Log analysis method, device, equipment, storage medium and program product

Abstract

Embodiments of the present application provide a log analysis method, device, equipment, storage medium and program product, relating to the field of artificial intelligence. The method comprises: in response to a log analysis instruction, a routing agent determines a log analysis agent corresponding to the log analysis instruction, and sends the log analysis instruction to the log analysis agent; the log analysis agent acquires first log information corresponding to the log analysis instruction, analyzes the first log information, obtains an analysis result, and sends the analysis result to a report compiling agent; and the report compiling agent generates an operation and maintenance report according to the analysis result, realizing intelligent processing of log analysis, improving the generation efficiency of the operation and maintenance report, and enhancing the usability and readability of the operation and maintenance report.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more particularly to a log analysis method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the rapid iteration and upgrading of digital and information systems in the financial industry, various trading systems, service scheduling systems, and operation and maintenance monitoring systems are constantly running. The log data generated during the daily operation of these systems is showing characteristics of massive volume, diversification, and heterogeneity.

[0003] Currently, in the daily operation and maintenance scenarios of financial industry business systems, when users need to obtain operation and maintenance reports, the system typically first filters and selects raw logs using manually defined keyword matching rules or regular expressions, then inputs the filtered log data into log analysis tools for parsing, and generates operation and maintenance reports based on the parsing results and a preset template. However, this implementation method has a low level of intelligence and is difficult to effectively cope with the complexity and variability of log data, resulting in insufficient efficiency and usability in generating operation and maintenance reports. Summary of the Invention

[0004] This application provides a log analysis method, apparatus, device, storage medium, and program product to solve the technical problems in the prior art, which are low in intelligence and difficult to adapt to complex and ever-changing log data due to reliance on manually defined rules and preset templates, resulting in low efficiency and insufficient availability of operation and maintenance reports.

[0005] In a first aspect, embodiments of this application provide a log analysis method, including:

[0006] In response to a log analysis command, the routing agent determines the log analysis agent corresponding to the log analysis command and sends the log analysis command to the log analysis agent.

[0007] The log analysis agent acquires the first log information corresponding to the log analysis instruction, analyzes the first log information to obtain the analysis result, and sends the analysis result to the report compilation agent.

[0008] The report-generating agent generates an operation and maintenance report based on the analysis results.

[0009] In some implementations, the routing agent determines the log analysis agent corresponding to the log analysis command, including:

[0010] The routing agent determines the user's intent based on the log analysis instructions;

[0011] The log analysis agent corresponding to the log analysis command is determined based on the user intent.

[0012] In some embodiments, the method further includes:

[0013] The log analysis agent sends the analysis results to the trend analysis agent;

[0014] The trend analysis agent obtains the first log information corresponding to the analysis result, determines the error trend within a preset time period based on the analysis result and the first log information, and sends the error trend to the report compilation agent;

[0015] The report-generating agent generates the operation and maintenance report based on the analysis results and the error trends.

[0016] In some implementations, the first log information includes tagged time-series metric data.

[0017] In some embodiments, the method further includes:

[0018] The log analysis agent sends the analysis results to the root cause recommendation agent;

[0019] The trend analysis agent sends the erroneous trend to the root cause recommendation agent;

[0020] The root cause recommendation agent generates a recommended solution based on the analysis results and the error trend, and sends the recommended solution to the report compilation agent;

[0021] The report-generating agent generates the operation and maintenance report based on the analysis results, the error trends, and the recommended solutions.

[0022] In some implementations, the root cause recommendation agent generates recommended solutions based on the analysis results and the error trends, including:

[0023] The root cause recommendation agent obtains matching historical knowledge based on the analysis results and the error trends;

[0024] Based on the analysis results, the error trends, and the historical knowledge, the recommended solution is generated.

[0025] In some implementations, the report-generating agent generates the operation and maintenance report based on the analysis results, the error trends, and the recommended solutions, including:

[0026] Obtain the preset operation and maintenance report template;

[0027] The content that matches each part of the analysis results, error trends, and recommended solutions in the operation and maintenance report template is written into the operation and maintenance report template to obtain the operation and maintenance report.

[0028] Secondly, embodiments of this application provide a log analysis apparatus, including:

[0029] The sending module is used to respond to the log analysis command, the routing agent determines the log analysis agent corresponding to the log analysis command, and sends the log analysis command to the log analysis agent;

[0030] The sending module is used for the log analysis agent to obtain first log information corresponding to the log analysis instruction, analyze the first log information to obtain analysis results, and send the analysis results to the report compilation agent.

[0031] The generation module is used by the report-generating agent to generate an operation and maintenance report based on the analysis results.

[0032] In some implementations, the determining module is used by the routing agent to determine the user intent based on the log analysis instructions;

[0033] The module is further configured to determine the log analysis agent corresponding to the log analysis instruction based on the user intent.

[0034] In some implementations, the sending module is used by the log analysis agent to send the analysis results to the trend judgment agent;

[0035] The sending module is further configured to allow the trend analysis agent to obtain first log information corresponding to the analysis result, determine the error trend within a preset time period based on the analysis result and the first log information, and send the error trend to the report compilation agent;

[0036] The generation module is used by the report-generating agent to generate the operation and maintenance report based on the analysis results and the error trends.

[0037] In some implementations, the sending module is used for the log analysis agent to send the analysis results to the root cause recommendation agent;

[0038] The sending module is also used for the trend analysis agent to send the erroneous trend to the root cause recommendation agent;

[0039] The sending module is further configured to generate a recommended solution based on the analysis results and the error trend, and send the recommended solution to the report compilation agent;

[0040] The generation module is used by the report-generating agent to generate the operation and maintenance report based on the analysis results, the error trends, and the recommended solutions.

[0041] In some implementations, the acquisition module is used by the root cause recommendation agent to acquire matching historical knowledge based on the analysis results and the error trends;

[0042] The generation module is used to generate the recommended solution based on the analysis results, the error trend, and the historical knowledge.

[0043] In some implementations, the acquisition module is used to acquire a preset operation and maintenance report template;

[0044] The generation module is used to write the content that matches each part of the analysis results, error trends, and recommended solutions in the operation and maintenance report template into the operation and maintenance report template to obtain the operation and maintenance report.

[0045] Thirdly, embodiments of this application provide an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0046] The memory stores computer-executed instructions;

[0047] The processor executes computer execution instructions stored in the memory to implement the method described in any one of the first aspects.

[0048] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described in any one of the first aspects.

[0049] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method described in any one of the first aspects.

[0050] The log analysis method, apparatus, device, storage medium, and program product provided in this application, in response to log analysis commands, enable targeted allocation of log analysis tasks by having a routing agent determine the corresponding log analysis agent and send the command to it. The log analysis agent then acquires and analyzes the first log information corresponding to the command, obtaining analysis results, which improves the adaptability and accuracy of the log analysis process to specific log content. Furthermore, a report compilation agent generates an operation and maintenance report based on the analysis results, providing structured output of the analysis conclusions and improving the usability and readability of the report. Moreover, the entire process of generating the operation and maintenance report does not require manual pre-setting of log filtering rules, avoiding information loss and rule maintenance costs associated with manual intervention, thus achieving intelligent log analysis and significantly improving the efficiency of operation and maintenance report generation. Attached Figure Description

[0051] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0052] Figure 1 A flowchart illustrating a log analysis method provided in this application embodiment. Figure 1 ;

[0053] Figure 2 A flowchart illustrating a method for determining a log analysis agent provided in an embodiment of this application;

[0054] Figure 3 A flowchart illustrating a log analysis method provided in this application embodiment. Figure 2 ;

[0055] Figure 4 A flowchart illustrating a log analysis method provided in this application embodiment. Figure 3 ;

[0056] Figure 5 This is a schematic diagram of the structure of a log analysis device provided in an embodiment of this application;

[0057] Figure 6 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of this application.

[0058] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0059] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0060] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0061] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0062] It should be noted that the log analysis methods, apparatus, devices, storage media and products provided in this application can be used in the field of big data, or in any field other than big data. The application fields of the log analysis methods, apparatus, devices, storage media and products in this application are not limited.

[0063] In the daily operation and maintenance scenarios of business systems in the financial industry, when users need to obtain operation and maintenance reports, the system usually first filters and selects the raw logs through manually defined keyword matching rules or regular expressions, then inputs the filtered log data into the log analysis tool for parsing, and generates operation and maintenance reports based on the parsing results and according to the preset template.

[0064] However, this implementation method has a low level of intelligence and is difficult to effectively cope with the complexity and variability of log data, resulting in insufficient efficiency and availability in generating operation and maintenance reports.

[0065] To address the aforementioned issues, this application provides a log analysis method. Upon receiving a log analysis instruction, the routing agent first determines the corresponding log analysis agent and sends the instruction to that agent. Then, the log analysis agent acquires the first log information corresponding to the instruction, analyzes it, obtains the analysis results, and sends these results to the report compilation agent. The report compilation agent then generates an operation and maintenance report based on the analysis results. This method establishes a collaborative processing relationship between the routing agent, the log analysis agent, and the report compilation agent through the log analysis instruction. This allows log acquisition, log analysis, and operation and maintenance report generation to be sequentially linked in a unified processing chain. It transforms the analysis process, which originally required manual processing, into a process based on agent-based division of labor, thereby achieving intelligent log analysis and significantly improving the efficiency of operation and maintenance report generation. Furthermore, the agent-based processing reduces human error and information omissions, improving the usability of operation and maintenance reports. This method can be widely applied to scenarios such as transaction anomaly investigation, service failure analysis, operational status verification, and operation and maintenance report generation.

[0066] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0067] The execution subject in this application embodiment can be an electronic device or a log analysis device installed in an electronic device. The electronic device can be a server, etc. The log analysis device can be implemented by software or by a combination of software and hardware. For example, the log analysis device can be a processor in the electronic device. For ease of understanding, the following description will use an electronic device as the execution subject.

[0068] Figure 1 This is a flowchart illustrating a log analysis method provided in an embodiment of this application. Figure 1 As shown, the method includes:

[0069] S101. In response to the log analysis command, the routing agent determines the log analysis agent corresponding to the log analysis command and sends the log analysis command to the log analysis agent.

[0070] Log analysis commands are used to characterize log analysis requests initiated by the user or system. These commands can be entered by operations and maintenance personnel through the operations and maintenance console, or can be automatically generated by the alarm system, scheduled task system, release management system, or fault ticket system.

[0071] Log analysis instructions typically carry constraints related to the analysis task, including but not limited to: time range, business module, service name, node identifier, error type, keywords, task priority, and content requirements. For example, a log analysis instruction could be described as "Analyze the error logs of financial payment transactions on March 29, identify the causes, provide solutions, and predict future trends."

[0072] The routing agent is used to parse the log analysis command after receiving it, so as to extract the constraint information for matching the log analysis agent.

[0073] After parsing the log analysis command, the routing agent determines the log analysis agent corresponding to the current log analysis command based on the pre-established capability description information of each log analysis agent. Log analysis agents can be categorized according to business domain, such as transaction link analysis agents, payment clearing analysis agents, database anomaly analysis agents, and API call failure analysis agents; or according to analysis type, such as error clustering analysis agents, root cause localization analysis agents, or text semantic attribution analysis agents.

[0074] When determining the target log analysis agent, the routing agent can match based on the time range, business module, and error type in the log analysis command. It can also further combine user command priority, historical task execution success rate, current agent load status, and preset task allocation rules to complete the matching. For example, when the log analysis command involves "a large number of duplicate errors in the account management system during a batch window," the routing agent can prioritize selecting the error clustering analysis agent to aggregate and classify the duplicate errors.

[0075] After identifying the appropriate log analysis agent, the routing agent sends the log analysis command to the target log analysis agent. To ensure task traceability, the routing agent can also generate a task identifier, record the sending time, record the command summary, and establish a task status record before sending the log analysis command, which will be used for subsequent exception retries, timeout detection, and report backtracking.

[0076] S102. The log analysis agent obtains the first log information corresponding to the log analysis command, analyzes the first log information, obtains the analysis results, and sends the analysis results to the report compilation agent.

[0077] In this embodiment of the application, after receiving the log analysis instruction sent by the routing agent, the log analysis agent can determine the range of logs to be obtained based on the task information in the instruction, and extract the first log information corresponding to the current log analysis instruction from the knowledge base.

[0078] The first log information serves as input data for the log analysis agent, carrying the log content to be analyzed. It can be raw log records or preprocessed structured log objects, and may also include tagged time-series metrics, error event summaries, call context fragments, or log-related detection metrics. The first log information typically includes at least some fields such as timestamp, business module identifier, service instance identifier, log level, log text, error code, or transaction serial number to support subsequent analysis operations.

[0079] In this embodiment, the first log information includes tagged time-series indicator data. The time-series indicator data can be generated by the log-sharing agent after extracting structured fields from the first log information, and then combined with the collection timestamp, business identifier, and anomaly identifier for storage. This allows the first log information to retain the business meaning of the log content while also having a format conducive to time-series analysis, facilitating efficient classification, retrieval, and correlation analysis of the first log information.

[0080] In one implementation, the log analysis agent can first construct log filtering conditions based on the time range, business module, and error type in the log analysis command, and then initiate a query request to obtain the initial log information. Query methods can include keyword retrieval, field filtering, Boolean combination retrieval, regular expression matching, vector semantic retrieval, or multi-condition joint retrieval.

[0081] For example, when the log analysis command specifies "querying timeout exceptions in payment clearing services between 9:00 and 11:00 on a certain day," the log analysis agent can generate a search statement containing time interval conditions, service name conditions, and error keyword conditions, and extract a set of logs that meet the conditions from the log index as the first log information. If the log analysis command does not explicitly specify the error type, but only provides a description of the business phenomenon, the log analysis agent can also first perform semantic expansion, expanding synonyms such as "transaction failure," "return exception," and "no response" into multiple search terms, and then perform log recall to reduce missed detections due to differences in log expression.

[0082] After acquiring the initial log information, the log analysis agent analyzes it. The analysis process may include log cleaning, time sorting, field extraction, templated merging, frequency statistics, similar log clustering, anomaly tag generation, context association, and semantic interpretation. Log cleaning removes duplicate logs, blank logs, irrelevant debugging logs, and logs with formatting errors. Field extraction identifies error codes, interface names, account number mask fields, transaction stage identifiers, and anomaly reason phrases from unstructured text. Templated merging groups logs that differ only in parameter values ​​but have the same structure into similar patterns to reduce redundancy. Similar log clustering processes logs with similar semantics or triggering links together, facilitating the identification of major anomaly patterns.

[0083] The analysis results represent the output of the log analysis agent after processing the initial log information. They typically include error type, anomaly characteristics, related tags, affected modules, frequency of occurrence, involved service nodes, time distribution, key context, and statistical conclusions. To facilitate subsequent maintenance report generation, the log analysis agent can further transform the analysis results into a unified data structure, such as a result object containing fields like "Anomaly Overview," "Detailed Samples," "Affected Scope," "Time Trend," and "Handling Suggestions," along with task identifiers, data source descriptions, and analysis time.

[0084] S103. The report-generating agent generates an operation and maintenance report based on the analysis results.

[0085] The report compilation agent receives the analysis results output by the log analysis agent and organizes, arranges, and outputs the content of the operation and maintenance report based on the analysis results. The report compilation agent can be deployed in the operation and maintenance portal, intelligent reporting service, fault review platform, or unified operation and maintenance platform, and it can consist of a template engine, text generation module, chart generation module, and report publishing module.

[0086] Operation and maintenance reports are used to present the processing conclusions corresponding to log analysis instructions to operation and maintenance personnel, system administrators, or auditors. Report formats can include web pages, PDF (Portable Document Format) documents, structured work order attachments, daily or weekly report entries. The "report compilation" function in the report compilation agent is not limited to simple text concatenation, but includes processing such as mapping analysis results, content segmentation, chart organization, conclusion extraction, and linking traceability information.

[0087] In one implementation, after receiving the analysis results, the report-generating agent can first verify the completeness of the results, such as checking whether the task identifier, analysis time, anomaly category field, statistical summary field, and evidence citation field are complete. If there are missing fields, the agent can supplement the common information according to preset rules. After the analysis results meet the report generation conditions, the report-generating agent can perform content matching and integration based on a preset report template. The preset report template may include content areas such as a task overview area, log source description area, anomaly statistics area, and impact scope area. The report-generating agent writes the error type, affected module, business context, statistical summary information, and tagged results from the analysis results into the corresponding areas, and generates bar charts, line charts, pie charts, or time series tables based on the statistical values ​​to reflect the frequency of anomalies, error distribution, and time changes. In another implementation, the report-generating agent can also directly organize natural language descriptions based on the field content in the analysis results, thereby forming operation and maintenance reports adapted to different task types.

[0088] For example, if the analysis results indicate that a payment interface experienced a large-scale timeout between 10:15 and 10:40, mainly concentrated on two service nodes, the report-generating agent can generate an "Abstract Overview" in the operation and maintenance report, describing the time range, affected interfaces, and affected nodes of the timeout anomaly; list representative log summaries and corresponding timestamps in the "Evidence Sample" section; describe the business modules involved and the number of failed requests in the "Affected Scope" section; cite root cause clues provided by the log analysis agent in the "Cause Analysis" section, such as thread pool exhaustion, slow downstream service response, or excessively long database connection waiting time; and provide suggestions for scaling up, retrying, rate limiting, or parameter verification in the "Handling Recommendations" section, based on preset knowledge items.

[0089] The generated operation and maintenance report can be stored in a report database, object storage, or document management system, and can be displayed through an operation and maintenance portal, sent via email, or pushed to relevant personnel via instant messaging. To meet the auditability requirements of the financial industry, the report-generating agent can also record task numbers, data time ranges, analysis execution times, data source locations, and associated log indexes in the report for subsequent traceability and review.

[0090] The log analysis method provided in this application, in response to a log analysis command, involves a routing agent determining the corresponding log analysis agent and sending the command to it, enabling targeted allocation of log analysis tasks. The log analysis agent then acquires and analyzes the first log information corresponding to the command, obtaining analysis results, thus improving the adaptability and accuracy of the log analysis process to specific log content. Furthermore, a report compilation agent generates an operation and maintenance report based on the analysis results, providing a structured output of the analysis conclusions and enhancing the usability and readability of the report. Moreover, the entire process of generating the operation and maintenance report eliminates the need for manual pre-setting of log filtering rules, avoiding information loss and rule maintenance costs associated with manual intervention. This achieves intelligent log analysis and significantly improves the efficiency of operation and maintenance report generation.

[0091] In some embodiments, such as Figure 2 As shown, the routing agent determines the log analysis agent corresponding to the log analysis command, and the method may include:

[0092] S201, The routing agent determines the user's intent based on log analysis instructions.

[0093] After receiving a log analysis command, the routing agent can perform natural language understanding to identify the core requirements contained within the command. User intent characterizes the business object, analysis scope, and points of concern addressed by the log analysis command. It is formed by the routing agent extracting information such as the time range, business module, log type, error code, anomaly, or target from the command text, and serves as the basis for subsequent selection of the log analysis agent.

[0094] S202. Determine the log analysis agent corresponding to the log analysis command based on the user's intent.

[0095] In one implementation, the routing agent can match user intent with pre-set capability information of each log analysis agent. This capability information can correspond to different analysis targets such as transaction failure analysis, interface timeout analysis, batch processing exception analysis, permission denial analysis, and database connection analysis, thereby selecting the appropriate target based on the current intent. Figure 1 If multiple log analysis agents can satisfy the intent, the routing agent can determine one of the target agents based on task priority, load status, or preset allocation rules, and use it as the log analysis agent corresponding to the log analysis instruction.

[0096] Using the above method, the routing agent first completes the semantic understanding of the log analysis instructions, and then maps the understanding results to specific log analysis agent selection results, realizing the targeted distribution of log analysis tasks. Since the distribution basis has been changed from log analysis instructions to user intent, the log analysis agent can receive more specific analysis targets and process the corresponding log information, thereby reducing misassignment and duplicate analysis, and improving the response efficiency and accuracy of log analysis results.

[0097] Based on the above embodiments, such as Figure 3 As shown, log analysis methods also include:

[0098] S301. In response to the log analysis command, the routing agent determines the log analysis agent corresponding to the log analysis command and sends the log analysis command to the log analysis agent.

[0099] S302. The log analysis agent obtains the first log information corresponding to the log analysis command, analyzes the first log information, and obtains the analysis result.

[0100] S303, the log analysis agent sends the analysis results to the trend judgment agent.

[0101] After completing the analysis of the first log information, the log analysis agent outputs the analysis results and passes them to the trend judgment agent so that subsequent processing can be carried out based on the same analysis result context.

[0102] S304. The trend analysis agent obtains and analyzes the first log information corresponding to the results, determines the error trend within a preset time period based on the analysis results and the first log information, and sends the error trend to the report compilation agent.

[0103] The preset future duration is used to limit the prediction range, corresponding to time windows within minutes, hours, or business cycles; the error trend is used to characterize the predicted conclusions regarding the number of errors, error frequency, or direction of error change within the preset future duration. For the first information and analysis results, please refer to the aforementioned related introduction.

[0104] Specifically, the trend analysis agent can correlate the error types, current error counts, and time-series characteristics in the analysis results with the historical frequency, duration, and distribution changes in the first log information to determine the direction and intensity of error trend changes within a preset time period. This error trend may manifest as a continuous increase in errors, a tendency to stabilize, periodic fluctuations, or a gradual decline, and is sent as the output of the trend analysis agent to the report compilation agent.

[0105] S305. The report-generating agent generates an operation and maintenance report based on the analysis results and error trends.

[0106] In this embodiment, after receiving the analysis results and error trends, the report-generating agent can integrate the current anomaly location conclusions, impact scope, trend prediction conclusions, and corresponding log summaries to generate an operations and maintenance report that includes current status analysis and risk prediction. This operations and maintenance report can be used to assist operations and maintenance personnel in determining whether capacity expansion, rate limiting, rollback, alarm escalation, or continuous monitoring are necessary.

[0107] The implementation of steps S301 and S302 can be referred to the aforementioned relevant introduction, and will not be repeated here.

[0108] The log analysis method provided in this application introduces a trend-judgment intelligence agent to perform time-series extended analysis on the analysis results. The generated operation and maintenance report can simultaneously cover the current abnormal state and future risk trends, improving the report's foresight and usability. Since the error trend is determined jointly based on the analysis results and the corresponding first log information, it can reduce the one-sidedness of drawing conclusions based solely on a single alarm, thereby improving the accuracy of the operation and maintenance report.

[0109] Figure 4 A flowchart illustrating a log analysis method provided in this application embodiment. Figure 3 ,like Figure 4 As shown, log analysis methods include:

[0110] S401. In response to the log analysis command, the routing agent determines the log analysis agent corresponding to the log analysis command and sends the log analysis command to the log analysis agent.

[0111] S402. The log analysis agent obtains the first log information corresponding to the log analysis command, analyzes the first log information, and obtains the analysis result.

[0112] S403. The log analysis agent sends the analysis results to the root cause recommendation agent.

[0113] S404. The trend analysis agent sends erroneous trends to the root cause recommendation agent.

[0114] S405. Based on the analysis results and error trends, the root cause recommendation agent generates recommended solutions and sends the recommended solutions to the report compilation agent.

[0115] In some embodiments, the root cause recommendation agent can first obtain matching historical knowledge based on the analysis results and error trends, and then generate recommended solutions based on the analysis results, error trends, and historical knowledge.

[0116] The root cause recommendation agent receives the analysis results from the log analysis agent and the error trends from the trend judgment agent, and performs root cause correlation inference based on both. Historical knowledge is used to support the generation of recommended solutions through historical experience or case information, which can be stored in a historical knowledge base and can be retrieved and matched according to error type, business scenario, interface name, exception code, or time series characteristics. Historical knowledge can include historical handling records, fault review conclusions, repair operation instructions, and verification results, facilitating the reuse of current abnormal scenarios.

[0117] Specifically, after acquiring matching historical knowledge, the root cause recommendation agent integrates and reasones the abnormal objects reflected in the current analysis results, the evolution direction reflected in the error trend, and the handling experience in the historical knowledge to generate recommended solutions adapted to the current fault scenario. Recommended solutions may include parameter adjustment suggestions, service restart suggestions, dependency link isolation suggestions, configuration rollback suggestions, rate limiting and degradation suggestions, or manual review suggestions, and may include corresponding verification methods and risk warnings. For handling actions that have been verified as effective in historical knowledge, the root cause recommendation agent can directly extract their key operational points; for cases where historical knowledge only provides partial handling clues, the root cause recommendation agent can combine error trends to determine whether the fault is in a continuously escalating stage, and then generate timely repair suggestions.

[0118] By using the current analysis results and error trends as the primary inputs, and then introducing matching historical knowledge for supplementary verification and experience reuse, the recommended solutions can not only reflect the real-time characteristics of the current system anomalies, but also leverage existing operational experience to improve the feasibility and accuracy of the suggestions.

[0119] S406. The report-generating agent generates an operation and maintenance report based on the analysis results, error trends, and recommended solutions.

[0120] In some embodiments, generating an operation and maintenance report can be achieved by first obtaining a preset operation and maintenance report template, and then writing the content that matches each part of the operation and maintenance report template in the analysis results, error trends, and recommended solutions into the operation and maintenance report template to obtain the operation and maintenance report.

[0121] Specifically, after receiving the analysis results, error trends, and recommended solutions, the report generation agent first retrieves an operation and maintenance report template matching the current log analysis task from the template library. The template can be a pre-configured text template, field template, or structured form template, and the appropriate version can be selected based on the business type, system type, or report purpose to ensure a consistent report format and ease of review. In practical applications, other formats can also be selected for this preset operation and maintenance report template; this embodiment does not limit this.

[0122] Next, the report compilation agent performs field parsing and semantic classification on the analysis results, error trends, and recommended solutions. Content that matches each part of the template is written into the corresponding placeholder area. For example, the analysis results are written into the problem location area, the error trends are written into the trend analysis area, and the recommended solutions are written into the handling suggestion area. Duplicate, conflicting, or redundant content in the same part is merged and organized to generate a complete and well-structured operation and maintenance report.

[0123] The specific implementation of steps S401 to S403 can be found in the aforementioned description, and will not be repeated here.

[0124] The log analysis method provided in this application generates an operation and maintenance report based on the analysis results, error trends, and recommended solutions through a report-generating intelligent agent. This reduces the difficulty of locating anomalies in massive logs, improves the accuracy of identifying error trends and the scope of business impact, and makes the generated analysis results easier to form operation and maintenance reports with time-series evidence. This allows for a clear reconstruction of the sequence of anomalies, accurate differentiation between causes and symptoms, and provides support for quickly locating root causes, assessing the duration of fault impact, and verifying the effectiveness of solutions. Furthermore, this method enhances the ability to track cross-service anomaly propagation, reduces manual screening costs, and improves the timeliness and consistency of operation and maintenance processing.

[0125] Figure 5 This is a schematic diagram of a log generation device provided in an embodiment of this application. Figure 5 As shown, the log generation device 500 includes:

[0126] The sending module 501 is used to respond to the log analysis command, the routing agent determines the log analysis agent corresponding to the log analysis command, and sends the log analysis command to the log analysis agent;

[0127] The sending module 501 is used for the log analysis agent to obtain the first log information corresponding to the log analysis instruction, analyze the first log information, obtain the analysis result, and send the analysis result to the report compilation agent.

[0128] The generation module 502 is used by the report-generating agent to generate operation and maintenance reports based on the analysis results.

[0129] In some implementations, a determination module is used to enable the routing agent to determine the user intent based on log analysis instructions;

[0130] The module is also used to determine the log analysis agent corresponding to the log analysis command based on the user's intent.

[0131] In some implementations, the sending module 501 is used for the log analysis agent to send the analysis results to the trend judgment agent;

[0132] The sending module 501 is also used for the trend judgment agent to obtain the first log information corresponding to the analysis results, determine the error trend within a preset time period based on the analysis results and the first log information, and send the error trend to the report compilation agent;

[0133] The generation module 502 is used by the report-generating agent to generate operation and maintenance reports based on the analysis results and error trends.

[0134] In some implementations, the sending module 501 is used for the log analysis agent to send the analysis results to the root cause recommendation agent;

[0135] The sending module 501 is also used for the trend analysis agent to send erroneous trends to the root cause recommendation agent;

[0136] The sending module 501 is also used to generate recommended solutions based on the analysis results and error trends, and send the recommended solutions to the report compilation agent;

[0137] The generation module 502 is used by the report-generating agent to generate operation and maintenance reports based on the analysis results, error trends, and recommended solutions.

[0138] In some implementations, the acquisition module is used by the root cause recommendation agent to acquire matching historical knowledge based on the analysis results and error trends;

[0139] The generation module 502 is used to generate recommended solutions based on the analysis results, error trends, and historical knowledge.

[0140] In some implementations, the acquisition module is used to acquire a preset operation and maintenance report template;

[0141] The generation module 502 is used to write the content that matches the various parts of the operation and maintenance report template from the analysis results, error trends and recommended solutions into the operation and maintenance report template to obtain the operation and maintenance report.

[0142] Figure 6 This is a schematic diagram of the structure of an electronic device provided for an exemplary embodiment of this application. Please refer to... Figure 6 The electronic device 600 may include at least one processor 601 for implementing the log analysis method provided in the embodiments of this application.

[0143] Optionally, the electronic device 600 further includes at least one memory 602 for storing program instructions and / or data. The memory 602 is coupled to the processor 601. The coupling in this embodiment is an indirect coupling or communication connection between devices, units, or modules, and can be electrical, mechanical, or other forms, used for information exchange between devices, units, or modules. The processor 601 may operate in conjunction with the memory 602. The processor 601 may execute program instructions stored in the memory 602. At least one of the at least one memory may be included in the processor.

[0144] Optionally, the electronic device 600 further includes a communication interface 603 for communicating with other devices via a transmission medium, thereby enabling the electronic device 600 to communicate with other devices. The communication interface 603 may be, for example, a transceiver, interface, bus, circuit, or a device capable of transmitting and receiving functions. The processor 601 can utilize the communication interface 603 to transmit and receive data and / or information, and to implement the methods provided in the embodiments of this application. For details, please refer to the detailed descriptions in the preceding embodiments; further elaboration is not repeated here.

[0145] This application embodiment does not limit the specific connection medium between the processor 601, memory 602, and communication interface 603. This application embodiment... Figure 6 The processor 601, memory 602, and communication interface 603 are connected via bus 604. Bus 604 is... Figure 6 The connections between other components are shown in thick lines only and are not intended to be limiting. This bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0146] It should be understood that the processor in the embodiments of this application can be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method embodiments can be completed by the integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above method.

[0147] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM). It should be noted that the memory used in the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0148] Accordingly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods described in the above-described method embodiments.

[0149] Accordingly, embodiments of this application may also provide a computer program product, which includes a computer program that, when executed by a processor, can implement the methods shown in the above-described method embodiments.

[0150] The terms “unit”, “module”, etc., used in this specification may be used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution.

[0151] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0152] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0153] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0154] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0155] When an integrated unit / module is implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0156] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0157] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0158] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0159] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A log analysis method, characterized in that, include: In response to a log analysis command, the routing agent determines the log analysis agent corresponding to the log analysis command and sends the log analysis command to the log analysis agent. The log analysis agent acquires the first log information corresponding to the log analysis instruction, analyzes the first log information to obtain the analysis result, and sends the analysis result to the report compilation agent. The report-generating agent generates an operation and maintenance report based on the analysis results.

2. The method according to claim 1, characterized in that, The routing agent determines the log analysis agent corresponding to the log analysis command, including: The routing agent determines the user's intent based on the log analysis instructions; The log analysis agent corresponding to the log analysis command is determined based on the user intent.

3. The method according to claim 1 or 2, characterized in that, Also includes: The log analysis agent sends the analysis results to the trend analysis agent; The trend analysis agent obtains the first log information corresponding to the analysis result, determines the error trend within a preset time period based on the analysis result and the first log information, and sends the error trend to the report compilation agent; The report-generating agent generates the operation and maintenance report based on the analysis results and the error trends.

4. The method according to claim 3, characterized in that, The first log information includes tagged time-series metric data.

5. The method according to claim 3, characterized in that, Also includes: The log analysis agent sends the analysis results to the root cause recommendation agent; The trend analysis agent sends the erroneous trend to the root cause recommendation agent; The root cause recommendation agent generates a recommended solution based on the analysis results and the error trend, and sends the recommended solution to the report compilation agent; The report-generating agent generates the operation and maintenance report based on the analysis results, the error trends, and the recommended solutions.

6. The method according to claim 5, characterized in that, The root cause recommendation agent generates recommended solutions based on the analysis results and the error trends, including: The root cause recommendation agent obtains matching historical knowledge based on the analysis results and the error trends; Based on the analysis results, the error trends, and the historical knowledge, the recommended solution is generated.

7. The method according to claim 5, characterized in that, The report-generating agent generates the operation and maintenance report based on the analysis results, the error trends, and the recommended solutions, including: Obtain the preset operation and maintenance report template; The content that matches each part of the analysis results, error trends, and recommended solutions in the operation and maintenance report template is written into the operation and maintenance report template to obtain the operation and maintenance report.

8. A log analysis device, characterized in that, include: The sending module is used to respond to the log analysis command, the routing agent determines the log analysis agent corresponding to the log analysis command, and sends the log analysis command to the log analysis agent; The sending module is used for the log analysis agent to obtain first log information corresponding to the log analysis instruction, analyze the first log information to obtain analysis results, and send the analysis results to the report compilation agent. The generation module is used by the report-generating agent to generate an operation and maintenance report based on the analysis results.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 7.

Images