A dynamic library injection and semantic filtering gas turbine host computer log suppression method

Abstract

The application provides a gas turbine host computer log suppression method based on dynamic library injection and semantic filtering, which comprises the following steps: pre-configuring a log filtering rule; injecting an interception library into a host computer graphical process through a dynamic link library preloading mechanism to intercept a log output function; judging whether a log target is a graphical interface session log file, and releasing if not; calling a multi-dimensional semantic filtering engine for three-level comprehensive analysis if the log target is the graphical interface session log file; based on the analysis result, matching the rule, writing important logs into a ring buffer area, a local compressed storage area or a network log server, discarding redundant noise logs, and releasing only ordinary logs to an original file. The application effectively suppresses the disk occupation of log files without modifying the source code and zero-invasive deployment, while retaining key fault information, improving the operation stability of the gas turbine host computer, and solving the problem of retaining key fault information while suppressing disk occupation.

Description

Technical Field

[0001] This invention relates to the field of host computer process log management technology for gas turbine DCS systems, and in particular to a method for suppressing gas turbine host computer logs through dynamic library injection and semantic filtering. Background Technology

[0002] The host computer (engineer station, operator station) of the gas turbine distributed control system runs numerous graphical monitoring programs. These programs continuously generate log output during operation, including interface refresh logs, business logic logs, debugging information, etc. Currently, the traditional practice is to write these logs to the log files allocated by the operating system for the graphical interface session by default.

[0003] However, this traditional log management method has inherent flaws. As the system runs continuously for extended periods, the log volume accumulates rapidly, causing the log file to grow continuously until it fills up the disk space, leading to lag, slow response, or even system crashes in the host computer, severely impacting the safety of gas turbine monitoring. Furthermore, existing solutions, such as periodic cleanup scripts, cannot distinguish between important fault logs and ordinary redundant logs, easily resulting in the accidental deletion of critical alarm information; while attempting to modify the host computer software source code faces problems of high cost and poor compatibility, and is impossible to implement for closed-source software provided by third parties.

[0004] Therefore, in order to solve the problem of how to retain critical fault information while suppressing disk usage, this application provides a method for suppressing gas turbine host computer logs through dynamic library injection and semantic filtering. Summary of the Invention

[0005] To address the challenge of suppressing disk usage while preserving critical fault information, this application provides a method for suppressing gas turbine host computer logs using dynamic library injection and semantic filtering, comprising the following steps: Step S1: Pre-configure log filtering rules and generate a rule configuration file. The rule configuration file defines the priority, pattern matching string, context association conditions, and application identifier for different logs. Step S2: Through the dynamic link library preloading mechanism, the dynamic link library that implements the log interception function is injected into all graphical processes of the host computer, so that the graphical process will execute the interception function in the dynamic link library first when calling the log output function. Step S3: The interception function captures the log output of the current process and determines whether the target file of the log output is the log file of the graphical interface session, which includes xsession-errors; if the target file is not the log file of the graphical interface session, the log output is allowed to be written to the original path; if the target file is the log file of the graphical interface session, the log output is further analyzed. Step S4: Call the multi-dimensional semantic filtering engine to perform comprehensive analysis on the log output content. The comprehensive analysis includes three levels: First level, perform fast pattern matching on the log content based on regular expressions to identify whether it contains preset error, warning or debugging keywords; Second level, parse the call stack information of the current process, and combine the mapping relationship between process identifier and functional module to determine the business scenario type of the log, including interface refresh type, business logic type or operation record type; Third level, count the frequency of the same or similar pattern logs within a predetermined time window to identify whether there is high-frequency repeated redundant output. Step S5: Based on the three-level analysis results, match and semantically analyze the log content with the log priority, pattern matching string, context association conditions, and application identifier defined in the rule configuration file, and output the judgment result. The judgment result includes important logs that need to be stored hierarchically, redundant and noisy logs that can be directly discarded, or ordinary logs that do not match any rules. For important logs that are determined to need to be stored hierarchically, write them to at least one level in the three-level storage system. The three-level storage system includes a circular buffer, a local solid-state disk compressed storage area, and a network log server. For redundant and noisy logs that are determined to be directly discarded, discard them directly without writing them to any storage medium. For ordinary logs that are determined to not match any rules, write them to the original system log file allocated by the operating system for the graphical interface session.

[0006] The log suppression method proposed in this application leverages the symbol resolution priority characteristics of the operating system's dynamic linker to achieve seamless interception and intelligent control of the log output behavior of the host computer's graphical processes. Specifically, a custom dynamic link library (e.g., libXLogInterceptor.so) is injected into all graphical processes of the gas turbine's host computer through the LD_PRELOAD environment variable preloading mechanism. This dynamic library employs function wrapping technology, defining wrapper functions with the exact same names as the standard library and graphics library log output functions (such as printf, fwrite, qDebug, etc.). According to the symbol resolution rules of the dynamic linker, when the application calls these functions, it will preferentially link to the function with the same name in the preloaded library, rather than the implementation in the original libc or Qt library. Thus, comprehensive interception of the log output stream can be achieved without modifying any application source code or recompiling. This method is particularly suitable for the numerous third-party closed-source graphical monitoring programs present in the gas turbine DCS system, solving the fundamental problems of "inability to modify source code" or "extremely high modification costs" in traditional solutions.

[0007] Upon intercepting a log output call, this method first performs a lightweight but crucial check: it checks whether the target file pointed to by the current log output is a log file allocated by the operating system for the graphical interface session, typically "xsession-errors". The massive amounts of interface refresh logs and debugging information generated by the host computer running for extended periods are mostly written to this file by default, which is the direct cause of rapid disk space depletion, system lag, and even crashes. This method obtains the file descriptor or file path through an interception function to accurately identify whether the target is the problematic file. If the target is not a graphical interface session log file (e.g., a dedicated log file defined by the application itself), it is immediately allowed without any intervention, ensuring the normal recording of existing business logs; if the target is indeed a file such as xsession-errors, it proceeds to the subsequent multi-dimensional semantic filtering analysis process. This pre-judgment mechanism ensures that this method only addresses the root cause of disk usage, with zero impact on other legitimate log outputs, minimizing the performance overhead introduced by interception.

[0008] For log entries that need to be intercepted, this method calls a multi-dimensional semantic filtering engine for in-depth analysis. This engine is designed with a three-level pipeline structure, refining layer by layer to balance efficiency and accuracy. The first level is fast pattern matching: based on a predefined set of regular expressions, it scans the log content to identify whether it contains preset keywords such as ERROR, WARNING, and DEBUG. This level can be completed within microseconds, used to quickly remove obvious harmless information or mark high-risk information. The second level is contextual analysis: by parsing the call stack (backtrace) information of the current process, combined with a preset mapping table of process ID and functional modules (e.g., mapping process "opc_server" to the data acquisition module, and "ui_main" to the interface refresh module), it determines the specific business scenario type that generated the log, including interface refresh, business logic, and operation record types. The same text log in different scenarios may have completely different importance—for example, "refresh complete" is redundant noise in the interface refresh category, while in the business logic category it may indicate a critical state change. The third level is time-series behavior analysis: it statistically analyzes the frequency of logs with the same or similar patterns (after regular expression fuzzy matching) occurring within a predetermined time window (e.g., 1 second or 10 seconds). High-frequency repetitive logs commonly found in the gas turbine's host computer (e.g., hundreds of "redraw window" messages per second) are major contributors to disk usage. This level can accurately identify such "log storms" and classify them as redundant output. The three-level engine executes sequentially, with each level able to output conclusions in advance for subsequent rule matching. The overall processing latency is controlled within microseconds to milliseconds, without affecting the real-time monitoring performance of the host computer.

[0009] Based on the above three-level analysis results, this method matches and semantically analyzes the log content against a pre-configured XML rule file, outputting three judgment results and adopting differentiated handling strategies for each. The first category is "important logs requiring hierarchical storage": these logs typically contain fault alarms, critical status changes, or user operation records. The system dynamically writes them to at least one level of the three-level storage system based on their importance score (determined by the priority field in the rule). The first level uses a circular buffer implemented with shared memory for cross-process access by real-time diagnostic tools, retaining the most recent 1000 logs; the second level is a local solid-state disk compressed storage area, which uses a log structured merge tree (LSM Tree) to organize data and adaptively selects the LZ4 or Zstandard compression algorithm according to the content type, retaining important logs within 24 hours, balancing storage efficiency and query performance; the third level is a network log server, which synchronously reports critical error logs to the central server through a reliable transmission protocol with sequence number allocation, acknowledgment, and timeout retransmission, enabling remote monitoring and fault tracing. The second category is "redundant noise logs that can be directly discarded": These logs are determined by the engine to be high-frequency repetitive information or pure debugging information of no value, and the system discards them directly without writing them to any storage medium, thus suppressing disk usage at the source. The third category is "ordinary logs that do not match any rules": These logs are neither important nor obvious noise, and the system allows them to pass through, writing them to the xsession-errors file originally allocated by the operating system, ensuring that the integrity of the log records is not compromised. Through this hierarchical handling mechanism, this method effectively controls disk usage while ensuring that all potentially valuable information is properly preserved or reported.

[0010] The method proposed in this application has the following outstanding advantages: First, zero intrusion—no modification to any application source code is required, and no recompilation or linking is necessary, making it particularly suitable for gas turbine DCS systems containing third-party closed-source software, resulting in extremely low deployment risk. Second, intelligent semantic filtering—through a three-level analysis engine, it can distinguish the value of logs in different scenarios such as interface refresh, business logic, and operation records, avoiding the problem of traditional cleanup scripts indiscriminately deleting critical alarm information. Third, hierarchical storage and reliable transmission—important logs are stored in a memory circular buffer, local compressed storage, and a remote server according to their urgency, meeting both the low latency requirements of real-time diagnosis and achieving permanent archiving of critical fault information. Fourth, rollback-enabled zero-intrusion deployment—in conjunction with environment detection, configuration adaptation, and system snapshot recovery mechanisms, it can be securely deployed on existing network node supervisory units, and can be restored to its original state with one click in case of anomalies, ensuring the continuous availability of the gas turbine monitoring system. In summary, this application fundamentally solves the problem of disk exhaustion, system lag, and even crashes caused by the unlimited growth of log files such as xsession-errors in the gas turbine host computer. At the same time, it fully preserves the key information needed for troubleshooting, significantly improving the operational stability and maintenance convenience of the gas turbine distributed control system.

[0011] Optionally, the rule configuration file is defined in XML format, and the dynamic link library reads the rule configuration file during initialization.

[0012] Optionally, the dynamic link library mentioned in step S2 is implemented using function wrapping technology. A wrapper function with the same name as the target log output function is defined in the dynamic library, and the symbol resolution priority of the dynamic linker is used to make the graphical process call the wrapper function first.

[0013] Optionally, the log output function intercepted by the wrapper function in step S2 includes at least one of printf, fwrite, and qDebug.

[0014] Optionally, in step S5, based on the three-level analysis results, the log content is matched and semantically analyzed with the log priority, pattern matching string, context association conditions, and application identifier defined in the rule configuration file, and the judgment result is output, specifically including: The three-level analysis results serve as input for rule matching. The first-level pattern matching result is used to match the pattern matching string in the rule and identify whether the log content conforms to the preset format. The second-level business scenario type judgment result is used to match the context association conditions in the rule and verify whether the log meets the requirements of a specific business scenario. The third-level high-frequency repetition recognition result, combined with the priority in the rule, helps to determine the importance level of the log. The application identifier is used to distinguish the log processing strategies of different graphical processes.

[0015] Optionally, the circular buffer mentioned in step S5 is a cross-process access circular queue implemented using shared memory, and each log entry includes a timestamp, process ID, log level, importance score, and log content.

[0016] Optionally, the circular buffer described in step S5 provides a thread-safe read / write interface and is configured with an automatic overwrite mechanism; when the buffer is full, the new log entry overwrites the old log entry with the lowest importance score.

[0017] Optionally, the local solid-state drive compressed storage area described in step S5 uses a log-structured merged tree structure to organize data, and adaptively selects a compression algorithm for storage based on the log content type.

[0018] Optionally, the network log server in step S5 adopts a reliable transmission protocol with sequence number allocation, acknowledgment and timeout retransmission mechanisms to achieve synchronous reporting of critical error logs.

[0019] Optionally, a zero-intrusive deployment step may be included before step S1: the zero-intrusive deployment step includes performing runtime environment detection on the host computer and completing configuration adaptation based on the detection results; the runtime environment detection includes identifying the operating system type, version, desktop environment, and installed graphics libraries.

[0020] Optionally, the zero-intrusive deployment steps further include: creating a system snapshot before deployment, performing functional verification after deployment, and restoring to the original state through the snapshot when an anomaly occurs.

[0021] This application provides a method for suppressing logs from a gas turbine host computer using dynamic library injection and semantic filtering. The method includes: pre-configuring log filtering rules; injecting an interception library into the host computer's graphical process via a dynamic link library preloading mechanism to intercept log output functions; determining whether the log target is a graphical interface session log file; if not, allowing the log to pass; if so, calling a multi-dimensional semantic filtering engine for three-level comprehensive analysis; and based on the analysis results and matching rules, writing important logs to a circular buffer, local compressed storage area, or network log server, discarding redundant and noisy logs, and only allowing ordinary logs to the original file. This application effectively suppresses disk usage of log files without modifying the source code or requiring zero-intrusion deployment, while preserving critical fault information, improving the operational stability of the gas turbine host computer, and solving the problem of preserving critical fault information while suppressing disk usage. Attached Figure Description

[0022] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart illustrating the gas turbine host computer log suppression method based on dynamic library injection and semantic filtering. Specific implementation methods The embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described below do not represent all embodiments consistent with the present invention. They are merely examples of systems and methods consistent with some aspects of the invention as detailed in the claims.

[0024] To address the challenge of suppressing disk usage while preserving critical fault information, this application provides a method for suppressing gas turbine host computer logs using dynamic library injection and semantic filtering, comprising the following steps: Step S1: Pre-configure log filtering rules and generate a rule configuration file. The rule configuration file defines the priority, pattern matching string, context association conditions, and application identifier for different logs. Step S2: Through the dynamic link library preloading mechanism, the dynamic link library that implements the log interception function is injected into all graphical processes of the host computer, so that the graphical process will execute the interception function in the dynamic link library first when calling the log output function. Step S3: The interception function captures the log output of the current process and determines whether the target file of the log output is the log file of the graphical interface session, which includes xsession-errors; if the target file is not the log file of the graphical interface session, the log output is allowed to be written to the original path; if the target file is the log file of the graphical interface session, the log output is further analyzed. Step S4: Call the multi-dimensional semantic filtering engine to perform comprehensive analysis on the log output content. The comprehensive analysis includes three levels: First level, perform fast pattern matching on the log content based on regular expressions to identify whether it contains preset error, warning or debugging keywords; Second level, parse the call stack information of the current process, and combine the mapping relationship between process identifier and functional module to determine the business scenario type of the log, including interface refresh type, business logic type or operation record type; Third level, count the frequency of the same or similar pattern logs within a predetermined time window to identify whether there is high-frequency repeated redundant output. Step S5: Based on the three-level analysis results, match and semantically analyze the log content with the log priority, pattern matching string, context association conditions, and application identifier defined in the rule configuration file, and output the judgment result. The judgment result includes important logs that need to be stored hierarchically, redundant and noisy logs that can be directly discarded, or ordinary logs that do not match any rules. For important logs that are determined to need to be stored hierarchically, write them to at least one level in the three-level storage system. The three-level storage system includes a circular buffer, a local solid-state disk compressed storage area, and a network log server. For redundant and noisy logs that are determined to be directly discarded, discard them directly without writing them to any storage medium. For ordinary logs that are determined to not match any rules, write them to the original system log file allocated by the operating system for the graphical interface session.

[0025] The log suppression method proposed in this application leverages the symbol resolution priority characteristics of the operating system's dynamic linker to achieve seamless interception and intelligent control of the log output behavior of the host computer's graphical processes. Specifically, a custom dynamic link library (e.g., libXLogInterceptor.so) is injected into all graphical processes of the gas turbine's host computer through the LD_PRELOAD environment variable preloading mechanism. This dynamic library employs function wrapping technology, defining wrapper functions with the exact same names as the standard library and graphics library log output functions (such as printf, fwrite, qDebug, etc.). According to the symbol resolution rules of the dynamic linker, when the application calls these functions, it will preferentially link to the function with the same name in the preloaded library, rather than the implementation in the original libc or Qt library. Thus, comprehensive interception of the log output stream can be achieved without modifying any application source code or recompiling. This method is particularly suitable for the numerous third-party closed-source graphical monitoring programs present in the gas turbine DCS system, solving the fundamental problems of "inability to modify source code" or "extremely high modification costs" in traditional solutions.

[0026] Upon intercepting a log output call, this method first performs a lightweight but crucial check: it checks whether the target file pointed to by the current log output is a log file allocated by the operating system for the graphical interface session, typically "xsession-errors". The massive amounts of interface refresh logs and debugging information generated by the host computer running for extended periods are mostly written to this file by default, which is the direct cause of rapid disk space depletion, system lag, and even crashes. This method obtains the file descriptor or file path through an interception function to accurately identify whether the target is the problematic file. If the target is not a graphical interface session log file (e.g., a dedicated log file defined by the application itself), it is immediately allowed without any intervention, ensuring the normal recording of existing business logs; if the target is indeed a file such as xsession-errors, it proceeds to the subsequent multi-dimensional semantic filtering analysis process. This pre-judgment mechanism ensures that this method only addresses the root cause of disk usage, with zero impact on other legitimate log outputs, minimizing the performance overhead introduced by interception.

[0027] For log entries that need to be intercepted, this method calls a multi-dimensional semantic filtering engine for in-depth analysis. This engine is designed with a three-level pipeline structure, refining layer by layer to balance efficiency and accuracy. The first level is fast pattern matching: based on a predefined set of regular expressions, it scans the log content to identify whether it contains preset keywords such as ERROR, WARNING, and DEBUG. This level can be completed within microseconds, used to quickly remove obvious harmless information or mark high-risk information. The second level is contextual analysis: by parsing the call stack (backtrace) information of the current process, combined with a preset mapping table of process ID and functional modules (e.g., mapping process "opc_server" to the data acquisition module, and "ui_main" to the interface refresh module), it determines the specific business scenario type that generated the log, including interface refresh, business logic, and operation record types. The same text log in different scenarios may have completely different importance—for example, "refresh complete" is redundant noise in the interface refresh category, while in the business logic category it may indicate a critical state change. The third level is time-series behavior analysis: it statistically analyzes the frequency of logs with the same or similar patterns (after regular expression fuzzy matching) occurring within a predetermined time window (e.g., 1 second or 10 seconds). High-frequency repetitive logs commonly found in the gas turbine's host computer (e.g., hundreds of "redraw window" messages per second) are major contributors to disk usage. This level can accurately identify such "log storms" and classify them as redundant output. The three-level engine executes sequentially, with each level able to output conclusions in advance for subsequent rule matching. The overall processing latency is controlled within microseconds to milliseconds, without affecting the real-time monitoring performance of the host computer.

[0028] Based on the above three-level analysis results, this method matches and semantically analyzes the log content against a pre-configured XML rule file, outputting three judgment results and adopting differentiated handling strategies for each. The first category is "important logs requiring hierarchical storage": these logs typically contain fault alarms, critical status changes, or user operation records. The system dynamically writes them to at least one level of the three-level storage system based on their importance score (determined by the priority field in the rule). The first level uses a circular buffer implemented with shared memory for cross-process access by real-time diagnostic tools, retaining the most recent 1000 logs; the second level is a local solid-state disk compressed storage area, which uses a log structured merge tree (LSM Tree) to organize data and adaptively selects the LZ4 or Zstandard compression algorithm according to the content type, retaining important logs within 24 hours, balancing storage efficiency and query performance; the third level is a network log server, which synchronously reports critical error logs to the central server through a reliable transmission protocol with sequence number allocation, acknowledgment, and timeout retransmission, enabling remote monitoring and fault tracing. The second category is "redundant noise logs that can be directly discarded": These logs are determined by the engine to be high-frequency repetitive information or pure debugging information of no value, and the system discards them directly without writing them to any storage medium, thus suppressing disk usage at the source. The third category is "ordinary logs that do not match any rules": These logs are neither important nor obvious noise, and the system allows them to pass through, writing them to the xsession-errors file originally allocated by the operating system, ensuring that the integrity of the log records is not compromised. Through this hierarchical handling mechanism, this method effectively controls disk usage while ensuring that all potentially valuable information is properly preserved or reported.

[0029] The method proposed in this application has the following outstanding advantages: First, zero intrusion—no modification to any application source code is required, and no recompilation or linking is necessary, making it particularly suitable for gas turbine DCS systems containing third-party closed-source software, resulting in extremely low deployment risk. Second, intelligent semantic filtering—through a three-level analysis engine, it can distinguish the value of logs in different scenarios such as interface refresh, business logic, and operation records, avoiding the problem of traditional cleanup scripts indiscriminately deleting critical alarm information. Third, hierarchical storage and reliable transmission—important logs are stored in a memory circular buffer, local compressed storage, and a remote server according to their urgency, meeting both the low latency requirements of real-time diagnosis and achieving permanent archiving of critical fault information. Fourth, rollback-enabled zero-intrusion deployment—in conjunction with environment detection, configuration adaptation, and system snapshot recovery mechanisms, it can be securely deployed on existing network node supervisory units, and can be restored to its original state with one click in case of anomalies, ensuring the continuous availability of the gas turbine monitoring system. In summary, this application fundamentally solves the problem of disk exhaustion, system lag, and even crashes caused by the unlimited growth of log files such as xsession-errors in the gas turbine host computer. At the same time, it fully preserves the key information needed for troubleshooting, significantly improving the operational stability and maintenance convenience of the gas turbine distributed control system.

[0030] In some embodiments, the dynamic link library can be specifically implemented as libXLogInterceptor.so, which reads the rule configuration file / etc / dcs_log_rules.conf during initialization; the shared memory circular buffer retains the most recent 1000 important logs by default, and the local solid-state disk compressed storage area retains important logs within 24 hours by default; the three-level analysis of the multi-dimensional semantic filtering engine can arrive at the judgment conclusion in advance at any level; the log business types specifically include three categories: UI refresh logs, business logic logs, and operation logs.

[0031] In some embodiments, the rule configuration file is defined in XML format, and the dynamic link library reads the rule configuration file during initialization.

[0032] This rule configuration file is used to carry the core strategy of log filtering. By presetting log priority, matching mode, context conditions and application identifier, it provides a unified judgment basis for subsequent three-level semantic filtering. The system completes the final judgment of important logs, redundant noisy logs and ordinary logs based on the rules, ensuring that the log handling behavior is consistent with the preset strategy.

[0033] In some embodiments, the dynamic link library in step S2 is implemented using function wrapping technology. A wrapper function with the same name as the target log output function is defined in the dynamic library, and the symbol resolution priority of the dynamic linker is used to make the graphical process call the wrapper function first.

[0034] By constructing a wrapper function with the same name as the standard log output function using function wrapping technology, and leveraging the symbol resolution priority of the dynamic linker to achieve priority invocation, the log output can be fully intercepted without modifying the source code of the host computer graphical program. This provides an execution entry point for subsequent target file judgment, three-level semantic analysis, log type identification, and hierarchical storage.

[0035] In some embodiments, the log output function intercepted by the wrapper function in step S2 includes at least one of printf, fwrite, and qDebug.

[0036] It uniformly intercepts commonly used log output interfaces such as printf, fwrite, and qDebug, and can completely capture all logs to be managed generated by the host computer's graphical process, ensuring that the three-level semantic filtering, log discrimination, and hierarchical storage can cover all log streams written to the graphical interface session log file.

[0037] In some embodiments, step S5, which involves matching and semantically judging the log content against the log priority, pattern matching string, context association conditions, and application identifier defined in the rule configuration file based on the three-level analysis results, and outputting a judgment result, specifically includes: the three-level analysis results serving as input for rule matching; the first-level pattern matching results being used to match the pattern matching string in the rules to identify whether the log content conforms to a preset format; the second-level business scenario type judgment results being used to match the context association conditions in the rules to verify whether the log meets the requirements of a specific business scenario; the third-level high-frequency repetition identification results, combined with the priority in the rules, assisting in determining the importance level of the log; and the application identifier being used to distinguish the log processing strategies of different graphical processes.

[0038] In some embodiments, the determination result is output according to the following rules: If the log content matches error or warning keywords through the first-level pattern matching, and is determined to belong to business logic or operation record categories through the second-level context association analysis, and is determined not to be high-frequency repetitive output through the third-level time sequence behavior analysis, then it is determined to be an important log that needs to be stored hierarchically based on the priority in the rules. If the log content only matches the debugging keyword after the first level pattern matching, and is determined to belong to the interface refresh category after the second level context association analysis, and is determined to be high-frequency repetitive output after the third level time sequence behavior analysis, then it is determined to be a redundant noise log that can be directly discarded based on the context association conditions in the rules. If, after the above three-level analysis, the log content does not match any pattern string, contextual conditions, or application identifier in any rule, it is determined to be a normal log that does not match any rule.

[0039] In some embodiments, the circular buffer in step S5 is a cross-process access circular queue implemented with shared memory, and each log entry includes a timestamp, process ID, log level, importance score, and log content.

[0040] The circular buffer, as the first level of the three-level storage, uses shared memory to enable cross-process access. Each log entry includes a timestamp, process ID, log level, importance score, and content. It is used to store recent data of logs that have been identified as important in the nearest location, providing a fast and readable log source for real-time fault diagnosis.

[0041] In some embodiments, the circular buffer described in step S5 provides a thread-safe read / write interface and is configured with an automatic overwrite mechanism; when the buffer is full, a new log entry overwrites the old log entry with the lowest importance score.

[0042] The circular buffer adopts a thread-safe read / write and automatic overwrite strategy. When the buffer is full, it overwrites old entries in order of importance from low to high, maximizing the retention of high-value and important logs within a limited memory space, thereby improving the storage effectiveness and log value density of the first level of the three-level storage system.

[0043] In some embodiments, the local solid-state drive compressed storage area in step S5 organizes data using a log-structured merged tree structure and adaptively selects a compression algorithm for storage based on the log content type.

[0044] The local solid-state drive compressed storage area is the second level of the three-level storage. It uses a log-structured merged tree structure to organize data and adaptively selects compression algorithms based on the log content type. It is used for medium- to long-term storage of information identified as important logs, which significantly reduces disk usage while ensuring that logs can be retrieved and parsed normally.

[0045] In some embodiments, the local solid-state drive compressed storage area adaptively selects a compression algorithm based on the log content type as follows: For plain text logs (such as user operation records, interface state changes, etc.), the LZ4 fast compression algorithm is used to achieve the highest compression and decompression speed to meet near real-time query requirements; for logs containing binary or structured data (such as collected data packets, diagnostic snapshots, etc.), the Zstandard (zstd) compression algorithm is used to achieve a balance between compression ratio and speed. Before writing to the compressed storage area, the dynamic library automatically determines the content type by detecting the proportion of non-ASCII characters in the log content or a preset log type marker, thereby selecting the corresponding compression algorithm.

[0046] Furthermore, the specific implementation of the reliable transmission protocol used in the network log server includes: the client (i.e., the dynamic library on the host computer side) assigns a monotonically increasing sequence number to each log entry that needs to be reported and stores the log in a sending queue. The client sends the logs to the server in batches (e.g., every 10 logs or every 100 milliseconds). Upon receiving the logs, the server returns an acknowledgment (ACK) containing the largest consecutive sequence number that has been successfully received. The client maintains an acknowledgment queue. For log entries that have not received an acknowledgment, a retransmission is triggered after a timeout (e.g., 500 milliseconds). The retransmission interval adopts an exponential backoff strategy (e.g., 500ms, 1s, 2s, with a maximum of 5s) until the maximum number of retransmissions (e.g., 3 times) is reached, at which point the retransmission is abandoned and a local error is recorded. This mechanism ensures that critical error logs can still reliably reach the remote log server during network fluctuations, achieving zero-loss reporting.

[0047] In some embodiments, the network log server in step S5 uses a reliable transmission protocol with sequence number allocation, acknowledgment and timeout retransmission mechanisms to achieve synchronous reporting of critical error logs.

[0048] The network log server is the third level of the three-tier storage system. It adopts a reliable transmission protocol with sequence number allocation, acknowledgment and timeout retransmission mechanisms. It synchronously reports important logs of critical error categories, which have been identified through three-tier screening and rule analysis, to the central log server, thereby enabling remote archiving and centralized monitoring of important logs.

[0049] In some embodiments, a zero-intrusive deployment step is included before step S1: the zero-intrusive deployment step includes performing runtime environment detection on the host computer and completing configuration adaptation based on the detection results; the runtime environment detection includes identifying the operating system type, version, desktop environment, and installed graphics libraries.

[0050] The runtime environment detection can automatically identify the host computer's operating system type, version, desktop environment, and installed graphics libraries, and generate adaptation parameters based on the actual environment to ensure that dynamic library injection, log interception, three-level semantic filtering, log discrimination, and hierarchical storage all run stably on different field nodes.

[0051] In some embodiments, the zero-intrusive deployment steps further include: creating a system snapshot before deployment, performing functional verification after deployment, and restoring to the original state through the snapshot when an anomaly occurs.

[0052] Before deployment, a system snapshot is created; after deployment, functional verification is performed; and in case of an anomaly, the original state can be restored with one click using the snapshot. This constitutes a complete rollback guarantee for zero-intrusion deployment, ensuring that the online process of functions such as three-level screening, log discrimination, and hierarchical storage does not affect the continuous operation of the gas turbine host computer monitoring business.

[0053] In some embodiments, the dynamic link library automatically reads the pre-configured log filtering rule configuration file during the loading and initialization phase, loading the rule information into memory to enable rapid calls between the interception function and the semantic filtering engine, thereby improving log processing efficiency. This method only applies to xsession. The errors logs undergo subsequent analysis and filtering. Output written to other paths or application-owned log files is directly allowed, precisely addressing disk usage issues without affecting existing business log records. A multi-dimensional semantic filtering engine uses three levels of analysis to comprehensively determine log value: fast pattern matching identifies log level markers, contextual correlation analysis determines the business scenario and functional module to which the logs originated, and time-series behavior analysis identifies frequently repetitive and redundant refresh logs. The combination of these three methods provides a comprehensive basis for log type identification. Based on the results of the three-level analysis and filtering rules, the system comprehensively judges logs containing fault alarms, abnormal errors, and critical state changes as important logs; frequently repetitive and diagnostically worthless interface refresh and debugging information as redundant noise logs; and logs that do not match the filtering rules and do not belong to the first two categories are classified as ordinary logs. Differential processing is then applied: tiered storage, direct discarding, or allowing writing to the original file. The three-tiered storage system is configured according to log importance and usage scenarios. A shared memory circular buffer stores recent important logs to meet real-time fault diagnosis needs. A local solid-state drive compressed storage area retains important logs within a certain period to achieve reliable local storage. A network log server is used to synchronously report critical error logs for remote centralized monitoring and fault tracing. This method uses dynamic library preloading to intercept logs, requiring no modification to the host computer's graphical application source code, no recompilation or linking, and no stopping or restarting of existing running processes. It only affects newly started processes, featuring zero intrusion, low risk, and easy deployment. By uniformly intercepting various log output functions in the standard library and graphics library, it can completely capture all information written to the graphical interface session log files generated by the host computer's graphical process, ensuring that all logs to be managed enter the semantic filtering and hierarchical processing flow, avoiding omissions.

[0054] like Figure 1The diagram illustrates the log suppression method for gas turbine host computer based on dynamic library injection and semantic filtering. First, the dynamic library injection graphical process is intercepted using the LD_PRELOAD mechanism. Then, log function call interception is executed, capturing all log output behavior. Next, it is determined whether the log target is xsession-errors. If the target is xsession-errors, multi-dimensional semantic filtering analysis is performed. If the target is not xsession-errors, the log is directly allowed to the original log file. After semantic filtering, rule matching analysis is performed to determine whether the log needs to be intercepted. If interception is required, hierarchical storage routing is implemented, writing the log to at least one of the following: memory buffer, local SSD storage, or network log server. If interception is not required, the log is directly allowed to the original log file, completing the entire log suppression process.

[0055] This application provides a method for suppressing logs from a gas turbine host computer using dynamic library injection and semantic filtering. The method includes: pre-configuring log filtering rules; injecting an interception library into the host computer's graphical process via a dynamic link library preloading mechanism to intercept log output functions; determining whether the log target is a graphical interface session log file; if not, allowing the log to pass; if so, calling a multi-dimensional semantic filtering engine for three-level comprehensive analysis; and based on the analysis results and matching rules, writing important logs to a circular buffer, local compressed storage area, or network log server, discarding redundant and noisy logs, and only allowing ordinary logs to the original file. This application effectively suppresses disk usage of log files without modifying the source code or requiring zero-intrusion deployment, while preserving critical fault information, improving the operational stability of the gas turbine host computer, and solving the problem of preserving critical fault information while suppressing disk usage.

[0056] Similar parts between the embodiments provided in this invention can be referred to mutually. The specific embodiments provided above are merely examples under the overall concept of this invention and do not constitute a limitation on the scope of protection of this application. For those skilled in the art, any other embodiments extended from the solution of this invention without creative effort are within the scope of protection of this invention.

Claims

1. A method for suppressing logs of a gas turbine host computer using dynamic library injection and semantic filtering, characterized in that, Includes the following steps: Step S1: Pre-configure log filtering rules and generate a rule configuration file. The rule configuration file defines the priority, pattern matching string, context association conditions, and application identifier for different logs. Step S2: Through the dynamic link library preloading mechanism, the dynamic link library that implements the log interception function is injected into all graphical processes of the host computer, so that the graphical process will execute the interception function in the dynamic link library first when calling the log output function. Step S3: The interception function captures the log output of the current process and determines whether the target file of the log output is the log file of the graphical interface session, wherein the log file of the graphical interface session includes xsession-errors; If the target file is not the log file of the graphical interface session, allow the log output to be written to the original path; if the target file is the log file of the graphical interface session, perform subsequent analysis on the log output. Step S4: Call the multi-dimensional semantic filtering engine to perform comprehensive analysis on the log output content. The comprehensive analysis includes three levels in sequence. The first level is to perform pattern matching on the log content based on regular expressions to identify whether it contains preset error, warning or debugging keywords. The second level analyzes the call stack information of the current process and, combined with the mapping relationship between the process identifier and the functional module, determines the business scenario type of the log generation, including interface refresh, business logic, or operation record types. The third level counts the frequency of logs with the same or similar patterns within a predetermined time window to identify whether there is high-frequency repetitive redundant output. Step S5: Based on the three-level analysis results, match and semantically analyze the log content with the log priority, pattern matching string, context association conditions and application identifier defined in the rule configuration file, and output the judgment result. The judgment result includes important logs that need to be stored hierarchically, redundant and noisy logs that can be directly discarded, or ordinary logs that do not match any rules. For important logs that are determined to require tiered storage, they are written to at least one level of the three-tiered storage system; the three-tiered storage system includes a circular buffer, a local solid-state disk compressed storage area, and a network log server. Redundant and noisy logs that are determined to be discardable are discarded directly without being written to any storage medium; For ordinary logs that are determined not to match any rules, they are written to the original system log file allocated by the operating system for the graphical interface session.

2. The method according to claim 1, characterized in that, The rule configuration file is defined in XML format, and the dynamic link library reads the rule configuration file during initialization.

3. The method according to claim 1, characterized in that, The dynamic link library mentioned in step S2 is implemented using function wrapping technology. A wrapper function with the same name as the target log output function is defined in the dynamic library. By utilizing the symbol resolution priority of the dynamic linker, the graphical process is given priority to call the wrapper function. The log output function intercepted by the wrapper function includes at least one of printf, fwrite, and qDebug.

4. The method according to claim 1, characterized in that, Step S5, based on the three-level analysis results, involves matching and semantically evaluating the log content against the log priority, pattern matching string, contextual association conditions, and application identifier defined in the rule configuration file, and outputting the judgment result. Specifically, this includes: The three-level analysis results serve as input for rule matching. The first-level pattern matching result is used to match the pattern matching string in the rule and identify whether the log content conforms to the preset format. The second-level business scenario type judgment result is used to match the context association conditions in the rule and verify whether the log meets the requirements of a specific business scenario. The third-level high-frequency repetition recognition result, combined with the priority in the rule, helps to determine the importance level of the log. The application identifier is used to distinguish the log processing strategies of different graphical processes.

5. The method according to claim 1, characterized in that, The circular buffer mentioned in step S5 is a cross-process access circular queue implemented using shared memory. Each log entry includes a timestamp, process ID, log level, importance score, and log content.

6. The method according to claim 5, characterized in that, The circular buffer described in step S5 provides a thread-safe read / write interface and is configured with an automatic overwrite mechanism; when the buffer is full, the new log entry overwrites the old log entry with the lowest importance score.

7. The method according to claim 1, characterized in that, In step S5, the local solid-state disk compressed storage area uses a log-structured merged tree structure to organize data and adaptively selects a compression algorithm for storage based on the log content type.

8. The method according to claim 1, characterized in that, The network log server described in step S5 uses a reliable transmission protocol with sequence number allocation, acknowledgment and response and timeout retransmission mechanisms to achieve synchronous reporting of critical error logs.

9. The method according to claim 1, characterized in that, Before step S1, a zero-intrusive deployment step is also included, which includes performing runtime environment detection on the host computer and completing configuration adaptation based on the detection results; the runtime environment detection includes identifying the operating system type, version, desktop environment, and installed graphics libraries.

10. The method according to claim 9, characterized in that, The zero-intrusive deployment steps also include: Create a system snapshot before deployment, perform functional verification after deployment, and restore to the original state through the snapshot if an anomaly occurs.

Images