Log analysis method, log analysis apparatus and related product

Abstract

Provided in the present application are a log analysis method, a log analysis apparatus and a related product, by means of which the accuracy of log analysis can be improved. The method comprises: acquiring a target log template of a target log and a first label of the target log template, wherein the target log template comprises information, which indicates the state of the target log, in the target log, and the first label is used for indicating that the target log is abnormal; on the basis of the degree of matching between the target log template and a normal log template in a log database, constructing prompt text, wherein the prompt text comprises a matching normal log template; on the basis of the prompt text, executing a false-alarm detection operation on the target log template, so as to determine a second label of the target log template; and on the basis of the second label, determining the state of the target log.

Description

Log analysis method, log analysis device and related products

[0001] The present application claims priority to the Chinese patent application No. 202411111509.3, filed on August 14, 2024, with the State Intellectual Property Office of China, and entitled "Log analysis method, log analysis device and related products", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the technical field of computer, and in particular, to a log analysis method, a log analysis device and related products. BACKGROUND

[0003] Businesses run on computers will generate logs, which record the running state of the business, including the running state of the business (such as start time, end time and running result) and abnormal information, etc. Therefore, by analyzing the logs, the occurred or potential faults in the running process of the business can be identified, so as to optimize the business running process and reduce potential risks.

[0004] The existing scheme can analyze the logs in the following way: collecting normal logs, which record the running state of the business running normally on the computer. Then, the normal logs are used to train a single classification model, so that the single classification model can learn the features of the normal logs. Finally, the log to be analyzed is input into the trained single classification model, and the inference of the single classification model is performed to determine whether the log to be analyzed is abnormal. Since the single classification model relies heavily on the training data, when the training data fails to cover various cases of the normal logs, the single classification model may not accurately capture multiple features of the normal logs in the learning process, which will affect the accuracy of log analysis. SUMMARY

[0005] The embodiments of the present application provide a log analysis method, a log analysis device and related products, which can improve the accuracy of log analysis.

[0006] In a first aspect, the present application provides a log analysis method, which comprises: obtaining a target log template of a target log and a first label of the target log template, the target log template comprising information indicating a state of the target log in the target log, and the first label being used to indicate an abnormality of the target log; constructing a prompt text according to a matching relationship between the target log template and a normal log template in a log database, the prompt text comprising the matched normal log template; performing a false alarm detection operation on the target log template according to the prompt text to obtain a second label of the target log template; and determining the state of the target log according to the second label.

[0007] It can be understood that the target log template includes information indicating the state of the target log. According to the matching relationship between the target log template and the normal log template in the log database, the prompt text is constructed, and then the false alarm detection operation is performed on the target log template according to the prompt text. Since the matched normal log template is included in the prompt text, it is helpful to compare the target log template with the normal log template to accurately determine the second label of the target log template, thereby improving the accuracy of log analysis.

[0008] Based on the first aspect, in possible implementation manners, the specific process of performing the false alarm detection operation on the target log template according to the prompt text to obtain the second label of the target log template is as follows:

[0009] The prompt text is input into the large language model LLM to obtain the second label of the target log template.

[0010] It can be understood that the LLM has strong semantic understanding and natural language processing capability. By inputting the prompt text into the large language model LLM, the large language model LLM can make full use of the information provided by the prompt text, so that the obtained second label of the target log template is more accurate.

[0011] Based on the first aspect, in possible implementation manners, the log database further includes an abnormal log template;

[0012] The specific process of obtaining the first log template of the first log and the first label of the first log template is as follows:

[0013] The first log template is extracted from the first log;

[0014] It is determined that the target log template does not match all the log templates in the log database;

[0015] The target log template is input into the single-classification abnormality detection model to obtain the first label of the target log template, and the single-classification abnormality detection model is trained based on a plurality of normal log templates.

[0016] It can be understood that when it is determined that the target log template does not match all the log templates in the log database, the label of the target log template cannot be determined. The target log template is input into the single-classification abnormality detection model to obtain the first label of the target log template. Since the single-classification abnormality detection model is trained based on a plurality of normal log templates, the single-classification abnormality detection model can compare the features of the target log template with the features of the learned normal log templates. When the state of the target log corresponding to the target log template is normal, the state of the target log corresponding to the target log template can be accurately determined as normal, thereby reducing the misjudgment of the target log template.

[0017] In a possible implementation manner of the first aspect, the second label is used to indicate a target log exception.

[0018] After determining the state of the target log according to the second label, the method further includes:

[0019] obtaining a target log block, the target log block including the target log and context of the target log;

[0020] determining a weight of a sentence in the target log block according to an information entropy of the sentence in the target log block;

[0021] obtaining a summary of the target log according to the weight of the sentence in the target log block, the summary of the target log being sentences corresponding to M largest weights in the target log block;

[0022] providing the summary of the target log to a user.

[0023] It can be understood that the information entropy can reflect the information amount of a sentence, and the weight of the sentence is determined based on the information entropy of the sentence, so that the weight of a sentence with a large information amount is greater than the weight of a sentence with a small information amount. Then, the sentence with a large weight is used as the summary of the target log, so that the summary of the target log can reflect more information that can reflect the running state of the business, and the user can understand the running state of the business based on the summary of the target log.

[0024] In a possible implementation manner of the first aspect, a specific process of determining the weight of the sentence in the target log block according to the information entropy of the sentence in the target log block is as follows:

[0025] constructing a text correlation graph according to the relationship between the sentences in the target log block, the text correlation graph including a plurality of nodes and edges between the nodes, wherein the nodes in the text correlation graph are used to indicate the sentences in the target log block, and the edges in the text correlation graph are used to indicate an association relationship between the sentences indicated by the nodes at two ends of the edges;

[0026] updating the weight of the node in the text correlation graph according to an initial weight of the node in the text correlation graph and a weight of the edge in the text correlation graph;

[0027] obtaining the weight of the sentence in the target log block according to the new weight of the node in the text correlation graph.

[0028] In the above scheme, the text correlation graph is constructed according to the relationship between the sentences in the target log block, so that the association relationship between the sentences can be more comprehensively understood, and the overall understanding of the target log is improved, so that the summary of the target log can include more information that can reflect the running state of the business.

[0029] In a possible implementation manner of the first aspect, the method further includes: updating the log database according to the target log template and the second label of the target log template.

[0030] In the above solution, the log database is updated according to the target log template and the second label of the target log template, so that the data in the log database is enriched, and more reference log templates are provided for log analysis. In addition, updating the log database can avoid time and resource consumption caused by retraining the model in the case that the result of log analysis is incorrect.

[0031] In a second aspect, the present application provides a log analysis device, comprising:

[0032] The acquisition module is configured to acquire a target log template of a target log and a first label of the target log template, the target log template including information indicating a state of the target log, and the first label being used to indicate an abnormality of the target log.

[0033] The analysis module is configured to construct a prompt text according to a matching relationship between the target log template and a normal log template in a log database, the prompt text including the matching normal log template; perform a false alarm detection operation on the target log template according to the prompt text to obtain a second label of the target log template; and determine the state of the target log according to the second label.

[0034] In a possible implementation manner of the second aspect, the analysis module is configured to input the prompt text into a large language model (LLM) to obtain the second label of the target log template.

[0035] In a possible implementation manner of the second aspect, the log database further includes an abnormal log template.

[0036] The acquisition module is configured to extract a first log template from a first log; determine that the target log template does not match all log templates in the log database; and input the target log template into a single-classification abnormality detection model to obtain the first label of the target log template, the single-classification abnormality detection model being trained based on a plurality of normal log templates.

[0037] In a possible implementation manner of the second aspect, the second label is used to indicate an abnormality of the target log, and the device further includes:

[0038] The abstract extraction module is configured to acquire a target log block, the target log block including the target log and a context of the target log; determine a weight of a sentence in the target log block according to information entropy of the sentence; and obtain an abstract of the target log according to the weight of the sentence in the target log block, the abstract of the target log being a sentence corresponding to a top M weight in the target log block.

[0039] The display module is used to provide users with a summary of the target log.

[0040] Based on the second aspect, in a possible implementation, the summary extraction module is used to construct a text association graph based on the relationship between sentences in the target log block. The text association graph contains multiple nodes and edges between nodes. Nodes in the text association graph are used to indicate sentences in the target log block, and edges in the text association graph are used to indicate the association relationship between sentences indicated by nodes located at both ends of the edge.

[0041] Based on the initial weights of the nodes in the text association graph and the weights of the edges in the text association graph, update the weights of the nodes in the text association graph. The initial weights of the nodes in the text association graph are the information entropy of the sentences indicated by the nodes, and the weights of the edges are the similarity between the sentences indicated by the nodes at both ends of the edge.

[0042] The weights of sentences in the target log block are obtained based on the new weights of the nodes in the text association graph.

[0043] Based on the second aspect, in a possible implementation, the device further includes a feedback module for updating the log database according to the target log template and a second tag of the target log template.

[0044] Thirdly, this application provides a computing device cluster including at least one computing device, the at least one computing device including a memory and a processor, the processor of the at least one computing device being configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster implements the method described in the first aspect and any possible implementation thereof.

[0045] Fourthly, this application provides a computer storage medium including program instructions that, when executed on a computing device cluster, enable the computing device cluster to perform the method described in the first aspect and any possible implementation thereof.

[0046] Fifthly, this application provides a computer program product, including program instructions that, when executed on a computing device cluster, cause the computing device cluster to perform the method described in the first aspect or any possible implementation thereof. The computer program product may be a software installation package. When the method provided by any possible design of the first aspect is required, the computer program product may be downloaded and executed on the computing device cluster to implement the method described in the first aspect and any possible implementation thereof. Attached Figure Description

[0047] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced.

[0048] Fig. 1 is a schematic diagram of a log analysis scenario provided by the present application;

[0049] Fig. 2 is a flow diagram of a log analysis method provided by the present application;

[0050] Fig. 3 is a flow diagram of determining the third state of the target log provided by the present application;

[0051] Fig. 4 is a schematic diagram of a prompt text template provided by the present application;

[0052] Fig. 5 is a schematic diagram of a prompt text provided by the present application;

[0053] Fig. 6 is a flow diagram of extracting the summary of the target log provided by the present application;

[0054] Fig. 7 is a schematic diagram of a text correlation graph provided by the present application;

[0055] Fig. 8 is a structural diagram of a log analysis device provided by the present application;

[0056] Fig. 9 is a structural diagram of a computing device provided by the present application;

[0057] Fig. 10 is a structural diagram of a computing device cluster provided by the present application;

[0058] Fig. 11 is a structural diagram of another computing device cluster provided by the present application. DETAILED DESCRIPTION

[0059] The technical solutions provided by the present application will be described below in combination with the drawings.

[0060] Referring to Fig. 1, Fig. 1 shows a schematic diagram of a log analysis scenario provided by the present application. As shown in Fig. 1, the scenario includes a log analysis device 100 and a database system 200, wherein the log analysis device 100 and the database system 200 are connected through a network, which can be a wide area network or a local area network.

[0061] The log analysis apparatus 100 can be deployed on a single computing device or a computing device cluster composed of multiple computing devices. The computing device herein includes a bare metal server (BMS), a virtual machine, a container, or an edge computing device. Among them, the BMS refers to a general-purpose physical server, such as an ARM server or an X86 server; the virtual machine refers to a complete computer system implemented by software simulation, having complete hardware system functions, and running in a completely isolated environment through network function virtualization (NFV) technology; the container refers to a group of processes that are limited in resources and isolated from each other; and the edge computing device refers to a device closer to the data source and the end user, having low latency and high bandwidth characteristics, such as a smart router, an edge server, and the like.

[0062] The database system 200 can include multiple storage nodes, and the storage node herein is a device with storage capability, which can include a hard disk, a magnetic disk, or other types of storage media.

[0063] It is worth noting that, in addition to the separate deployment as shown in FIG. 1, the log analysis apparatus 100 and the database system 200 can also be deployed together according to business needs, for example, the log analysis apparatus 100 and the database system 200 are deployed by the same hardware resource, and the log analysis apparatus 100 and the database system 200 respectively implement corresponding functions through different software modules. For ease of description, the following embodiments are introduced in the deployment form of the log analysis apparatus 100 and the database system 200 shown in FIG. 1.

[0064] Next, the process of how to implement log analysis in the scenario shown in FIG. 1 is introduced in combination with specific flow steps.

[0065] Referring to FIG. 2, FIG. 2 is a flow diagram of a log analysis method provided by the present application. The method is applied to a communication system composed of a log analysis apparatus and a database system 200, wherein the log analysis apparatus can be, for example, the log analysis apparatus 100 in FIG. 1, and the database system 200 can be the database system 200 in FIG. 1.

[0066] S201: The log analysis apparatus acquires a target log to be analyzed.

[0067] The target log records events and information in the business running process, and usually includes a timestamp, a log level, message content, and other related identification information.

[0068] Specifically, the log analysis apparatus can obtain logs in a time period from a database system by querying conditions (e.g., time range), and take any one of the logs in the time period as a target log, wherein the database system stores logs generated by a computer system running in different time periods.

[0069] S202: The log analysis apparatus obtains a target log template according to the target log.

[0070] In an implementation, the target log obtained by the log analysis apparatus from the database system is an unstructured log, which means that the content in the target log lacks explicit fields or markers to distinguish the content of different parts in the target log. By parsing the target log, a structured target log composed of log time, component, target log template, and parameter list can be obtained, which means that the content in the target log has explicit fields or markers to distinguish the content of different parts in the target log. The log analysis apparatus obtains the target log template from the structured target log. The parsing method includes but is not limited to drain algorithm and machine learning algorithm.

[0071] The component is used to indicate the business corresponding to the target log; the target log template includes information indicating the state of the target log in the target log; and the parameter list includes parameters in the target log.

[0072] For example, the target log is "Error occurred in ComponentA at 2024-01-01 12:00:00:Connection timeout for user'Alice'from IP'192.168.1.1'", which is an unstructured log. By parsing the unstructured target log, a structured target log "[2024-01-01 12:00:00][ComponentA]Error:Connection timeout for user'Alice'from IP'192.168.1.1'" is obtained. The log time is "2024-01-01 12:00:00", the component is "ComponentA", the target log template is "Error:Connection timeout for user'{username}from IP'{ip}'", and the parameter list is {username:'Alice', ip:'192.168.1.1'}.

[0073] It should be understood that the format of the logs generated when the business runs on different servers can be different (for example, the log time format is inconsistent), and these logs are usually unstructured logs, which increases the difficulty of log analysis. By parsing the unstructured logs into structured logs, it is convenient to extract log templates from the logs that can reflect the running state of the business.

[0074] In another implementation, the target log is a structured log, and the log analysis device directly obtains the target log template from the structured target log.

[0075] S203: The log analysis device first determines the state of the target log (hereinafter referred to as the "first state" for ease of description) according to the matching relationship between the target log template and the log templates in the log database.

[0076] The database system includes a log database, which includes a plurality of log templates, vectors corresponding to the plurality of log templates, and labels of the plurality of log templates. The label of the log template can be label A or label B. When the label of the log template is label A, it means that the state of the log corresponding to the log template is abnormal. When the label of the log template is label B, it means that the state of the log corresponding to the log template is normal. The log analysis device determines the first state of the target log according to the matching relationship between the target log template and the log templates in the log database. The first state of the target log depends on the label of the matched log template, and the first state of the target log includes abnormal, normal, or suspected abnormal.

[0077] Specifically, taking the target log template and a log template (hereinafter referred to as "log template A") in the log database as an example, the log analysis device can determine the matching relationship between the two in the following way: first, the log analysis device calculates the vector of the target log template, and then calculates the similarity between the vector of the target log template and the vector of the log template A. When the similarity is greater than or equal to a first threshold, it is determined that the target log template matches the log template A; when the similarity is less than the first threshold, it is determined that the target log template does not match the log template A.

[0078] In a possible implementation, the log analysis device can input the target log template into a vectorization model, and obtain the vector of the target log template through the calculation of the vectorization model. The vectorization model can be an existing artificial intelligence model that can better calculate vectors, such as a model based on a transformer architecture, a Word2Vec model, etc., which is not limited in the present application.

[0079] Taking a model based on a transformer architecture as an example, in the training stage, the semantic information and features of the log templates are learned through a large number of log templates, and the log templates are gradually converted into vectors by using a multi-layer Transformer encoder. By continuously adjusting the parameters by minimizing the loss function, the fitting ability of the vectorization model to the log templates is improved, thereby enhancing the representation ability of the log templates; in the test stage, the input log template is converted into a vector by the vectorization model for subsequent log analysis.

[0080] The above process only records the process in which the log analysis device determines the matching relationship between the target log template and the log template A, but the log analysis device can also determine the matching relationship between the target log template and other log templates in the log database in the same way.

[0081] It should be understood that in actual application, the following three cases can exist:

[0082] Case 1: The similarity between the target log template and all the log templates in the log database is less than the first threshold. In this case, the log analysis device can determine that the state of the target log is suspected abnormal.

[0083] Case 2: The similarity between the target log template and only one log template in the log database is greater than or equal to the first threshold. In this case, the log analysis device can determine that the state of the target log template is the state indicated by the label of the log template matched with the target log template. Specifically, when the label of the log template matched with the target log template is label A, the log analysis device can determine that the first state of the target log is abnormal; when the label of the log template matched with the target log template is label B, the log analysis device can determine that the first state of the target log is normal.

[0084] Case 3: The similarity between the target log template and multiple log templates in the log database is greater than or equal to the first threshold. In this case, the log analysis device can comprehensively analyze the labels of these log templates to determine the first state of the target log, which can reduce the risk of misjudgment. Specifically: when the number of log templates with label A among the matched multiple log templates is greater than the number of log templates with label B, it is determined that the first state of the target log is abnormal; when the number of log templates with label A is less than the number of log templates with label B, it is determined that the first state of the target log is normal; when the number of log templates with label A is equal to the number of log templates with label B, it is determined that the first state of the target log template is the state indicated by the label of the log template with the greatest similarity to the target log template among the matched multiple log templates.

[0085] For ease of understanding, two examples are introduced as follows:

[0086] Suppose the first threshold value is 0.8, the similarity between the target log template and 5 log templates (i.e., log template 1, log template 2, log template 3, log template 4, and log template 5) in the log database is greater than or equal to 0.8, and the labels corresponding to the above 5 log templates are label B, label A, label B, label A, and label B, respectively. Since the number of label A in the 5 log templates is 2 and the number of label B is 3, the number of label B is greater than the number of label A, and thus the first state of the target log can be determined as normal.

[0087] Suppose the first threshold value is 0.7, the similarity between the target log template and 6 log templates (i.e., log template 1, log template 2, log template 3, log template 4, log template 5, and log template 6) in the log database is 0.8, 0.7, 0.84, 0.91, 0.75, and 0.77, respectively, and the labels corresponding to the above 6 log templates are label B, label A, label A, label B, label A, and label B, respectively. The number of label A in the 6 log templates is 3, and the number of label B is 3, and the number of label A is equal to the number of label B. Thus, the first state of the target log can be determined according to the label corresponding to the log template with the greatest similarity to the target log template in the 6 log templates. Since the similarity between log template 4 and the target log template is the greatest among the 6 log templates, the first state of the target log can be determined as the state indicated by the label corresponding to log template 4, i.e., normal.

[0088] It should be understood that the first state of the target log can be normal, abnormal, or suspected abnormal. In order to improve the accuracy of log analysis, the log analysis device can use different steps for subsequent processing for different states: when the first state is normal, S207 can be directly executed; when the first state is abnormal, S206 can be executed first, and then S207 can be executed; when the first state is suspected abnormal, S204 to S207 need to be executed.

[0089] S204: The log analysis device performs an abnormality recognition operation on the target log template according to the vector corresponding to the target log template, and determines the state of the target log again (for ease of description, referred to as "second state" below).

[0090] In a possible implementation, the log analysis apparatus can input the vector corresponding to the target log template into the single-class anomaly detection model, and determine the second state of the target log through inference of the single-class anomaly detection model. The single-class anomaly detection model is an artificial intelligence model that is trained based on normal logs and can better determine whether a log to be analyzed is normal, for example, a deep support vector data description (DeepSVDD) model, an isolation forest model, a one-class support vector machine (One-Class SVM) model, and the like.

[0091] Taking the DeepSVDD model as an example, the log analysis apparatus inputs the vector corresponding to the target log template into the DeepSVDD model. The DeepSVDD model first maps the vector corresponding to the target log template to a low-dimensional space learned in the training phase, and then calculates the distance from the point corresponding to the vector of the target log template in the low-dimensional space to the center of the spherical region. If the distance from the point corresponding to the vector of the target log template in the low-dimensional space to the center of the spherical region exceeds the radius of the sphere learned in the training phase, the second state of the target log is abnormal, otherwise the second state of the target log is normal. The spherical region is a spherical space range defined by the distribution characteristics of the training data learned by the DeepSVDD model in the training phase.

[0092] It should be noted that, in addition to the above manner (i.e., using a single-class anomaly detection model to identify the abnormality of the target log template), the log analysis apparatus can also use other manners to identify the abnormality of the target log template, such as a decision tree model, a convolutional neural network model, and the like, which are not limited by the present application.

[0093] It should be understood that the second state of the target log can be normal or abnormal, and in order to improve the accuracy of log analysis, the log analysis apparatus can use different steps for subsequent processing for different states: when the second state of the target log is abnormal, S205 is performed; when the second state of the target log is normal, S207 is performed.

[0094] S205: The log analysis apparatus performs a false positive detection operation on the target log template, and determines the state (for ease of description, referred to as the "third state" below) of the target log for the third time.

[0095] In a possible implementation, the log analysis apparatus can use a large language model (LLM) to perform a false alarm detection operation on the target log template to determine the third state of the target log. The LLM is a model based on deep learning technology and capable of processing large-scale natural language data. Through a large-scale pre-training process, the LLM can learn the grammatical structure, semantic relationship, and context information in natural language, thereby generating accurate, fluent, and semantically reasonable text.

[0096] Next, this step is described in more detail in combination with a flow diagram for determining the third state of the target log shown in FIG. 3.

[0097] S2051: The log analysis apparatus constructs a prompt text according to the matching relationship between the target log template and the normal log template in the log database.

[0098] Specifically, the database system pre-stores a prompt text template, and the prompt text template defines the format of the prompt text and the content that the prompt text needs to include. Therefore, the log analysis apparatus can obtain the prompt text template from the database system, and then construct the prompt text according to the obtained prompt text template and the matching relationship between the target log template and the normal log template in the log database. The normal log template refers to a log template indicating that the state of the log is normal.

[0099] The prompt information template is designed based on a chain of thought (CoT) method. For ease of understanding, this step is described below in combination with a prompt text template shown in FIG. 4.

[0100] As shown in FIG. 4, the prompt text template is used to instruct to determine the state of the log corresponding to the input log template by following the determination step, and output the determination result and the determination reason. The determination step includes:

[0101] Step 1: Determine the number of reference log templates. If the number of reference log templates is 0, perform step 3; if the number of reference log templates is greater than 0, perform step 2. The reference log template is a normal log template in the log database that matches the input log template.

[0102] Step 2: Determine whether the input log template is similar in structure or semantics to the reference log template. If the input log template is similar to the reference log template, determine that the state of the target log corresponding to the target log template is normal, otherwise determine that the state of the target log corresponding to the target log template is abnormal.

[0103] Step 3: Identify the information contained in the log template, including the identification of key elements, such as error codes, state information, and other important features.

[0104] Based on the above prompt text template, the log analysis apparatus can construct the prompt text shown in FIG. 5. As shown in FIG. 5, the "input log template" in the prompt text is the target log template, and the reference log template set includes normal log templates in the log database that match the target log template. It is worth noting that when the target log template does not match any normal log template in the log database, the reference log template set is an empty set.

[0105] The reference log template set can be determined in the following way:

[0106] The log analysis apparatus calculates the similarity between the vector of the target log template and the vector of a normal log template (hereinafter referred to as "log template B") in the log database. When the similarity between the two is greater than or equal to a second threshold value, it is determined that the target log template matches the log template B, and the log template B is added to the reference log template set, wherein the second threshold value is less than or equal to the first threshold value. When the similarity between the two is less than the second threshold value, it is determined that the target log template does not match the log template B, and the similarity between the vector of the next normal log template in the log database and the vector of the target log template is calculated, and so on, until the similarity between the vector of all normal log templates in the log database and the vector of the target log template is calculated.

[0107] S2052: The log analysis apparatus inputs the prompt text into the LLM, and performs a false positive detection operation on the target log based on the LLM to determine a third state of the target log.

[0108] Specifically, after the log analysis apparatus inputs the prompt text into the LLM, the LLM can be prompted to infer the state of the target log according to the following judgment steps: determining whether there is a parameter log template in the reference log template set. If there is no parameter log template in the reference log template set, the state of the target log is determined according to the information contained in the target log template, wherein the information contained in the target log template includes error code and state information. If there is a parameter log template in the reference log template set, it is determined whether the target log template is similar in structure or semantics to the reference log template. If the target log template is similar to one or more reference log templates, the third state of the target log is determined to be normal, otherwise the third state of the target log is determined to be abnormal.

[0109] When the third state of the target log is normal, S207 is performed.

[0110] Alternatively, when the third state of the target log is abnormal, S206 can also be performed.

[0111] S206: The log analysis apparatus generates an abstract of the target log.

[0112] The summary of the target log is a summary of key information, important features or core content in the target log, which can help users quickly locate abnormal problems generated in the business running process.

[0113] Next, the present step is described in more detail in combination with the flow diagram of the summary extraction of the target log shown in FIG. 6.

[0114] S2061: The log analysis device extracts the target log block from the log file.

[0115] The log file includes a plurality of logs, and the plurality of logs include the target log and the context of the target log. It is worth noting that in actual application, the log analysis device generally obtains the log file, but in order to simplify the description, the above steps are introduced by taking one log (i.e. the target log) in the log file as an example.

[0116] In an implementation mode, the log analysis device can extract the target log block from the log file according to a preset time range, and the extracted target log block includes the target log and the context of the target log, and the context of the target log includes logs whose log generation time meets the preset time range. The log file includes. Wherein, the preset time range is defined by the user or set by the log analysis device. For example, the preset time range can be [m-3ms, m+3ms], where m is the generation time of the target log, and in this case, the context of the target log can specifically include all logs in the log file whose preset time range is in [m-3ms, m) and whose preset time range is in (m, m+3ms].

[0117] In another implementation mode, the log analysis device can extract the target log block from the log file according to a preset line number range, and the extracted target log block includes the target log and the context of the target log, where the context of the target log includes logs meeting the preset line number range. Wherein, the preset line number range is defined by the user or set by the log analysis device. For example, the preset line number range can be [n-5, n+5], where n is the line number of the target log in the log file, and in this case, the context of the target log can specifically include all logs in the log file whose preset line number range is in [n-5, n) and whose preset line number range is in (n, n+5].

[0118] In another implementation, the log analysis apparatus can extract the target log block from the log file according to a preset time range and a preset line number range, the extracted target log block including the target log and context of the target log, where the context of the target log includes logs satisfying the preset time range and the preset line number range. For example, the preset time range is [m-1ms, m+1ms] and the preset line number range is [n-3, n+3], where m is the generation time of the target log and n is the line number of the target log in the log file. In this case, the context of the target log can specifically include all logs in the log file satisfying the condition that the preset time range is in [m-1ms, m) or the preset time range is in (m, m+1ms] and the preset line number range is in [n-3, n) or the preset line number range is in (n, n+3].

[0119] S2062: The log analysis apparatus divides the target log block into multiple sentences.

[0120] In an implementation, the log analysis apparatus divides the target log block into multiple sentences according to delimiters, including but not limited to comma, semicolon and period.

[0121] In addition to the above manner, the log analysis apparatus can also divide the first log block into multiple sentences according to other manners, for example, dividing the target log block into multiple sentences according to syntax structure or semantic information; for another example, dividing the target log block into multiple sentences according to log content, where one log is one sentence.

[0122] S2063: The log analysis apparatus constructs a text correlation graph according to the relationship between the sentences in the target log block and the sentences.

[0123] The text correlation graph includes multiple nodes and edges between the nodes, where the nodes in the text correlation graph are used to indicate the sentences in the target log block, and the edges in the text correlation graph are used to indicate the correlation relationship between the sentences indicated by the nodes at both ends of the edges. In this application, all the sentences in the target log block are correlated by default, and therefore, each node in the text correlation graph is connected to other nodes in the text correlation graph.

[0124] For ease of understanding, refer to FIG. 7, which shows an example of a text correlation graph, and FIG. 7 includes eight nodes (i.e., node A1, node A2, node B1, node C1, node C2, node D1, node D2 and node D3), and each of the eight nodes is connected to other nodes in the text correlation graph.

[0125] S2064: The log analysis apparatus determines the maximum weight of the nodes in the text correlation graph according to the information entropy of the nodes in the text correlation graph.

[0126] The log analysis apparatus calculates information entropy of each node in the text correlation graph, and takes the calculated information entropy as an initial weight of the corresponding node, wherein the information entropy of the node is used to describe an amount of information contained in a sentence indicated by the node. Then, the log analysis apparatus updates the weight of the node in the text correlation graph according to the initial weight of the node in the text correlation graph and a weight of an edge in the text correlation graph, wherein the weight of the edge can be obtained by calculating a similarity between two sentences indicated by two nodes connected by the edge. The updating of the weight of the node is repeatedly performed for multiple times, so as to obtain a final weight of the node.

[0127] In an implementation manner, the log analysis apparatus can calculate the information entropy of the node in the text correlation graph by formula (1), and update the weight of the node according to formula (2): H(X) = -∑ x∈X P(x)logP(x) formula (1)

[0128] wherein H(X) is the information entropy of the node X; x can be any one of a word, a character, a bigram or a trigram in the sentence indicated by the node X, and the application does not make a specific limitation on x; P(x) can be approximately equal to a frequency of occurrence of x in the sentence indicated by the node X.

[0129] wherein WS(V i ) is the weight of the node V i , d is a damping coefficient, generally set as 0.85, In(V i ) is a node set pointing to the node V i , Out(V j ) is a node set pointed by the node V j , w ji is a weight of an edge from the node V j to the node V i , and W jk is a weight of an edge from the node V j to the node V k .

[0130] In order to facilitate understanding, the following will take the node A1 in the text correlation graph shown in FIG. 7 as an example to illustrate that the log analysis apparatus can calculate the final weight of the node A1 by the following steps:

[0131] Step 1: The log analysis apparatus calculates the initial weight of the node A1 by using formula (1).

[0132] Step 2: The log analysis device updates the weight of node A1 according to the initial weight of node A1, the weight of another node connected to node A1 (including node A2, node B1, node C1, node C2, node D1, node D2 and node D3) on the edge connected to node A1, and the weight of the edge connected to node A1 (including the edge between node A1 and node A2, the edge between the adjacent node of node A1 and node B1, the edge between node A1 and node C1, the edge between node A1 and node C2, the edge between node A1 and node D1, the edge between node A1 and node D2, the edge between node A1 and node D3).

[0133] Step 3: The log analysis device repeats step 2 until a preset number of iterations is reached to obtain the final weight of node A1.

[0134] The preset number of iterations can be set by the user or dynamically set by the log analysis device according to the actual situation (for example, the weight of node A1 changes less than a specified threshold).

[0135] S2065: The log analysis device determines the summary of the target log according to the final weight of the node in the text association graph.

[0136] The summary of the target log is the sentence indicated by the top M nodes in the final weight of all nodes in the text association graph, where M can be set by the user or set by the log analysis device according to the actual situation.

[0137] It should be understood that the information entropy of the sentences in the target log block can reflect the amount of information and uniqueness carried by each sentence in the target log block, so the present application selects to use the information entropy as the initial weight of each sentence, which can determine the importance of each sentence in the initial stage, so that the key sentences in the target log block can be more effectively captured in the subsequent iteration process, thereby improving the quality and accuracy of the summary extraction.

[0138] S207: The log analysis device shows the user the analysis result of the target log.

[0139] When the state of the target log is normal, the analysis result of the target log is used to indicate that the target log is a normal log. Here, the state of the target log being normal includes three cases, namely the first state being normal, the second state being normal, and the third state being normal. When the third state of the target log is normal, the analysis result of the target log can not only indicate that the target log is a normal log, but also include the judgment reason for this result (i.e. the judgment reason output by the LLM in S204).

[0140] When the state of the target log is abnormal, the analysis result of the target log is used to indicate that the target log is an abnormal log. Here, the state of the target log being abnormal includes three cases, which are a first state abnormality, a second state abnormality, and a third state abnormality. When the third state of the target log is abnormal, the analysis result of the target log can indicate that the target log is an abnormal log, and can further include a judgment reason for this result (i.e., the judgment reason output by the LLM in S204).

[0141] Further, after the user views the analysis result of the target log, the user can manually analyze the state of the target log according to the summary of the target log in the analysis result. When the manually analyzed state is inconsistent with the analysis result of the log analysis device (the manually analyzed state is normal, and the analysis result of the log analysis device is abnormal), the user can instruct the log analysis device to update the log database. In a specific implementation, the log analysis device can update the log database in the following manner: the log analysis device updates the target log template, the vector corresponding to the target log template, and the label B of the target log template to the log database.

[0142] The above S201 to S207 detail the process of how the log analysis device analyzes the target log. It should be understood that, for other logs in the log file, the log analysis device can also analyze them in the same manner.

[0143] Optionally, after the log analysis device completes the analysis of all logs in the log file, the log analysis device can further perform the following steps:

[0144] The user re-evaluates all logs in the log file to determine whether there is a missed log in the output result of the log analysis device. Here, a missed log refers to a target log whose state corresponding to the target log template is indicated by the label A, but the state of the target log corresponding to the target log template is determined by the log analysis device to be the state indicated by the label B. If the user determines that a target log is missed according to the received log file, the user instructs the log analysis device to update the target log template corresponding to the target log, the vector of the target log template corresponding to the target log, and the label A of the target log template corresponding to the target log to the log database.

[0145] In conclusion, the application provides a log analysis method. First, the target log to be analyzed and the target log template are obtained. Then, the first state of the target log is determined according to the matching relationship between the target log template and the log templates in the log database. If the first state is suspected abnormal, the abnormal identification operation is performed on the target log template to determine the second state of the target log. When the second state is abnormal, the false alarm detection operation is performed on the target log template by the LLM to determine the third state of the target log. When the third state is abnormal, the target log summary is generated and displayed to the user for further evaluation. In the case where the user evaluation result is inconsistent with the judgment result output by the LLM, the log database is updated. In this way, the accuracy of log analysis is improved through layer-by-layer judgment. In addition, the number of logs generated by the business running on the computer is very large, and the log analysis efficiency is very low relying on manual work. The application can reduce the labor cost and improve the business experience by using an artificial intelligence model to analyze the logs.

[0146] The application provides a log analysis device. Referring to FIG. 8, FIG. 8 is a structural schematic diagram of a log analysis device 100 provided by the application. The log analysis device 100 comprises:

[0147] The acquisition module 110 is configured to acquire a target log template of a target log and a first label of the target log template. The target log template comprises information indicating the state of the target log in the target log. The first label is used to indicate that the target log is abnormal.

[0148] The analysis module 120 is configured to construct a prompt text according to the matching relationship between the target log template and normal log templates in the log database. The prompt text comprises the matched normal log templates. The analysis module 120 is further configured to perform a false alarm detection operation on the target log template according to the prompt text to obtain a second label of the target log template. The analysis module 120 is further configured to determine the state of the target log according to the second label.

[0149] In a possible implementation, the analysis module 120 is configured to input the prompt text into a large language model (LLM) to obtain the second label of the target log template.

[0150] In a possible implementation, the log database further comprises an abnormal log template.

[0151] The acquisition module 110 is configured to extract a first log template from the first log. The acquisition module 110 is further configured to determine that the target log template does not match all log templates in the log database. The acquisition module 110 is further configured to input the target log template into a single-class abnormal detection model to obtain the first label of the target log template. The single-class abnormal detection model is trained based on a plurality of normal log templates.

[0152] In a possible implementation, the second label is used to indicate that the target log is abnormal. The device further comprises:

[0153] The abstract extraction module 130 is configured to obtain a target log block, the target log block comprising a target log and a context of the target log; determine a weight of a sentence in the target log block according to information entropy of the sentence in the target log block; and obtain an abstract of the target log according to the weight of the sentence in the target log block, the abstract of the target log being sentences corresponding to a first M positions in the target log block in a descending order of the weight.

[0154] The display module 140 is configured to provide the abstract of the target log to a user.

[0155] In a possible implementation, the abstract extraction module 130 is configured to construct a text correlation graph according to a relationship between the sentences in the target log block and the sentences, the text correlation graph comprising a plurality of nodes and edges between the nodes, wherein the nodes in the text correlation graph are used to indicate the sentences in the target log block, and the edges in the text correlation graph are used to indicate an association relationship between the sentences indicated by the nodes at two ends of the edges.

[0156] The abstract extraction module 130 is configured to update the weight of the node in the text correlation graph according to an initial weight of the node in the text correlation graph and a weight of the edge in the text correlation graph, the initial weight of the node in the text correlation graph being the information entropy of the sentence indicated by the node, and the weight of the edge being a similarity between the sentences indicated by the nodes at two ends of the edge.

[0157] The abstract extraction module 130 is configured to obtain the weight of the sentence in the target log block according to the new weight of the node in the text correlation graph.

[0158] In a possible implementation, the apparatus further comprises a feedback module 150 configured to update a log database according to the target log template and the second label of the target log template.

[0159] Referring to FIG. 9, FIG. 9 is a structural schematic diagram of a computing device 300 provided by the present application, the computing device 300 can deploy the log analysis apparatus 100 shown in FIG. 8, and operations and / or functions of each module in the computing device 300 are respectively used to implement corresponding steps in the log analysis method shown in FIGS. 2 to 7.

[0160] As shown in FIG. 9, the computing device 300 comprises a processor 310, a memory 320 and a communication interface 330, wherein the processor 310, the memory 320 and the communication interface 330 can be connected to each other through a bus 340.

[0161] The processor 310 can read program codes (including instructions) stored in the memory 320, execute the program codes stored in the memory 320, so that the computing device 300 executes the log analysis method shown in FIGS. 2 to 7, or so that the computing device 300 deploys the log analysis apparatus 100.

[0162] The processor 310 can have various implementations, such as a central processing unit (CPU) or a combination of a CPU and a hardware chip. The hardware chip can be an ASIC, a PLD, or a combination thereof. The PLD can be a CPLD, an FPGA, a GAL, or any combination thereof. The processor 310 executes various types of digital storage instructions, such as software or firmware programs stored in the memory 320, which enables the computing device 300 to provide a wide variety of services.

[0163] In an implementation, as an example, the processor 310 includes one or more CPUs.

[0164] In an implementation, as an example, the computing device 300 also includes multiple processors, each of which can be a single-CPU or a multi-CPU. The processor herein refers to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0165] The memory 320 is configured to store program codes, which are executed by the processor 310 to perform the processing steps of the log analysis method in the log analysis method embodiments shown in FIGS. 2-7. The program codes can include one or more software modules, which can be the software modules provided in FIG. 8, such as the obtaining module 110, the analyzing module 120, the summary extraction module 130, the display module 140, and the feedback module 150.

[0166] The memory 320 can include a volatile memory, such as a random access memory (RAM), and / or a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The memory 320 can also include a combination of the above-mentioned types of memories.

[0167] The communication interface 330 can be a wired interface (e.g., an Ethernet interface, a fiber optic interface, other types of interfaces (e.g., an infiniBand interface)) or a wireless interface (e.g., a cellular network interface or a wireless local area network interface) for communicating with other computing devices or apparatuses. The communication interface 330 can employ a family of protocols on top of the transmission control protocol / internet protocol (TCP / IP), such as a remote function call (RFC) protocol, a simple object access protocol (SOAP) protocol, a simple network management protocol (SNMP) protocol, a common object request broker architecture (CORBA) protocol, and a distributed protocol, among others.

[0168] The bus 340 can be a peripheral component interconnect express (PCIe) bus, an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), or the like. The bus 340 can be divided into an address bus, a data bus, a control bus, and the like.

[0169] In addition to including a data bus, the bus 340 can also include a power bus, a control bus, a status signal bus, and the like. However, for the sake of clarity, all of the buses are labeled as the bus 340 in the figure. Only one thick line is used in FIG. 9 for ease of representation, but it does not mean that there is only one bus or only one type of bus.

[0170] The computing device 300 described above is used to execute the log analysis method shown in FIGS. 2 to 7, and the specific implementation process is described in the above method embodiments, which will not be repeated here.

[0171] It should be appreciated that the computing device 300 is merely one example of a computing device that can be used to implement embodiments described herein, and that the computing device 300 can have more or fewer components than shown, can combine two or more components, or a different configuration of components can be possible. As described in connection with the log analysis method embodiments illustrated in FIGS. 2-7, additional details of the computing device 300 can be found in the description of the computing device 300 in connection with FIGS. 2-7, which will not be repeated here.

[0172] The present disclosure also provides a computing device cluster that can deploy the log analysis apparatus 100 illustrated in FIG. 10, and each module in the computing device cluster can be configured to perform operations and / or functions described in connection with the log analysis method embodiments illustrated in FIGS. 2-7.

[0173] As illustrated in FIG. 10, the computing device cluster includes at least one computing device 300. The memory 320 of one or more computing devices 300 in the computing device cluster can store the same instructions for performing the log analysis method embodiments illustrated in FIGS. 2-7. The computing device 300 can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device 300 can also be a terminal device, such as a desktop computer, a laptop computer, or a smartphone.

[0174] In some possible implementations, the memory 320 of one or more computing devices 300 in the computing device cluster can also store partial instructions for performing the log analysis method embodiments illustrated in FIGS. 2-7, respectively. In other words, a combination of one or more computing devices 300 can collectively perform the instructions for performing the log analysis method embodiments illustrated in FIGS. 2-7.

[0175] It should be noted that the memory 320 of different computing devices 300 in the computing device cluster can store different instructions for performing partial functions of the log analysis apparatus 100, respectively. That is, the instructions stored in the memory 320 of different computing devices 300 can implement the functions of one or more of the obtaining module 110, the analyzing module 120, the summary extraction module 130, the display module 140, and the feedback module 150.

[0176] In some possible implementation manners, one or more of the computing devices 300 in the computing device cluster can be connected through a network. The network can be a wide area network or a local area network, etc. FIG. 11 is a structural schematic diagram of another computing device cluster provided in the present application. As shown in FIG. 11, two computing devices 300A and 300B are connected through a network. Specifically, the computing devices are connected to the network through the communication interfaces in the computing devices. In this kind of possible implementation manner, the memory 320 in the computing device 300A stores instructions for executing the functions of the obtaining module 110, the analyzing module 120, the summary extraction module 130, the display module 140 and the feedback module 150. Meanwhile, the memory 320 in the computing device 300B also stores instructions for executing the functions of the obtaining module 110, the analyzing module 120, the summary extraction module 130, the display module 140 and the feedback module 150.

[0177] The connection manner between the computing device cluster shown in FIG. 11 can be a scenario considering high concurrency computing, for example, the computing device 300A receives a large number of log files to be analyzed at the same time, in which case, the computing device 300A can transfer part of the log files to be analyzed to the computing device 300B to complete the analysis, thereby improving the overall log analysis efficiency.

[0178] It should be understood that the functions of the computing device 300A shown in FIG. 11 can also be completed by multiple computing devices 300. Similarly, the functions of the computing device 300B can also be completed by multiple computing devices 300.

[0179] The present application also provides a computer program product containing instructions, which can be software or a program product containing instructions capable of running on a computing device or stored in any available medium. When the computer program product runs on at least one computing device, the at least one computing device is caused to execute the log analysis method shown in FIGS. 2 to 7.

[0180] The present application also provides a computer storage medium, which can be any available medium capable of being stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a digital video disc (DVD) with high density) or a semiconductor medium (for example, a solid state disk), etc. The computer storage medium contains instructions for instructing the computing device to execute the log analysis method shown in FIGS. 2 to 7.

[0181] In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0182] In the above embodiments, all or part of the embodiments can be implemented by software, hardware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer storage medium to another computer storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media, or semiconductor media, etc.

[0183] The above is only a specific embodiment of the present application. Those skilled in the art can think of changes or replacements based on the specific embodiments provided by the present application, which should be covered within the protection scope of the present application.

Claims

1. A log analysis method applied to a log analysis device, characterized by, The method comprises: obtaining a target log template of a target log and a first label of the target log template, the target log template comprising information indicating a state of the target log in the target log, and the first label being used to indicate that the target log is abnormal; constructing a prompt text according to a matching relationship between the target log template and a normal log template in a log database, the prompt text comprising the matching normal log template; performing a false alarm detection operation on the target log template according to the prompt text to obtain a second label of the target log template; determining the state of the target log according to the second label.

2. The method of claim 1, wherein, The method further comprises: inputting the prompt text into a large language model (LLM) to obtain the second label of the target log template.

3. The method of claim 1, wherein, The log database further comprises an abnormal log template. The method further comprises: extracting the first log template from the first log; determining that the target log template does not match any log template in the log database; inputting the target log template into a single-class abnormality detection model to obtain the first label of the target log template, the single-class abnormality detection model being trained based on a plurality of normal log templates.

4. The method according to any one of claims 1 to 3, characterized in that, The second label is used to indicate that the target log is abnormal. After determining the state of the target log according to the second label, the method further comprises: obtaining a target log block, the target log block comprising the target log and a context of the target log; determining a weight of a sentence in the target log block according to an information entropy of the sentence in the target log block; obtaining a summary of the target log according to the weights of the sentences in the target log block, the summary of the target log being sentences corresponding to the top M weights in the target log block; providing the summary of the target log to a user.

5. The method of claim 4, wherein, The method further comprises: constructing a text association graph according to relationships between sentences in the target log block, the text association graph comprising a plurality of nodes and edges between the nodes, wherein the nodes in the text association graph are used to indicate the sentences in the target log block, and the edges in the text association graph are used to indicate an association relationship between the sentences indicated by the two end nodes of the edge; updating the weights of the nodes in the text association graph according to initial weights of the nodes in the text association graph and weights of the edges in the text association graph, the initial weights of the nodes in the text association graph being information entropies of the sentences indicated by the nodes, and the weights of the edges being similarities between the sentences indicated by the two end nodes of the edge; obtaining the weights of the sentences in the target log block according to the new weights of the nodes in the text association graph.

6. The method of claim 5, wherein, The method further comprises: updating the log database according to the target log template and the second label of the target log template.

7. A log analysis apparatus characterized by comprising: The device comprises: The acquisition module is configured to acquire a target log template of a target log and a first label of the target log template, the target log template including information indicating a state of the target log, and the first label being used to indicate that the target log is abnormal. The analysis module is configured to construct a prompt text according to a matching relationship between the target log template and a normal log template in a log database, the prompt text including the matching normal log template; perform a false alarm detection operation on the target log template according to the prompt text to obtain a second label of the target log template; and determine the state of the target log according to the second label.

8. The apparatus of claim 7, wherein, The analysis module is configured to input the prompt text into a large language model (LLM) to obtain the second label of the target log template.

9. The apparatus of claim 7, wherein, The log database further includes an abnormal log template. The acquisition module is configured to extract the first log template from the first log; determine that the target log template does not match all log templates in the log database; and input the target log template into a single-classification abnormality detection model to obtain the first label of the target log template, the single-classification abnormality detection model being trained based on a plurality of normal log templates.

10. The apparatus of any one of claims 7 to 9, wherein, The second label is used to indicate that the target log is abnormal, and the device further includes: The summary extraction module is configured to acquire a target log block, the target log block including the target log and a context of the target log; determine a weight of a sentence in the target log block according to an information entropy of the sentence; and obtain a summary of the target log according to the weights of the sentences in the target log block, the summary of the target log being sentences corresponding to the top M weights in the target log block. The display module is configured to provide the summary of the target log to a user.

11. The device of claim 10, wherein The summary extraction module is configured to construct a text association graph according to relationships between sentences in the target log block, the text association graph including a plurality of nodes and edges between the nodes, wherein a node in the text association graph is used to indicate a sentence in the target log block, and an edge in the text association graph is used to indicate an association relationship between sentences indicated by nodes at two ends of the edge. The weights of the nodes in the text association graph are updated according to initial weights of the nodes in the text association graph and weights of the edges in the text association graph, the initial weights of the nodes in the text association graph being information entropies of the sentences indicated by the nodes, and the weights of the edges being similarities between the sentences indicated by the nodes at two ends of the edge. The weights of the sentences in the target log block are obtained according to new weights of the nodes in the text association graph.

12. The apparatus of claim 11, wherein, The device further includes: The feedback module is configured to update the log database according to the target log template and the second label of the target log template.

13. A computing device, comprising: The computing device includes a memory and a processor, the processor being configured to execute instructions stored in the memory to cause the computing device to perform the method of any one of claims 1 to 6.

14. A cluster of computing devices, characterized in that, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method of any one of claims 1 to 6.

15. A computer storage medium, comprising, a computer program product comprising program instructions configured to cause a cluster of computing devices to perform the method of any one of claims 1 to 6 when the program instructions are executed on the cluster of computing devices.

16. A computer program product, characterised in that, a computer program product comprising program instructions configured to cause a cluster of computing devices to perform the method of any one of claims 1 to 6 when the program instructions are executed on the cluster of computing devices. a computer program product comprising program instructions configured to cause a cluster of computing devices to perform the method of any one of claims 1 to 6 when the program instructions are executed on the cluster of computing devices.

Images