Log analysis method and device based on intelligent agent

Abstract

The invention provides a log analysis method based on an intelligent agent. In the method, firstly, a first command is received, and a first log is obtained based on the first command; secondly, on the basis of the context of the first log and the first cue word, a network object entity contained in the first log is recognized through a large model agent, the large model agent comprises a large model, and the large model is guided by a network object entity rule; the first prompt word is used for guiding the large model to identify the network object entity and the position thereof in the first log. Next, in response to a selection operation on a target network object entity, a second command is triggered, the target network object entity belongs to the network object entity contained in the first log, and the second command is generated through the large model agent according to the target network object entity, a second prompt word and a network object entity rule. Finally, a second log is obtained based on the second command. The method solves the problems that in traditional command operation, the information needs to be manually copied and pasted, a new command needs to be input, operation is tedious, and workflow is interrupted.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence (AI) technology, and in particular to a log parsing method and apparatus based on intelligent agents. Background Technology

[0002] In current network operations and maintenance practices, the command-line interface (CLI) remains the primary means of configuring, monitoring, and troubleshooting network devices. However, traditional CLI operation modes have limitations. In traditional CLI operations, obtaining more detailed information (such as querying the status of a specific interface) requires manually copying and pasting the information and entering a new command, which is cumbersome and disrupts the workflow. Furthermore, CLI syntax and output formats differ between different manufacturers and device types, resulting in high learning and adaptation costs for personnel. Summary of the Invention

[0003] This application provides a log parsing method and apparatus based on intelligent agents, which solves the above-mentioned technical problems.

[0004] Firstly, an agent-based log parsing method is provided. In this method, firstly, a first command is received, and based on the first command, a first log is obtained. Secondly, based on the context of the first log and a first prompt word, a large model agent (including a large model) identifies the network object entities contained in the first log. The large model agent is guided by network object entity rules, and the first prompt word guides the large model to identify the network object entities and their positions in the first log. Next, in response to the selection of a target network object entity, a second command is triggered. The target network object entity belongs to the network object entities contained in the first log. The second command is generated by the large model agent based on the target network object entity, the second prompt word, and the network object entity rules. Finally, based on the second command, a second log is obtained.

[0005] In one possible implementation, after identifying network object entities in the first log by a large model agent, the display of network object entities is enhanced based on the identification results.

[0006] In one possible implementation, the network object entity rule includes entity type, device manufacturer, and operation command template. In response to the selection operation of the target network object entity, before triggering the second command, the large model agent further identifies the entity type and device manufacturer corresponding to the target network object entity. Guided by the second prompt word, the large model agent matches the operation command template according to the entity type and device manufacturer. Based on the target network object entity and the operation command template, the second command is generated.

[0007] In one possible implementation, network object entity rules also include network object entity identification patterns, association rules between entity types and executable operations, and difference handling rules related to device manufacturers and / or models.

[0008] In one possible implementation, the agent-based log parsing method also includes: obtaining network object entity rules and guiding a large model based on the network object entity rules.

[0009] Secondly, an agent-based log parsing device is provided. This device includes a receiving module, a first acquisition module, an identification module, a triggering module, and a second acquisition module. The receiving module receives a first command. The first acquisition module acquires a first log based on the first command. The identification module identifies network object entities contained in the first log using a large model agent based on the first log context and a first prompt word. The large model agent includes a large model guided by network object entity rules. The first prompt word guides the large model to identify the network object entity and its position in the first log. The triggering module, in response to a selection operation on a target network object entity, triggers a second command. The target network object entity belongs to the network object entities contained in the first log. The second command is generated by the large model agent based on the target network object entity, the second prompt word, and network object entity rules. The second acquisition module acquires a second log based on the second command.

[0010] Thirdly, a computing device is provided, including a memory and a processor, wherein the memory stores instructions that, when executed by the processor, cause the method described in the first aspect to be implemented.

[0011] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, causes the method described in the first aspect to be implemented.

[0012] Fifthly, a computer program product is provided, the computer program product including program instructions, which, when executed by a computer, cause the computer to perform the method described in the first aspect.

[0013] The method provided in this application, guided by prompt words and network object entity rules, automatically extracts structured network object entities from unstructured logs through a large model agent. This overcomes the rigidity of traditional rule engines and reduces the uncontrollable risks of pure large models. By responding to selection operations on network object entities, the guided large model directly generates the corresponding execution command for that network object entity. Based on this command, more detailed log information of the network object entity (such as querying the status of a specific interface) is directly obtained. This allows the system to automatically generate and execute the corresponding command simply by clicking on the identified network object entity, improving the speed of returning detailed log information and eliminating problems such as mechanical operations like copying and pasting network object entity information and command spelling, as well as workflow interruptions. The large model does not generate commands arbitrarily but operates under the constraints of network object entity rules, effectively mitigating phantom commands or syntax errors, avoiding unauthorized operations, and ensuring the legality and security of generated commands while maintaining flexibility. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of an agent-based log parsing system architecture provided in an embodiment of this application;

[0015] Figure 2 This is a schematic diagram of a log analysis method based on an intelligent agent provided in an embodiment of this application;

[0016] Figure 3 This is an example diagram of the interaction of a large model for recognizing network object entities provided in an embodiment of this application;

[0017] Figure 4 This is an example diagram of the user interface interaction for triggering a new command provided in an embodiment of this application;

[0018] Figure 5 This is a specific example diagram of the agent-based log parsing method provided in the embodiments of this application;

[0019] Figure 6 This is a schematic diagram of the structure of a log parsing device based on an intelligent agent provided in an embodiment of this application. Detailed Implementation

[0020] The solutions provided in the embodiments of this application will now be described with reference to the accompanying drawings. In the embodiments of this application, "multiple" refers to two or more objects, and "various types" refers to two or more types. Terms such as "first," "second," etc., are only used to distinguish similar objects and are not necessarily used to describe a specific order or number of objects.

[0021] To facilitate understanding of the solutions provided in the embodiments of this application, the technical terms that may be involved in the embodiments of this application will be introduced first.

[0022] CLI commands refer to text instructions that users enter in a terminal or command-line window to interact with the operating system, applications, or services.

[0023] Large language models (LLMs) are language models trained using deep learning algorithms and possessing a large number of parameters. Compared to ordinary language models, LLMs have stronger language processing capabilities and wider applicability, enabling them to handle more complex and abstract language tasks, such as question answering and text generation.

[0024] Cue word engineering, also known as instruction engineering, cue engineering, or cue template engineering, encompasses various techniques and methods for providing cue words for generative AI tools. Cue word engineering is a method to improve the quality of model-generated results by optimizing the input text. For large models to generate high-quality content, users need to input several high-quality cue words. For the same large model, providing different cue words will produce different results.

[0025] Network maintenance personnel perform routine maintenance tasks such as querying network element configuration information, locating faults, and conducting routine checks. Current technical solutions typically involve using tools like SecureCRT or system application interfaces to log into network devices, enter CLI commands, retrieve information from the command execution logs, and then enter the next CLI command, repeating this process multiple times to complete daily maintenance tasks.

[0026] One existing technical solution provides a method for CLI command interaction using tools such as SecureCRT. In this method, firstly, the user opens SecureCRT, selects the device to log in, and enters their username and password. Secondly, they enter a CLI command and press Enter to execute it. Then, they view the CLI command log and find the key information they need. Next, they enter the CLI command again, using the key information as parameters for further queries. This process is repeated until the desired information is obtained. However, this method requires multiple CLI command entries to retrieve the required information, making it cumbersome and disruptive to the workflow.

[0027] Another existing technical solution provides a CLI command execution method. In this method, firstly, the received CLI command parameters are serialized to obtain a serialized CLI command. Secondly, the serialized CLI command is checked according to a configuration file. Then, if the check passes, the serialized CLI command is sent to the server, so that the server executes the command according to the serialized CLI command, obtains the execution result, and returns it. Finally, the execution result is formatted according to a set output template to obtain the target execution result. This solution relies on static configuration for syntax-level validation and forwarding of the serialized CLI command, and relies on predefined configuration files (such as regular expressions or whitelists) for formal checks of the serialized command, thus failing to understand the true intent or contextual legality of the command.

[0028] Another existing technical solution provides a standardized configuration method for CLI command lines. In this method, firstly, the CLI command line type to be standardized is determined during execution. Secondly, the standardized strategy corresponding to the CLI command line type is matched using this standardized strategy. Finally, the standardized configuration of the CLI command line to be standardized is performed using this standardized strategy. This method configures different standardized strategies for different types of CLI command lines and uses these strategies to standardize the corresponding CLI command lines. However, its static strategy cannot adapt to changes in command context and semantics; the standardized strategy is strongly coupled with the command structure, resulting in poor extensibility.

[0029] This application proposes an agent-based log parsing method. First, a command is received. Second, based on the command, the original log is obtained. Then, based on the original log context and prompt words, a large model agent identifies network object entities contained in the original log. The large model agent includes a large model guided by network object entity rules. The first prompt word guides the large model to identify network object entities and their positions in the first log. Next, in response to the selection of a target network object entity, a new command is triggered. The target network object entity belongs to the network object entities contained in the original log. The new command is generated by the large model agent based on the target network object entity, the new prompt word, and network object entity rules. Finally, based on the new command, a new log is obtained.

[0030] In the method provided in this embodiment, on the one hand, guided by prompt words and network object entity rules, a large model agent automatically extracts structured network object entities from unstructured logs, overcoming the rigidity of traditional rule engines and reducing the uncontrollable risks of pure large models. On the other hand, by responding to the selection operation of a network object entity, the guided large model directly generates the execution command corresponding to that network object entity. Based on this command, more detailed log information of the network object entity (such as querying the status of a specific interface) is directly obtained. This allows the system to automatically generate and execute the corresponding command simply by clicking on the identified network object entity, improving the speed of returning detailed log information and eliminating problems such as mechanical operations of copying and pasting network object entity information and command spelling, as well as workflow interruptions. Furthermore, the large model does not generate commands freely but works under the constraints of network object entity rules, which can effectively alleviate phantom commands or syntax errors, avoid unauthorized operations, and ensure the legality and security of generated commands while retaining flexibility.

[0031] Next, we will describe a log parsing method based on an intelligent agent provided in the embodiments of this application.

[0032] This application proposes an agent-based log analysis system. Figure 1 A schematic diagram of an agent-based log analysis system architecture is shown. Figure 1 As shown, the system may include a user interface, a command execution engine, a log processing module, a large model service module, and a rule knowledge base. The user interface may include an input module through which command requests can be entered into the command execution engine. The command execution engine can be used to execute commands, such as running a network device, which then returns raw logs. The log processing module is used to receive the raw logs. The large model service module can be used to parse the raw logs and identify network object entities in the logs based on the parsing results. Its large model can pre-learn knowledge from the network object entity rule knowledge base.

[0033] Continue to refer to Figure 1 Its user interface can be used to input user requests through input modules, including but not limited to device selection and command requests. Specifically, the user interface can be a web or UI interface; for example, web technologies (such as React / Vue / Angular) can be used to implement device selection boxes and command input boxes.

[0034] In one implementation, continue to refer to Figure 1The user interface can also include an enhancement display module to enhance entity information in the logs. Specifically, a log display area can be added to the user interface, which can be implemented using the enhancement display module. This log display area can support rendering styled, clickable text. The enhancement display module can also be used to capture click events by clicking on the text of a network object entity and convey the information contained in that network object entity.

[0035] Continue to refer to Figure 1 The command execution engine receives command requests from the input module and executes them. After execution, the executed entity can return raw logs. Executed entities include, but are not limited to, network devices, servers (physical / virtual), containers and orchestration platforms, cloud platform resources, database systems, middleware and application services (such as Nginx, Apache, Tomcat, Redis, Kafka, RabbitMQ, etc.), monitoring and logging systems, and automation / configuration management tools themselves. The command execution engine can use libraries such as Paramiko (SSH) or Netmiko to implement secure login and device command execution. The command execution engine can encompass mechanisms such as connection management, timeout handling, and error handling.

[0036] Continue to refer to Figure 1 The log processing module can be used to receive raw logs from the executed entity. It can also be used to combine the raw logs with the recognition results from the large model module to generate the logs required by the user interface, which have been processed by the entity recognition of the large model module.

[0037] Continue to refer to Figure 1 The large model service module can be used to parse raw logs. Before parsing the raw logs, the large model service module can learn knowledge from the network object entity rule knowledge base. Specifically, based on the pre-learned network object entity rule knowledge, the large model service module can analyze the raw logs, identify and label the information and location of network object entities.

[0038] It is easy to understand that the recognition results of the original logs can be returned to the log processing module. The log processing module can combine the original logs with the recognition results of the large model module and send them to the enhancement display module of the user interface. The enhancement display module can display the network object entity information contained in the recognition results.

[0039] It's worth noting that its large model service module can integrate large model APIs (such as Deepseek). This module can also function as a large model agent, which includes a large model and can be used to learn rules and knowledge, perform inference based on model input, and output inference results. The large model agent can also include planning (task decomposition, self-reflection / correction), memory (long and short memory), tool modules (search engines, image and text generation, speech recognition, etc.), a process engine (e.g., arranging prompts, large models, knowledge bases, etc., according to the agent's operational flow), and support and interaction modules (e.g., supporting input and output from text, voice, vision, and sensors).

[0040] The large model service module can also be used to provide the construction logic for prompts, such as including device information, command information, recognition requirements, and output format constraints. The large model service module can also be used to process large model responses, such as parsing JSON.

[0041] Continue to refer to Figure 1 The knowledge in the rule knowledge base can include device rules, CLI syntax, entity-operation command mappings, etc. Device rules refer to a set of rules defining the behavioral characteristics, capability boundaries, configuration constraints, and best practices of a specific type of device. CLI syntax refers to the formal description of the command structure, parameter format, keywords, and option combinations of various device command-line interfaces (CLI). Entity-operation mapping defines the association between network object entities (such as device names, interfaces, and IP addresses) identified in logs or context and the operations (commands or actions) that can be performed on them.

[0042] Furthermore, the rule knowledge base can be stored using one or more methods, such as a database, a file, or a memory cache. The data structure within the rule knowledge base can be an entity type table, a mapping rule table, etc. The rule knowledge base can be used to describe the CRUD (Create, Read, Update, Delete) interfaces for rules; a typical entity-operation mapping rule entry can be illustrated with an example.

[0043] Optionally, the rule knowledge base can be a document library, which may include specification documents for network devices from various manufacturers, such as CLI command manuals, configuration guides, etc.

[0044] Optionally, the rule knowledge base can also be a rule table library, which can include business rules compiled based on professional needs and expert experience and entered into the rule tables. These rule tables can be continuously updated, allowing the large model to continuously learn and make its capabilities more specialized in that functional area.

[0045] Continue to refer to Figure 1The large model service module can also be used to generate new commands. Specifically, users can select one or more network object entities to perform a selection operation on the user interface, which can be done through clicking or other methods. After the selection operation is performed, the information of the network object entity can be transmitted to the large model service module, thereby triggering a query operation for a new command. Furthermore, based on an understanding of the semantics of the network object entity, the large model service module can identify the network object entity, specifically identifying the entity type and device manufacturer corresponding to the network object entity. Then, guided by prompt words and based on pre-learned network object entity rule knowledge, the large model service module can match the operation command template corresponding to the network object entity through the entity type and device manufacturer information. The prompt words can be pre-constructed. The prompt words can be used to clarify the role of the large model and guide it to clarify the query requirements for the next operation command for the network object entity based on the learned network object entity rule knowledge.

[0046] This application provides a method for guiding a large model to learn network object entity rules, which may include the following steps.

[0047] First, the standardized documents of network devices (such as switches, routers, firewalls, etc.) in the file library, such as CLI command manuals, configuration guides, common output examples, device model characteristics, and other structured / semi-structured text data, can be used as learning materials for the large model.

[0048] Secondly, prompts can be designed to input the knowledge related to the network object entity rules mentioned above into the large model service module, allowing the large model to learn the semantics and typical output structures of different commands. For example, `dis cu`, `show running-config`, `show interface`, `show ip route`, etc. It can also learn different key entity types and their identification patterns in the output logs, such as entity types like Interface port, IP Address, VLAN, BGP Neighbor, OSPFArea, ACL, device hostname, etc., with identification patterns including location, context, and format. Furthermore, it can learn the mapping rules between entities and operation commands, such as: identifying an Interface entity -> executing `dis interface [interface name]`; identifying a BGP Neighbor IP -> executing `dis bgp peer [IP]`.

[0049] This application provides another method for guiding a large model to learn network object entity rules, which may include the following steps.

[0050] First, network object entity rules can be configured. These rules can be configured in the form of rule tables.

[0051] Its network object entity rules can include entity type definitions. They can also include entity identification patterns, such as traditional classification rules, or a combination of large model output and traditional classification rules. Entity identification patterns refer to the technical methods or strategies used to identify and extract specific types of entities (such as IP addresses, device names, error codes, timestamps, interface names, etc.) from text (such as logs, technical documents, etc.). Its network object entity rules can also include entity-operation mapping rules, for example, specifying which entity type can trigger which subsequent commands (templates), such as: Interface -> disinterface {entity_text}; IP Address -> ping {entity_text} or tracert {entity_text} or dis arp {entity_text} (which may require user selection or contextual judgment).

[0052] Furthermore, its network object entity rules can also include differential handling rules related to device manufacturer / model. For example, a device manufacturer's command to query the IPv4 address routing prefix list is `dis ip ip-prefix {entity_text}`, while another device manufacturer's command is `show ip prefix-list {entity_text}`.

[0053] Secondly, after configuring the network object entity rules, the large model service module pre-learns the rule knowledge in the rule knowledge base. The configured network object entity rules can then be stored in the rule knowledge base.

[0054] Optionally, the mapping rules for the above entity-operation commands may include equipment manufacturer, equipment model, entity type, operation command template, etc. For example, the entity-operation command mapping rules are shown in Table 1.

[0055]

[0056] Table 1. Entity-Operation Command Mapping Rules

[0057] This application provides a log parsing method based on intelligent agents. Figure 2 A schematic diagram of an agent-based log analysis method is shown. Figure 2 As shown, the method includes the following steps.

[0058] Step S201: Receive the first command and obtain the first log based on the first command.

[0059] Commands can be entered through the user interface input module, and then received by the command execution engine. The command execution engine can log in to the target device (or device group) via SSH, Telnet, or API, and execute the received command. After the command is executed, the raw log of the command execution can be obtained and sent to the log processing module.

[0060] Step S202: Based on the first log context and the first prompt word, the network object entity contained in the first log is identified by the large model agent. The large model agent includes a large model, which is guided by the network object entity rules. The first prompt word is used to guide the large model to identify the network object entity and the position of the network object entity in the first log.

[0061] The log processing module can receive raw logs and input the raw log data and prompt words into the large model service module. The large model service module performs inference based on the context and prompt words of the raw logs to further identify the network object entities contained in the raw logs.

[0062] It is worth noting that its overall model is guided by network object entity rules. The guidance method can be found in the examples above, and will not be repeated here.

[0063] The prompt words used to identify network object entities can be pre-constructed. Optionally, the prompt words can contain instructions that clearly define the role of the large model and guide it to identify network object entities and return their locations. For example, “You are a network expert. In your daily work, you often log in to devices and use CLI commands to query relevant configurations. You can identify network object entities (such as physical port names) based on the log content of the query commands and perform further detailed configuration queries on the network object entities. Please retrieve all network object entities identified in the command log and return the text content of each entity and its start and end position indices in the log. Only return the identification results in JSON format: {"entities": [{"type": "Interface", "text": "GigabitEthernet0 / 0 / 1", "start_index": 102, "end_index": 120}, ...]}”.

[0064] Based on the aforementioned prompts, the large model can proactively identify and semantically understand key network object entities (such as ports and ACLs) from the raw logs, clarifying their entity type, position, and role within the context of the raw logs. For example, Figure 3 This illustration shows an example diagram of the large model interaction for identifying network object entities provided in an embodiment of this application, such as... Figure 3 As shown, Figure 3 The left sub-diagram represents the prompts sent to the large model, which include descriptions of roles, tasks, inputs, and outputs. The right sub-diagram represents the large model's recognition results of network object entities, including information about the network object entities and their types.

[0065] In some implementations, after identifying network object entities in the first log by a large model agent, the display of network object entities is enhanced based on the identification results.

[0066] After the large model agent identifies network object entities in the original logs, the log processing module sends the original logs and entity recognition results to the user interface. The user interface receives the original logs and entity recognition results and uses the display enhancement module to visually enhance the corresponding text fragments about the network object entities in the original logs (such as the entity content in `start_index` and `end_index`). Visual enhancement methods can include changing colors, adding underlines, or changing them to clickable links / button styles. The enhanced original logs can then be highlighted and interactively displayed in the user interface.

[0067] In this embodiment, by enhancing the display of entities, the structured entities can be visually highlighted in the original context, reducing the user's cognitive load and accelerating the capture of key information, especially when processing massive logs.

[0068] Step S203: In response to the selection operation of the target network object entity, a second command is triggered. The target network object entity belongs to the network object entities contained in the first log. The second command is generated by the large model agent based on the target network object entity, the second prompt word, and the network object entity rules.

[0069] In the user interface, one or more network object entities can be selected to perform a selection operation, which can be done through clicking or other methods. After the selection operation is performed, a new command is automatically triggered. It's easy to understand that the target network object entity belongs to the network object entities included in the first log. Furthermore, the second command is generated by the large model agent based on the target network object entity, the second prompt word, and the network object entity rules.

[0070] Optionally, the network object entity can be a display-enhanced entity, which facilitates the user to quickly locate the position of the target network object entity, thereby enabling the user to further perform the selection operation of the target network object entity.

[0071] In some implementations, the network object entity rules may include entity type, device manufacturer, and operation command template. In response to the selection operation of the target network object entity, before triggering the second command, the large model agent may also identify the entity type and device manufacturer corresponding to the target network object entity. Based on the guidance of the second prompt word, the large model agent matches the operation command template according to the entity type and device manufacturer, and generates the second command based on the target network object entity and the operation command template.

[0072] After the selection operation is performed, the information of the network object entity can be transmitted to the large model service module, thereby triggering a query operation for a new command. Furthermore, based on its understanding of the semantics of the network object entity, the large model service module can identify the network object entity, specifically identifying its entity type and device manufacturer. Then, guided by the second prompt word and based on pre-learned network object entity rule knowledge, the large model service module can match the corresponding operation command template to the network object entity using its entity type and device manufacturer information.

[0073] The second prompt can be pre-constructed. The second prompt can clarify the role of the large model and guide it to define the query requirements for the next operation command on the network object entity based on the learned network object entity rule knowledge. For example, the second prompt could be: "You are a network expert who frequently logs into devices and uses CLI commands to query relevant configurations in your daily work. You can identify network object entities in the command echo logs and, based on command manuals for various scenarios, perform further detailed operation command template configuration queries for the network object entities, and output complete CLI operation commands. Only JSON format recognition results are returned: {"device":"CORE-S9306-01", "entity": "GigabitEthernet1 / 0 / 0 / 1", "cmd": "display interface GigabitEthernet1 / 0 / 0 / 1"}.

[0074] Before outputting the complete operation command, the large model can intelligently populate the variable positions of the queried operation command template with the specific network object entity identifier, generating a correctly formatted and immediately executable specific command in real time. For example, by filling the interface name GigabitEthernet0 / 0 / 1 into the placeholder {entity_text} in the interface query command template, the command `dis interface GigabitEthernet0 / 0 / 1` is generated. The newly generated command can be automatically delivered to the command execution engine.

[0075] In this implementation, the large-scale model agent identifies the entity type and the device manufacturer to which it belongs. Guided by the second prompt word, the large-scale model matches the corresponding operation command template from the rule base based on the above two dimensions, fills the target entity value into the template, and generates a legal and appropriate second command. This mechanism eliminates the need for manual memorization or manual assembly of CLI commands. Instead, it encapsulates the syntactic differences between multiple manufacturers and devices within the rule base. The large-scale model agent dynamically completes the automatic conversion of semantic intent to manufacturer-specific commands at runtime. This ensures that the generated commands conform to the syntactic specifications of the target device and have operational security without changing the user's unified interaction method (such as clicking on the highlighted entity). This reduces the operational complexity, human error rate, and learning cost of cross-vendor operation and maintenance. At the same time, it supports rapid adaptation to new devices by expanding the rule base without retraining the model or modifying the core logic.

[0076] In some implementations, network object entity rules also include network object entity identification patterns, association rules between entity types and executable operations, and difference handling rules related to device manufacturers and / or models.

[0077] Step S204: Obtain the second log based on the second command.

[0078] After receiving a new command, the command execution engine can perform operations on the relevant devices based on the new command. After the devices execute the new command, they can return new logs to the command execution engine.

[0079] For example, Figure 4 This diagram illustrates an example of a user interface interaction for triggering a new command, as provided in an embodiment of this application. Figure 4 As shown, firstly, users can select a device in the input box of the user interface on the left and enter a query command to execute. Next, the user interface generates the original logs after network object entity display enhancement; for example, the enhanced network object entities are 100GE1 / 0 / 0, 100GE1 / 0 / 1, and 100GE2 / 0 / 0. Then, the user clicks on the target network object entity 100GE1 / 0 / 0, and the large model service module automatically generates a query command for the new command, performs a contextual query, and generates a new command corresponding to the network object entity. The relevant devices corresponding to that network object entity execute the new command. Finally, the user interface returns the new logs corresponding to the new command.

[0080] Next, let's combine... Figure 5 ,right Figure 2 The provided agent-based log parsing method is illustrated with an example. Figure 5 A specific example diagram of an agent-based log parsing method is shown, such as... Figure 5 As shown, the method in this example includes the following steps.

[0081] First, the user enters a CLI command. Specifically, the user can select the target device (or group of devices) through the user interface, and then enter or select the CLI command to be executed, such as selecting the command: display interface brief.

[0082] Secondly, the backend can log in to the target device (or device group) via SSH, Telnet, or API through the command execution engine and execute the CLI commands entered by the user. After executing the CLI command, the raw log of the CLI command execution can be obtained.

[0083] Next, the raw logs can be sent to a large-scale intelligent model that has learned network object entity rules. This large-scale intelligent model can identify network object entities in the raw logs based on the raw logs and prompts. The large-scale intelligent model can parse the raw logs based on its pre-learned network object entity rules and identify the network object entities and their locations.

[0084] Next, the user interface can receive the raw logs and the entity recognition results returned by the large model agent.

[0085] Then, the display enhancement module can visually enhance the network object entities in the original log based on the entity recognition results. For example, it can change the color of text fragments, add underlines, or change them to clickable links / buttons. The enhanced logs can then be displayed in a highlighted and interactive manner in the user interface.

[0086] Then, the system can determine whether the enhanced visualization entity has been clicked.

[0087] Then, if a visually enhanced entity is clicked, the large model service module can identify the network object entity. Specifically, it can identify the entity type and device manufacturer corresponding to the network object entity. Based on the pre-learned network object entity rule knowledge, it can match the operation command template corresponding to the network object entity through the entity type and device manufacturer information.

[0088] Next, the text content corresponding to the entity is filled into the placeholders in the command template to generate the specific executable command. The system automatically uses the command execution engine in the background to execute the newly generated command on the same device.

[0089] Finally, the result logs of the new command are obtained. The result logs corresponding to the new command are also parsed and enhanced by the large model (a recursive process, such as identifying the interface status, IP address, etc. in the result logs corresponding to the new command), forming a workflow for in-depth exploration.

[0090] Based on the above description, this application also provides a schematic diagram of the structure of an agent-based log parsing device 600. For example... Figure 6 As shown, the device 600 includes:

[0091] The receiving module 610 is used to receive the first command.

[0092] The first acquisition module 620 is used to obtain the first log based on the first command.

[0093] The identification module 630 is used to identify network object entities contained in the first log based on the first log context and a first prompt word, through a large model agent. The large model agent includes a large model, which is guided by network object entity rules. The first prompt word is used to guide the large model to identify network object entities and their positions in the first log.

[0094] Trigger module 640 is used to trigger a second command in response to the selection operation of the target network object entity. The target network object entity belongs to the network object entities contained in the first log. The second command is generated by the large model agent based on the target network object entity, the second prompt word, and the network object entity rules.

[0095] The second acquisition module 650 obtains the second log based on the second command.

[0096] For example, the implementation of the identification module 630 will be described below. Similarly, the receiving module 610, the first acquisition module 620, the triggering module 640, and the second acquisition module 650 can refer to the implementation of the identification module 630.

[0097] As an example of a software functional unit, module 630 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Further, the aforementioned computing instance may be one or more. For example, module 630 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed within the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed within the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0098] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0099] As an example of a hardware functional unit, the identification module 630 may include at least one computing device, such as a server. Alternatively, the identification module 630 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0100] The multiple computing devices included in the identification module 630 can be distributed in the same region or in different regions. Similarly, the multiple computing devices included in the identification module 630 can be distributed in the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices included in the identification module 630 can be distributed in the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0101] It should be noted that, in other embodiments, the identification module 630 can be used to perform... Figure 2 The receiving module 610 can be used to execute any step in the method shown. Figure 2 In any step of the method shown, the first acquisition module 620 can be used to execute Figure 2 In any step of the method shown, trigger module 640 can be used to execute Figure 2 The second acquisition module 650 can be used to execute any step in the method shown. Figure 2Any step in the method shown, implemented by the identification module 630, receiving module 610, first acquisition module 620, triggering module 640, and second acquisition module 650, can be specified as needed and implemented by the identification module 630, receiving module 610, first acquisition module 620, triggering module 640, and second acquisition module 650 respectively. Figure 2 The different steps in the method shown implement all the functions of the agent-based log parsing device 600.

[0102] Based on the same concept as the foregoing embodiments, this application also provides a computing device, which includes at least a processor and a memory. The memory stores a program, and when the processor reads the program, it can implement the algorithmic functions embodied by the above-described methods or devices.

[0103] Based on the methods in the above embodiments, this application provides a computer-readable storage medium including computer program instructions. When executed by a cluster of computing devices including at least one computing device, the computer program instructions cause the cluster of computing devices to perform the methods in the above embodiments. Exemplarily, the computer-readable storage medium can be any available medium capable of being stored in the cluster of computing devices or a data storage device such as a data center containing one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives).

[0104] Based on the methods in the above embodiments, this application provides a computer program product containing instructions. The computer program product may be software or program products containing instructions, capable of running on a computing device or stored on any available medium. When the instructions are executed by a cluster of computing devices containing at least one computing device, at least one computing device in the cluster of computing devices performs the methods in the above embodiments.

[0105] It is understood that the processor in the embodiments of this application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A general-purpose processor may be a microprocessor or any conventional processor.

[0106] The method steps in the embodiments of this application can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can reside in an ASIC.

[0107] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state disk (SSD)).

[0108] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of this application.

Claims

1. A log parsing method based on intelligent agents, characterized in that, include: Receive the first command, and obtain the first log based on the first command; Based on the first log context and the first prompt word, a large model agent identifies the network object entities contained in the first log; the large model agent includes a large model, which is guided by network object entity rules; the first prompt word is used to guide the large model to identify the network object entities and their positions in the first log. In response to the selection operation of the target network object entity, a second command is triggered; The target network object entity belongs to the network object entity contained in the first log. The second command is generated by the large model agent based on the target network object entity, the second prompt word, and the network object entity rules. Based on the second command, the second log is obtained.

2. The method according to claim 1, characterized in that, After identifying the network object entities in the first log through the large model agent, the method further includes: Based on the identification results of the network object entities, the display of the network object entities is enhanced.

3. The method according to claim 1, characterized in that, The network object entity rules include entity type, device manufacturer, and operation command template. Before triggering the second command in response to the selection operation of the target network object entity, the method further includes: The large model agent is used to identify the entity type and device manufacturer corresponding to the target network object entity. Guided by the second prompt word, the large model agent matches operation command templates according to the entity type and device manufacturer. The second command is generated based on the target network object entity and the operation command template.

4. The method according to claim 3, characterized in that, The network object entity rules also include network object entity identification patterns, association rules between entity types and executable operations, and rules for handling differences related to device manufacturers and / or models.

5. The method according to claim 1, characterized in that, The method further includes: Retrieve network object entity rules; The large model is guided by the network object entity rules.

6. A log parsing device based on intelligent agents, characterized in that, include: The receiving module is used to receive the first command; The first acquisition module is used to obtain the first log based on the first command; The identification module is used to identify network object entities contained in the first log based on the first log context and the first prompt word through a large model agent; the large model agent includes a large model, which is guided by network object entity rules, and the first prompt word is used to guide the large model to identify the network object entity and the position of the network object entity in the first log; The trigger module, in response to the selection operation of the target network object entity, triggers the second command; The target network object entity belongs to the network object entity contained in the first log. The second command is generated by the large model agent based on the target network object entity, the second prompt word, and the network object entity rules. The second acquisition module obtains the second log based on the second command.

7. A computing device, comprising a memory and a processor, characterized in that, The memory stores instructions that, when executed by a processor, cause the method described in any one of claims 1-5 to be implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it causes the method described in any one of claims 1-5 to be implemented.

9. A computer program product, characterized in that, The computer program product includes program instructions that, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-5.

Images