Log management method and device

Abstract

The invention provides a log management method and device, and relates to the technical field of log management.The method comprises the steps that a target service log is obtained, and whether the target service log is a duplicate log or not is determined; if not, storing the target service log; and extracting the log printing time of the target service log, and updating the time variable corresponding to each service server in the application server cluster based on the log printing time. According to the log management method and device provided by the invention, the repeatability test can be performed on the target service log, the target service log is stored when the target service log is determined not to be a repeated log, and meanwhile, the next round of task of collecting the service log of the application server cluster can be executed based on the log printing time; therefore, the consistency and integrity of the obtained service logs of the application server cluster are guaranteed, repeated collection and missed collection of the service logs are avoided, meanwhile, repeated storage of log files is avoided, and log management resources are saved.

Description

Technical Field

[0001] This invention relates to the technical field of log management, and in particular to a log management method and apparatus. Background Technology

[0002] Log management typically plays a crucial role in operations and maintenance (O&M) management, serving as a vital reference for identifying system or application issues. Log management involves analyzing, storing, and backing up business records generated by the platform. Therefore, it helps O&M personnel discover potential security vulnerabilities and take timely countermeasures to ensure the safe operation of business.

[0003] Currently, the most commonly used log system architecture for log management is ELKF (Elasticsearch Logstash Kibana Filebeat). Although the ELKF architecture can be used for centralized storage, processing, and visualization of log data, its main focus is on the collection, indexing, and display of logs. It does not have a built-in mechanism to ensure the consistency between the collected logs and the stored logs, and it suffers from data latency issues, failing to guarantee the integrity of the stored logs.

[0004] Meanwhile, using the ELKF architecture for log management requires regular maintenance of the log management system, including monitoring the operation status of each component, optimizing query performance, data backup and recovery, etc. This requires the operations and maintenance team to invest additional time and energy to manage and maintain the entire log solution. At the same time, the ELKF architecture consumes a lot of resources and has high operating costs, requiring a large amount of computing resources and storage space to support the retrieval and query of log data.

[0005] In summary, ensuring the consistency and integrity of log files stored during log management, as well as saving log management costs and improving log management efficiency, are problems that the operations and maintenance team needs to solve. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to provide a log management method and apparatus to alleviate the above-mentioned technical problems.

[0007] In a first aspect, embodiments of the present invention provide a log management method applied to an application server cluster, the application server cluster including multiple business servers; the method includes: acquiring a target service log, wherein the target service log is a log collected based on a time variable corresponding to each business server in the application server cluster; determining whether the target service log is a duplicate log; if not, storing the target service log; extracting the log printing time of the target service log, and updating the time variable corresponding to each business server in the application server cluster based on the log printing time.

[0008] In conjunction with the first aspect, this embodiment of the invention provides a first possible implementation of the first aspect, wherein the application server cluster is configured with a log collection component, a log deduplication service component, and a log storage system; the step of obtaining target service logs includes: collecting target service logs from each business server through the log collection component, and sending the target service logs to the log deduplication service component.

[0009] In conjunction with the first possible implementation of the first aspect, this embodiment of the invention provides a second possible implementation of the first aspect, wherein the step of determining whether the target service log is a duplicate log includes: determining whether the target service log is a duplicate log through the log deduplication service component.

[0010] In conjunction with the second possible implementation of the first aspect, this embodiment of the invention provides a third possible implementation of the first aspect, wherein the step of determining whether the target service log is a duplicate log by means of the log deduplication service component includes: obtaining historical service logs for a preset recent historical time period by means of the log deduplication service component; determining whether the content similarity between the target service log and the historical service log is higher than a preset threshold; if yes, determining that the target service log is a duplicate log; if no, determining that the target service log is a non-duplicate log.

[0011] In conjunction with the first possible implementation of the first aspect, this embodiment of the invention provides a fourth possible implementation of the first aspect, wherein the step of storing the target service log as described above includes: sending the target service log to the log storage system, and storing the target service log through the log storage system.

[0012] In conjunction with the first possible implementation of the first aspect, this embodiment of the invention provides a fifth possible implementation of the first aspect, wherein the step of extracting the log printing time of the target service log and updating the time variables corresponding to each business server in the application server cluster based on the log printing time includes: in response to the log storage system successfully storing the log, extracting the log printing time of the target service log; returning the log printing time to the log collection component, so that the log collection component updates the time variables corresponding to each business server in the application server cluster according to the log printing time.

[0013] In conjunction with the first aspect, this embodiment of the invention provides a sixth possible implementation of the first aspect, wherein the above method further includes: in response to the update of the time variable corresponding to each business server in the application server cluster, continuing to collect the target service logs of each business server through the log collection component.

[0014] In conjunction with the first possible implementation of the first aspect, this embodiment of the invention provides a seventh possible implementation of the first aspect, wherein the application server cluster is further configured with a visualization management component; the method further includes: displaying the target service logs stored in the log storage system through the visualization management component.

[0015] Secondly, embodiments of the present invention also provide a log management device applied to an application server cluster, the application server cluster including multiple business servers; the device includes: an acquisition module, used to acquire target service logs, wherein the target service logs are logs collected based on time variables corresponding to each business server in the application server cluster; a deduplication module, used to determine whether the target service logs are duplicate logs; a storage module, used to store the target service logs when the deduplication module determines that the target service logs are not duplicate logs; and an update module, used to extract the log printing time of the target service logs and update the time variables corresponding to each business server in the application server cluster based on the log printing time.

[0016] Thirdly, embodiments of the present invention also provide a server, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in the first aspect above.

[0017] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the method described in the first aspect.

[0018] The embodiments of the present invention bring the following beneficial effects:

[0019] The log management method and apparatus provided in this invention can determine whether a target service log is a duplicate log after it has been acquired. If not, the target service log is stored. Then, the log printing time of the target service log is extracted, and the time variables corresponding to each business server in the application server cluster are updated based on the log printing time. The process of determining whether the target service log is a duplicate log can perform a duplicate check on the target service log. It is only stored when it is determined that the target service log is not a duplicate log. At the same time, the next round of collecting service logs from the application server cluster can be executed based on the log printing time, thereby ensuring the consistency and integrity of the service logs obtained from the application server cluster, avoiding duplicate collection and missed collection of service logs. Without the intervention of third-party system components, this not only improves log management efficiency and reduces the operation and maintenance burden, but also avoids duplicate storage of log files and saves log management resources.

[0020] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0021] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0022] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 A flowchart of a log management method provided in an embodiment of the present invention;

[0024] Figure 2 A schematic diagram of a log system architecture provided in an embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of a log management device provided in an embodiment of the present invention;

[0026] Figure 4 This is a schematic diagram of the structure of a server provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] Currently, log management commonly adopts the ELKF architecture. Although the ELKF architecture can be used for centralized storage, processing, and visualization of log data, its main focus is on the collection, indexing, and display of logs. It does not have a built-in mechanism to ensure the consistency between the collected logs and the stored logs, and it suffers from data latency issues, thus failing to guarantee the integrity of the stored logs.

[0029] Based on this, the log management method and apparatus provided in this embodiment of the invention can effectively alleviate the above-mentioned technical problems.

[0030] To facilitate understanding of this embodiment, a log management method disclosed in this embodiment of the invention will first be described in detail.

[0031] In one possible implementation, this invention provides a log management method applied to an application server cluster, which includes multiple business servers.

[0032] Specifically, the log management method in this embodiment of the invention is a log management method based on the ElasticSearch architecture, such as... Figure 1 The flowchart shown illustrates a log management method, which includes the following steps:

[0033] Step S102: Obtain the target service logs;

[0034] Among them, the target service log is the service log collected based on the time variables corresponding to each business server in the application server cluster;

[0035] Step S104: Determine whether the target service log is a duplicate log;

[0036] Step S106: If not, store the target service log;

[0037] Step S108: Extract the log printing time of the target service log, and update the time variables corresponding to each business server in the application server cluster based on the log printing time.

[0038] The log management method provided in this invention can determine whether the target service log is a duplicate log after it has been acquired. If not, the target service log is stored. Then, the log printing time of the target service log is extracted, and the time variables corresponding to each business server in the application server cluster are updated based on the log printing time. The process of determining whether the target service log is a duplicate log can perform a duplicate check on the target service log. Only when it is determined that the target service log is not a duplicate log is it stored. At the same time, the next round of collecting service logs from the application server cluster can be executed based on the log printing time, thereby ensuring the consistency and integrity of the obtained service logs from the application server cluster, avoiding duplicate collection and missed collection of service logs. Without the intervention of third-party system components, this method not only improves log management efficiency and reduces the operational burden, but also avoids duplicate storage of log files, saving log management resources.

[0039] In actual use, the above application server cluster is configured with a log collection component, a log deduplication service component, and a log storage system. In the ElasticSearch architecture, the log collection component is also called the FileBeat component, the log deduplication service component is also called the Log deduplication component, and the log storage system is also called the ElasticSearch system.

[0040] Furthermore, based on the aforementioned log collection components, log deduplication service components, and log storage system, a log system architecture is formed to manage the service logs of multiple business servers in the application server cluster.

[0041] Specifically, the aforementioned log collection component is mainly used to collect service logs from each business server in the application server cluster. For example, it continuously collects service logs from each business server according to a preset collection cycle. The log deduplication service component is mainly used to perform duplicate detection on the target service logs collected by the log collection component. When it is determined that the target service logs are not duplicate logs, the target service logs are then stored in the log storage system.

[0042] Therefore, based on the above log system architecture, in step S102 above, when obtaining the target service log, the target service log of each business server can be collected through the log collection component, and the target service log can be sent to the log deduplication service component.

[0043] Furthermore, in step S104 above, when determining whether the target service log is a duplicate log, the log deduplication service component can be used to determine whether the target service log is a duplicate log.

[0044] Specifically, the log deduplication service component can be used to obtain historical service logs for a preset recent historical time period; then, it can be determined whether the content similarity between the target service log and the historical service log is higher than a preset threshold; if so, the target service log is determined to be a duplicate log; if not, the target service log is determined to be a non-duplicate log.

[0045] In practical use, there are usually multiple historical service logs for the most recent historical time period. For example, when performing duplicate detection on the target service log collected in this paper, multiple historical service logs for the most recent historical time periods such as the past 5 minutes and 10 minutes can be obtained and compared with the target service log to determine whether the target service log is a duplicate log.

[0046] For unique target service logs, further storage is performed. Specifically, in step S106 above, when storing target service logs, the target service logs can be sent to a log storage system for storage. Duplicate logs, on the other hand, can be discarded.

[0047] Furthermore, for non-duplicate target service logs, the process described in step S108 above can continue to be executed to update the time variables of each business server. Specifically, in step S108 above, in response to the log storage system successfully storing the logs, the log printing time of the target service logs can be extracted; then, the log printing time can be returned to the log collection component so that the log collection component can update the time variables corresponding to each business server in the application server cluster based on the log printing time.

[0048] Therefore, based on the log collection component, log deduplication service component, and log storage system architecture described above, the log management process can include the following steps:

[0049] As each business server in the application server cluster runs, the log deduplication service component obtains the target service logs of the application server cluster sent by the log collection component, determines whether the target service logs are duplicate logs, and if not, stores the target service logs in the log storage system and sends the log printing time of the target service logs to the log collection component. This allows the log collection component to update the corresponding time variables of each business server in the application server cluster according to the log printing time, thereby solving the problems of high log management cost, high resource consumption, and inability to guarantee the integrity and consistency of stored logs.

[0050] Furthermore, in the above-described scheme of this invention, after obtaining the target service log sent by the log collection component, the log deduplication service component performs a duplicate check on the target service log. If it determines that the target service log is not a duplicate log, it stores the target service log in the log storage system. After the target service log is successfully stored, it returns the log printing time of the target service log to the log collection component, so that the target service log can execute the next round of collection of service logs of the application server cluster based on the log printing time. That is, in response to the update of the time variable corresponding to each business server in the application server cluster, the target service log of each business server continues to be collected through the log collection component, thereby ensuring the consistency and integrity of the obtained service logs of the application server cluster, avoiding duplicate collection and missed collection of service logs by the log collection component, improving log management efficiency and reducing the operation and maintenance burden without intervening in third-party system components, and avoiding duplicate storage of log files, thus saving log management resources.

[0051] Furthermore, in this embodiment of the invention, the application server cluster is also configured with a visual management component; that is, the log system architecture also includes a visual management component, which can display the corresponding visual interface through a graphical user interface, and then realize the display and retrieval of stored service logs through visual management.

[0052] Therefore, the log management method provided in this embodiment of the invention can also display the target service logs stored in the log storage system through a visualization management component.

[0053] Furthermore, for ease of understanding, Figure 2 A schematic diagram of a log system architecture is also shown, illustrating the aforementioned log collection component 10, log deduplication service component 11, log storage system 12, and visualization management component 13. Furthermore, for ease of explanation, Figure 2 The document also shows an application server cluster 100, and one of its business servers, Service 01.

[0054] Specifically, Figure 2 In the system, the visualization management component, also known as the Kibana component, can retrieve and display logs. The log storage system stores the log data processed by the log deduplication service component. The log deduplication service component provides log deduplication services and can obtain the target service logs of the application server cluster sent by the log collection component. The target service logs are logs collected by the log collection component based on the time variables corresponding to each business server in the application server cluster. The log deduplication service determines whether the target service logs are duplicate logs. If not, it stores the target service logs and sends the log print time of the target service logs to the log collection component, so that the log collection component updates the time variables corresponding to each business server in the application server cluster according to the log print time. Then, the target service logs are sent to the log storage system for storage, and can be displayed and retrieved through the visualization management component.

[0055] In practical use, log duplication occurs because the log collection component fails to update the stored time variable in a timely manner, or the log deduplication service component reports an incorrect log print time to the log collection component, resulting in duplicate logs being collected by the log collection component. Here, the log print time of the target service log refers to the time the target service log was generated.

[0056] In addition, it also includes situations where a certain type of log appears for a long time. For example, for fault logs, they may last for a long time without being processed or the processing is not completed. In this case, the fault log will be generated repeatedly within a certain period of time. At this time, the log collection component will also collect duplicate target service logs. For this type of log, deduplication can be performed until a non-duplicate service log is collected again.

[0057] Furthermore, in this embodiment of the invention, the log deduplication service provided by the aforementioned log deduplication service component can perform cleaning operations on the log content of the target service log. For example, it can replace the timestamp, log path field, and status information field in the log with null values ​​using regular expression matching. Subsequently, it can calculate the text similarity, vector similarity, and maximum common subgraph of the target service log content in batches, and then filter the results after taking the average value. Then, it can group target service logs with similarity into clusters and groups them. Through a preset detection algorithm, such as a density-based anomaly detection algorithm, it can quantify and obtain abnormal log information to achieve the purpose of deduplication. If the content similarity between the target service log and the historical service log is higher than a preset threshold, the target service log is determined to be a duplicate log; otherwise, the target service log is determined not to be a duplicate log. In specific implementation, the specific detection algorithm for the above-mentioned duplication detection can be configured according to the actual use case, and this embodiment of the invention does not impose any restrictions on this.

[0058] Meanwhile, in this embodiment of the invention, the log deduplication service component and the log collection component can establish a connection using gRPC bidirectional stream mode to ensure the data integrity of the log printing time and the target service log during transmission and avoid data loss.

[0059] In summary, the log management method provided by this invention, after acquiring the target service log sent by the log collection component, can perform a duplicate check on the target service log. If it is determined that the target service log is not a duplicate log, it stores the target service log. After the target service log is successfully stored, it returns the log printing time of the target service log to the log collection component, so that the target service log can execute the next round of task to collect service logs of the application server cluster based on the log printing time. This ensures the consistency and integrity of the acquired service logs of the application server cluster, avoids duplicate collection and omission of service logs by the log collection component, improves log management efficiency and reduces the operation and maintenance burden without intervening in third-party system components, and avoids duplicate storage of log files, saving log management resources.

[0060] Furthermore, based on the above embodiments, this embodiment of the invention also provides a log management device applied to an application server cluster, the application server cluster including multiple business servers; such as Figure 3 The schematic diagram shown illustrates the structure of a log management device, which includes:

[0061] The acquisition module 30 is used to acquire target service logs, wherein the target service logs are logs collected based on time variables corresponding to each business server in the application server cluster;

[0062] Deduplication module 32 is used to determine whether the target service log is a duplicate log;

[0063] Storage module 34 is used to store the target service log when the deduplication module determines that the target service log is not a duplicate log;

[0064] The update module 36 is used to extract the log printing time of the target service log and update the time variable corresponding to each business server in the application server cluster based on the log printing time.

[0065] The log management device provided in this embodiment of the invention has the same technical features as the log management method provided in the above embodiments, so it can also solve the same technical problems and achieve the same technical effects.

[0066] Furthermore, embodiments of the present invention also provide a server, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method.

[0067] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the above-described method.

[0068] Furthermore, this embodiment of the invention also provides a schematic diagram of a server structure, such as... Figure 4 The diagram shows the structure of the server, which includes a processor 41 and a memory 40. The memory 40 stores computer-executable instructions that can be executed by the processor 41, and the processor 41 executes the computer-executable instructions to implement the above-described method.

[0069] exist Figure 4 In the illustrated embodiment, the server further includes a bus 42 and a communication interface 43, wherein the processor 41, the communication interface 43, and the memory 40 are connected via the bus 42.

[0070] The memory 40 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 43 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc. The bus 42 may be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 42 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0071] Processor 41 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 41 or by software instructions. Processor 41 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the memory, and the processor 41 reads the information in the memory and uses its hardware to complete the aforementioned method.

[0072] The computer program product of the log management method and apparatus provided in the embodiments of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation, please refer to the method embodiments, which will not be repeated here.

[0073] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0074] Furthermore, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances.

[0075] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0076] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0077] Finally, it should be noted that the above embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A log management method, characterized in that, Applied to an application server cluster, the application server cluster comprising multiple business servers; the method includes: Obtain the target service log, wherein the target service log is a service log collected based on the time variable corresponding to each business server in the application server cluster; Determine whether the target service log is a duplicate log; If not, then store the target service log; Extract the log printing time of the target service log, and update the time variable corresponding to each business server in the application server cluster based on the log printing time.

2. The method according to claim 1, characterized in that, The application server cluster is configured with a log collection component, a log deduplication service component, and a log storage system; The steps to obtain the target service logs include: The log collection component collects target service logs from each business server and sends the target service logs to the log deduplication service component.

3. The method according to claim 2, characterized in that, The steps for determining whether the target service log is a duplicate log include: The log deduplication service component determines whether the target service log is a duplicate log.

4. The method according to claim 3, characterized in that, The step of determining whether the target service log is a duplicate log through the log deduplication service component includes: The log deduplication service component obtains historical service logs for a preset recent historical time period. Determine whether the content similarity between the target service log and the historical service log is higher than a preset threshold; If so, the target service log is determined to be a duplicate log; If not, determine that the target service log is a non-duplicate log.

5. The method according to claim 2, characterized in that, The steps for storing the target service logs include: The target service logs are sent to the log storage system, and the target service logs are stored through the log storage system.

6. The method according to claim 2, characterized in that, The steps of extracting the log print time of the target service log and updating the time variables corresponding to each business server in the application server cluster based on the log print time include: In response to the log storage system successfully storing the log, the log printing time of the target service log is extracted; The log printing time is returned to the log collection component so that the log collection component updates the time variables corresponding to each business server in the application server cluster based on the log printing time.

7. The method according to claim 2, characterized in that, The method further includes: In response to the update of the time variable corresponding to each business server in the application server cluster, the target service logs of each business server are continued to be collected through the log collection component.

8. The method according to claim 2, characterized in that, The application server cluster is also configured with a visual management component; The method further includes: The visual management component displays the target service logs stored in the log storage system.

9. A log management device, characterized in that, Applied to an application server cluster, the application server cluster comprising multiple business servers; the device includes: The acquisition module is used to acquire target service logs, wherein the target service logs are service logs collected based on time variables corresponding to each business server in the application server cluster; The deduplication module is used to determine whether the target service log is a duplicate log; The storage module is used to store the target service log when the deduplication module determines that the target service log is not a duplicate log; The update module is used to extract the log printing time of the target service log and update the time variables corresponding to each business server in the application server cluster based on the log printing time.

10. A server, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in any one of claims 1-8.

Images