Log analysis method and electronic device

Abstract

The application discloses a log analysis method and an electronic device, relates to the technical field of data processing, and cuts log data into multiple log blocks and respectively performs matching and analysis, so that log processing is changed from centralized offline processing to segmented processing based on blocks, thereby gradually analyzing and evaluating the value of each log block in the process of continuous log generation, and realizing dynamic real-time processing. A log template tree is constructed, log blocks are mapped to corresponding tree node state vectors, logs of different text forms but belonging to the same type of abnormal mode are uniformly represented at the structure level, a composite vector is formed by combining a system performance vector and a semantic vector, and the composite vector is input into a value function model for evaluation, so that the model realizes abnormal risk prediction through state structured expression and value function modeling, solves the technical problems that logs cannot be dynamically and instantaneously processed and that low-sample abnormalities are difficult to effectively learn, and achieves the technical effects of improving real-time analysis capability and enhancing abnormal prediction stability.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a log analysis method and electronic device. Background Technology

[0002] In the field of server operation and maintenance, a large amount of log data and performance monitoring data are continuously generated during system operation. This data contains information on system status changes, resource usage, and potential anomalies. With the widespread application of cloud computing and distributed architectures, the scale of log data continues to grow, with daily data volumes reaching extremely high levels. How to promptly identify abnormal signs from massive, unstructured, and noisy log text, and provide early warnings of potential system failures, has become a key technical challenge for ensuring stable system operation.

[0003] However, log analysis methods in related technologies typically require processing large volumes of log data, necessitating centralized offline processing. This makes dynamic, real-time analysis during continuous log generation difficult, resulting in delayed anomaly detection and failing to meet real-time operational needs. Furthermore, severe system crashes are rare in actual operation, leading to a limited number of relevant samples. Log analysis methods in these technologies, which rely on training with numerous abnormal samples, struggle to effectively learn anomaly characteristics, resulting in unstable prediction accuracy or insufficient ability to identify rare faults. Summary of the Invention

[0004] This application provides a log analysis method and electronic device to at least solve the technical problems in related technologies, such as the inability to dynamically and instantly process logs and the difficulty in effectively learning from low-sample anomalies, thereby achieving the technical effects of improving real-time analysis capabilities and enhancing the stability of anomaly prediction.

[0005] This application provides a log analysis method, including: Obtain log data generated by the target system, and divide the log data into blocks to obtain multiple log blocks; Obtain the system performance vector and semantic vector corresponding to the log block. The system performance vector represents the system operation index characteristics of the time period corresponding to the log block, and the semantic vector represents the semantic characteristics of the log block. Based on the semantic vector and the pre-built log template tree, multiple log blocks are matched to determine the tree node state vector corresponding to the log block; the tree node state vector represents the category feature of the log block in the log classification system corresponding to the pre-built log template tree; The composite vector is input into the value function model to obtain the corresponding value score, which represents the probability that the target system will experience an anomaly; the composite vector includes the tree node state vector, the system performance vector, and the semantic vector.

[0006] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described log analysis methods.

[0007] This application transforms log processing from centralized offline processing to block-based segmented processing by dividing log data into multiple log blocks and matching and analyzing them separately. This allows for gradual analysis and value assessment of each log block as it is continuously generated, achieving dynamic real-time processing. A log template tree is constructed, mapping log blocks to corresponding tree node state vectors. This provides a unified structural representation for logs with different text formats but belonging to the same anomaly pattern. A composite vector is then formed by combining system performance vectors and semantic vectors and input into a value function model for evaluation. This model uses structured state representation and value function modeling to predict anomaly risks, solving the technical problems of the inability to process logs dynamically and in real-time, and the difficulty in effectively learning from low-sample anomalies. This achieves the technical effects of improving real-time analysis capabilities and enhancing the stability of anomaly prediction. Attached Figure Description

[0008] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 A flowchart of a log analysis method provided in an embodiment of this application; Figure 2 A schematic diagram of a log template tree provided in an embodiment of this application; Figure 3 This is a schematic diagram illustrating the execution of a reinforcement learning agent according to an embodiment of this application; Figure 4 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0010] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0011] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0012] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0013] The specific application environment architecture or specific hardware architecture on which the log analysis method depends is described here.

[0014] The log analysis method described in this application can be deployed in a distributed computing environment, such as a cloud computing platform or data center architecture. The target system may include multiple business servers, database servers, and network devices. Each node is interconnected via a network and continuously generates operational logs and performance monitoring data. Log data is aggregated in real-time to a log processing platform via log collection components (such as log brokers or message queue systems). The log processing platform performs processing steps such as log block segmentation, template tree matching, state construction, and value function evaluation, thereby achieving unified monitoring of the overall operational status of the distributed system and prediction of anomalies and risks. In terms of hardware architecture, the log analysis method can run on electronic devices including processors, memory, and network interfaces. The processor executes program instructions for log block segmentation, vector computation, log template tree matching, and value function inference. The memory stores the log template tree structure, value function model parameters, and historical trajectory data. When the system is large-scale, GPU (Graphics Processing Unit) servers or dedicated acceleration hardware can be used to accelerate semantic vector generation and value function model computation to meet the real-time analysis requirements of high-concurrency log streams.

[0015] Combination Figure 1 This application provides an embodiment of a log analysis method, which includes: S11: Obtain the log data generated by the target system, divide the log data into blocks, and obtain multiple log blocks.

[0016] This embodiment first acquires log data generated by the target system. Log data can originate from, but is not limited to, runtime logs output by business servers, database service processes, operating system kernel modules, or network components. It can be text-formatted logs, semi-structured logs, or structured log records. Log data can be acquired in real-time using log acquisition programs, message queue components, or file monitoring, or it can be read in batches at preset time intervals. This embodiment focuses on scenarios where log data is continuously generated over time and the data volume is large. Therefore, the time sequence information is maintained during the data acquisition stage to facilitate subsequent processing based on time periods.

[0017] After acquiring the log data, it is segmented into multiple log blocks. Segmentation refers to dividing continuous log records into several relatively independent log blocks according to a preset time window, log entry threshold, or event triggering rules. For example, a fixed time window can be used as the segmentation unit, such as forming a log block every 30 seconds or every minute; a fixed number of log entries can also be used as the segmentation basis, such as forming a log block every 100 log entries; or, when a specific keyword or status change is detected, several log entries before and after it can be combined into a log block. This embodiment does not limit the specific segmentation method, as long as it can split a continuous log stream into multiple time-related log blocks.

[0018] During the segmentation process, the chronological order of log records within each log block is maintained, ensuring that each log block reflects a segment of the target system's operation within its corresponding time period. Each log block can contain multiple log records, whose content may cover output information from different modules. This embodiment divides a continuous log stream into multiple log blocks, so that subsequent processing no longer targets the entire log set at once, but rather analyzes it segment by segment based on individual log blocks. This segmentation method changes the centralized batch processing approach in related technologies, allowing log data to be divided into multiple independently processable analysis units during its generation.

[0019] Furthermore, in practical implementation, the log segmentation process can be completed in real time in memory or implemented using a streaming processing framework. For high-concurrency scenarios, a sliding window approach can be used to overlap the logs, allowing for partial overlap between adjacent log blocks to preserve contextual information across time periods. This embodiment does not limit the specific implementation tools or runtime environment; it only emphasizes that by segmenting log data into blocks, multiple log blocks are obtained, providing a foundation for subsequent vector acquisition and matching processing based on these log blocks.

[0020] S12: Obtain the system performance vector and semantic vector corresponding to the log block. The system performance vector represents the system operation index characteristics of the time period corresponding to the log block, and the semantic vector represents the semantic characteristics of the log block.

[0021] This embodiment obtains the corresponding system performance vector and semantic vector for each log block. The system performance vector is used to characterize the system operation index features within the corresponding time period of the log block. Since each log block in step S11 already corresponds to a specific time range, this embodiment can read the operation index data within the same time period from the monitoring module or performance acquisition interface based on this time range. The operation index can be, but is not limited to, numerical information such as CPU (Central Processing Unit) utilization, memory usage, disk I / O (input / output) read / write counts, network I / O traffic, number of threads, and API (Application Program Interface) call frequency. The above indicators can be organized by means of average value, maximum value, minimum value, or rate of change, and combined into a set of numerical vectors as the system performance vector.

[0022] In practical implementation, the performance monitoring database can be queried for corresponding time intervals of log blocks based on their timestamp ranges. For example, when a log block covers log records within a certain minute, this embodiment can extract the CPU utilization curve data for that minute and calculate the mean or peak value as a dimension of the vector. Similarly, for network anomaly log blocks, network I / O metrics within that time period can be extracted as part of the system performance vector. The system performance vector can, but is not limited to, adopt a fixed-dimensional structure, with each dimension corresponding to a preset metric, and the values ​​are standardized or normalized to form a vector.

[0023] For semantic vectors, this embodiment extracts semantic features from the text content of log blocks. Since a log block typically contains multiple log records, this embodiment can either concatenate all the text in the log block and input it into a preset semantic vector model for encoding, or first perform a summary processing on the log block before vectorization. The semantic vector model can, but is not limited to, use a pre-trained text embedding model or a neural network-based language representation model to convert the log text into a fixed-dimensional numerical vector. This semantic vector is used to represent the overall semantic features of the log block, enabling log blocks with different expressions but similar semantics to have similar representations in the vector space.

[0024] In this embodiment, the system performance vector and semantic vector describe the same log block from two dimensions: operational metrics and textual semantics, respectively. The system performance vector reflects the objective operational status of the log block within the corresponding time period, while the semantic vector reflects the meaning of the event expressed by the textual content of the log block. By obtaining these two types of vectors respectively, a numerical input basis is provided for subsequent log template tree matching and value score calculation.

[0025] S13: Match multiple log blocks based on semantic vectors and pre-built log template trees to determine the tree node state vector corresponding to the log block; the tree node state vector represents the category characteristics of the log block in the log classification system corresponding to the pre-built log template tree.

[0026] This embodiment matches multiple log blocks based on semantic vectors and a pre-built log template tree. The log template tree is a pre-established log classification structure, where different nodes correspond to different categories of log patterns. Each log block has already obtained its corresponding semantic vector in step S12. This embodiment uses this semantic vector as the matching basis and compares it with the pre-defined representative vectors of each node in the log template tree. The representative vectors can be, but are not limited to, the node semantic center vectors calculated from historical log samples, or vector representations obtained by encoding a semantic model after manually setting template descriptions.

[0027] During the matching process, similarity can be calculated between the semantic vector and the representative vectors of multiple candidate nodes in the log template tree. The similarity calculation method can be, but is not limited to, cosine similarity, Euclidean distance, or dot product. For each log block, this embodiment determines the position of the most matching node based on the calculated similarity value. If the similarity between the representative vector and the semantic vector of a node reaches a preset matching condition, then that node is determined as the target node corresponding to the log block. This embodiment does not limit the specific similarity algorithm; it only requires that the corresponding category node be located in the log template tree based on the semantic vector.

[0028] Once matching is complete, the node position of the log block in the log template tree is determined, and a corresponding tree node state vector is generated. The tree node state vector characterizes the category features of the log block within the predefined log classification system corresponding to the log template tree. In practice, the identifier of the target node can be encoded as a fixed-length numerical vector, for example, using node numbers, or a structural code can be generated based on the node's hierarchical position in the template tree. This embodiment emphasizes mapping continuous semantic vectors to discrete category representations through the matching process, enabling the log block to obtain a clear classification identifier.

[0029] In some specific embodiments, if the semantic vector does not match any existing nodes in the log template tree, this embodiment can temporarily classify the log block into a preset unknown category node and record its semantic vector for subsequent processing. Regardless of the specific implementation method, the purpose of this step is to locate nodes in the log template tree based on the semantic vector and convert the matching result into a tree node state vector, so that the log block has a structured category feature representation in the classification system.

[0030] S14: Input the composite vector into the value function model to obtain the corresponding value score. The value score represents the probability of the target system experiencing anomalies. The composite vector includes the tree node state vector, the system performance vector, and the semantic vector.

[0031] This embodiment inputs a composite vector into the value function model to obtain the corresponding value score. The composite vector includes a tree node state vector, a system performance vector, and a semantic vector, representing the same log block from three dimensions: log category features, operational indicator features, and textual semantic features, respectively. This embodiment concatenates or combines these three vectors in a preset order to form a fixed-dimensional composite vector. The combination method can be, but is not limited to, direct vector concatenation, linear transformation followed by concatenation, or unified mapping through an embedding layer, as long as it ultimately generates a numerical representation for input to the value function model.

[0032] The value function model is used to output a value score based on the state described by the composite vector. In this embodiment, the value function model can be, but is not limited to, a neural network-based regression model, whose input is a composite vector and whose output is a value score in continuous numerical form. This value score is used to characterize the probability or risk level of an anomaly occurring in the target system. For example, when the composite vector reflects that a certain log block belongs to the anomaly category and the system performance indicators show abnormal fluctuations within the corresponding time period, the value function model may output a lower or higher anomaly tendency value score; when the composite vector corresponds to the normal category and the operating indicators are stable, it outputs a relatively higher or lower risk value score.

[0033] In a practical implementation, the composite vector can be input into a pre-trained value function model for forward computation to obtain a value score. This computation can be performed on a single server or in a hardware environment that supports parallel computing. This embodiment does not limit the specific network structure of the value function model; for example, it can use a multi-layer fully connected network, a convolutional structure, or other model structures suitable for processing vector inputs, as long as it can output the corresponding value score based on the composite vector.

[0034] Through the steps described above, this embodiment transforms the multidimensional feature representation corresponding to log blocks into numerical value scores. These value scores directly characterize the probability of an anomaly occurring in the target system, providing a basis for subsequent judgments based on value changes.

[0035] The following is combined Figure 2 The log template tree provided in the embodiments of this application will be described.

[0036] In one exemplary embodiment, the log template tree is a multi-level tree structure, and the nodes of the log template tree are used to represent different levels of log types; wherein, the root node of the log template tree includes at least one first-level child node for classifying the domain or service to which the log belongs, and the first-level child node includes at least one second-level child node for classifying specific error types or templates.

[0037] The log template tree uses a multi-level tree structure to organize log type information. The root node of the log template tree corresponds to the original log block, used to represent log inputs that have not yet been categorized. This embodiment initially divides logs according to their domain or service by setting multiple first-level child nodes under the root node. For example, first-level child nodes may include categories such as Database, Network, Application, Hard Disk, Operating System (OS), Security, and Unknown. Different categories correspond to different functional modules or operating environments, allowing log blocks to be classified at a higher level before further subdivision.

[0038] Below the first-level child nodes, this embodiment sets up second-level child nodes to classify specific error types or template categories. For example, under the network category, a connection timeout can be set; under the hard disk category, an input / output error or disk full can be set; and under the application category, a null pointer can be set. The second-level child nodes correspond to more clearly defined error types, reflecting the specific exception patterns involved in the log block. Through this hierarchical division, this embodiment allows the log classification process to unfold gradually from coarse to fine, with each level of node undertaking classification responsibilities at different granularities.

[0039] In some specific embodiments, the log template tree can be further configured with third-level child nodes to represent more specific template forms. For example, under the I / O Error category, Disk I / O Failed can be set as a specific template. Furthermore, in the Database category, under the second-level child node, DB Connection pool exhausted can be set as a specific template. The third-level child nodes can correspond to recurring typical patterns in historical logs, and their content can be, but is not limited to, manually compiled or derived from historical data. In addition, this embodiment can also set Unknown or NewPattern type nodes at each level to accommodate log blocks that cannot be temporarily categorized into existing categories.

[0040] Through the aforementioned multi-level tree structure, this embodiment enables the log template tree to form a classification system similar to a knowledge graph, with clear hierarchical and semantic relationships between different nodes. The position of a log block in this tree structure not only indicates its domain but also reflects its error type and specific pattern.

[0041] In one exemplary embodiment, multiple log blocks are matched based on semantic vectors and a pre-built log template tree to determine the tree node state vector corresponding to the log block, including: Based on semantic vectors, similarity retrieval is performed on multiple first-level child nodes in the log template tree to determine candidate first-level child nodes; Under the candidate first-level child nodes, the semantic vector is compared with the representative vectors of multiple second-level child nodes based on similarity. If the similarity between the semantic vector and the representative vector exceeds a preset threshold, the corresponding second-level child node is determined as the target node for log block matching, and a tree node state vector is generated based on the identifier of the target node.

[0042] This embodiment matches multiple log blocks based on semantic vectors and a pre-built log template tree, aiming to locate the target node level by level according to the hierarchical structure of the log template tree. The log blocks have already undergone vectorization in previous steps, yielding corresponding semantic vectors. This embodiment first performs similarity retrieval among multiple first-level child nodes of the log template tree. First-level child nodes typically correspond to different domains or service categories, such as Network, Database, and Application. By calculating the similarity value between the semantic vector and the representative vector of each first-level child node, this embodiment selects the first-level child node with the highest similarity as a candidate branch, completing the first-level routing.

[0043] After identifying the candidate first-level child nodes, this embodiment continues with a second-level matching process under that branch. Specifically, the semantic vector of the log block is compared with the representative vectors of multiple second-level child nodes under the first-level child node for similarity. Second-level child nodes typically correspond to specific error types or template categories. Similarity calculation methods can include, but are not limited to, cosine similarity, vector dot product, or distance metrics. When the similarity between the semantic vector and the representative vector of a certain second-level child node exceeds a preset threshold, this embodiment determines that second-level child node as the target node for log block matching. This preset threshold can be set according to the historical sample distribution, for example, 0.8 or other values ​​suitable for the current data distribution.

[0044] During the matching process, if a second-level child node does not reach a preset threshold, this embodiment can continue to compare it with other second-level child nodes under the same first-level child node until the similarity retrieval of all candidate nodes is completed. Through this step-by-step traversal method, this embodiment locates the log block to a specific level node in the log template tree. After determining the target node, this embodiment generates a tree node state vector based on the node's identifier, which is used to characterize the category features of the log block in the log classification system.

[0045] In some implementations, to improve matching efficiency, this embodiment can use vector retrieval to quickly filter candidate branches in the first-level child node matching stage, and combine language models for auxiliary judgment in the second-level or lower-level node matching stage. That is, after obtaining preliminary results from the embedding similarity calculation, the language model is used to semantically compare the candidate node descriptions with the log block content to confirm the matching results. The above method can be, but is not limited to, one of the specific implementation methods.

[0046] In one exemplary embodiment, it further includes: If the similarity between the semantic vector and the representative vector of the first-level child node is lower than the first preset threshold, it is determined that no candidate first-level child node is matched, and a new first-level child node is created in the log template tree, and the new first-level child node is determined as the target node for log block matching. If the similarity between the semantic vector and the representative vector of the candidate first-level child node exceeds the first preset threshold, and the similarity between the semantic vector and the representative vectors of the candidate first-level child node and the second-level child node is lower than the second preset threshold, then it is determined that no second-level child node is matched, a new second-level child node is created under the first-level child node, and the new second-level child node is determined as the target node for log block matching.

[0047] In this embodiment, when the semantic vector cannot form a valid match with any existing node in the log template tree, the log template tree is dynamically expanded. Specifically, if the similarity between the semantic vector and all first-level child nodes is lower than a first preset threshold, this embodiment determines that the current log block does not belong to any existing domain or service category. In this case, this embodiment creates a new first-level child node under the root node of the log template tree and identifies this new first-level child node as the target node for log block matching. This processing method is suitable for situations where entirely new categories of logs appear, such as log content generated by adding a new service module or a new business type.

[0048] In another scenario, the semantic vector's similarity to a certain first-level child node exceeds a first preset threshold, but under that first-level child node, the similarity to all second-level child nodes is below a second preset threshold. This embodiment classifies this situation as having a known domain but an unknown specific error type. In this case, this embodiment creates a new second-level child node under the corresponding first-level child node and identifies the new second-level child node as the target node for log block matching. By distinguishing between matching failures at different levels, this embodiment makes the expansion of the log template tree hierarchically targeted, rather than simply categorizing them all into unknown categories.

[0049] In some implementations, when the similarity between all template child nodes under a certain branch and the log block is lower than a preset threshold, such as less than 0.6, this embodiment can temporarily classify the log block as an unknown node and trigger the unknown node generation process. In this process, this embodiment calls a preset language model to input the log block and corresponding prompt words into the model for analysis. The prompt words can, but are not limited to, indicate that the language model determines that the log block does not belong to any existing template in the current log template tree and generates a new template description that can summarize the characteristics of the log block.

[0050] After generating a new node description, this embodiment adds the description as new node content to the log template tree, forming a new first-level or second-level child node. Once the new node is created, subsequent similar log blocks can be compared and matched with this new node during the traversal of the log template tree. This embodiment, through the above method, enables the log template tree to continuously evolve during operation, adapting to changes in log patterns rather than being limited to a pre-defined fixed template set.

[0051] In one exemplary embodiment, creating a new first-level child node or a new second-level child node includes: The preset language model is invoked to analyze the log block and its prompt words, and a new node description is generated. The prompt words are used to instruct the preset language model to analyze why the log block does not belong to any existing node in the log template tree, and to summarize and generate a new node description that summarizes the log block. Based on the new node description, a corresponding new node is created in the log template tree; the new node is either a new first-level child node or a new second-level child node.

[0052] In this embodiment, when it is determined that a new first-level child node or a new second-level child node needs to be created, a preset language model is invoked to perform semantic analysis on the log block and generate a new node description. Specifically, this embodiment inputs the log block content and corresponding prompt words into the preset language model, enabling the language model to understand the relationship between the current log block and the existing log template tree structure within a given context. The prompt words contain information about the current branch and examples of existing child nodes, allowing the language model to make judgments within a limited scope, rather than generating a description in a completely open context.

[0053] In this embodiment, the prompt words are used to instruct the preset language model to complete two tasks: first, to determine whether a log block belongs to any existing child node under the current branch; and second, if it does not belong to any existing child node, to summarize and generate a new node description. For example, if child nodes such as Query Syntax Error, ConnectionTimeout, and Authentication Error already exist under the Database branch, this embodiment provides these known templates as context to the language model. The language model first compares and judges the log block. If it believes that it can be classified into an existing template, it returns the corresponding node identifier; if no match can be found, it outputs a new and concise template description to summarize the common characteristics of this type of log.

[0054] After generating a new node description, this embodiment creates a corresponding new node in the log template tree based on that description. The new node can be created, but is not limited to, under the current first-level child node as a new second-level child node; if no match is found at a higher level, a new first-level child node can also be created. The node's identifier information, description text, and representative vector can be generated during creation or calculated subsequently. This embodiment enables the log template tree to automatically expand when faced with unknown log patterns, rather than relying solely on manually predefined templates.

[0055] The key point of this embodiment is to use prompt words to constrain the output range of the language model, making it judge and generate text around the structure of the log template tree, rather than performing generalized text generation. By inputting log blocks and prompt words into a preset language model and creating new nodes based on the model output, this embodiment realizes the dynamic supplementation and updating of the log template tree during operation, enabling subsequent similar log blocks to be identified and located in the tree structure.

[0056] In summary, the operational flow of the value function model after integrating the prompt word template tree can be described as follows in this embodiment: 1. Log Processing: The target system generates log data. In this embodiment, log blocks are extracted from the log data within a preset time unit for subsequent analysis. 2. Log Template Tree Traversal: The log blocks are vectorized to obtain corresponding semantic vectors. Based on the semantic vectors, similarity retrieval and traversal are performed in the pre-constructed log template tree to match the log blocks to the corresponding tree nodes and determine their corresponding node identifiers. 3. State Construction: Based on the text content of the log blocks, a semantic embedding model is used to generate semantic vectors. After the semantic vectors are input into the log template tree for matching, the identifier information of the matching nodes is obtained, and the node identifiers are converted into tree node state vectors. According to the time period corresponding to the log blocks, system operation indicator data is obtained through the performance monitoring program and organized to generate system performance vectors. Finally, the semantic vectors, tree node state vectors, and system performance vectors are combined to form a composite vector St=[semantic vector, tree node state vector, system performance vector], which is used to input the value function model for value evaluation.

[0057] In this embodiment, the composite vector St consists of a semantic vector, a tree node state vector, and a system performance vector, with each vector undertaking different types of feature representation functions.

[0058] Vsemantic is the semantic vector. This semantic vector is obtained by extracting features from the current log block using a pre-defined semantic embedding model. The semantic embedding model can be, but is not limited to, an embedding model based on a large language model, or a word embedding model such as BERT family (bidirectional encoder family) or BAAI bge-m3 (multilingual embedding model). In specific implementation, the log text block is input into the embedding model, and the corresponding feature vector is output. The vector dimension can be 768-dimensional, 1536-dimensional, or other dimensions depending on the model. This semantic vector is used to represent the natural language semantic features of the log block, making logs with similar semantics close in the vector space. For example, "Network unreachable" and "Connection timed out" have high similarity in the vector space and can be judged as log types with similar semantics.

[0059] Vtree is a tree node state vector used to represent the structural position of a log block within the log template tree. When a log block is traversed through the log template tree and matched to a certain child node, this embodiment converts the node's identifier information into a vector form. The encoding method can be, but is not limited to, One-hot Encoding or Node Embedding. For example, if there are 100 template nodes defined in the log template tree, and the current log block matches node number 23, then Vtree is a vector of length 100, where the 23rd bit is 1 and the remaining bits are 0. Through this structured encoding method, the category to which the log block belongs can be expressed in a clear discrete state form. Compared with semantic vectors, this vector has a clearer category indication function.

[0060] Vmetric is a system performance vector used to represent the operational environment characteristics of a log block within a given time period. In this embodiment, when generating the status, not only the log text itself is considered, but also the environmental data at the time the log was generated. The system performance vector can include frequency characteristics, system metric characteristics, and time characteristics. For example, it counts the number of times this type of log occurs in the past 1 or 5 minutes and performs standardization; it obtains metrics such as CPU Loading, Memory Usage, and Disk I / O at the time the log occurred; it records whether it occurred during peak business hours and the time interval since the last occurrence of a different type of error. These characteristics can be generated after processing the logs and monitoring data using a preset program.

[0061] Finally, Vsemantic, Vtree, and Vmetric are combined to form a composite vector St = [Vsemantic, Vtree, Vmetric]. Here, the semantic vector provides textual semantic information, the tree node state vector provides structural category information, and the system performance vector provides environmental context information. The hierarchical structure of the prompt word template tree ensures that log blocks have completed category localization before entering the state construction stage, reducing repetitive reasoning and making the generated tree node state vectors more stable. These three types of vectors together constitute the state representation used for subsequent value assessment.

[0062] It's important to understand that this embodiment incorporates the tree node state vector corresponding to the log template tree as part of a composite vector into the state representation of the value function model. The core of this approach is to change the way the state is expressed. While using only semantic vectors as state input can preserve the semantic information of the log text, this vector belongs to a high-dimensional continuous space representation, making it difficult to directly reflect the causal relationship between log categories and anomalies. This embodiment introduces tree node state vectors, making the structural position of log blocks in the log template tree explicit state information. For example, when a log block matches Node_52 (Networktimeout) or Node_57 (SSD I / O Error), the model receives not just an abstract semantic vector, but a clear category identifier, enabling it to analyze the correlation between this type of error and subsequent anomalies in conjunction with the system performance vector.

[0063] It's also important to understand that, regarding stability, this embodiment uses a log template tree to structurally categorize the original logs, making the state representation more robust to noise. For logs that differ only in numerical fields but are essentially the same, such as I / O error logs from different sector numbers, direct semantic vectorization might still produce subtle differences in the high-dimensional embedding space, causing the value function model to treat them as different states. This embodiment maps these logs uniformly to the same tree node state vector, allowing the model to focus on the error category itself, rather than numerical fluctuations that don't affect operational decisions. In this way, the value function model outputs more consistently when faced with input disturbances, reducing parameter fluctuations introduced by irrelevant features.

[0064] During the training phase, this embodiment uses a log template tree to aggregate states. The original log text constitutes an approximately infinite state space, while the log template tree maps it to a finite number of discrete nodes. For example, when the log template tree contains a preset number of anomalous type nodes, the set of states that reinforcement learning needs to learn is limited to this finite set. The value function model only needs to learn the trend of value score changes corresponding to the state vectors of different tree nodes, without having to repeatedly explore in a high-dimensional continuous text space. This approach allows the model to form a stable value judgment for the corresponding node after a clear negative reward situation occurs.

[0065] In anomaly attribution analysis, this embodiment also enhances interpretability through tree node state vectors. When an anomaly occurs in the system, the historical state sequence can be represented as a series of tree node states, such as [Normal, Normal, Node_57, Crash]. The model can directly identify key nodes before the anomaly occurs and update the value function parameters corresponding to those nodes. Compared to dimensional analysis of high-dimensional semantic vectors, this embodiment presents the anomaly causal path in a structured manner, facilitating analysis and adjustment.

[0066] Overall, this embodiment uses a semantic embedding model and a log template tree to perceive and classify log blocks, transforming the results into tree node state vectors. The value function model then performs value assessment and action decisions based on these composite vectors. Through this state construction method, the value function model revolves around structured states during both training and actual operation, resulting in a clearer behavioral logic in terms of stability, convergence speed, and anomaly attribution analysis.

[0067] The following is combined Figure 3 The execution steps of a reinforcement learning agent are explained.

[0068] In one exemplary embodiment, the value function model includes a first value function and a second value function; The first value function is used to evaluate the first value score corresponding to the state described by the composite vector; the second value function is used to evaluate the second value score that can be obtained by performing a specific operation and maintenance action in the state described by the composite vector.

[0069] In this embodiment, the value function model includes a first value function and a second value function. The first value function is used to evaluate the state described by the composite vector and outputs a corresponding first value score. This first value score represents the probability or risk level of the target system experiencing anomalies in the current state. This embodiment transforms the traditional supervised learning-based anomaly classification problem into a state-value evaluation problem, that is, it no longer only judges whether the current log block is abnormal, but evaluates the degree of influence of the current state on future anomaly outcomes.

[0070] In this embodiment, the value function model can be trained using a reinforcement learning framework. The first value function can correspond to the state value function V(s), used to evaluate the expected return of the current state itself; the second value function can correspond to the action value function Q(s,a), used to evaluate the expected return that may be obtained by performing a specific operation and maintenance action in the current state. In the server operation and maintenance scenario, this expected return can be understood as a score of the future system health. Through this modeling approach, this embodiment abstracts the log analysis problem into a state evolution problem, making the value score reflect future risk trends, rather than just a static judgment at the current moment.

[0071] In practical operation, the input to the value function model is a composite vector, which consists of a semantic vector, a tree node state vector, and a system performance vector. This composite vector is the state space representation in reinforcement learning. This embodiment addresses an environment that generates log data at high frequency, with log volumes ranging from, but not limited to, several Tera bytes per day. Therefore, before inputting the data into the value function model, the log data needs to be organized and structured, converting the raw logs into a composite vector usable for state representation. The prompt word template tree serves as the structured representation of the logs, enabling log blocks to be transformed into explicit tree node state vectors, which, together with the semantic vector and the system performance vector, constitute the state representation.

[0072] In applying the second value function, this embodiment can also evaluate the value of different operational actions. For example, under the same composite vector describing a state, the second value score corresponding to different actions such as restarting services, releasing resources, or adjusting configurations can be evaluated, and based on this, it can be determined which action is more beneficial to the future health of the system in the current state. This embodiment combines log analysis, state construction, and value evaluation, enabling the value function model to be calculated around a unified state expression during both the training and usage phases.

[0073] In an exemplary embodiment, the action space A corresponding to the value function model is used to define the operational actions that can be performed under the state described by the current composite vector. The action space may include, but is not limited to, the following action types: No-operation (no processing); Alert (issuing an anomaly alert); Execution tool query (e.g., calling a preset operational tool for log retrieval or status detection); Restarting system services (e.g., performing a restart operation on an anomaly-related service); Shutting down a software service (e.g., taking a specific module offline before the anomaly spreads). The above actions are merely exemplary definitions; in actual deployment, the action set can be expanded or tailored according to the operational strategy of the target system. For example, it may also include actions such as automatically expanding resources, switching to standby nodes, clearing cached data, or adjusting parameter configurations. The specific content of action space A may be determined by preset rules set by the user, or summarized and organized based on historical operational data. By incorporating these actions into a unified action space representation, the second value function can evaluate the second value score corresponding to different actions under a given state described by the composite vector.

[0074] In one exemplary embodiment, it further includes: Compare the value score of the current log block with the historical value score, and calculate the change in the value score; If the change in value score is negative and its absolute value exceeds the preset alarm threshold, an abnormal risk is determined and an alarm is triggered. The composite vector is input into the pre-trained second value function to calculate the second value score that can be obtained by performing different operation and maintenance actions. Select the operation and maintenance action with the highest second value score as the action to be executed, and execute the action to be executed.

[0075] In this embodiment, after a log block is processed to obtain a composite vector, this composite vector is input into the value function model to obtain the corresponding value score. The value score can be output by the first value function and is used to represent the degree of risk of future anomalies in the target system under the current state. In this embodiment, when processing multiple log blocks consecutively, historical value scores are recorded, and the value score corresponding to the current log block is compared with the historical value scores to calculate the change in value score. This change reflects the change in the system risk trend, rather than just the absolute value at a single point in time.

[0076] When the change in value score is negative and its absolute value exceeds a preset alarm threshold, this embodiment determines that the current state has an abnormal risk. A negative change in value score can, but is not limited to, indicate a decrease in the expected value of the system's future health; when consecutive negative changes occur, or when a single significant decrease occurs, this embodiment triggers an alarm. At this time, the composite vector is not only used for abnormal risk judgment, but is also input into a pre-trained second value function to evaluate the second value score that can be obtained by performing different maintenance actions in the current state.

[0077] The second value function corresponds to the action value function Q(s,a), whose input is the current composite vector and different candidate maintenance actions, and whose output is the second value score corresponding to each action. In this embodiment, the second value score is calculated for each of the multiple candidate actions, and the maintenance action with the highest value is selected as the action to be executed. For example, in the event of a decline in health, actions such as querying tools, restarting system services, or shutting down specific software services can be selected. The action selection is based on the magnitude of the second value score, rather than a fixed rule.

[0078] In the overall operation process, the composite vector St = [semantic vector, tree node state vector, system performance vector] is used to calculate a reward score through a value function model. This reward score can be regarded as the increment of system health. In this embodiment, the reward score can be continuously accumulated to form a health index. When the reward score drops sharply or becomes continuously negative, the health shows a clear downward trend. This embodiment triggers an action decision process based on the change in health, enabling the action module to select the corresponding operation and maintenance action in the current state, thereby completing the anomaly response process based on value assessment.

[0079] In one exemplary embodiment, after determining that an abnormal risk exists and triggering an alarm, the method further includes: Receive categorized feedback on triggered alarms, including false alarms and valid alarms; The classification feedback is converted into a reward signal, which is then used to adjust the model parameters of the value function model online.

[0080] In this embodiment, after an abnormal risk is detected and an alarm is triggered, a classification feedback for the triggered alarm is also received. This classification feedback can come from manual annotations by operations and maintenance personnel on the user interface, or from the automatic judgment results of external professional software. The classification results include two types: false alarms and correct alarms. In this embodiment, this classification feedback is used as the basis for subsequent model adjustments, rather than simply being saved as statistical information.

[0081] In its implementation, this embodiment converts the aforementioned classification feedback into reward signals. For example, when an alarm is determined to be a valid alarm, a positive reward score, such as +30, can be assigned; when an alarm is determined to be a false alarm, a negative reward score, such as -30, can be assigned. The value of the reward score can be, but is not limited to, set according to actual business needs. Subsequently, this reward signal is used to adjust the model parameters of the value function model online, making the value function model more closely aligned with actual operational judgment standards in subsequent evaluations. In this way, this embodiment enables the value function model to gradually learn the evaluation logic of operational personnel or professional software regarding the severity of anomalies.

[0082] Within the reinforcement learning framework, regardless of whether a state-based first value function or a state-and-action-based second value function is used, the input is the state represented by a composite vector. Since this composite vector includes semantic vectors, directly using high-dimensional raw semantic embeddings for training may result in a large state space dimension and sparse sample distribution, thus affecting the model's convergence process. In practical operation, situations may arise where value scores lack interpretability, making it difficult for operations personnel to understand the reason for a particular reward score.

[0083] To address the above issues, this embodiment introduces a log template tree to structurally represent log blocks. The position of a log block within the log template tree is transformed into a tree node state vector, which, together with the semantic vector and system performance vector, forms a composite vector. In this way, the state representation no longer relies solely on high-dimensional semantic embedding but incorporates structured category information. This embodiment gives the state space clear category indication. During online adjustment, the reward signal acts not only on semantic features but also on the structural information represented by the tree node state vector, enabling the model to update parameters by combining textual semantics and structural categories.

[0084] In one exemplary embodiment, the training process of the value function model includes: Collect historical log data and corresponding historical system performance vectors to form historical trajectory data; In historical trajectory data, negative rewards are marked for time points where abnormal events occur, and positive rewards are marked for time points where normal operation is performed, thus generating a labeled training dataset. Using the training dataset, an offline reinforcement learning algorithm is used for iterative training to obtain the value function model.

[0085] In this embodiment, the value function model is trained based on historical log data. First, log data generated by the target system during its historical operation is collected, and combined with the historical system performance vectors for the corresponding time periods, forming historical trajectory data arranged in chronological order. The historical trajectory data can be divided into multiple continuous state sequences according to time windows, and the state at each moment can be represented by both semantically relevant features and system performance features. In this way, this embodiment integrates the original logs and operational metrics into a time-series data structure that can be used for reinforcement learning modeling.

[0086] After obtaining historical trajectory data, the time points where abnormal events occurred are labeled. Specifically, when abnormal events such as system crashes, service interruptions, or severe performance degradation occur in the historical records, the corresponding time points can be labeled as negative rewards; during periods when the system is running normally, they are labeled as positive rewards. The reward values ​​can be set in a graded manner according to the severity of the abnormality, for example, major abnormalities are given larger negative values, and minor abnormalities are given smaller negative values. Through the above labeling method, this embodiment transforms historical operation results into reward signals in reinforcement learning.

[0087] After generating the labeled training dataset, an offline reinforcement learning algorithm is used to iteratively train the value function model. Offline reinforcement learning refers to updating parameters directly using historical trajectory data without interacting with the real-time environment. This embodiment may, but is not limited to, using a value function approximation method for training, such as performing multiple iterations on the first or second value function to gradually converge the model parameters to a stable state. During training, the model learns the expected reward estimate for different states based on the relationship between states and corresponding rewards.

[0088] Once training is complete, a value function model for practical deployment is obtained. This model can output a corresponding value score after receiving a state described by a composite input vector. This embodiment combines historical trajectory data with reward annotations, enabling the value function model to assess abnormal risk trends before deployment, without relying on real-time trial and error.

[0089] This section provides an overall explanation of the value function model. The core idea is to transform the problem of anomaly classification based on single log entries in related technologies into a state-based future risk assessment problem. Specifically, the state St is constructed using the log sequence of the past N minutes and the corresponding system performance indicators for that time period. The state can be represented as a composite vector containing log window information and performance indicator information. Under this state, the value function model outputs a value score, representing the expected degree to which the system will maintain normal operation over a future period. When the system is running stably, the value score remains at a high level; when critical error logs or dangerous log combinations occur, the value score drops significantly. By monitoring the change in value score ΔV(St) between adjacent time points, anomaly risk trends can be identified, rather than being limited to single-point anomaly detection.

[0090] In terms of reinforcement learning structure, this application clearly distinguishes between states, actions, rewards, and state transitions. States are jointly determined by the log window and system performance metrics; actions can include inaction, issuing alerts, or performing maintenance operations; the reward function characterizes the effect of the behavior, for example, a small positive reward is given for normal operation, a larger negative reward for failing to provide early warning of major faults, and a positive reward for successfully providing early warnings or successfully handling problems. State transitions are determined by the actual server operating environment. In real-world scenarios, since extensive trial-and-error training in a production environment is not feasible, an offline reinforcement learning approach is adopted, training the value function model based on historical log trajectories.

[0091] During the offline training phase, a historical dataset is constructed by collecting event trajectories containing the causes and consequences of anomalies and normal operating trajectories. Anomaly time points are labeled with negative rewards, while normal operating time periods are labeled with positive rewards. Subsequently, an offline reinforcement learning algorithm is used to iteratively fit the value function model. This can be either a state-based value function V(St) or a value function Q(s,a) that considers both states and actions. During training, historical states and their corresponding rewards are repeatedly fitted, allowing the model to learn which state patterns lead to anomalous results. For scenarios where rewards are generated solely based on states, V(St) can be trained directly; for data including action records, the Q(s,a) model can be trained to simultaneously evaluate the effects of actions.

[0092] Furthermore, this application proposes online fine-tuning incorporating external feedback. Once the value function model is online and running, if an alarm is triggered, operations personnel or external professional software can determine whether the alarm is a false alarm or a valid alarm. This determination result is converted into a reward signal, used to adjust the value function model online, gradually bringing the model closer to the actual business judgment logic. Through a combination of offline training and online feedback, the value function model continuously learns while ensuring deployability.

[0093] To address the convergence difficulties and insufficient interpretability issues arising from directly using high-dimensional semantic vectors as state input, this application further introduces a log template tree, mapping log blocks to tree node state vectors, which, together with semantic vectors and system performance vectors, form a composite vector. This structured state representation compresses the originally nearly infinite text state space into a finite, discrete set of categories, enabling the value function model to be computed based on interpretable structured states during both training and inference phases. Ultimately, this results in a log analysis method that combines log semantic understanding, structured classification, and reinforcement learning value assessment.

[0094] Furthermore, in another exemplary embodiment, hierarchical state modeling with time decay weights can be introduced. When constructing the composite vector, log blocks and system performance vectors at different time scales are weighted hierarchically to enhance the ability to characterize the abnormal evolution process.

[0095] The composite vector St is mainly formed by combining the semantic vector within the current time window, the tree node state vector, and the system performance vector. This method can already express the current state, but for scenarios where anomalies gradually accumulate, slowly deteriorate, or fluctuate in stages, its temporal dynamic information is still relatively implicit. To address this, time decay can be introduced when constructing the composite vector to perform hierarchical weighted integration of the states from multiple past time windows.

[0096] Specifically, this can be implemented, but is not limited to, as follows: Represent the states within the most recent T time units as {St-T+1,…,St}, and assign a time weight coefficient αk to each historical state, where states closer to the current time have a larger weight, and states farther away have a smaller weight. The weighting function can be an exponential decay function, a linear decay function, or a piecewise constant function. Then, the semantic vector, the tree node state vector, and the system performance vector are weighted, accumulated, or concatenated to form an enhanced composite vector containing time evolution information.

[0097] In practical applications, for example, a Node_57 (SSD I / O Error) might occur three times consecutively within a short period, with the intervals between each occurrence gradually shortening, while the Disk Queue Length in the system performance vector gradually increases. After time-decay weighting, the value function model can identify the trend of accelerating error frequency and deteriorating indicators, rather than evaluating based solely on the instantaneous state at a single point in time. Thus, the first value score evaluated by the value function model will reflect trend risk more comprehensively than just current instantaneous risk. This embodiment enhances the value function model's ability to model progressive anomalies while maintaining the advantages of structured state representation. Compared to using only a single time window state, this embodiment can more accurately distinguish between sporadic errors and persistent risk accumulation, improving the foresight of anomaly prediction and enhancing the smoothness and stability of the value score change curve.

[0098] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0099] Embodiments of this application also provide a log analysis apparatus, including: The log acquisition module is used to acquire log data generated by the target system, divide the log data into blocks, and obtain multiple log blocks. The vector acquisition module is used to acquire the system performance vector and semantic vector corresponding to the log block. The system performance vector represents the system operation index characteristics of the log block for the corresponding time period, and the semantic vector represents the semantic characteristics of the log block. The matching module is used to match multiple log blocks based on semantic vectors and a pre-built log template tree to determine the tree node state vector corresponding to the log block; the tree node state vector represents the category features of the log block in the log classification system corresponding to the pre-built log template tree; The decision module is used to input the composite vector into the value function model to obtain the corresponding value score. The value score represents the probability that the target system will experience an anomaly. The composite vector includes the tree node state vector, the system performance vector, and the semantic vector.

[0100] In one exemplary embodiment, the log template tree is a multi-level tree structure, and the nodes of the log template tree are used to represent different levels of log types; wherein, the root node of the log template tree includes at least one first-level child node for classifying the domain or service to which the log belongs, and the first-level child node includes at least one second-level child node for classifying specific error types or templates.

[0101] In one exemplary embodiment, the matching module includes: The first retrieval module is used to perform similarity retrieval among multiple first-level child nodes of the log template tree based on semantic vectors to determine candidate first-level child nodes; The second retrieval module is used to compare the similarity between the semantic vector and the representative vectors of multiple second-level child nodes under the candidate first-level child nodes; The matching determination module is used to determine the corresponding second-level child node as the target node for log block matching if the similarity between the semantic vector and the representative vector exceeds a preset threshold, and to generate a tree node state vector based on the identifier of the target node.

[0102] In one exemplary embodiment, a node expansion module is further included, for: If the similarity between the semantic vector and the first-level child node is lower than the first preset threshold, it is determined that no candidate first-level child node is matched, and a new first-level child node is created in the log template tree, and the new first-level child node is determined as the target node for log block matching. If the similarity between the semantic vector and the candidate first-level child node exceeds the first preset threshold, but the similarity between the candidate first-level child node and the second-level child node is lower than the second preset threshold, then it is determined that no second-level child node is matched, a new second-level child node is created under the first-level child node, and the new second-level child node is determined as the target node for log block matching.

[0103] In one exemplary embodiment, the node creation module is configured to: The preset language model is invoked to analyze the log block and its prompt words, and a new node description is generated. The prompt words are used to instruct the preset language model to analyze why the log block does not belong to any existing node in the log template tree, and to summarize and generate a new node description that summarizes the log block. Based on the new node description, create a corresponding new node in the log template tree.

[0104] In one exemplary embodiment, the value function model includes a first value function and a second value function; The first value function is used to evaluate the first value score corresponding to the state described by the composite vector; the second value function is used to evaluate the second value score that can be obtained by performing a specific operation and maintenance action in the state described by the composite vector.

[0105] In one exemplary embodiment, it further includes: The comparison module is used to compare the value score of the current log block with the historical value score and calculate the change in value score. The action judgment module is used to determine that there is an abnormal risk if the change in value score is negative and its absolute value exceeds the preset alarm threshold, and to trigger an alarm. The composite vector is input into the pre-trained second value function to calculate the second value score that can be obtained by performing different operation and maintenance actions. The action execution module is used to select the operation and maintenance action with the highest second value score as the action to be executed, and then execute the action to be executed.

[0106] In one exemplary embodiment, it further includes: The adjustment module receives classification feedback on triggered alarms, including false alarms and correct alarms; it converts the classification feedback into reward signals and uses the reward signals to adjust the model parameters of the value function model online.

[0107] In one exemplary embodiment, the model training module is used to collect historical log data and corresponding historical system performance vectors to form historical trajectory data; in the historical trajectory data, negative rewards are marked for time points where abnormal events occur, and positive rewards are marked for time points where normal operation occurs, generating a labeled training dataset; using the training dataset, an offline reinforcement learning algorithm is used for iterative training to obtain a value function model.

[0108] For a description of the features in the embodiment corresponding to the log analysis device, please refer to the relevant description of the embodiment corresponding to the log analysis method, which will not be repeated here.

[0109] like Figure 4 Embodiments of this application also provide an electronic device, including a memory 101 and a processor 102, wherein the memory 101 stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above-described log analysis method embodiments.

[0110] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described log analysis method embodiments at runtime.

[0111] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0112] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described log analysis method embodiments.

[0113] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described log analysis method embodiments.

[0114] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0115] The log analysis method and electronic device provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to help understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A log analysis method, characterized in that, include: Obtain log data generated by the target system, and divide the log data into blocks to obtain multiple log blocks; Obtain the system performance vector and semantic vector corresponding to the log block. The system performance vector represents the system operation index characteristics of the time period corresponding to the log block, and the semantic vector represents the semantic characteristics of the log block. The pre-built log template tree is a multi-level tree structure, and the nodes of the log template tree are used to represent log types at different levels; wherein, the root node of the log template tree includes at least one first-level child node for classifying the domain or service to which the log belongs, and the first-level child node includes at least one second-level child node for classifying specific error types or templates. Based on the semantic vector and the pre-constructed log template tree, multiple log blocks are matched to determine the tree node state vector corresponding to the log block, including: Based on the semantic vector, similarity retrieval is performed on multiple first-level child nodes in the log template tree to determine candidate first-level child nodes; Under the candidate first-level child node, the semantic vector is compared with the representative vectors of multiple second-level child nodes for similarity. If the similarity between the semantic vector and the representative vector exceeds a preset threshold, the corresponding second-level child node is determined as the target node for matching the log block, and the tree node state vector is generated based on the identifier of the target node. The composite vector is input into the value function model to obtain the corresponding value score, which represents the expected degree of normal operation of the target system in the future. The composite vector includes the tree node state vector, the system efficiency vector, and the semantic vector. The tree node state vector represents the category characteristics of the log block in the log classification system corresponding to the pre-constructed log template tree. Compare the current value score and the historical value score corresponding to the log block, and calculate the change in the current value score relative to the historical value score; If the change is negative and its absolute value exceeds the preset alarm threshold, an abnormal risk is determined to exist, and an alarm is triggered.

2. The log analysis method according to claim 1, characterized in that, Also includes: If the similarity between the semantic vector and the representative vector of the first-level child node is lower than the first preset threshold, it is determined that no candidate first-level child node is matched, and a new first-level child node is created in the log template tree, and the new first-level child node is determined as the target node for matching the log block. If the similarity between the semantic vector and the representative vector of the candidate first-level child node exceeds the first preset threshold, and the similarity between the semantic vector and the representative vectors of the candidate first-level child node and the second-level child node is lower than the second preset threshold, then it is determined that no second-level child node is matched, a new second-level child node is created under the first-level child node, and the new second-level child node is determined as the target node for matching the log block.

3. The log analysis method according to claim 2, characterized in that, Create new first-level child nodes or new second-level child nodes, including: A preset language model is invoked to analyze the log block and the prompt words of the log block, and a new node description is generated; the prompt words are used to instruct the preset language model to analyze why the log block does not belong to any existing node in the log template tree, and to summarize and generate a new node description that summarizes the log block; Based on the new node description, a corresponding new node is created in the log template tree; the new node is either the new first-level child node or the new second-level child node.

4. The log analysis method according to claim 1, characterized in that, The value function model includes a first value function and a second value function; Wherein, the first value function is used to evaluate the first value score corresponding to the state described by the composite vector; the second value function is used to evaluate the second value score that can be obtained by performing different candidate operation and maintenance actions in the state described by the composite vector.

5. The log analysis method according to claim 4, characterized in that, After determining that there is an abnormal risk and triggering an alarm, the process also includes: The composite vector is input into a pre-trained second value function to calculate the second value score that can be obtained by performing different operation and maintenance actions; Select the maintenance action with the highest second value score as the action to be executed, and execute the action to be executed.

6. The log analysis method according to claim 5, characterized in that, After determining that an abnormal risk exists and triggering an alarm, the following steps are also included: Receive categorization feedback for triggered alarms, including false alarms or correct alarms; The classification feedback is converted into a reward signal, and the model parameters of the value function model are adjusted online using the reward signal.

7. The log analysis method according to any one of claims 1-6, characterized in that, The training process of the value function model includes: Collect historical log data and corresponding historical system performance vectors to form historical trajectory data; In the historical trajectory data, negative rewards are marked for time points where abnormal events occur, and positive rewards are marked for time points where normal operation occurs, thus generating a labeled training dataset; Using the training dataset, the value function model is obtained through iterative training using an offline reinforcement learning algorithm.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the log analysis method as described in any one of claims 1 to 7 when executing the computer program.

Images