Log error mode early warning method, device and equipment and storage medium

Abstract

This application discloses a log error pattern early warning method, apparatus, device, and storage medium, relating to the field of anomaly early warning technology. The disclosed log error pattern early warning method includes: acquiring current log data; determining multiple error pattern categories based on the current log data; determining the error pattern frequency and error pattern frequency growth rate corresponding to the multiple error pattern categories within the current time window to obtain current error pattern data; determining early warning thresholds corresponding to the multiple error pattern categories based on historical error frequency data to obtain current early warning threshold data; and performing log error pattern early warning based on the current error pattern data and the current early warning threshold data. This solution can improve the accuracy of early warnings for high-frequency log anomalies in Linux systems.

Description

Technical Field

[0001] This application relates to the field of anomaly warning technology, and in particular to log error mode warning methods, devices, equipment and storage media. Background Technology

[0002] Currently, monitoring and analysis of Linux system logs primarily rely on commercial or open-source log management tools such as the ELK (Elasticsearch, Logstash, Kibana) suite, Splunk, and Zabbix. These tools typically employ keyword matching, regular expression filtering, and fixed threshold alerts to retrieve and detect anomalies in the logs. For example, operations and maintenance personnel may need to predefine error rules containing specific keywords, triggering alerts when matching content appears in the logs; or they may set static frequency thresholds based on historical experience, issuing warnings when these thresholds are exceeded.

[0003] However, relying on manual configuration of keywords and rules cannot automatically identify new error patterns. When the Linux system environment or application version changes, operations and maintenance personnel need to frequently adjust the rules manually. Static thresholds or simple rules for alerting cannot adapt to the dynamic fluctuations in the Linux system's operating status, easily leading to missed or false alarms. Therefore, improving the accuracy of Linux systems' early warnings for high-frequency log anomalies has become an unresolved issue.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a log error mode early warning method, device, equipment and storage medium, which aims to solve the technical problem of how to improve the accuracy of early warning of high-frequency log anomalies in Linux systems.

[0006] To achieve the above objectives, this application proposes a log error mode early warning method, which includes: Get the current log data; Multiple error mode categories are determined based on the current log data; Determine the error mode frequency and error mode frequency growth rate corresponding to the multiple error mode categories within the current time window to obtain the current error mode data; Based on historical error frequency data, the warning thresholds corresponding to the multiple error mode categories are determined to obtain the current warning threshold data; Log error mode warnings are issued based on the current error mode data and the current warning threshold data.

[0007] In one embodiment, the step of determining the warning thresholds corresponding to the multiple error mode categories based on historical error frequency data to obtain the current warning threshold data includes: Obtain the preset error frequency growth rate threshold corresponding to the multiple error mode categories to obtain the first warning threshold data; Based on historical error frequency data and preset threshold coefficients, the real-time error frequency warning thresholds corresponding to the multiple error mode categories are determined to obtain the second warning threshold data. The current warning threshold data is obtained based on the first warning threshold data and the second warning threshold data.

[0008] In one embodiment, the step of determining the real-time error frequency warning threshold corresponding to the multiple error mode categories based on historical error frequency data and preset threshold coefficients to obtain the second warning threshold data includes: Obtain the error frequency corresponding to the multiple error mode categories within multiple consecutive historical time windows to obtain historical error frequency data; Based on the historical error frequency data, the mean error frequency corresponding to the multiple error mode categories is determined to obtain the mean error frequency data; Based on the average error frequency data and the preset threshold coefficient, the real-time error frequency warning threshold corresponding to the multiple error mode categories is determined to obtain the second warning threshold data.

[0009] In one embodiment, the current warning threshold data includes a preset error frequency growth rate threshold and a real-time error frequency warning threshold corresponding to the plurality of error mode categories; The step of issuing log error mode warnings based on the current error mode data and the current warning threshold data includes: When the frequency of the error mode exceeds a preset error frequency growth rate threshold corresponding to the error mode category, a log error mode warning is issued; or When the rate of increase of the error mode frequency exceeds the real-time error frequency warning threshold corresponding to the error mode category, a log error mode warning is issued.

[0010] In one embodiment, the step of determining multiple error mode categories based on the current log data includes: Extract a numerical vector based on the current log data; Multiple error mode categories are determined based on the numerical vector.

[0011] In one embodiment, the step of determining multiple error mode categories based on the numerical vector includes: The numerical vectors are clustered based on the clustering parameters to obtain the current clustering result. Based on the current clustering result, the current log data is labeled with the corresponding error pattern identifier to obtain multiple error pattern categories; After the step of labeling the current log data with error pattern identifiers based on the multiple current clustering labels to obtain multiple error pattern categories, the method further includes: Obtain the current warning record generated based on the multiple error pattern categories, and determine the updated historical data based on the current log data, the current error pattern data, the current clustering result, and the current warning record; Based on the updated historical data, the clustering parameters, the preset error frequency growth rate threshold, and the preset threshold coefficient are adjusted to provide log error pattern warnings for the updated current log data.

[0012] In one embodiment, the step of extracting a numerical vector based on the current log data includes: Remove timestamps, Internet Protocol addresses, and process identifiers from the current log data to obtain a cleaned log; Keyword extraction was performed on the cleaning logs to obtain keywords; Convert the keywords into numerical vectors.

[0013] Furthermore, to achieve the above objectives, this application also proposes a log error mode early warning device, which includes: The data acquisition module is used to acquire the current log data; The data processing module is used to determine multiple error mode categories based on the current log data; The data processing module is also used to determine the error mode frequency and error mode frequency growth rate corresponding to the multiple error mode categories within the current time window, and to obtain the current error mode data; The threshold determination module is used to determine the warning thresholds corresponding to the multiple error mode categories based on historical error frequency data, and to obtain the current warning threshold data. The error warning module is used to provide log error mode warnings based on the current error mode data and the current warning threshold data.

[0014] In addition, to achieve the above objectives, this application also proposes a log error mode early warning device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the log error mode early warning method as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the log error mode warning method described above.

[0016] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the log error mode warning method described above.

[0017] One or more technical solutions proposed in this application have at least the following technical effects: By acquiring current log data and classifying it into multiple error mode categories, different types of operational anomalies can be accurately distinguished. Current error mode data is generated by statistically analyzing the frequency and growth rate of error modes within the current time window, which can quantitatively reflect the recent occurrence and changing trends of each anomaly. The corresponding warning threshold is determined based on historical error frequency data to obtain the current warning threshold data, which allows the warning standard to align with the long-term patterns of anomalies, reducing misjudgments. Warning operations based on these two types of data can promptly identify and issue warnings for high-frequency, sudden increases in error modes, reducing manual analysis costs, improving the accuracy and timeliness of log anomaly warnings, and adapting to resource-constrained operating scenarios. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating an embodiment of the log error mode early warning method of this application. Figure 2 This is a flowchart illustrating Embodiment 2 of the log error mode early warning method of this application. Figure 3 A simplified flowchart illustrating the log error mode early warning method provided in Embodiment 2 of this application; Figure 4 This is a schematic diagram of the module structure of the log error mode early warning device according to an embodiment of this application; Figure 5This is a schematic diagram of the device structure of the hardware operating environment involved in the log error mode early warning method in the embodiments of this application.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0024] The main solution of this application embodiment is: to obtain current log data; to determine multiple error mode categories based on the current log data; to determine the error mode frequency and error mode frequency growth rate corresponding to the multiple error mode categories within the current time window, and obtain current error mode data; to determine the warning threshold corresponding to the multiple error mode categories based on historical error frequency data, and obtain current warning threshold data; and to perform log error mode warning based on the current error mode data and the current warning threshold data.

[0025] Monitoring and analysis of Linux system logs primarily rely on commercial or open-source log management tools such as the ELK (Elasticsearch, Logstash, Kibana) suite, Splunk, and Zabbix. These tools typically employ methods like keyword matching, regular expression filtering, and fixed threshold alerts to retrieve and detect anomalies in the logs. For example, operations personnel may need to predefine error rules containing specific keywords, triggering alerts when matching content appears in the logs; or they may set static frequency thresholds based on historical experience, issuing warnings when these thresholds are exceeded.

[0026] However, relying on manually configured keywords and rules cannot automatically identify new error patterns. When the Linux system environment or application version changes, operations and maintenance personnel need to frequently adjust the rules manually. Static thresholds or simple rules for alerting cannot adapt to the dynamic fluctuations in the Linux system's operating status, easily leading to missed or false alarms. Furthermore, systems like ELK and Splunk are complex to deploy, consume high resources, and are difficult to deploy on resource-constrained edge nodes. Therefore, improving the accuracy of Linux systems' early warnings for high-frequency log anomalies has become an unresolved issue.

[0027] This application provides a solution that, by acquiring current log data and classifying it into multiple error mode categories, can accurately distinguish different types of operational anomalies. It generates current error mode data by statistically analyzing the frequency and growth rate of error modes within the current time window, quantifying the recent occurrence and trends of each anomaly. Based on historical error frequency data, it determines the corresponding warning threshold to obtain the current warning threshold data, ensuring that the warning standard aligns with the long-term patterns of anomalies and reducing misjudgments. By conducting warning operations based on these two types of data, it can promptly identify and issue warnings for frequently increasing error modes, reducing manual analysis costs, improving the accuracy and timeliness of log anomaly warnings, and adapting to resource-constrained operational scenarios.

[0028] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or log error mode early warning device capable of performing the above functions. The following description uses a log error mode early warning device as an example to illustrate this embodiment and the subsequent embodiments.

[0029] Based on this, embodiments of this application provide a log error mode early warning method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the log error mode early warning method of this application.

[0030] In this embodiment, the log error mode early warning method includes steps S10 to S50: Step S10: Obtain the current log data; It should be noted that the current log data refers to the collection of log-related information generated and collected in real time during the recent operation of the Linux system, including system running status logs, program running feedback logs, and various exception feedback logs.

[0031] It should be understood that the current log data obtained from the corresponding log storage location of the Linux system through preset data collection methods such as reading log files or connecting to log service interfaces is in the form of raw strings without structure processing.

[0032] Step S20: Determine multiple error mode categories based on the current log data; It should be noted that error mode categories refer to categories formed by dividing log data with similar semantic content that reflect the same type of operational anomalies. Each error mode category corresponds to a type of device operational anomaly. For example, disk input / output anomalies, network timeout anomalies, and memory allocation failure anomalies are different error mode categories.

[0033] It should be understood that the current log data is first cleaned to remove irrelevant information, then the key semantic features in the log are extracted and transformed into feature vectors. The feature vectors are then classified and calculated using a preset clustering algorithm to divide the log data into multiple groups with similar semantics. Each group corresponds to an error pattern category, thereby determining multiple error pattern categories.

[0034] In one feasible implementation, step S20 may include steps S21-S22: Step S21: Extract a numerical vector based on the current log data; It should be noted that the numerical vector is an ordered sequence of numerical values ​​obtained after converting log text information. This sequence quantifies the core semantic features of the log, facilitating subsequent calculation and classification using algorithms. Each numerical dimension in the numerical vector corresponds to a key semantic piece of information in the log. The numerical vectors for different log texts differ, and the degree of difference reflects the differences in the semantic content of the logs.

[0035] It should be understood that the current log data is first cleaned to remove non-semantic information such as timestamps, IP addresses, and process IDs. Then, core keywords in the log are extracted using algorithms such as Term Frequency-Inverse Document Frequency (TF-IDF) and TextRank. The extracted keywords are then converted into standardized numerical forms and combined to generate a numerical vector with uniform dimensions, thus completing the extraction operation from the original log text to a numerical vector.

[0036] In one feasible implementation, step S21 may include steps S211 to S213: Step S211: Remove the timestamp, Internet Protocol address, and process identifier from the current log data to obtain the cleaned log; It should be noted that the timestamp is an identifier that records the specific time the log was generated, including year, month, day, hour, minute, second, etc. This information is only used to identify the time the log was generated and does not carry the semantics of operational anomalies reflected in the log.

[0037] In addition, Internet Protocol (IP) addresses are digital identifiers used to identify the location of devices in a network. They are often recorded in logs as address information related to device communication, which is irrelevant to the error patterns reflected in the logs and is considered irrelevant and redundant information.

[0038] Additionally, the Process Identifier (PID) is a unique numerical designation assigned by the operating system to a running process to distinguish different running processes. This information only relates to process identity and does not reflect the core semantics of the log. Cleaned logs are the pure log text obtained after removing all non-semantically irrelevant information. Cleaned logs retain only the core content that reflects the device's operating status and anomaly types.

[0039] It should be understood that the process involves traversing each log entry in the current log data, identifying and removing three types of irrelevant information: timestamps, Internet protocol addresses, and process identifiers. During the removal process, the core semantic content describing the device's operating status and abnormal phenomena in the log text is fully preserved. After processing, all log entries with irrelevant information removed are summarized to form a cleaned log with a uniform format and no redundant information.

[0040] Step S212: Extract keywords from the cleaning log to obtain keywords; It should be noted that keywords are core words extracted from cleaning logs that can accurately represent the core semantics of the logs and reflect the types of abnormal device operation. Keywords have semantic representativeness and can be associated with specific error patterns such as disk anomalies, network failures, and memory problems. One or more keywords can be extracted from a single cleaning log. The quality of keyword extraction determines the accuracy of subsequent numerical vectors.

[0041] It should be understood that by calling preset keyword extraction algorithms, such as TF-IDF and TextRank, semantic analysis is performed on the text content in the cleaning logs, key indicators such as word frequency and semantic weight are statistically analyzed, words with weight values ​​higher than preset standards are selected as core words, and corresponding keywords are extracted from each cleaning log to complete the keyword extraction operation.

[0042] Step S213: Convert the keywords into numerical vectors.

[0043] It should be noted that the numerical vector is an ordered sequence of numerical values ​​obtained by mapping keywords in text form. Each dimension of the numerical vector corresponds to the semantic weight or occurrence feature of a keyword. Different keyword combinations correspond to different numerical vectors, which can be used by clustering algorithms for similarity calculation.

[0044] It should be understood that by adopting preset feature vectorization processing rules, the extracted text-based keywords are mapped to standardized numerical values. The numerical values ​​corresponding to each keyword are arranged in a unified dimensional order to ensure that the numerical vectors generated from all logs have the same dimension, so as to avoid the impact of dimensional differences on subsequent clustering processing, thus completing the transformation from keywords to numerical vectors and outputting numerical vectors that can be used for clustering analysis.

[0045] In this implementation, a clean log is obtained by removing three types of irrelevant information from the current log data. This process eliminates redundant information interference and focuses on the core semantic content of the log. Keywords are then extracted from the clean log to accurately extract the core semantic words that represent error patterns, reducing the impact of invalid text content on subsequent analysis. The keywords are then converted into numerical vectors, completing the standardized conversion from text semantics to structured numerical values. This provides semantically accurate input data for subsequent clustering processing, improving the accuracy and stability of subsequent error pattern classification.

[0046] Step S22: Determine multiple error mode categories based on the numerical vector.

[0047] It should be noted that error mode categories are formed by dividing log data with similar semantics and reflecting the same type of operational anomalies. Each error mode category corresponds to a type of Linux system operational anomaly; that is, disk I / O anomalies, network timeout anomalies, and memory allocation failure anomalies are all different error mode categories. Multiple error mode categories are sets of categories corresponding to two or more different operational anomalies divided from the set of numerical vectors. The category division results determine the accuracy of subsequent anomaly analysis.

[0048] It should be understood that by using pre-defined clustering algorithms such as K-means and DBSCAN, similarity calculations and classifications are performed on all extracted numerical vectors. Numerical vectors with similarity higher than a preset threshold are grouped into the same group. Each group of numerical vectors corresponds to an error pattern category. Multiple different error pattern categories are determined through multiple classification results, thus realizing the division from numerical vectors to error pattern categories.

[0049] In one feasible implementation, step S22 may include steps S221 to S222: Step S221: Perform clustering processing on the numerical vector based on the clustering parameters to obtain the current clustering result; It should be noted that clustering parameters are a set of configuration information used to guide the clustering algorithm in completing the classification operation. These parameters include configuration items such as the number of clusters, distance metric, and neighborhood radius. Clustering parameters affect the classification accuracy, efficiency, and stability of the clustering process. Setting clustering parameters in conjunction with the semantic distribution characteristics of log data can adapt to the numerical vector distribution patterns corresponding to different error modes, thus avoiding overfitting or underfitting problems in the classification results.

[0050] In addition, the current clustering result is a set of numerical vector grouping information generated after the clustering process. The current clustering result clearly divides the numerical vector groups with similar semantic features. Each group corresponds to a core semantic of the log and serves as the basis for labeling error patterns.

[0051] It should be understood that the pre-configured clustering parameters are retrieved, and all extracted numerical vectors are input into the clustering algorithm as processing objects. The semantic similarity between each numerical vector is calculated one by one according to the rules set by the clustering parameters. Based on the similarity, the numerical vectors are divided into multiple different vector groups, and the current clustering result containing detailed information on the division of each vector group is generated, thus completing the clustering processing of the numerical vectors.

[0052] Step S222: Based on the current clustering result, label the current log data with the corresponding error pattern identifier to obtain multiple error pattern categories.

[0053] It should be noted that error mode identifiers are special marking information used to uniquely distinguish different error mode categories. Error mode identifiers can be numbers, characters, or text labels. Each error mode identifier corresponds to a type of device malfunction and can quickly identify the malfunction category to which a single log belongs.

[0054] It should be understood that by reading the core semantic features corresponding to each numerical vector group in the current clustering result, grouping the current log data corresponding to the same numerical vector group into the same data group, assigning a unique error mode identifier to each group of log data, completing the one-to-one binding of log data and error mode identifier, and forming multiple error mode categories that correspond to different types of runtime exceptions.

[0055] In one feasible implementation, steps S223-S224 may be included after S222: Step S223: Obtain the current warning record generated based on the multiple error mode categories, and determine the updated historical data based on the current log data, the current error mode data, the current clustering result, and the current warning record; It should be noted that the current warning record is a complete collection of record information generated after executing the log error mode warning for multiple error mode categories. It includes the warning trigger time, the corresponding error mode category, the reason for the warning trigger, the warning notification method, and the warning processing status, which can comprehensively reflect the execution process and results of the warning operation.

[0056] In addition, the updated historical data is the latest set of historical information formed by integrating the current log data, current error pattern data, current clustering results and current warning records. The updated historical data will supplement the latest log collection, feature analysis, clustering classification and warning feedback information, replace the old version of historical data, and provide a comprehensive and real-time reference for subsequent parameter adjustments.

[0057] It should be understood that the current warning record generated after warnings are issued for multiple error pattern categories is retrieved. At the same time, the current log data obtained in the previous period, the current error pattern data generated by statistics, and the current clustering results output by clustering processing are integrated. The current warning record, current log data, current error pattern data, and current clustering results are summarized, organized and stored according to data type and time sequence to generate updated historical data containing the latest log analysis process information.

[0058] Step S224: Adjust the clustering parameters, preset error frequency growth rate threshold, and preset threshold coefficient based on the updated historical data to provide log error pattern warnings for the updated current log data.

[0059] It should be noted that the preset error frequency growth rate threshold is a pre-set critical value used to determine whether the error mode frequency growth rate exceeds the normal range, and is used to distinguish between normal small frequency fluctuations and abnormal rapid frequency increases.

[0060] In addition, the preset threshold coefficient is a pre-set proportional value used to calculate the warning threshold. The preset threshold coefficient, combined with the historical average error frequency, can determine the warning threshold corresponding to different error mode categories, and can adapt to the frequency fluctuation characteristics of different error mode categories.

[0061] In addition, the updated current log data is the current log data newly collected after the updated historical data is generated. The updated current log data is used to verify the validity of the adjusted parameters.

[0062] It should be understood that the process involves retrieving updated historical data and comprehensively analyzing information such as log semantic distribution, clustering quality score, warning trigger frequency, and accuracy. Based on the analysis results, the configuration items in the clustering parameters, such as the number of clusters and distance measurement method, are optimized. At the same time, the preset error frequency growth rate threshold is corrected to adapt to the latest frequency growth pattern, and the preset threshold coefficient is adjusted to improve the calculation accuracy of the warning threshold. Then, using the adjusted clustering parameters, preset error frequency growth rate threshold, and preset threshold coefficient, error pattern analysis, classification, and warning operations are performed on the newly collected and updated current log data to complete parameter adaptive optimization and a new round of log error pattern warnings.

[0063] In this implementation, by integrating multiple types of the latest core data to generate updated historical data, the entire process of log collection, feature extraction, clustering and classification, and early warning feedback can be completely retained, providing a real, comprehensive, and real-time reference for dynamic parameter adjustment. Furthermore, by dynamically optimizing clustering parameters, preset error frequency growth rate thresholds, and preset threshold coefficients based on updated historical data, it can adapt to the dynamic changes in the semantic distribution of log data and the anomaly occurrence patterns, avoiding clustering inaccuracies, false alarms, or missed alarms caused by fixed parameters. This makes subsequent log error pattern warnings more aligned with actual operating scenarios, continuously improving the accuracy of error pattern recognition and early warning accuracy, and enhancing the adaptive optimization capabilities of log error analysis.

[0064] Step S30: Determine the error mode frequency and error mode frequency growth rate corresponding to the multiple error mode categories within the current time window to obtain the current error mode data; It should be noted that the current time window is a pre-defined continuous time interval used for statistical analysis of log error-related data, such as five minutes, one hour, or one day, which can be adjusted according to actual analysis needs.

[0065] Additionally, error mode frequency refers to the total number of times log data corresponding to a certain error mode category appears within the current time window. This value can intuitively reflect the frequency of the corresponding exception type in recent times.

[0066] Additionally, the error mode frequency growth rate refers to the magnitude of change in the error mode frequency of a specific error mode category between consecutive adjacent time windows, used to measure how quickly the frequency of the corresponding anomaly type increases. The current error mode data is a dataset that integrates the error mode frequencies and error mode frequency growth rates corresponding to each error mode category within the current time window.

[0067] It should be understood that, firstly, a current time window of a preset duration is selected, then the number of log occurrences corresponding to each error mode category within the current time window is counted to obtain the error mode frequency, the error mode frequency growth rate is calculated by comparing the error mode frequency of the current time window with that of the previous adjacent time window, and finally the error mode frequency and error mode frequency growth rate corresponding to each error mode category are summarized and integrated to obtain the current error mode data.

[0068] Step S40: Determine the warning thresholds corresponding to the multiple error mode categories based on historical error frequency data to obtain the current warning threshold data; It should be noted that historical error frequency data refers to the aggregated error pattern frequency data for each error mode category within multiple historical time windows of equal length over a relatively long, preset time period. This type of data reflects the long-term frequency patterns of each anomaly type, specifically the error mode frequency data for the same hour each day over the past seven days. The warning threshold is a pre-set critical value used to determine whether a warning is triggered. Each error mode category corresponds to an independent warning threshold, determined by statistical patterns in historical data, used to distinguish between normal frequency fluctuations and abnormal frequency spikes. The current warning threshold data is a dataset formed by integrating the warning thresholds corresponding to multiple error mode categories, providing a unified critical standard for warning judgment.

[0069] It should be understood that the process involves retrieving and classifying historical error frequency data according to error mode categories, then performing statistical analysis on each category of historical error frequency data to obtain the historical average frequency, combining it with preset multiple coefficients or growth rate thresholds, calculating and determining the corresponding warning threshold for each error mode category, and finally summarizing and organizing the warning thresholds for all error mode categories to obtain the current warning threshold data.

[0070] In one feasible implementation, step S40 may include steps S41 to S43: Step S41: Obtain the preset error frequency growth rate threshold corresponding to the multiple error mode categories to obtain the first warning threshold data; It should be noted that the preset error frequency growth rate threshold is a pre-set critical value used to determine whether the rate of increase in error mode frequency is abnormal. The preset error frequency growth rate threshold is determined based on the normal fluctuation range in historical operating data. Each error mode category can correspond to an independent value, used to identify error trends that accelerate abnormally within a short period of time. The first warning threshold data is a dataset formed by integrating the preset error frequency growth rate thresholds corresponding to multiple error mode categories, used to determine whether a warning is triggered from the perspective of growth rate.

[0071] It should be understood that the preset error frequency growth rate thresholds corresponding to each error mode category are retrieved and pre-configured and stored, and the threshold information corresponding to all categories is summarized and organized to form a unified and callable first warning threshold data.

[0072] Step S42: Determine the real-time error frequency warning threshold corresponding to the multiple error mode categories based on historical error frequency data and preset threshold coefficients to obtain the second warning threshold data; It should be noted that historical error frequency data reflects the stable level of the long-term occurrence frequency of various errors and serves as the basis for calculating the baseline threshold. The preset threshold coefficient is used to distinguish between normal fluctuations and abnormally high frequencies, adapting to the fluctuation characteristics of different error modes.

[0073] Additionally, the real-time error frequency warning threshold is a critical value calculated by combining historical patterns and a preset ratio, used to determine whether the current frequency exceeds the normal range. The second warning threshold data is a dataset formed by integrating the real-time error frequency warning thresholds corresponding to multiple error mode categories, used to determine whether a warning is triggered from the perspective of absolute frequency.

[0074] It should be understood that historical error frequency data is retrieved and historical average frequencies are calculated according to error mode categories. Each average frequency is multiplied by a preset threshold coefficient to calculate the real-time error frequency warning threshold corresponding to each error mode category. All threshold information is then aggregated to form the second warning threshold data.

[0075] In one feasible implementation, step S42 may include steps S421 to S423: Step S421: Obtain the error frequency corresponding to the multiple error mode categories within multiple consecutive historical time windows to obtain historical error frequency data; It should be noted that a continuous historical time window refers to a time interval of multiple identical time periods that are sequentially connected within a preset period of time in the past. For example, if a single time window is preset to 1 hour, multiple continuous historical time windows can be the past 8 hours.

[0076] In addition, error frequency refers to the total number of log entries corresponding to a certain error mode category within a single time window, which can be quantitatively reflected to show the frequency of occurrence of this type of anomaly within a specific period.

[0077] In addition, historical error frequency data is a dataset that integrates the error frequencies corresponding to each error mode category in multiple consecutive historical time windows, containing long-term time-series information on the frequency of anomalies.

[0078] It should be understood that the total duration of continuous historical time windows and the duration of individual windows are preset. All continuous historical time windows are traversed, and the number of log occurrences corresponding to each error mode category in each window is counted to obtain the corresponding error frequency. The error frequencies of all windows and all categories are sorted and summarized by category and time sequence, and outliers are removed to form historical error frequency data.

[0079] Step S422: Determine the average error frequency corresponding to the multiple error mode categories based on the historical error frequency data to obtain the average error frequency data; It should be noted that the mean error frequency refers to the arithmetic mean of the error frequencies corresponding to a certain error pattern category across all consecutive historical time windows. The mean error frequency reflects a stable baseline level of the long-term occurrence frequency of this type of anomaly, thus avoiding the influence of short-term random fluctuations on the baseline judgment. The mean error frequency data is a dataset formed by integrating the mean error frequencies corresponding to multiple error pattern categories, providing a baseline value for each error pattern category.

[0080] It should be understood that the historical error frequency data is grouped according to error mode categories, the error frequencies corresponding to multiple consecutive historical time windows contained in each group are summed, and then divided by the total number of historical time windows in that group to obtain the mean error frequency for each error mode category. The mean information corresponding to all categories is then summarized to form the mean error frequency data.

[0081] Step S423: Based on the average error frequency data and the preset threshold coefficient, determine the real-time error frequency warning threshold corresponding to the multiple error mode categories to obtain the second warning threshold data.

[0082] It should be noted that the preset threshold coefficient is set according to the tolerance and fluctuation characteristics of different error mode categories. For example, the preset threshold coefficient of a certain error mode category can be set to 2, which means that if the current frequency reaches twice the historical average, it will be judged as abnormal.

[0083] In addition, the real-time error frequency warning threshold is obtained by multiplying the average error frequency by a preset threshold coefficient, which can adapt to the long-term patterns of various anomalies and accurately determine whether the current frequency exceeds the normal range.

[0084] It should be understood that the average value of each error mode category in the error frequency mean data is retrieved, the pre-configured preset threshold coefficient is retrieved, the average error frequency of each category is multiplied by the preset threshold coefficient one by one, the real-time error frequency warning threshold corresponding to each error mode category is calculated, all threshold information is summarized and stored by category to form the second warning threshold data.

[0085] In this embodiment, historical error frequency data is obtained by acquiring the error frequency within a continuous historical time window. The mean error frequency data is obtained by calculating the mean error frequency based on the historical data, which can eliminate short-term fluctuation interference and establish a stable frequency benchmark for various anomalies. The second warning threshold data is obtained by combining the mean data with a preset threshold coefficient to calculate the real-time warning threshold. This allows the threshold to conform to the long-term abnormal pattern, accurately distinguish between normal fluctuations and abnormal high frequencies, provide an objective and reliable frequency judgment standard for log error warnings, reduce the false alarm rate caused by static thresholds, and improve the accuracy of warning judgments.

[0086] Step S43: Obtain the current warning threshold data based on the first warning threshold data and the second warning threshold data.

[0087] It should be noted that the current warning threshold data covers both frequency magnitude and rate of change. The first warning threshold data is used to judge errors that are slowly increasing, while the second warning threshold data is used to judge cases of instantaneous spikes without continuous growth. This can avoid misjudgment or omission due to a single dimension of judgment and provide a comprehensive and reliable basis for judgment on log error pattern warnings.

[0088] It should be understood that the preset error frequency growth rate threshold corresponding to each error mode category in the first warning threshold data is matched and integrated with the real-time error frequency warning threshold of the corresponding category in the second warning threshold data. Two types of critical values ​​are configured for each error mode category to generate the corresponding current warning threshold data.

[0089] Step S50: Issue a log error mode warning based on the current error mode data and the current warning threshold data.

[0090] It should be noted that log error mode warning refers to issuing a prompt message when the frequency-related data of a certain error mode category exceeds the corresponding warning threshold, so as to remind the operation and maintenance personnel to take action. The warning action can promptly report the abnormal operation of the equipment and prevent the abnormality from continuing to worsen and affecting the normal operation of the equipment.

[0091] It should be understood that the error mode frequency and its growth rate for each error mode category in the current error mode data are compared one by one with the corresponding warning threshold in the current warning threshold data. When the error mode frequency or growth rate for a certain error mode category exceeds the corresponding warning threshold, the anomaly is determined to be a high-frequency surge anomaly, and a preset warning method is triggered to send a warning notification, completing the log error mode warning operation. When triggering a log error mode warning, one or more methods can be selected from email, SMS, and Webhook interface to send the warning notification according to the operation and maintenance needs, promptly pushing the anomaly information to the operation and maintenance personnel and adapting to the warning delivery needs in different scenarios.

[0092] This embodiment provides a log error pattern early warning method. By acquiring current log data and dividing it into multiple error pattern categories, it can accurately distinguish different types of operational anomalies. By statistically analyzing the frequency and growth rate of error patterns within the current time window to form current error pattern data, it can quantitatively reflect the recent occurrence and changing trends of each anomaly. Based on historical error frequency data, it determines the corresponding early warning threshold to obtain the current early warning threshold data, allowing the early warning standard to conform to the long-term pattern of anomalies, reducing misjudgments. Based on these two types of data, early warning operations can be carried out in a timely manner to identify high-frequency sudden increases in error patterns and issue early warnings, reducing manual analysis costs, improving the accuracy and timeliness of log anomaly early warnings, and adapting to resource-constrained operating scenarios.

[0093] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 The current warning threshold data includes the preset error frequency growth rate threshold and the real-time error frequency warning threshold corresponding to the multiple error mode categories; Step S50 may include steps S51 to S52: Step S51: When the error mode frequency is greater than the preset error frequency growth rate threshold corresponding to the error mode category, a log error mode warning is issued. It should be noted that the preset error frequency growth rate threshold is set based on the range of normal error occurrences in historical operation. Different error mode categories and different time window lengths correspond to different preset error frequency growth rate thresholds, which are used to filter out abnormal types whose frequency exceeds the normal range.

[0094] It should be understood that the target error mode category and the error mode frequency corresponding to the current time window length are extracted from the current error mode data. Then, the preset error frequency growth rate threshold corresponding to the error mode category in the current warning threshold data is retrieved. The extracted error mode frequency is compared with the corresponding preset error frequency growth rate threshold. When the comparison result shows that the error mode frequency is greater than the preset error frequency growth rate threshold, the operation abnormality corresponding to the error mode category is determined to be a frequency abnormality, and the preset warning method is triggered to perform the log error mode warning operation.

[0095] Step S52: When the error mode frequency growth rate is greater than the real-time error frequency warning threshold corresponding to the error mode category, a log error mode warning is issued.

[0096] It should be noted that the error mode frequency growth rate accurately reflects the rate at which the frequency of the corresponding anomaly type is increasing, and is used to identify trends of rapid deterioration of anomalies. The real-time error frequency warning threshold can accurately distinguish between normal, minor frequency fluctuations and a rapid increase in the frequency of anomalies.

[0097] It should be understood that, firstly, the error mode frequency growth rate corresponding to the target error mode category is extracted from the current error mode data. Then, the real-time error frequency warning threshold corresponding to the error mode category in the current warning threshold data is retrieved. The extracted error mode frequency growth rate is compared with the corresponding real-time error frequency warning threshold. When the comparison result shows that the error mode frequency growth rate is greater than the real-time error frequency warning threshold, the operation abnormality corresponding to the error mode category is determined to be an abnormal trend, and the preset warning method is triggered to perform the log error mode warning operation.

[0098] This embodiment provides a log error pattern early warning method. By comparing the error pattern frequency with a preset error frequency growth rate threshold, it can accurately identify operational anomalies whose frequency exceeds the normal range. By comparing the error pattern frequency growth rate with a real-time error frequency early warning threshold, it can promptly capture the deteriorating trend of rapidly increasing anomaly frequency. In this way, both static frequency anomalies and dynamic trend anomalies can be covered, avoiding false alarms or missed alarms, improving the accuracy and timeliness of log error pattern early warning, and helping operation and maintenance personnel to quickly locate and handle operational anomalies, ensuring system stability.

[0099] For example, to help understand the implementation process of the log error mode early warning method obtained by combining this embodiment with the above embodiment one, please refer to... Figure 3 , Figure 3 A simplified flowchart of a log error mode early warning method is provided, specifically: Raw logs are collected, and log data is obtained through the log collection stage. The log cleaning and feature extraction stage completes data cleaning and feature extraction. Error log clustering is used to classify error patterns. Then, the high-frequency error identification and trend analysis stage obtains current error pattern data. At the same time, historical data is input into the model optimization and learning stage. The optimization results generated by the model optimization and learning stage are fed back to the dynamic early warning stage. Dynamic early warning of log error patterns is based on the output of the high-frequency error identification and trend analysis stage.

[0100] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the log error mode early warning method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0101] This application also provides a log error mode early warning device, please refer to... Figure 4 The log error mode early warning device includes: Data acquisition module 10 is used to acquire current log data; Data processing module 20 is used to determine multiple error mode categories based on the current log data; The data processing module 20 is also used to determine the error mode frequency and error mode frequency growth rate corresponding to the multiple error mode categories within the current time window, and to obtain the current error mode data; Threshold determination module 30 is used to determine the warning threshold corresponding to the multiple error mode categories based on historical error frequency data, and obtain the current warning threshold data; Error warning module 40 is used to provide log error mode warnings based on the current error mode data and the current warning threshold data.

[0102] In one embodiment, the threshold determination module 30 is further configured to obtain a preset error frequency growth rate threshold corresponding to the plurality of error mode categories to obtain a first warning threshold data; determine a real-time error frequency warning threshold corresponding to the plurality of error mode categories based on historical error frequency data and a preset threshold coefficient to obtain a second warning threshold data; and obtain a current warning threshold data based on the first warning threshold data and the second warning threshold data.

[0103] In one embodiment, the threshold determination module 30 is further configured to acquire the error frequency corresponding to the multiple error mode categories within multiple consecutive historical time windows to obtain historical error frequency data; determine the average error frequency corresponding to the multiple error mode categories based on the historical error frequency data to obtain average error frequency data; and determine the real-time error frequency warning threshold corresponding to the multiple error mode categories based on the average error frequency data and a preset threshold coefficient to obtain second warning threshold data.

[0104] In one embodiment, the current warning threshold data includes a preset error frequency growth rate threshold and a real-time error frequency warning threshold corresponding to the plurality of error mode categories; The error warning module 40 is also used to issue a log error mode warning when the error mode frequency is greater than the preset error frequency growth rate threshold corresponding to the error mode category; or to issue a log error mode warning when the error mode frequency growth rate is greater than the real-time error frequency warning threshold corresponding to the error mode category.

[0105] In one embodiment, the data processing module 20 is further configured to extract a numerical vector based on the current log data; and determine multiple error mode categories based on the numerical vector.

[0106] In one embodiment, the data processing module 20 is further configured to perform clustering processing on the numerical vector based on clustering parameters to obtain a current clustering result; label the current log data with error pattern identifiers according to the current clustering result to obtain multiple error pattern categories; obtain current warning records generated based on the multiple error pattern categories, and determine updated historical data based on the current log data, the current error pattern data, the current clustering result, and the current warning records; and adjust the clustering parameters, the preset error frequency growth rate threshold, and the preset threshold coefficient based on the updated historical data to provide log error pattern warnings for the updated current log data.

[0107] In one embodiment, the data processing module 20 is further configured to remove timestamps, Internet Protocol addresses, and process identifiers from the current log data to obtain a cleaned log; extract keywords from the cleaned log to obtain keywords; and convert the keywords into numerical vectors.

[0108] The log error pattern early warning device provided in this application, employing the log error pattern early warning method in the above embodiments, can solve the technical problem of how to improve the accuracy of early warning for high-frequency log anomalies in Linux systems. Compared with the prior art, the beneficial effects of the log error pattern early warning device provided in this application are the same as those of the log error pattern early warning method provided in the above embodiments, and other technical features in the log error pattern early warning device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0109] This application provides a log error mode early warning device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the log error mode early warning method in the above embodiment 1.

[0110] The following is for reference. Figure 5 The diagram illustrates a structural schematic suitable for implementing a log error mode early warning device according to embodiments of this application. The log error mode early warning device in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5The log error pattern warning device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0111] like Figure 5 As shown, the log error mode warning device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the log error mode warning device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. Input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touch screens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, LCDs (Liquid Crystal Displays), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the log error mode warning device to communicate wirelessly or wiredly with other devices to exchange data. Although log error mode warning devices with various systems are shown in the figures, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0112] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0113] The log error pattern early warning device provided in this application, employing the log error pattern early warning method in the above embodiments, can solve the technical problem of how to improve the accuracy of early warning for high-frequency log anomalies in Linux systems. Compared with the prior art, the beneficial effects of the log error pattern early warning device provided in this application are the same as those of the log error pattern early warning method provided in the above embodiments, and other technical features in this log error pattern early warning device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0114] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0115] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0116] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the log error mode warning method in the above embodiments.

[0117] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable Read Only Memory), or flash memory, optical fiber, CD-ROM (CD-Read Only Memory), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0118] The aforementioned computer-readable storage medium may be included in the log error mode warning device; or it may exist independently and not be assembled into the log error mode warning device.

[0119] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the log error mode warning device, the log error mode warning device causes the following actions: acquiring current log data; determining multiple error mode categories based on the current log data; determining the error mode frequency and error mode frequency growth rate corresponding to the multiple error mode categories within the current time window to obtain current error mode data; determining the warning threshold corresponding to the multiple error mode categories based on historical error frequency data to obtain current warning threshold data; and performing log error mode warning based on the current error mode data and the current warning threshold data.

[0120] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including LAN (Local Area Network) or WAN (Wide Area Network)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0121] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0122] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0123] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described log error mode early warning method, thereby solving the technical problem of how to improve the accuracy of early warnings for high-frequency log anomalies in Linux systems. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the log error mode early warning method provided in the above embodiments, and will not be repeated here.

[0124] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the log error mode warning method described above.

[0125] The computer program product provided in this application solves the technical problem of how to improve the accuracy of early warning of high-frequency log anomalies in Linux systems. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the log error pattern early warning method provided in the above embodiments, and will not be repeated here.

[0126] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or / indirect applications in other related technical fields are included in the patent protection scope of this application.

Claims

1. A log error mode early warning method, characterized in that, The log error mode early warning method includes: Get the current log data; Multiple error mode categories are determined based on the current log data; Determine the error mode frequency and error mode frequency growth rate corresponding to the multiple error mode categories within the current time window to obtain the current error mode data; Based on historical error frequency data, the warning thresholds corresponding to the multiple error mode categories are determined to obtain the current warning threshold data; Log error mode warnings are issued based on the current error mode data and the current warning threshold data.

2. The method as described in claim 1, characterized in that, The step of determining the warning thresholds corresponding to the multiple error mode categories based on historical error frequency data to obtain the current warning threshold data includes: Obtain the preset error frequency growth rate threshold corresponding to the multiple error mode categories to obtain the first warning threshold data; Based on historical error frequency data and preset threshold coefficients, the real-time error frequency warning thresholds corresponding to the multiple error mode categories are determined to obtain the second warning threshold data. The current warning threshold data is obtained based on the first warning threshold data and the second warning threshold data.

3. The method as described in claim 2, characterized in that, The step of determining the real-time error frequency warning threshold corresponding to the multiple error mode categories based on historical error frequency data and preset threshold coefficients to obtain the second warning threshold data includes: Obtain the error frequency corresponding to the multiple error mode categories within multiple consecutive historical time windows to obtain historical error frequency data; Based on the historical error frequency data, the mean error frequency corresponding to the multiple error mode categories is determined to obtain the mean error frequency data; Based on the average error frequency data and the preset threshold coefficient, the real-time error frequency warning threshold corresponding to the multiple error mode categories is determined to obtain the second warning threshold data.

4. The method as described in claim 1, characterized in that, The current warning threshold data includes the preset error frequency growth rate threshold and the real-time error frequency warning threshold corresponding to the multiple error mode categories; The step of issuing log error mode warnings based on the current error mode data and the current warning threshold data includes: When the frequency of the error mode is greater than the preset error frequency growth rate threshold corresponding to the error mode category, a log error mode warning is issued. or When the rate of increase of the error mode frequency exceeds the real-time error frequency warning threshold corresponding to the error mode category, a log error mode warning is issued.

5. The method as described in claim 1, characterized in that, The step of determining multiple error mode categories based on the current log data includes: Extract a numerical vector based on the current log data; Multiple error mode categories are determined based on the numerical vector.

6. The method as described in claim 5, characterized in that, The step of determining multiple error mode categories based on the numerical vector includes: The numerical vectors are clustered based on the clustering parameters to obtain the current clustering result. Based on the current clustering result, the current log data is labeled with the corresponding error pattern identifier to obtain multiple error pattern categories; After the step of labeling the current log data with error pattern identifiers based on the multiple current clustering labels to obtain multiple error pattern categories, the method further includes: Obtain the current warning record generated based on the multiple error pattern categories, and determine the updated historical data based on the current log data, the current error pattern data, the current clustering result, and the current warning record; Based on the updated historical data, the clustering parameters, the preset error frequency growth rate threshold, and the preset threshold coefficient are adjusted to provide log error pattern warnings for the updated current log data.

7. The method as described in claim 5, characterized in that, The step of extracting a numerical vector based on the current log data includes: Remove timestamps, Internet Protocol addresses, and process identifiers from the current log data to obtain a cleaned log; Keyword extraction was performed on the cleaning logs to obtain keywords; Convert the keywords into numerical vectors.

8. A log error mode early warning device, characterized in that, The device includes: The data acquisition module is used to acquire the current log data; The data processing module is used to determine multiple error mode categories based on the current log data; The data processing module is also used to determine the error mode frequency and error mode frequency growth rate corresponding to the multiple error mode categories within the current time window, and to obtain the current error mode data; The threshold determination module is used to determine the warning thresholds corresponding to the multiple error mode categories based on historical error frequency data, and to obtain the current warning threshold data. The error warning module is used to provide log error mode warnings based on the current error mode data and the current warning threshold data.

9. A log error mode early warning device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the log error mode warning method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the log error mode early warning method as described in any one of claims 1 to 7.

Images