Log processing method, electronic device, and computer program product

Abstract

This application discloses a log processing method, electronic device, and computer program product, belonging to the field of communication technology. The method of this application includes: reading a log file to be processed, wherein the log file is in text format; filtering log segments in the log file to be processed according to a target parameter set to obtain at least one fault segment; and inputting the at least one fault segment into a preset target model to obtain a fault analysis result.

Description

Technical Field

[0001] This application belongs to the field of data processing technology, and in particular relates to a log processing method, electronic device, and computer program product. Background Technology

[0002] In related technologies, log analysis usually relies on manual troubleshooting, but for log analysis in situations with complex log faults and large log data volumes, there are still problems such as low log processing efficiency. Summary of the Invention

[0003] The purpose of this application is to provide a log processing method, electronic device, and computer program product that can improve log processing efficiency.

[0004] In a first aspect, a log processing method is provided, comprising: reading a log file to be processed, wherein the log file is in text format; filtering log segments in the log file to be processed according to a target parameter set to obtain at least one fault segment; and inputting the at least one fault segment into a preset target model to obtain a fault analysis result.

[0005] Secondly, a log processing device is provided, comprising: a first processing module for reading a log file to be processed, wherein the log file is in text format; a second processing module for filtering log segments in the log file to be processed according to a target parameter set to obtain at least one fault segment; and a third processing module for inputting the at least one fault segment into a preset target model to obtain a fault analysis result.

[0006] Thirdly, embodiments of this application provide an electronic device, including: a memory, a processor, and computer-executable instructions stored in the memory and executable on the processor, wherein the computer-executable instructions, when executed by the processor, implement the steps of the method described in the first aspect. Fourthly, embodiments of this application provide a computer-readable storage medium for storing computer-executable instructions that, when executed by a processor, implement the steps of the method described in the first aspect. Fifthly, embodiments of this application provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, implement the steps of the method described in the first aspect.

[0007] In this embodiment of the application, by reading the log file to be processed, filtering the log segments in the log file according to the target parameter set to obtain at least one fault segment, and finally inputting the at least one fault segment into a preset target model to obtain the fault analysis result, the efficient and automated processing of log files can be achieved. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This is a schematic diagram illustrating an application scenario of the log processing method provided in an exemplary embodiment of this application.

[0010] Figure 2 This is one of the flowcharts illustrating a log processing method provided in an exemplary embodiment of this application.

[0011] Figure 3 This is a second schematic flowchart of a log processing method provided in an exemplary embodiment of this application.

[0012] Figure 4a This is a schematic diagram of a parameter configuration interface provided in an exemplary embodiment of this application.

[0013] Figure 4b This is a schematic diagram of the system call process in the log processing flow provided by an exemplary embodiment of this application.

[0014] Figure 5 This is the third flowchart of a log processing method provided in an exemplary embodiment of this application.

[0015] Figure 6 This is a schematic diagram of the structure of a log processing apparatus provided in an exemplary embodiment of this application.

[0016] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an exemplary embodiment of this application. Detailed Implementation

[0017] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0018] like Figure 1 The diagram shown is an application scenario of the log processing method provided in an exemplary embodiment of this application. The application scenario may include, but is not limited to, the user interaction layer 10, the user interface (UI) 11, the application layer 12, the service layer 13, the storage layer 14, etc.

[0019] The user interaction layer 11 can be used to handle user questions and answers, such as receiving user input and operations.

[0020] The user UI12 can be used to display related content / controls such as fault location parameter display, fault segment display, and conclusion display.

[0021] The application layer 13 can be used to design data filtering processing logic, manage the validity of data filtering rules, and extract fault fragment data.

[0022] The service layer 14 can be used to provide programming interface (e.g., OpenAI interface) calls, built-in prior knowledge base configuration, prompt word management, etc.

[0023] The storage layer 15 can be used to provide storage for fault prior knowledge, storage for characters in the OpenAI built-in knowledge base, etc. Based on this, the technical solutions provided by the embodiments of this application will be described in detail below with reference to the accompanying drawings and through some embodiments and application scenarios.

[0024] Figure 2 This diagram illustrates a flowchart of a log processing method 200 provided in an embodiment of this application. This method 200 can be executed by an electronic device, such as a terminal device or a server device. In other words, the method can be executed by software or hardware installed on the terminal device or server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. Figure 2 As shown, the method may include the following steps.

[0025] S210, read the log file to be processed.

[0026] The log file is in text format, such as ".txt".

[0027] The log file can be, but is not limited to, a file saved independently, a file saved in a folder, a file in a compressed file, etc.

[0028] For example, taking a folder as an example, the process of reading the log file to be processed in S210 may include, but is not limited to: sequentially traversing the log files under the folder, determining whether the format of the log file is text format, and if so, performing the log processing steps in S220-S230 based on the log file.

[0029] S220, filter the log segments in the log file to be processed according to the target parameter set to obtain at least one fault segment.

[0030] The target parameter set includes one or more target parameters for preliminary filtering of valid segments in the log file to obtain at least one faulty segment.

[0031] In this embodiment, the target parameters in the target parameter set can also be understood as keywords, key parameters, filtering parameters, etc. In an exemplary implementation, the keywords can be, but are not limited to, "error", "isCaptivePortal pacUr", "isCaptivePortal", etc., and are not limited here.

[0032] In some embodiments, the process of filtering log segments in the log file to be processed according to the target parameter set in S220 to obtain at least one faulty segment may include, but is not limited to: first filtering the log segments in the log file to be processed according to each target parameter in the target parameter set; and then determining the log segments in the log file that include the target parameters as the at least one faulty segment. That is, in this embodiment, the initial filtering of the faulty segments is achieved by parameter comparison, thereby ensuring the effectiveness of the filtered faulty segments.

[0033] In some embodiments, when filtering log fragments in the log file to be processed, specific parameters from the target parameter set can also be returned, such as those displayed in the user UI. These specific parameters are parameters not included in the log file. In this embodiment, by returning specific parameters from the target parameter set, users can easily perform a rough analysis of fault types based on these specific parameters (such as excluding fault types corresponding to the specific parameters), optimize the target parameter set, and thus improve the efficiency of subsequent log processing.

[0034] S230, input the at least one fault segment into the preset target model to obtain the fault analysis result.

[0035] The preset target model can be understood as a pre-configured or default large language model used to achieve automated fault log location and analysis, and improve the efficiency of log processing.

[0036] In one exemplary implementation, the fault analysis results may include, but are not limited to, fault segments and the fault types corresponding to the fault segments.

[0037] In this embodiment, by reading the log file to be processed, filtering the log segments in the log file according to the target parameter set, at least one fault segment is obtained. Finally, the at least one fault segment is input into a preset target model to obtain the fault analysis result, which can realize efficient and automated processing of log files.

[0038] In some embodiments, if the log file to be processed read in S210 is in a non-text format, then the format of the log file can be converted to the text format through text format preprocessing. This allows the processing objects of the log processing scheme provided in this application embodiment to be not limited to the text format, thus expanding the application scope of the log processing scheme provided in this application embodiment.

[0039] For example, taking a folder as an example, the process of reading the log file to be processed in S210 may include: traversing the log files under the folder, determining whether the format of the log file is text format, and if so, performing the log processing steps in S220-S230 above based on the log file; otherwise, preprocessing the format of the log file to text format, and performing the log processing steps in S220-S230 above based on the text format log file.

[0040] In one exemplary embodiment, the non-text format log file may include, but is not limited to, images, PCAP files, etc. Taking the PCAP file as an example, in this embodiment, when preprocessing the PCAP file into a text format log file, the preprocessing process may include: based on the user UI, triggering the PCAP file upload via a button such as an upload file button, and then entering the background processing flow, that is, calling the pcaplogparser function of the service layer (or the backend data access layer), importing the pcap input information of the rdpcap() function provided by a parsing library (such as scapy), parsing each data packet in the PCAP file packet by packet, and returning the parsed field information to the pcapmodelinfo variable in "line" units to obtain the text format log file.

[0041] In one exemplary implementation, the field information may include, but is not limited to, timestamps, source Internet Protocol (IP), destination IP, protocol type, payload, etc.

[0042] In some embodiments, before performing the filtering of log fragments in the log file to be processed according to the target parameter as described in S220 to obtain at least one fault fragment, the method embodiment 200 provided in this application may further include, as described in step S220. Figure 3 The contents of S240-S250 shown are as follows.

[0043] S240, Determine the fault filtering mode.

[0044] The fault filtering mode may include, but is not limited to, at least one of the first mode and the second mode. In this embodiment, the first mode is a mode for filtering log fragments based on a preset parameter set and a first parameter set.

[0045] The preset parameter set can be understood as a set of general parameters that are pre-configured in a standard (base) parameter library.

[0046] The first parameter set is a newly added parameter set relative to the preset parameter set. In this embodiment, the first parameter set can be understood as a set of parameters added by the user on demand, based on the preset parameter set, thereby ensuring the effectiveness of the log fragment filtering while matching the filtering parameters with user needs. That is, the first mode can be understood as a semantically enhanced processing mode based on the preset parameter set.

[0047] The second mode is a log fragment filtering mode based on a second parameter set. The second parameter set includes at least one combined parameter, and each combined parameter includes at least two parameters from the preset parameter set and / or the first parameter set. That is, the first mode can be understood as a semantically enhanced, hybrid parameter processing mode based on the preset parameter set and / or the first parameter set.

[0048] For example, assuming the preset parameter set includes {parameter 1, parameter 2, parameter 3}, and the first parameter set includes {parameter 4, parameter 5, parameter 6}, then when the combined parameters in the second parameter set include at least two parameters from the preset parameter set, the combined parameters can be "parameter 1 + parameter 2, parameter 1 + parameter 3", etc.; when the combined parameters in the second parameter set include at least two parameters from both the preset parameter set and the first parameter set, the combined parameters can be "parameter 1 + parameter 4, parameter 2 + parameter 6", etc.; when the combined parameters in the second parameter set include at least two parameters from the first parameter set, the combined parameters can be "parameter 4 + parameter 5, parameter 5 + parameter 6", etc.

[0049] In this embodiment, the first mode can be understood as filtering the log files at the granularity of a single parameter (such as parameter 1, parameter 2, etc.), while the second mode can be understood as filtering the log files at the granularity of combined parameters (such as parameter 1 + parameter 2).

[0050] Based on the descriptions of the first and second modes above, there can be multiple ways to determine the fault filtering mode in the aforementioned S240. For example, the first mode or the second mode can be determined as the fault filtering mode by default.

[0051] For example, the first mode or the second mode can be determined as the fault filtering mode based on the user's mode selection operation at the user interaction layer.

[0052] In some embodiments, if the determined fault filtering mode includes the first mode and the second mode, then the log fragments in the log file to be processed can be processed based on the first mode and the second mode respectively to obtain fault analysis results under different modes.

[0053] S250, the parameter set corresponding to the fault filtering mode is determined as the target parameter set.

[0054] In this embodiment, the two fault filtering modes provided in S240-S250 can meet the log processing needs of users in different scenarios.

[0055] For example, assuming the fault filtering mode is the first mode and the target parameter set includes parameters 1-7 as shown in Table 1, then parameters 1-7 can be compiled into a list combination using regular expression compilation, such as patterns = [re.compile(keyword) for keyword in keywords]. Then, after searching line by line using methods such as pattern.search, the line containing the corresponding target parameter is added as a fault fragment to the list (such as matched_lines) and returned. If no line containing the target parameter is found after searching all lines, then the target parameter is returned. The pseudocode for implementing the aforementioned example is as follows.

[0056] for line in pcapmodelinfo: if any(pattern.search(line) for pattern in patterns): matched_lines.append(line.strip()) Else: Nomathcd_list.append(any(pattern.search(line)) Table 1

[0057] In some embodiments, when the fault filtering mode is determined to be the first mode, the method embodiment 200 of this application may further include: receiving and responding to first target configuration information, and determining a first parameter set corresponding to the first mode based on the first target configuration information. That is, when the fault filtering mode is determined to be the first mode, the first parameter set can be configured.

[0058] In one exemplary implementation, the first target configuration information may include, but is not limited to, at least one of the following a)-c).

[0059] a) Parameter configuration information to be added.

[0060] b) Parameter configuration information to be deleted.

[0061] c) Parameter configuration information to be saved.

[0062] For example, assuming the log file is a WiFi connection-related log file, then, if the fault filtering mode is determined to be the first mode, the following can be displayed: Figure 4aThe parameter configuration interface shown is used by the user to input first target configuration information, such as disconnected, was, registerNetworkAgent, etc., to configure the first parameter set.

[0063] Among them, the parameter list can be added via the front-end design keyword configuration parameter option (dropdown = document.getElementById('parameterDropdown')) and the function addparamDropdown() (const parameters = ['base', 'model1', 'model2' ***).

[0064] Through such Figure 4a The click event of the add button shown, such as addEventListener('click',populateDropdown), implements the function of adding user parameters, that is, the first target configuration information is the parameter configuration information to be added.

[0065] Through such Figure 4a The click event of the delete button shown, such as deleteEventListener('click',populateDropdown), implements the user's parameter deletion function, that is, the first target configuration information is the parameter configuration information to be deleted.

[0066] Through such Figure 4a The save button shown saves the latest list of parameters to the variable filterdataall, which means that the first target configuration information is the parameter configuration information to be saved.

[0067] Similar to the configuration of the first parameter set, in some embodiments, when the fault filtering mode is determined to be the second mode, the method embodiment 200 of this application may further include: receiving and responding to second target configuration information, and determining a second parameter set corresponding to the second mode based on the second target configuration information. That is, when the fault filtering mode is determined to be the second mode, the configuration of the second parameter set can be performed.

[0068] In one exemplary implementation, the second target configuration information may include, but is not limited to, at least one of the following a)-c).

[0069] a) Parameter configuration information to be added.

[0070] b) Parameter configuration information to be deleted.

[0071] c) Parameter configuration information to be saved.

[0072] The second target configuration information can be referred to the foregoing description of the first target configuration information, and will not be repeated here.

[0073] In some embodiments, the process of inputting the at least one fault segment into a preset target model to obtain a fault analysis result as described in S230 may include, but is not limited to: displaying the at least one fault segment; receiving and responding to a first operation for the at least one fault segment, determining a target fault segment from the at least one fault segment according to the first operation; and inputting the target fault segment into the preset target model to obtain the fault analysis result. In an exemplary embodiment, the first operation may include, but is not limited to, at least one of a segment deletion operation, a segment selection operation, and a segment saving operation.

[0074] In other words, in this embodiment, before performing fault analysis on at least one fault segment obtained from the initial filtering through the preset target model, at least one fault segment can be displayed so that users can perform secondary filtering on at least one fault segment as needed, such as deleting invalid segments, to obtain valid target fault segments. Then, the target fault segment is analyzed through the target model, thereby improving the accuracy and efficiency of the fault analysis results.

[0075] In some embodiments, the process of inputting the at least one fault segment into a preset target model to obtain fault analysis results as described in S230 may include, but is not limited to: for each fault segment, assembling prompt words for the fault segment; inputting the at least one fault segment with completed prompt word assembly into the preset target model to obtain fault analysis results, wherein the prompt words are used to describe relevant information of the fault segment, such as the possible fault type of the fault segment, the context information of the fault segment, etc., so that when the target model analyzes the fault segment, it can enhance the target model's understanding of the fault segment and achieve numerical-level fault location accuracy.

[0076] In this embodiment, the target model can be understood as a large language model in Retrieval-Augmented Generation (RAG), and the prompt words can be understood as prompt information that matches or is related to the fault segment retrieved from the built-in knowledge base based on the RAG technology, so as to serve as contextual information of the fault segment, enhance the target model's ability to understand the fault segment, and improve the accuracy of the fault analysis results output by the target model.

[0077] In some embodiments, considering that the character limit in the built-in knowledge base (which can also be understood as a priori knowledge base) may prevent the data characters in the fault segment from being structured, resulting in irregular segmentation of the fault segment and subsequent context breakage when adapting it to the built-in knowledge base, this embodiment can further construct a pre-trained dataset based on log features (such as fault log features) to retrieve prompt words that match or are related to the fault segment. At least some data segments in the pre-trained dataset are constructed based on the relevant attributes of the log segment, such as slicing the log segment according to its relevant attributes. The relevant attributes of the log segment may include, but are not limited to, the fault type and fault storage path of the log segment.

[0078] In other words, for each of the aforementioned fault segments, prompt words are assembled for the fault segments; when the at least one fault segment with assembled prompt words is input into a preset target model to obtain the fault analysis result, the prompt words involved can be determined based on the preset training dataset, thereby avoiding the problem of context breakage caused by fixed character segmentation in the built-in knowledge base, and realizing flexible adjustment of the segmentation method of the input text of the target model.

[0079] In one exemplary implementation, the preset training dataset may be stored in a traditional database (such as Elasticsearch) or the built-in knowledge base, without limitation.

[0080] In one exemplary implementation, the pre-trained dataset can also be understood as prior data, such as the original fault types and their corresponding labeling information.

[0081] For example, assuming the number of characters in the training set fields exceeds the character threshold corresponding to the built-in knowledge base, this embodiment can design a traditional database to store prior data (such as the original fault type and its corresponding tag information). When the application layer receives a fault fragment that has undergone preliminary filtering, it can search and match the fault fragment with the prior data in the traditional database to extract matching or related prompt words from the traditional database, such as the possible fault type corresponding to the fault fragment. The fault type and the prompt words are then assembled and output, for example, the output format may include: fault fragment 1 / possible fault type 1 (i.e., prompt word 1), fault fragment 2 / possible fault type 2 (i.e., prompt word 2), ... Finally, the fault fragment with assembled prompt words is input into the target model for fault analysis. Thus, by introducing data from the traditional database as input, the target model can refer to the prior data in the traditional database when analyzing fault logs, improving fault analysis efficiency and achieving numerical-level fault location accuracy in the fault analysis results.

[0082] In one exemplary implementation, for a scenario with both a traditional database and the built-in database, after obtaining sufficiently filtered fault logs, it can be done as follows: Figure 4b As shown, the fault fragment is first retrieved and matched with prior data in a traditional database to extract clue words that match or are related to the fault fragment from the traditional database. The clue words and the fault fragment are then combined and input into the target model (such as a large language model) for fault analysis to output the fault analysis results. However, if no clue words that match or are related to the fault fragment are extracted from the traditional database, clue words that match or are related to the fault fragment can be retrieved from the built-in knowledge base. The clue words and the fault fragment are then combined and input into the target model (such as a large language model) for fault analysis to output the fault analysis results. This embodiment does not impose any limitations on this.

[0083] In some embodiments, when performing fault analysis based on the target model, if the fault analysis result is determined to be abnormal, the system switches to a larger language model other than the target model; the at least one faulty segment is then re-input into the larger language model for fault analysis. In other words, this embodiment can dynamically schedule the model based on whether the target model returns a normal result, ensuring the smooth execution of the log processing flow, avoiding stuttering during model invocation, and improving the user experience.

[0084] Optionally, the abnormal situations of the fault analysis results may include, but are not limited to: the fault analysis results are empty or no fault analysis results are returned, the network is prompting that it is retrying, or the network is showing an abnormality.

[0085] In the case of "prompting retry", the target model can be repeatedly requested to analyze the at least one fault segment. If the number of repetitions exceeds a predetermined value (e.g., 3 times), the fault analysis result can be determined to be abnormal.

[0086] In some embodiments, when analyzing at least one fault segment based on the target model, the user can enter the RAG mode by inputting a question into the target model, thereby triggering the retrieval and matching of specific fault indicators between the prior knowledge base and the traditional database content, and thus obtaining the fault analysis results, achieving accurate recall of fault-related semantics and optimizing the analysis accuracy.

[0087] Based on the description of the aforementioned method embodiment 200, the following is in conjunction with... Figure 5 The process of the log processing solution provided in this application is described.

[0088] S501, taking a folder as an example, traverse the log files in the folder.

[0089] S502, determine whether the log file is in text format. If not, proceed to S503; otherwise, proceed to S504.

[0090] S503 converts non-text log files to text format.

[0091] S504: Determine whether to select the first mode. If yes, execute S506; otherwise, execute S505.

[0092] S505: Determine whether to select the second mode. If yes, proceed to S506; otherwise, the log processing flow ends.

[0093] S506, Filter the log segments in the log file to be processed according to the target parameter set.

[0094] S507: Determine whether there is a faulty segment based on the filtering results. If so, proceed to S508; otherwise, return to S501 and continue traversing the next log file.

[0095] S508, input at least one fault segment obtained from the filtering into the preset target model for analysis, and obtain the fault analysis result.

[0096] In one exemplary implementation, before performing fault analysis based on the target model, the at least one fault segment may be displayed; a first operation for the at least one fault segment is received and responded to, and a target fault segment is determined from the at least one fault segment according to the first operation; the target fault segment is input into a preset target model for analysis to obtain fault analysis results.

[0097] In one exemplary embodiment, before performing fault analysis based on the target model, prompt words corresponding to the fault fragment can be extracted by searching traditional databases or built-in databases. The prompt words and the fault fragment are then combined and input into the target model for fault analysis to activate the RAG semantic enhancement mode, thereby achieving accurate recall of fault-related semantics and improving the accuracy of fault analysis. The log processing workflow provided in this example enables automated and efficient fault analysis of log files, ensuring the accuracy of fault analysis.

[0098] Each step in the aforementioned log processing flow provided in this embodiment can refer to the relevant description in the aforementioned method embodiment 200 and achieve the same or corresponding technical effects. To avoid repetition, it will not be described again here.

[0099] Furthermore, the log processing flow provided in this embodiment may include, but is not limited to, the aforementioned S401-S408. It may include more or fewer steps than the aforementioned S401-S408, and this is not limited here.

[0100] Figure 6 The diagram shows a schematic of the structure of a log processing device 600 provided in an embodiment of this application. The device 600 includes: a first processing module 610 for reading a log file to be processed, wherein the log file is in text format; a second processing module 620 for filtering log segments in the log file to be processed according to a target parameter set to obtain at least one fault segment; and a third processing module 630 for inputting the at least one fault segment into a preset target model to obtain a fault analysis result.

[0101] In some embodiments, filtering log segments in the log file to be processed according to a target parameter set to obtain at least one faulty segment includes: filtering log segments in the log file to be processed according to each target parameter in the target parameter set; and determining the log segments in the log file that include the target parameters as the at least one faulty segment.

[0102] In some embodiments, the step of filtering log segments in the log file to be processed according to a target parameter set to obtain at least one fault segment further includes: returning a specific parameter in the target parameter set, wherein the specific parameter is a parameter not included in the log file.

[0103] In some embodiments, before filtering log segments in the log file to be processed according to the target parameters to obtain at least one faulty segment, the second processing module 620 is further configured to: determine a fault filtering mode; determine the parameter set corresponding to the fault filtering mode as the target parameter set; wherein, the fault filtering mode includes at least one of a first mode and a second mode, the first mode is a mode for filtering log segments based on a preset parameter set and a first parameter set, the second mode is a mode for filtering log segments based on a second parameter set, the first parameter set is a newly added parameter set relative to the preset parameter set, the second parameter set includes at least one combined parameter, and each combined parameter includes at least two parameters from the preset parameter set and / or the first parameter set.

[0104] In some embodiments, the second processing module 620 is further configured to perform any of the following: When the fault filtering mode is determined to be the first mode, the system receives and responds to the first target configuration information, and determines the first parameter set corresponding to the first mode based on the first target configuration information. If the fault filtering mode is determined to be the second mode, the system receives and responds to the second target configuration information, and determines the second parameter set corresponding to the second mode based on the second target configuration information.

[0105] In some embodiments, the first target configuration information and / or the second target configuration information includes at least one of the following: parameter configuration information to be added; parameter configuration information to be deleted; and parameter configuration information to be saved.

[0106] In some embodiments, inputting the at least one fault segment into a preset target model to obtain a fault analysis result includes: displaying the at least one fault segment; receiving and responding to a first operation for the at least one fault segment, determining a target fault segment from the at least one fault segment according to the first operation; and inputting the target fault segment into the preset target model to obtain the fault analysis result.

[0107] In some embodiments, the first operation includes at least one of a fragment deletion operation, a fragment selection operation, and a fragment saving operation.

[0108] In some embodiments, the target model is determined based on a preset training dataset, wherein at least a portion of the data fragments in the preset training dataset are constructed based on the relevant attributes of the log fragments.

[0109] In some embodiments, the first processing module 610 is further configured to convert the format of the log file to be processed into the text format if it is determined that the format of the log file to be processed is a non-text format.

[0110] In some embodiments, the third processing module 610 is further configured to switch to a large language model other than the target model if the fault analysis result is determined to be abnormal; and re-input the at least one fault fragment into the large language model for fault analysis.

[0111] The device 600 provided in this application embodiment can execute the methods described in the preceding method embodiments and achieve the functions and beneficial effects of the methods described in the preceding method embodiments, which will not be repeated here.

[0112] Figure 7 This diagram illustrates the hardware structure of the electronic device 700 provided in the embodiments of this application. Referring to the diagram, at the hardware level, the electronic device 700 may include a processor 710. In an exemplary embodiment, the electronic device 700 may also include a network interface 720, an internal bus 730, and a memory 740. The memory 740 may include RAM, such as high-speed random-access memory (RAM), and may also include non-volatile memory, such as at least one disk storage device. Of course, the electronic device 700 may also include other hardware required for other services.

[0113] The processor 710, network interface 720, and memory 740 can be interconnected via an internal bus 730. This internal bus 730 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be categorized as an address bus, data bus, control bus, etc. For ease of illustration, only a single bidirectional arrow is used in this diagram, but this does not imply that there is only one bus or one type of bus.

[0114] Memory 740 is used to store programs. Specifically, the program may include program code, which includes computer operation instructions. Memory 740 may include main memory and non-volatile memory, and provides instructions and data to processor 710.

[0115] Processor 710 reads the corresponding computer program from non-volatile memory into memory and then executes it, forming a device for locating a specific user at the logical level. Processor 710 executes the program stored in memory 740, specifically for the following purposes: Figures 2-3The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0116] The above is as stated in this application. Figures 2-3 The methods disclosed in the illustrated embodiments can be applied to or implemented by processor 710. Processor 710 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the hardware of processor 710 or by instructions in software form. The processor 710 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a readily available storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 740, and processor 710 reads the information from memory 740 and, in conjunction with its hardware, completes the steps of the above method.

[0117] The electronic device 700 can also execute the methods described in the preceding method embodiments and achieve the functions and beneficial effects of the methods described in the preceding method embodiments, which will not be repeated here.

[0118] Of course, in addition to software implementation, the electronic device 700 of this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0119] This application also proposes a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, cause the electronic device to perform... Figures 2-3 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0120] The computer-readable storage medium mentioned above includes read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, etc.

[0121] This application also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, which, when executed by a computer, implement the following process: Figures 2-3 The methods disclosed in the embodiments shown achieve the functions and beneficial effects of the methods described in the preceding method embodiments, and will not be repeated here.

[0122] Computer-readable storage media include both permanent and non-permanent, removable and non-removable media, which can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media do not include transient media, such as modulated data signals and carrier waves.

[0123] In summary, the above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

[0124] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0125] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0126] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

Claims

1. A log processing method, comprising: Read the log file to be processed, wherein the log file is in text format; The log segments in the log file to be processed are filtered according to the target parameter set to obtain at least one fault segment; The at least one fault segment is input into a preset target model to obtain fault analysis results.

2. The method of claim 1, wherein, The step of filtering log segments in the log file to be processed according to the target parameter set to obtain at least one fault segment includes: Filter the log segments in the log file to be processed according to each target parameter in the target parameter set; The log segment in the log file that includes the target parameter is identified as the at least one fault segment.

3. The method of claim 2, wherein, The step of filtering log segments in the log file to be processed according to the target parameter set to obtain at least one fault segment further includes: Return a specific parameter from the target parameter set, which is a parameter not included in the log file.

4. The method of claim 1, wherein, Before filtering log segments in the log file to be processed according to the target parameters to obtain at least one faulty segment, the method further includes: Determine the fault filtering mode; The parameter set corresponding to the fault filtering mode is determined as the target parameter set; The fault filtering mode includes at least one of a first mode and a second mode. The first mode is a mode for filtering log fragments based on a preset parameter set and a first parameter set. The second mode is a mode for filtering log fragments based on a second parameter set. The first parameter set is a newly added parameter set relative to the preset parameter set. The second parameter set includes at least one combined parameter. Each combined parameter includes at least two parameters from the preset parameter set and / or the first parameter set.

5. The method of claim 4, wherein, The method further includes any one of the following: When the fault filtering mode is determined to be the first mode, the system receives and responds to the first target configuration information, and determines the first parameter set corresponding to the first mode based on the first target configuration information. If the fault filtering mode is determined to be the second mode, the system receives and responds to the second target configuration information, and determines the second parameter set corresponding to the second mode based on the second target configuration information.

6. The method of claim 5, wherein, The first target configuration information and / or the second target configuration information include at least one of the following: Parameter configuration information to be added; Parameter configuration information to be deleted; Parameter configuration information to be saved.

7. The method of claim 1, wherein, The step of inputting the at least one fault segment into a preset target model to obtain fault analysis results includes: Display the at least one faulty segment; Receive and respond to a first operation for the at least one fault segment, and determine a target fault segment from the at least one fault segment according to the first operation; The target fault segment is input into the preset target model to obtain the fault analysis result.

8. The method of claim 7, wherein, The first operation includes at least one of the following: a segment deletion operation, a segment selection operation, and a segment saving operation.

9. The method of claim 1, wherein, The step of inputting the at least one fault segment into a preset target model to obtain fault analysis results includes: For each of the aforementioned fault segments, prompt words are assembled from the fault segments; Input the at least one fault fragment assembled with the prompt words into a preset target model to obtain fault analysis results; The prompt words are determined based on a preset training dataset. At least some data segments in the preset training dataset are constructed based on the relevant attributes of the log segments. The relevant attributes of the log segments include at least one of fault type and fault storage path.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the method as claimed in any one of claims 1-9.

11. A computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions that, when executed by a computer, implement the steps of the method as described in any one of claims 1-9.

Images