anomaly log includes:
[0080] 1) Using the time corresponding to the comparison anomaly log, determine the first preceding anomaly log sequence and the first following anomaly log sequence based on the context log set corresponding to the comparison anomaly log.
[0081] In this embodiment, the time corresponding to the comparison anomaly log can be obtained from the log database. The time corresponding to the comparison anomaly log can be used as the starting time to sort the context log set corresponding to the comparison anomaly log, resulting in a first preceding anomaly log sequence and a first following anomaly log sequence. The first preceding anomaly log sequence can be a sequence of preceding anomaly logs whose log time is before the starting time, and the first following anomaly log sequence can be a sequence of following anomaly logs whose log time is after the starting time.
[0082] For example, the time corresponding to the anomaly log can be represented as T0. The first anomaly log sequence above stores 99 log samples before time T0, with index 0 corresponding to T0. Data at time 1, index 98 corresponds to T0 Data at time 99. First, the following is the abnormal log sequence: storing 99 log samples after time T0, with index 0 corresponding to T0. Data at time 1, index 98 corresponds to T0 Data from time 99. Each sequence element contains a triplet of specific content, program information, and similarity calculation results (first similarity and second similarity).
[0083] 2) For the first above-text abnormal log sequence and the first below-text abnormal log sequence, the status of the corresponding abnormal log is marked based on the first similarity and the second similarity corresponding to each abnormal log in the first above-text abnormal log sequence and the first below-text abnormal log sequence, respectively. The status includes a valid status and a status to be verified.
[0084] Specifically, after obtaining the first preceding context abnormal log sequence and the first following context abnormal log sequence, the final similarity of each abnormal log can be determined based on the first similarity and the second similarity corresponding to each abnormal log in the first preceding context abnormal log sequence and the first following context abnormal log sequence. For example, the average of the sum of the first similarity and the second similarity can be used as the final similarity. Based on the final similarity of each abnormal log in the first preceding context abnormal log sequence and the first following context abnormal log sequence, the status of the corresponding abnormal log can be determined. The status can include a valid status and a pending verification status.
[0085] For example, a final similarity threshold is set. If the calculated final similarity is higher than the set final similarity threshold, the status of the abnormal log corresponding to the final similarity can be determined as a valid status. If the calculated final similarity is higher than the set final similarity threshold, the status of the abnormal log corresponding to the final similarity can be determined as a pending verification status.
[0086] 3) Use a preset state backtracking algorithm to optimize the state of the abnormal logs marked as the state to be verified in the first above-text abnormal log sequence and the first below-text abnormal log sequence, so as to obtain the second above-text abnormal log sequence and the second below-text abnormal log sequence.
[0087] Specifically, after obtaining the status of each abnormal log in the first preceding abnormal log sequence and the first following abnormal log sequence, a preset status backtracking algorithm can be used to optimize the status of the abnormal logs marked as the status to be verified in the first preceding abnormal log sequence and the first following abnormal log sequence. The optimized first preceding abnormal log sequence is then determined as the second preceding abnormal log sequence, and the optimized first following abnormal log sequence is then determined as the second following abnormal log sequence.
[0088] In this embodiment, the preset state backtracking algorithm can be a recursive forward detection algorithm. For example, the first above-mentioned abnormal log sequence may include: (To be verified) (To be verified) (To be verified) (To be verified) (The above log entry) (To be verified) (The above log entry) (To be verified) (The above log entry) (To be verified). In the recursive forward detection algorithm, the distance from the start time ( The furthest exception log marked as (previous log) is traced back to the starting time, that is, from exception log i to exception log a. The exception logs in exception log i to exception log a whose status is pending verification are changed to the previous log. That is, the status of a, b, c, d, f, and h are changed from pending verification to the previous log, while the status of j is not changed.
[0089] Following the above description, after performing state backtracking, the resulting sequence of abnormal logs can be: a: 15:00 (logs above). (The above log entry) (The above log entry) (The above log entry) (The above log entry) (The above log entry) (The above log entry) (The above log entry) (The above log entry) (To be verified).
[0090] 4) Generate the context exception log sequence based on the second preceding exception log sequence and the second following exception log sequence.
[0091] Specifically, after obtaining the second preceding context exception log sequence and the second following context exception log sequence, a context exception log sequence can be generated based on the second preceding context exception log sequence and the second following context exception log sequence.
[0092] As an optional implementation of this embodiment, generating the context exception log sequence based on the second preceding context exception log sequence and the second following context exception log sequence includes:
[0093] 1) Determine the valid above-text log sequence based on the status corresponding to each above-text abnormal log in the second above-text abnormal log sequence.
[0094] Specifically, the valid endpoint of the preceding text can be determined based on the status corresponding to each preceding text exception log in the second preceding text exception log sequence. Then, each preceding text exception log from the starting point to the valid endpoint of the preceding text in the second preceding text exception log sequence can be extracted, thereby determining the valid preceding text log sequence.
[0095] For example, the valid endpoint mentioned above: find the largest k that satisfies the second above abnormal log sequence. All exception logs with the status "previous log" are considered as previous logs. Previous exception logs from 0 to k are considered as valid previous logs.
[0096] 2) Determine the valid context log sequence based on the status corresponding to each context log exception in the second context log sequence.
[0097] Specifically, the valid endpoint of the following text can be determined based on the status corresponding to each following text exception log in the second following text exception log sequence. Then, each following text exception log from the starting point to the valid endpoint of the following text exception log sequence can be extracted to determine the valid following text log sequence.
[0098] For example, the following valid endpoint: finding the largest m that satisfies the second following abnormal log sequence. All are "follow-up logs", and the following error logs from 0 to m are used as the valid following queue.
[0099] 3) Combine the valid preceding log sequence and the valid following log sequence to obtain the context exception log sequence.
[0100] It is known that the context exception log sequence can be obtained by combining the valid preceding log sequence and the valid following log sequence.
[0101] It should be noted that after determining the context exception log sequence, the context exception log sequence, along with the corresponding comparison exception log and baseline exception log, can be saved to the exception log database.
[0102] Example 2
[0103] Figure 2 This is a schematic diagram of the structure of an anomaly log analysis device provided in Embodiment 2 of this disclosure; as shown... Figure 2 As shown, the device includes: an anomaly log group determination module 210, a similarity calculation module 220, a context log anomaly log sequence determination module 230, and an analysis result determination module 240.
[0104] The exception log group determination module 210 is used to determine the exception log set corresponding to the current service instance from the log database; the exception log set includes at least one exception log group; each exception log group includes a baseline exception log and at least one comparison exception log.
[0105] The similarity calculation module 220 is used to calculate, for any abnormal log group, the similarity between each context log in the context log set of each comparison abnormal log in the abnormal log group and each context log in the context log set corresponding to the baseline abnormal log using a preset similarity algorithm.
[0106] The context log abnormal log sequence determination module 230 is used to, for any comparison abnormal log, filter the context log set corresponding to the comparison abnormal log based on the time corresponding to the comparison abnormal log and use the similarity of each comparison abnormal log to determine the context abnormal log sequence corresponding to the comparison abnormal log.
[0107] The analysis result determination module 240 is used to determine the analysis result of each of the comparative abnormal logs based on the context abnormal log sequence corresponding to each of the comparative abnormal logs and the historical abnormal log database; the historical abnormal log database includes each historical abnormal log and its corresponding abnormal cause.
[0108] Embodiment 2 of this disclosure provides an analysis device for abnormal logs, which provides a basis for abnormal diagnosis, improves the efficiency of log inspection, realizes accurate location of abnormal logs, reduces the volume of logs to be analyzed, and reduces the difficulty of abnormal log analysis.
[0109] Furthermore, the similarity includes a first similarity and a second similarity; the similarity calculation module 220 further includes:
[0110] The first parsing unit is used to parse the context log set corresponding to the comparison anomaly log for any comparison daily log to obtain a first program information column and a first specific content column; the first program information column includes the first program information corresponding to each context log in the context log set of the comparison anomaly log; the first specific content column includes the first specific content corresponding to each context log in the context log set of the comparison anomaly log.
[0111] The second parsing unit is used to parse the context log set corresponding to the benchmark anomaly log to obtain a second program information column and a second specific content column; the second program information column includes the second program information corresponding to each context log in the context log set of the benchmark anomaly log; the second specific content column includes the second specific content corresponding to each context log in the context log set of the benchmark anomaly log.
[0112] The program information pair determination unit is used to determine each program information pair based on the sequential position correspondence between each first program information in the first program information column and each second program information in the second program information column;
[0113] The first similarity determination unit is used to determine the first similarity of each context log in the context log set of the comparison anomaly log based on each program information pair and using the preset similarity algorithm.
[0114] The specific content pair determination unit is used to determine each specific content pair based on the sequential position correspondence between each first specific content in the first specific content column and each second specific content in the second specific content column;
[0115] The second similarity determination unit is used to determine the second similarity of each context log in the context log set of the comparison anomaly log based on each specific content pair and using the preset similarity algorithm.
[0116] Furthermore, the context log exception log sequence determination module 230 is also used for:
[0117] Using the time corresponding to the comparison anomaly logs, a first preceding anomaly log sequence and a first following anomaly log sequence are determined based on the context log set corresponding to the comparison anomaly logs.
[0118] For the first preceding abnormal log sequence and the first following abnormal log sequence, the status of the corresponding abnormal log is marked based on the first similarity and the second similarity corresponding to each abnormal log in the first preceding abnormal log sequence and the first following abnormal log sequence, respectively. The status includes a valid status and a status to be verified.
[0119] A preset state backtracking algorithm is used to optimize the state of the abnormal logs marked as the state to be verified in the first above-text abnormal log sequence and the first below-text abnormal log sequence, so as to obtain the second above-text abnormal log sequence and the second below-text abnormal log sequence.
[0120] The context exception log sequence is generated based on the second preceding exception log sequence and the second following exception log sequence.
[0121] Furthermore, the generating unit is also used for:
[0122] The valid above-text log sequence is determined based on the status corresponding to each above-text abnormal log in the second above-text abnormal log sequence.
[0123] The valid context log sequence is determined based on the status corresponding to each context log exception in the second context log sequence.
[0124] The context exception log sequence is obtained by combining the valid preceding log sequence and the valid following log sequence.
[0125] Furthermore, the exception log group determination module 210 also includes:
[0126] An initial exception log set determination unit is used to obtain the initial exception log set corresponding to the current service instance from the log database.
[0127] A feature value determination unit is used to determine the feature value corresponding to each abnormal log in the initial abnormal log set;
[0128] The first abnormal log set determination unit is used to group the initial abnormal log set according to each of the feature values, based on the preset similarity algorithm and the preset threshold, to determine the first abnormal log set, wherein the first abnormal log set includes at least one first abnormal log group.
[0129] An abnormal log set determination unit is used to filter each of the first abnormal log groups based on a preset quantity filtering condition to determine the abnormal log set.
[0130] Furthermore, the exception log set determination unit is also used for:
[0131] Based on preset quantity filtering conditions, each of the first abnormal log groups is filtered to determine the second abnormal log group and the third abnormal log group; the second abnormal log group is the abnormal log group that does not meet the preset quantity filtering conditions, and the third abnormal log group is the abnormal log group that meets the preset quantity filtering conditions.
[0132] Randomly sample the log data in the second abnormal log group to obtain a fourth abnormal log group that meets the preset quantity filtering conditions;
[0133] The abnormal log set is determined based on the fourth abnormal log group and the third abnormal log group.
[0134] The abnormal log analysis device provided in this disclosure can execute the abnormal log analysis method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of the execution method.
[0135] Example 3
[0136] Figure 3 A schematic diagram of the structure of an electronic device 10 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the embodiments of the present disclosure described and / or claimed herein.
[0137] like Figure 3 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0138] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0139] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microprocessor, etc. Processor 11 performs the various methods and processes described above, such as methods for analyzing exception logs.
[0140] In some embodiments, the anomaly log analysis method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the anomaly log analysis method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the anomaly log analysis method by any other suitable means (e.g., by means of firmware).
[0141] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0142] Computer programs for implementing the methods of embodiments of this disclosure may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.
[0143] In the context of embodiments of this disclosure, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0144] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0145] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.
[0146] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.
[0147] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the embodiments of this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of the embodiments of this disclosure can be achieved, and this document does not impose any limitations.
[0148] The specific embodiments described above do not constitute a limitation on the scope of protection of the embodiments disclosed herein. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the embodiments disclosed herein should be included within the scope of protection of the embodiments disclosed herein.
[0149] This disclosure also provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements the exception log analysis method provided in any embodiment of this application.
[0150] In implementing a computer program product, computer program code for performing the operations of the embodiments of this disclosure can be written in one or more programming languages or a combination thereof. Programming languages include object-oriented programming languages such as Java, Smalltalk, and C++, as well as conventional procedural programming languages such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0151] Note that the above are merely preferred embodiments and the technical principles applied in this disclosure. Those skilled in the art will understand that this disclosure is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the protection scope of this disclosure. Therefore, although the embodiments of this disclosure have been described in detail above, this disclosure is not limited to the above embodiments. More other equivalent embodiments may be included without departing from the concept of this disclosure, and the scope of this disclosure is determined by the scope of the appended claims.
Claims
1. A method for analyzing anomaly logs, characterized in that, include: Determine the set of exception logs corresponding to the current service instance from the log database; the set of exception logs includes at least one exception log group; each exception log group includes a baseline exception log and at least one comparison exception log. For any abnormal log group, a preset similarity algorithm is used to calculate the similarity between each context log in the context log set of each comparison abnormal log in the abnormal log group and each context log in the context log set corresponding to the baseline abnormal log. For any comparison anomaly log, based on the time corresponding to the comparison anomaly log, the context log set corresponding to the comparison anomaly log is filtered using the similarity values to determine the context anomaly log sequence corresponding to the comparison anomaly log. Based on the contextual anomaly log sequence corresponding to each of the aforementioned anomaly logs and the historical anomaly log database, the analysis results of each of the aforementioned anomaly logs are determined; the historical anomaly log database includes each historical anomaly log and its corresponding anomaly cause.
2. The method according to claim 1, characterized in that, The similarity includes a first similarity and a second similarity; The step of calculating the similarity between each context log in the context log set corresponding to each comparison anomaly log in the anomaly log group and each context log in the context log set corresponding to the baseline anomaly log using a preset similarity algorithm includes: For any comparison daily log, the context log set corresponding to the comparison anomaly log is parsed to obtain a first program information column and a first specific content column; the first program information column includes the first program information corresponding to each context log in the context log set of the comparison anomaly log; the first specific content column includes the first specific content corresponding to each context log in the context log set of the comparison anomaly log. The context log set corresponding to the benchmark anomaly log is parsed to obtain a second program information column and a second specific content column; the second program information column includes the second program information corresponding to each context log in the context log set of the benchmark anomaly log; the second specific content column includes the second specific content corresponding to each context log in the context log set of the benchmark anomaly log. Each program information pair is determined based on the sequential positional correspondence between each first program information in the first program information column and each second program information in the second program information column; Based on each program information pair, the first similarity corresponding to each context log in the context log set of the comparison anomaly log is determined by the preset similarity algorithm. Each specific content pair is determined based on the sequential positional correspondence between each first specific content in the first specific content column and each second specific content in the second specific content column; Based on each specific content pair, the second similarity is determined for each context log in the context log set of the comparison anomaly log using the preset similarity algorithm.
3. The method according to claim 2, characterized in that, The step of filtering the context log set corresponding to the compared anomaly logs based on the time corresponding to the compared anomaly logs, using the similarity scores of each log, to determine the context anomaly log sequence corresponding to the compared anomaly logs includes: Using the time corresponding to the comparison anomaly logs, a first preceding anomaly log sequence and a first following anomaly log sequence are determined based on the context log set corresponding to the comparison anomaly logs. For the first preceding abnormal log sequence and the first following abnormal log sequence, the status of the corresponding abnormal log is marked based on the first similarity and the second similarity corresponding to each abnormal log in the first preceding abnormal log sequence and the first following abnormal log sequence, respectively. The status includes a valid status and a status to be verified. A preset state backtracking algorithm is used to optimize the state of the abnormal logs marked as the state to be verified in the first above-text abnormal log sequence and the first below-text abnormal log sequence, so as to obtain the second above-text abnormal log sequence and the second below-text abnormal log sequence. The context exception log sequence is generated based on the second preceding exception log sequence and the second following exception log sequence.
4. The method according to claim 3, characterized in that, The step of generating the context exception log sequence based on the second preceding context exception log sequence and the second following context exception log sequence includes: The valid above-text log sequence is determined based on the status corresponding to each above-text abnormal log in the second above-text abnormal log sequence. The valid context log sequence is determined based on the status corresponding to each context log exception in the second context log sequence. The context exception log sequence is obtained by combining the valid preceding log sequence and the valid following log sequence.
5. The method according to claim 1, characterized in that, The step of determining the set of exception logs corresponding to the current service instance from the log database includes: Retrieve the initial set of exception logs corresponding to the current service instance from the log database; Determine the feature value corresponding to each exception log in the initial exception log set; Based on each of the aforementioned feature values, the initial abnormal log set is grouped according to the preset similarity algorithm and the preset threshold to determine a first abnormal log set, wherein the first abnormal log set includes at least one first abnormal log group. The first abnormal log group is filtered based on a preset quantity filtering condition to determine the abnormal log set.
6. The method according to claim 5, characterized in that, The step of filtering each of the first abnormal log groups based on preset quantity filtering conditions to determine the abnormal log set includes: Based on preset quantity filtering conditions, each of the first abnormal log groups is filtered to determine the second abnormal log group and the third abnormal log group; the second abnormal log group is the abnormal log group that does not meet the preset quantity filtering conditions, and the third abnormal log group is the abnormal log group that meets the preset quantity filtering conditions. Randomly sample the log data in the second abnormal log group to obtain a fourth abnormal log group that meets the preset quantity filtering conditions; The abnormal log set is determined based on the fourth abnormal log group and the third abnormal log group.
7. An analysis device for anomaly logs, characterized in that, include: An exception log group determination module is used to determine the exception log set corresponding to the current service instance from the log database; the exception log set includes at least one exception log group; each exception log group includes a baseline exception log and at least one comparison exception log; The similarity calculation module is used to calculate, for any abnormal log group, the similarity between each context log in the context log set of each comparison abnormal log in the abnormal log group and each context log in the context log set corresponding to the baseline abnormal log using a preset similarity algorithm. The context log abnormal log sequence determination module is used to, for any comparison abnormal log, filter the context log set corresponding to the comparison abnormal log based on the time corresponding to the comparison abnormal log and use the similarity of each comparison abnormal log to determine the context abnormal log sequence corresponding to the comparison abnormal log. The analysis result determination module is used to determine the analysis result of each of the comparative anomaly logs based on the context anomaly log sequence corresponding to each of the comparative anomaly logs and the historical anomaly log database; the historical anomaly log database includes each historical anomaly log and its corresponding anomaly cause.
8. An electronic device, characterized in that, include: At least one processor; as well as, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the analysis method of the exception log as described in any one of claims 1-6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, this program implements the method for analyzing exception logs as described in any one of claims 1-6.
10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method for analyzing exception logs as described in any one of claims 1-6.