Log processing method, apparatus, device, medium, and product

Abstract

Embodiments of the present application provide a log processing method, device, equipment, medium and product. The method comprises: obtaining a current log of a bank transaction system within a preset time period during the processing of a service; identifying the current log based on a preset information base to obtain an error service event in the current log; wherein the preset information base comprises at least one preset characteristic information, and the preset characteristic information represents characteristic information for determining that the service event is an error service event; displaying the error service event in the current log; and in response to a control instruction of a user, adjusting and storing the current log; wherein the control instruction represents confirmation of the error service event in the current log, or represents modification of the error service event in the current log. The method is used to efficiently identify error service events and automatically update the effect of a shielding rule engine.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a log processing method, apparatus, device, medium and product. Background Technology

[0002] During the execution of business transactions in a bank's transaction system, multiple service events occur, such as query events or payment events. These service events are recorded in a log. However, the log may contain erroneous service events, requiring identification of these incorrect events.

[0003] In existing technologies, the process involves manually reviewing logs to identify potentially erroneous service events, and then manually modifying those events in the logs.

[0004] However, the above method relies entirely on manual methods to identify erroneous service events in the logs, which is inefficient and time-consuming. Summary of the Invention

[0005] The log processing methods, apparatus, devices, media, and products provided in this application are used to achieve the effect of efficiently identifying erroneous service events.

[0006] In a first aspect, embodiments of this application provide a log processing method, including:

[0007] Obtain the current log of the bank's transaction system during a preset time period while processing business; wherein the current log includes at least one service event;

[0008] Based on a preset information database, the current log is identified to obtain erroneous service events in the current log; wherein, the preset information database includes at least one preset feature information, and the preset feature information represents the feature information that determines the service event as an erroneous service event;

[0009] Display the service events that cause errors in the current log;

[0010] In response to a user's control command, the current log is adjusted and stored; wherein the control command indicates either confirming an erroneous service event in the current log or indicating modifying an erroneous service event in the current log.

[0011] In one possible implementation, the preset feature information is a preset error code; based on a preset information database, the current log is identified to obtain the service events causing errors in the current log, including:

[0012] If a service event in the current log is identified as containing a preset error code based on the preset error code in the preset information database, then the service event is determined to be an erroneous service event.

[0013] In one possible implementation, the preset feature information is the execution path of the erroneous service event; based on a preset information database, the current log is identified to obtain the erroneous service events in the current log, including:

[0014] Determine the execution path of the service events in the current log;

[0015] If the execution path of the service event in the current log is found to be consistent with the execution path based on the preset information database, then the service event is determined to be an erroneous service event.

[0016] In one possible implementation, displaying the service events causing errors in the current log includes:

[0017] Determine the category of the current log based on the erroneous service events in the current log;

[0018] When the current log category is a persistent anomaly category, the erroneous service events in the current log are displayed; wherein, the persistent anomaly category represents erroneous service events that have occurred multiple times in the current log.

[0019] In one possible implementation, determining the category of the current log based on the erroneous service events in the current log includes:

[0020] Obtain historical logs for historical periods from the bank's transaction system. These historical logs are logs from when the bank's transaction system executed the same historical business as the current log. The historical period corresponding to these historical logs is the same as the preset period.

[0021] If it is determined that the same type of service event in the current log has occurred a first preset number of times in the historical log, then the current log is classified as a persistent anomaly.

[0022] In one possible implementation, determining the category of the current log based on the erroneous service events in the current log includes:

[0023] If, based on the service events of each error in the current log, it is determined that the same type of service event in the current log has occurred a second preset number of times within a preset time period, then the category of the current log is determined to be a persistent anomaly category.

[0024] In one possible implementation, the method further includes:

[0025] In response to a user's modification command, preset feature information in the preset information database is modified; wherein, the modification command indicates that the preset feature information in the preset information database is modified.

[0026] In one possible implementation, the method further includes:

[0027] The preset feature information is compiled and processed to obtain and display a tree structure; wherein the tree structure represents the logical relationship between the features in the preset feature information.

[0028] Secondly, embodiments of this application provide a log processing apparatus, including:

[0029] The acquisition module is used to acquire the current log of the bank transaction system during the processing of business within a preset time period; wherein the current log includes at least one service event;

[0030] The identification module is used to identify the current log based on a preset information database to obtain erroneous service events in the current log; wherein the preset information database includes at least one preset feature information, and the preset feature information represents the feature information that determines the service event as an erroneous service event;

[0031] The display module is used to display the erroneous service events in the current log.

[0032] An adjustment module is used to adjust and store the current log in response to a user's control command; wherein the control command indicates either confirming an erroneous service event in the current log or modifying an erroneous service event in the current log.

[0033] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0034] The memory stores computer-executed instructions;

[0035] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0036] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0037] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0038] The log processing method, apparatus, device, medium, and product provided in this application obtain the current log of a bank transaction system during a preset time period during business processing. The current log includes at least one service event. Based on a preset information database, the current log is identified to obtain erroneous service events. The preset information database includes at least one preset feature information, which characterizes the features used to determine if a service event is erroneous. The erroneous service events in the current log are then displayed. Finally, in response to a user's control command, the current log is adjusted and stored. The control command either confirms or modifies erroneous service events in the current log, achieving efficient identification of erroneous service events and promoting early detection and handling of production problems. Attached Figure Description

[0039] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0040] Figure 1 One of the flowcharts for the log processing method provided in this application;

[0041] Figure 2 The second flowchart illustrating the log processing method provided in this application;

[0042] Figure 3 A flowchart illustrating the current log recognition method provided in this application;

[0043] Figure 4 A flowchart illustrating the method for displaying service events for errors in the current log provided in this application;

[0044] Figure 5 A schematic diagram of the log processing device provided in this application;

[0045] Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application.

[0046] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0047] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0048] First, let me explain the terms used in this application:

[0049] The AC automaton is a multi-pattern matching algorithm invented in 1975 by Alfred V. Aho and Margaret J. Corasick of Bell Labs. It can efficiently detect the occurrence of all predefined pattern strings (such as keywords) in a single text scan, making it a milestone algorithm in the field of string matching.

[0050] PaaS containers refer to containerized application instances deployed on PaaS cloud platforms. Their lifecycle is managed by a container orchestration engine, generating a mixed log stream containing technical errors (such as resource anomalies) and business errors (such as transaction verification failures). These logs are dynamic (instance IPs are not fixed), distributed (across multiple node instances), and short-cycle (instances automatically scale up and down), requiring centralized log pipeline collection and analysis.

[0051] Payment product transaction logs: These refer to the log records generated by banks or financial institutions during the processing of user payment requests (transactions) for payment-related service products. These logs typically contain information such as the initiation of the transaction, processing steps, result status, and verification of relevant business rules. They are characterized by dynamism, dispersion, and potentially low standardization, making them a key focus for business operations and maintenance.

[0052] Currently, PaaS container log analysis for bank payment products mainly relies on application log profiling platforms and production intelligent verification point platforms. At the same time, it largely depends on operations and maintenance personnel manually pulling transaction logs to analyze phenomena and locate problems.

[0053] Bank payment products involve a wide variety of transactions and service interfaces, and PaaS container logs contain both technical and business errors. Existing application log profiling platforms and intelligent verification point platforms lack timeliness due to the need for timely manual maintenance; furthermore, they primarily focus on key transactions, lacking broad coverage. Therefore, transaction log analysis and maintenance after application product deployment remain crucial. When faced with massive and complex logs, some invalid errors and normal business errors can interfere with the discovery and handling of critical issues. Operational log analysis often relies on the proficiency and experience of operations personnel in application transactions. If logs cannot be quickly analyzed to accurately pinpoint critical issues, it will affect the response speed to production problems, potentially leading to a wider impact and customer complaints.

[0054] This application addresses the problems of cumbersome logs, heavy workload in operation and maintenance analysis, and low processing efficiency in existing PaaS container log analysis for payment products. It proposes a log processing method that uses rule sets to filter logs and automatically updates the rule sets through an iterative module, thereby enabling early detection and handling of production issues and improving operation and maintenance efficiency.

[0055] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0056] Figure 2 The second flowchart illustrating the log processing method provided in this application is as follows: Figure 2 As shown, the method includes:

[0057] S201. Obtain the current log of the bank transaction system during a preset time period in the process of processing business; wherein the current log includes at least one service event.

[0058] A bank's transaction system, more commonly referred to in the industry as the core banking system or core accounting system, is not a single machine or piece of software, but a complex ecosystem comprised of numerous modules and subsystems that operates 24 / 7. Its core tasks are processing transactions, managing accounts, and updating accounts.

[0059] For example, let's take a "spending and recharge" transaction in mobile banking as an example.

[0060] Suppose that the mobile banking app has just released version V4.5. After the new version went live, "duplicate payment" errors started appearing online. User A clicked the "Confirm Payment" button twice in a short period of time (e.g., within 5 seconds). The system backend processed the first transaction, but when the second request arrived, the payment bill status had already changed to "Paid".

[0061] Desired logging: The system will record this transaction and generate an error message in the log. The goal is for the system to automatically and intelligently identify and handle this error log entry containing sensitive information.

[0062] There are two service events, one normal event and the other error event. One of them is a duplicate payment event, but the error event contains some information that should have been masked, but it was not.

[0063] S202. Based on a preset information database, identify the current log to obtain erroneous service events in the current log; wherein, the preset information database includes at least one preset feature information, and the preset feature information represents the feature information that determines the service event as an erroneous service event.

[0064] It should be noted that an erroneous service event refers to a service event recorded in the log that contains information that should be blocked.

[0065] For example, an erroneous service event may occur if the service event contains the last four digits of the card number being 9988 and the balance being 500.00 yuan. Since the last four digits of the card number being 9988 involve user privacy and the balance being 500.00 yuan also involve sensitive user information, this service event is considered an erroneous service event.

[0066] S203. Display the service events that cause errors in the current log.

[0067] For example, the above information is displayed for subsequent manual review.

[0068] S204. In response to the user's control command, adjust and store the current log; wherein the control command indicates either confirming an erroneous service event in the current log or indicating modifying an erroneous service event in the current log.

[0069] For example, when a human sees the erroneous service event (i.e., the blocked number is not blocked), they will reconfirm whether it is indeed an erroneous service event.

[0070] The log processing method provided in this application embodiment obtains the current log of a bank transaction system during a preset time period during business processing; wherein the current log includes at least one service event; then, based on a preset information database, the current log is identified to obtain erroneous service events in the current log; wherein the preset information database includes at least one preset feature information, the preset feature information representing the feature information that determines the service event as an erroneous service event; the erroneous service events in the current log are displayed; and in response to a user's control command, the current log is adjusted and stored; wherein the control command represents confirming the erroneous service events in the current log, or represents modifying the erroneous service events in the current log, thereby achieving the effect of efficiently identifying erroneous service events, and thus promoting the early detection and early handling of production problems.

[0071] In one example, the preset feature information is a preset error code; based on the information database, the current log is identified to obtain the erroneous service events in the current log, including: if based on the preset error codes in the preset information database, a preset error code is identified in the service event in the current log, and it is found that the information to be blocked is not blocked in the service event, then the service event (i.e., user payment service) is determined to be an erroneous service event.

[0072] For example, suppose the structured output feature vector in JSON format is:

[0073] {

[0074] "txn_id":"TXN7788990011",

[0075] ...

[0076] "error_code": "ERR_PAY_DUP_001"

[0077] ...

[0078] }

[0079] When an error code is detected and it is found that the blocked information has not been effectively blocked, the user's payment service event can be determined to be an erroneous service event. Furthermore, the fact that the blocked information was not blocked in this erroneous service event indicates that the existing error message blocking rules are flawed.

[0080] This embodiment can effectively identify erroneous service events.

[0081] Figure 3 A flowchart illustrating the current log recognition method provided in this application is shown below. Figure 3 As shown, in this embodiment... Figure 2 Based on the embodiments, the current log recognition method is described in detail, which includes:

[0082] S301. Determine the execution path of the service events in the current log.

[0083] For example, if the execution path of a service event is correct, then the sensitive information of the service event in the log should be masked. If the sensitive information in the service event is not masked, then the execution path of the service event is incorrect, indicating that the masking rule may be wrong.

[0084] S302. If it is determined that the execution path of the service event in the current log is consistent with the execution path based on the preset information database, then the service event is determined to be an erroneous service event.

[0085] For example, if the sensitive information in a service event is not effectively blocked, then the service event is an erroneous service event.

[0086] This application embodiment achieves effective identification of the current log. By determining the execution path of the service event in the current log, if the execution path of the service event in the current log is consistent with the execution path based on the preset information database, then the service event can be determined to be an erroneous service event, but the blocking rule is incorrect, which can be modified later.

[0087] Figure 4 A flowchart illustrating the method for displaying service events for errors in the current log provided in this application is shown below. Figure 4 As shown, in this embodiment... Figure 2 or Figure 3 Based on the embodiments, the method for displaying service events with errors in the current log is described in detail. The method includes:

[0088] S401. Determine the category of the current log based on the service events causing errors in the current log.

[0089] For example, the historical logs of the bank's transaction system for a historical period are obtained. The historical logs are the logs of the bank's transaction system when it executed the same historical business as the business corresponding to the current log. The historical period corresponding to the historical log is the same as the preset period. If it is determined that the same type of error service event in the current log (the information to be masked is not masked) has occurred a first preset number of times in the historical log, then the category of the current log is determined to be the persistent anomaly category.

[0090] For example, if based on the service events of each error in the current log (those that are masked are not masked), it is determined that the same type of service event in the current log has occurred a second preset number of times within a preset time period, then the category of the current log is determined to be a persistent anomaly category.

[0091] S402. When the current log category is persistent exception, display the erroneous service events in the current log; wherein, persistent exception category represents erroneous service events that have appeared multiple times in the current log.

[0092] The method for displaying erroneous service events in the current log provided in this embodiment determines the category of the current log based on the erroneous service events in the current log (the information to be blocked is not blocked). When the category of the current log is a persistent anomaly category, the erroneous service events in the current log are displayed, which can push high-risk logs to the manual review platform.

[0093] In one example, in response to a user's modification command, preset feature information in a preset information database is modified; wherein, the modification command indicates that the preset feature information in the preset information database is modified.

[0094] For example, the preset feature information in the preset information database is modified, that is, the error information blocking rules are modified so that the blocked information is blocked.

[0095] In one example, preset feature information is compiled and processed to obtain and display a tree structure; the tree structure represents the logical relationship between the features in the preset feature information.

[0096] For example, rule conflict detection, such as duplicate coverage checks, is performed. If the checks pass, the AC automatic mechanism builder is triggered to compile the rule set into a state transition optimized Trie tree.

[0097] The following embodiment further illustrates the principles of this application.

[0098] Let's consider a scenario where mobile banking has just released version 4.5. After the new version goes live, "duplicate payment" errors start appearing online.

[0099] User A clicked the "Confirm Payment" button twice in a short period of time (within 5 seconds). The system backend processed the first request, but when the second request arrived, the status of the payment bill had already changed to "Paid".

[0100] Our desired logging is that the system records the transaction and generates an error message in the log. Ideally, the system should be able to automatically and intelligently identify and handle this error log containing sensitive information.

[0101] like Figure 1 As shown, the transaction log source collects raw data in real time through the log collector and pushes it to the preprocessing pipeline for cleaning (such as format standardization and invalid field filtering).

[0102] For example, raw logs are collected from the application server.

[0103] The log collector captures this log in real time. The log is parsed into structured JSON; this example does not limit the specific structure. Fields useless for error analysis, such as specific IP addresses, are removed.

[0104] The rule base pre-stores regular expressions and sensitive word rules, which are then linked to the AC automaton for efficient pattern matching. Simultaneously, action instructions (such as blocking types / replacement characters) are bound to the rule metadata. Raw logs are input into the AC matching engine, which calls the AC automaton to quickly scan for sensitive words. When a match is found, the engine requests the corresponding action instruction from the rule metadata. The blocking executor dynamically processes the logs according to the instructions (e.g., blocking the entire log of a transaction with an "insufficient card balance" error), generating de-identified logs and synchronously recording the blocking location / frequency to the statistics module.

[0105] For example, one of the regular expression rules is (\d{4}), and the bound metadata / action instructions are: {"action": "mask", "type": "replace_all", "with": "*"}. The cleaned JSON log enters the AC matching engine. The engine scans and finds that "card number ending in 9988" matches the rule, and immediately requests the action instruction from the rule metadata. According to the instruction, the entire segment "card number ending in 9988, balance 500.00" in the log is replaced with "card number ending in ****, balance *** yuan". The de-identified log is generated for downstream monitoring and storage. At the same time, the masking statistics module records that the "card number masking rule" is triggered once.

[0106] The error feature extraction module identifies key error information and outputs a structured feature vector based on preset rules, such as error code regular expression matching and exception stack features.

[0107] For example, the module matches error_codes that begin with ERR and extracts key semantics from error_msg. The module identifies error_code as "ERR_PAY_DUP_001" and error_msg as "This bill has already been paid; please do not pay again."; it outputs a structured feature vector, i.e., a feature vector in JSON format.

[0108] The persistent error detection module associates historical context (such as high-frequency error information from the previous version deployment, the number of consecutive failures with the same transaction ID) and identifies persistent anomalies using a sliding window algorithm. Logs that meet thresholds (such as ≥3 errors for the same service between two versions or within 5 minutes) generate a list of pending review for manual intervention or automated circuit breaker decisions.

[0109] For example, the detection module knows that the current version is V4.5 and associates it with the high-frequency errors recorded in the codebase for the previous version V4.4, which are ERR_TIMEOUT_XXX. ERR_PAY_DUP_001 is a new error in V4.5.

[0110] Check the number of failures with the same user_id within a sliding window, such as within five minutes.

[0111] Suppose that within five minutes, the system detects five ERR_PAY_DUP_001 errors involving three different users. The rule is defined as "within the same service, if a new error code appears three or more times within five minutes after the new version is released," it is considered a persistent anomaly. If this condition is met, the ERR_PAY_001 error, along with its feature vector, frequency, and associated transaction ID, is added to a pending review list, awaiting manual analysis to determine if it represents a code defect or requires the addition of new blocking rules.

[0112] The list of pending reviews pushes high-risk logs to the human review panel. Simultaneously, the blocking statistics module provides real-time feedback on false alarms (such as the blocking of legitimate transactions) to the review panel, forming a proactive + reactive dual-channel review mechanism. Reviewers verify the log context in the interactive interface, confirm rule defects (such as over-matching), and click "Approve," triggering a rule entry request. This request carries correction instructions (such as narrowing the regular expression matching range), directly updating the corresponding rule and metadata in the rule base. The new rule takes effect immediately in the filtering layer, and subsequent blocking statistics continuously monitor the false blocking rate, forming a closed loop of "detection-feedback-correction-verification."

[0113] For example, the list of pending audits pushes the aggregated information of ERR_PAY_DUP_001 (5 times in 5 minutes) to the human auditing desk. Simultaneously, the statistics module reports a "false alarm": an auditor discovered that a normal "insufficient balance" error (ERR_BALANCE_INSUFFICIENT) was incorrectly masked by an old, overly broad regular expression rule (such as matching .*insufficient.*), which masked crucial debugging information. The auditor sees detailed information about ERR_PAY_DUP_001 in the interactive interface, including the original (anonymized) logs, frequency trends, and associated transaction records. Upon investigation, it is confirmed that this is a new business error introduced in version 4.5 due to adjustments in the logic to prevent duplicate payments. It falls within the normal business process, but the error message contains sensitive information such as the user's billing number, which needs to be automatically masked. Meanwhile, the auditor addresses the "false alarm" and confirms that it was caused by over-matching of the old rules.

[0114] The auditor clicks "Create Blocking Rule" for ERR_PAY_DUP_001. The system automatically retrieves the official description of this error code from the error code system: "This bill has already been paid; please do not pay again." as a base. For the "false alarm," the auditor edits the old rule, narrowing its scope to insufficient card balance. When the auditor clicks "Approve," two rule entry requests are triggered: first, a new rule request to generate a regular expression to block the bill number for ERR_PAY_DUP_001; second, replacing the old rule with insufficient card balance. The requests are sent to the rule database, and the corresponding regular expression and metadata are updated in real time.

[0115] The error code system provides structured error codes and descriptions (e.g., ERR_PAY_DUP_001, "This bill has already been paid, please do not pay again."). The codebase automatically extracts new error features by parsing commit messages (e.g., "This bill has already been paid, please do not pay again."). The rule generator integrates dual-source input, transforming error semantics into regular expressions (e.g., "This ([\u4e00-\u9fa5A-Za-z0-9]+) has been (paid|paid|paid), please do not (duplicate|again)(?:pay|paid)"), while inheriting error context associations from the version control library.

[0116] For example, Source 1: ERR_PAY_DUP_001: "This bill has already been paid. Please do not pay again."; Source 2: By parsing the commit message of version V4.5, the code file and code context corresponding to this error code are automatically associated. The rule generator analyzes the error description, identifies key entities and actions; combined with Chinese natural language processing and generalization requirements, it may generate more general regular expression rules. This rule can not only match the example error, but also match semantically similar error descriptions that may appear in the future. A knowledge graph is established linking this rule with the mobile_pay_phonebill service, version V4.5, and the ERR_PAY_TIMEOUT_002 error code.

[0117] Figure 5 A schematic diagram of the log processing device provided in this application is shown below. Figure 5 As shown, the log processing device 50 provided in this embodiment includes:

[0118] The acquisition module 501 is used to acquire the current log of the bank transaction system during the business processing within a preset time period; wherein the current log includes at least one service event;

[0119] The identification module 502 is used to identify the current log based on a preset information database to obtain the erroneous service events in the current log; wherein, the preset information database includes at least one preset feature information, and the preset feature information represents the feature information that determines the service event as an erroneous service event;

[0120] Display module 503 is used to display error service events in the current log;

[0121] The adjustment module 504 is used to adjust and store the current log in response to user control commands; wherein the control commands represent either confirming erroneous service events in the current log or modifying erroneous service events in the current log.

[0122] In one possible implementation, the identification module 502 is specifically used for:

[0123] If a service event in the current log is identified as having a preset error code based on the preset error codes in the preset information database, then the service event is determined to be an erroneous service event.

[0124] In one possible implementation, the identification module 502 is specifically used for:

[0125] Determine the execution path of the service events in the current log;

[0126] If the execution path of a service event in the current log is found to be consistent with the execution path in the preset information database, then the service event is determined to be an erroneous service event.

[0127] In one possible implementation, the display module 503 is specifically used for:

[0128] Determine the category of the current log based on the service events that caused the error in the current log;

[0129] When the current log category is persistent exception, display the erroneous service events in the current log; the persistent exception category represents erroneous service events that have appeared multiple times in the current log.

[0130] In one possible implementation, the display module 503 is specifically used for:

[0131] Obtain historical logs from the bank's transaction system for a historical period. The historical logs are logs from when the bank's transaction system executed the same historical business as the current log. The historical period corresponding to the historical logs is the same as the preset period.

[0132] If it is determined that the same type of service event in the current log has occurred a first preset number of times in the historical logs, then the current log is classified as a persistent exception.

[0133] In one possible implementation, the display module 503 is specifically used for:

[0134] If, based on the service events of each error in the current log, it is determined that the same type of service event in the current log has occurred a second preset number of times within a preset time period, then the category of the current log is determined to be a persistent exception category.

[0135] In one possible implementation, the log processing device 50 further includes a modification module, specifically used for:

[0136] In response to a user's modification command, the preset feature information in the preset information database is modified; wherein, the modification command indicates that the preset feature information in the preset information database is modified.

[0137] In one possible implementation, the log processing device 50 further includes a compilation processing module, specifically used for:

[0138] The preset feature information is compiled and processed to obtain and display a tree structure; wherein, the tree structure represents the logical relationship between the features in the preset feature information. The log processing device provided in this embodiment can execute the method provided in the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described in detail here.

[0139] Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application. Figure 6 As shown, the electronic device 60 provided in this embodiment includes at least one processor 601 and a memory 602. Optionally, the device 60 further includes a communication component 603. The processor 601, memory 602, and communication component 603 are connected via a bus 604.

[0140] In a specific implementation, at least one processor 601 executes computer execution instructions stored in memory 602, causing at least one processor 601 to perform the above-described method.

[0141] The specific implementation process of processor 601 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0142] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0143] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0144] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0145] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0146] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0147] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0148] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0149] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0150] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0151] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0152] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0153] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0154] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A log processing method, characterized in that, The method includes: Obtain the current log of the bank's transaction system during a preset time period while processing business; wherein the current log includes at least one service event; Based on a preset information database, the current log is identified to obtain erroneous service events in the current log; wherein, the preset information database includes at least one preset feature information, and the preset feature information represents the feature information that determines the service event as an erroneous service event; Display the service events that cause errors in the current log; In response to a user's control command, the current log is adjusted and stored; wherein the control command indicates either confirming an erroneous service event in the current log or indicating modifying an erroneous service event in the current log.

2. The method according to claim 1, characterized in that, The preset feature information is a preset error code; Based on a preset information database, the current log is identified to obtain erroneous service events in the current log, including: If a service event in the current log is identified as containing a preset error code based on the preset error code in the preset information database, then the service event is determined to be an erroneous service event.

3. The method according to claim 1, characterized in that, The preset feature information is the execution path of the erroneous service event; Based on a preset information database, the current log is identified to obtain erroneous service events in the current log, including: Determine the execution path of the service events in the current log; If the execution path of the service event in the current log is found to be consistent with the execution path based on the preset information database, then the service event is determined to be an erroneous service event.

4. The method according to claim 1, characterized in that, Display the service events that cause errors in the current log, including: Determine the category of the current log based on the erroneous service events in the current log; When the current log category is a persistent anomaly category, the erroneous service events in the current log are displayed; wherein, the persistent anomaly category represents erroneous service events that have occurred multiple times in the current log.

5. The method according to claim 4, characterized in that, Based on the erroneous service events in the current log, determine the category of the current log, including: Obtain historical logs for historical periods from the bank's transaction system. These historical logs are logs from when the bank's transaction system executed the same historical business as the current log. The historical period corresponding to these historical logs is the same as the preset period. If it is determined that the same type of service event in the current log has occurred a first preset number of times in the historical log, then the current log is classified as a persistent anomaly.

6. The method according to claim 4, characterized in that, Based on the erroneous service events in the current log, determine the category of the current log, including: If, based on the service events of each error in the current log, it is determined that the same type of service event in the current log has occurred a second preset number of times within a preset time period, then the category of the current log is determined to be a persistent anomaly category.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: In response to a user's modification command, preset feature information in the preset information database is modified; wherein, the modification command indicates that the preset feature information in the preset information database is modified.

8. The method according to any one of claims 1-6, characterized in that, The method further includes: The preset feature information is compiled and processed to obtain and display a tree structure; wherein the tree structure represents the logical relationship between the features in the preset feature information.

9. A log processing device, characterized in that, include: The acquisition module is used to acquire the current log of the bank transaction system during the processing of business within a preset time period; wherein the current log includes at least one service event; The identification module is used to identify the current log based on a preset information database to obtain erroneous service events in the current log; wherein the preset information database includes at least one preset feature information, and the preset feature information represents the feature information that determines the service event as an erroneous service event; The display module is used to display the erroneous service events in the current log. An adjustment module is used to adjust and store the current log in response to a user's control command; wherein the control command indicates either confirming an erroneous service event in the current log or modifying an erroneous service event in the current log.

10. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-8.

Images