Log detection method and apparatus, computing device cluster, medium and program product

Abstract

The present application provides a log detection method, a log detection apparatus, a computing device cluster, a computer-readable storage medium, and a computer program product. The method comprises: identifying anomaly sample logs from among sample logs; on the basis of the anomaly sample logs, generating an anomaly log template, the anomaly log template containing common features of the multiple anomaly sample logs; converting the anomaly log template into a regular expression; and, by means of the regular expression, determining whether a log under test is an anomaly log. The present application can comprehensively detect anomaly logs, and consume fewer computing resources.

Description

Log detection methods, devices, computing device clusters, media, and program products

[0001] This application claims priority to Chinese Patent Application No. 202411523784.6, filed on October 29, 2024, entitled "Log Detection Method, Apparatus, Computing Device Cluster, Media and Program Product", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of computer technology, and in particular to a log detection method, a log detection device, a computing device cluster, a computer-readable storage medium, and a computer program product. Background Technology

[0003] In this field, there are techniques for detecting logs generated by computing devices to determine whether there are any anomalies. Existing log detection methods include those using regular expressions and those using artificial intelligence models. However, log detection methods using regular expressions cannot automatically construct regular expressions, requiring manual construction and failing to comprehensively cover all types of abnormal logs. Log detection methods using artificial intelligence models consume significant computing resources, requiring expensive GPUs (graphics processing units). Therefore, there is an urgent need in this field for a log detection technology that can comprehensively detect abnormal logs while consuming fewer computing resources. Summary of the Invention

[0004] Therefore, this application aims to provide a log detection method, log detection device, computing device cluster, computer-readable storage medium, and computer program product that can comprehensively detect abnormal logs while consuming relatively few computing resources.

[0005] In one aspect, this application provides a log detection method, which includes: identifying abnormal sample logs from sample logs; generating an abnormal log template based on the abnormal sample logs, the abnormal log template including common features of multiple abnormal sample logs; converting the abnormal log template into a regular expression; and determining whether the log to be detected is an abnormal log through the regular expression.

[0006] According to this approach, by constructing anomaly log templates for sample logs in a test environment and then building regular expressions for anomaly logs based on these templates, regular expressions for detecting anomaly logs can be automatically constructed without manual intervention, ensuring both the efficiency of regular expression construction and the comprehensiveness of the anomaly logs covered by the regular expressions. Furthermore, using these pre-constructed regular expressions to detect anomaly logs in a production environment avoids the need for computationally intensive artificial intelligence models, thus making the technical solution of this application more computationally efficient and more widely applicable.

[0007] In one possible implementation of this application, identifying abnormal sample logs from sample logs includes: identifying suspicious logs from sample logs through rules or artificial intelligence (AI) algorithms; inputting the suspicious logs into a large language model to obtain the abnormal sample logs output by the large language model.

[0008] According to this implementation, suspicious logs are first identified using rules or AI algorithms, which helps improve the efficiency of suspicious log identification. Identifying suspicious logs from a small number of sample logs using rules and AI algorithms does not increase the consumption of computing resources because this identification is performed in a test environment with a small number of sample logs. Then, the high generalization capability of the large language model is used to further confirm the small number of suspicious logs identified from the sample logs, identifying the truly abnormal sample logs. This helps improve the accuracy of abnormal sample log identification, and because the number of suspicious logs is further reduced, the identification performed by the large language model will not generate significant computing resource consumption.

[0009] In one possible implementation of this application, there are M abnormal log templates. Generating an abnormal log template based on abnormal sample logs includes: determining the abnormal score of each of the M abnormal log templates. Converting the abnormal log templates into regular expressions includes: converting each of the M abnormal log templates into M regular expressions, where each regular expression has the corresponding abnormal score of the abnormal log template. Determining whether the log to be detected is an abnormal log using the regular expressions includes: sorting the M regular expressions in descending order of their abnormal scores; selecting the top N regular expressions with the highest to lowest abnormal scores to determine whether the log to be detected is an abnormal log, where M ≥ N.

[0010] According to this implementation, while generating abnormal log templates, each abnormal log template is scored to generate an abnormal score. Based on the abnormal score, the regular expressions with the highest abnormal scores are selected from the regular expressions generated by all abnormal log templates. This helps to reduce the number of regular expressions, further reducing the computational load for detecting abnormal logs, while ensuring that the abnormal logs with the most severe abnormality can be accurately detected, thereby maximizing the security of the device.

[0011] In one possible implementation of this application, identifying abnormal sample logs from sample logs includes: determining the abnormal score of the abnormal sample logs. Specifically, determining the abnormal score of each of the M abnormal log templates includes: determining the abnormal score of the abnormal log template based on the average of the abnormal scores of at least one abnormal sample log that conforms to the abnormal log template.

[0012] According to this implementation, the anomaly score of the anomaly log template is derived from the anomaly scores of the anomaly sample logs. Since the anomaly log template is obtained by summarizing the commonalities of multiple anomaly sample logs, the anomaly degree of the anomaly sample logs that conform to the anomaly sample template is consistent with the anomaly degree of the template. By scoring the anomaly log template based on the average anomaly score of the anomaly sample logs, the accuracy of the anomaly score can be guaranteed, while the efficiency of scoring can be guaranteed through a simple calculation method.

[0013] In one possible implementation of this application, determining the anomaly score of the abnormal sample log includes: determining the anomaly score of the abnormal sample log through a large language model.

[0014] According to this implementation, the anomaly score of abnormal sample logs is determined by a large language model, which helps to improve the efficiency and accuracy of anomaly score determination. The large language model has extensive understanding and judgment capabilities; scoring abnormal sample logs using the large language model, instead of manually, greatly improves the efficiency of anomaly score determination and saves manual time and labor.

[0015] In one possible implementation of this application, the abnormal score of the abnormal sample log is determined by a large language model, including: constructing a prompt word based on multiple reference logs and multiple reference abnormal scores corresponding to the multiple reference logs; inputting the abnormal sample log to be scored and the prompt word into the large language model, and querying the large language model for the abnormal score of the abnormal sample log to be scored.

[0016] According to this implementation, by constructing reference logs and corresponding reference anomaly scores, it helps large language models understand how to score abnormal sample logs, making the scoring of large language models more accurate and based on evidence.

[0017] In one possible implementation of this application, determining whether a log to be detected is an abnormal log using a regular expression includes: sending the regular expression to multiple agent programs; and using the multiple agent programs to determine whether the log to be detected is an abnormal log based on the regular expression.

[0018] According to this implementation, the agent program is a software program distributed across multiple computing devices or clusters of computing devices. Using the agent program to perform log detection based on regular expressions enables decentralized detection of abnormal logs, thereby avoiding the inefficiency and excessive computational resource consumption associated with centralized log detection, and contributing to improved efficiency and wider applicability of log detection.

[0019] On the other hand, this application provides a log detection device, which includes: an identification module for identifying abnormal sample logs from sample logs; a generation module for generating an abnormal log template based on the abnormal sample logs, the abnormal log template including common features of multiple abnormal sample logs; a conversion module for converting the abnormal log template into a regular expression; and a judgment module for judging whether the log to be detected is an abnormal log through the regular expression.

[0020] In one possible implementation of this application, the identification module is further configured to: identify suspicious logs from sample logs through rules or artificial intelligence (AI) algorithms; input the suspicious logs into a large language model to obtain abnormal sample logs output by the large language model.

[0021] In one possible implementation of this application, there are M abnormal log templates. The generation module is further configured to: determine the abnormal score of each of the M abnormal log templates. The conversion module is further configured to: convert each of the M abnormal log templates into M regular expressions, where each regular expression has the corresponding abnormal score of the abnormal log template. The judgment module is further configured to: sort the M regular expressions in descending order of their abnormal scores; select the top N regular expressions with the highest to lowest abnormal scores to determine whether the log to be detected is an abnormal log, where M ≥ N.

[0022] In one possible implementation of this application, the identification module is further configured to: determine the anomaly score of the abnormal sample logs. The generation module is further configured to: determine the anomaly score of the abnormal log template based on the average of the anomaly scores of at least one abnormal sample log that conforms to the abnormal log template.

[0023] In one possible implementation of this application, the identification module is further configured to: determine the anomaly score of the abnormal sample log through a large language model.

[0024] In one possible implementation of this application, the recognition module is further configured to: construct prompt words based on multiple reference logs and multiple reference anomaly scores corresponding to the multiple reference logs; input the anomaly sample logs to be scored and the prompt words into the large language model, and query the large language model for the anomaly scores of the anomaly sample logs to be scored.

[0025] In one possible implementation of this application, the judgment module is further configured to: send the regular expression to multiple agent programs; and through the multiple agent programs, determine whether the log to be detected is an abnormal log based on the regular expression.

[0026] On the other hand, this application provides a computing device cluster, including at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster performs the above-described log detection method.

[0027] On the other hand, this application provides a computer-readable storage medium storing a computer program for performing the above-described log detection method.

[0028] On the other hand, this application provides a computer program product, including program code, which, when a computer runs the computer program product, causes the computer to implement the above-described log detection method.

[0029] Any of the log detection devices, computing device clusters, computer-readable storage media, or computer program products provided above are used to execute the log detection methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects of the corresponding solutions in the corresponding methods provided above, and will not be repeated here. Attached Figure Description

[0030] The specific embodiments of this application are described in detail below with reference to the accompanying drawings, wherein:

[0031] Figure 1 shows a system architecture diagram of a log detection method according to an embodiment of this application;

[0032] Figure 2 shows a schematic flowchart of a log detection method according to an embodiment of this application;

[0033] Figure 3 shows a flowchart of a log detection method according to another embodiment of this application;

[0034] Figure 4 shows a schematic diagram of a large language model prompt word according to an embodiment of this application;

[0035] Figure 5 shows a schematic diagram of the structure of a log detection device according to an embodiment of this application;

[0036] Figure 6 shows a schematic diagram of the structure of a computing device according to an embodiment of the present application;

[0037] Figure 7 shows a schematic diagram of the structure of a computing device cluster according to an embodiment of this application;

[0038] Figure 8 shows a schematic diagram of the structure of a computing device cluster according to another embodiment of this application. Detailed Implementation

[0039] To enable those skilled in the art to more clearly understand the concepts and ideas of this application, the application is described in detail below with reference to specific embodiments. It should be understood that the embodiments given herein are only a part of all possible embodiments of this application. After reading the specification of this application, those skilled in the art are capable of making improvements, modifications, or substitutions to parts or the entirety of the following embodiments, and such improvements, modifications, or substitutions are also included within the scope of protection claimed in this application.

[0040] In this document, the terms "one," "an," and other similar words are not intended to indicate that only one of the described things exists, but rather that the description refers only to one of the described things, which may have one or more. In this document, the terms "comprising," "including," and other similar words are intended to indicate a logical relationship, not a spatial relationship. For example, "A includes B" means that logically B belongs to A, not that spatially B is located inside A. Furthermore, the meanings of the terms "comprising," "including," and other similar words should be considered open-ended, not closed-ended. For example, "A includes B" means that B belongs to A, but B does not necessarily constitute all of A; A may also include other elements such as C, D, and E.

[0041] In this document, the terms "first," "second," and other similar terms are not intended to imply any order, quantity, or importance, but are merely used to distinguish different elements. In this document, the terms "embodiment," "this embodiment," "an embodiment," or "an example" do not indicate that the description applies only to one specific embodiment, but rather that such description may also be applicable to one or more other embodiments. Those skilled in the art will understand that any description made herein with respect to one embodiment can be substituted, combined, or otherwise combined with the descriptions in one or more other embodiments, and the new embodiments resulting from such substitutions, combinations, or other combinations are readily conceived by those skilled in the art and fall within the scope of protection of this application.

[0042] In the various embodiments of this application, a log can refer to a file or data collection that records events occurring during the operation of a system or software. It details operational activities, error messages, system state changes, and other information within a specific time period, playing a crucial role in system maintenance, troubleshooting, security auditing, and performance analysis. By reviewing logs, administrators and developers can understand the system's operational status, promptly identify and resolve problems, trace the system's operational history, and ensure the system's stable operation and security.

[0043] In the various embodiments of this application, log inspection refers to a process of analyzing, reviewing, and evaluating log records generated by systems, applications, or networks. It aims to achieve multiple purposes by deeply mining and parsing various information contained in the logs, such as timestamps, event types, source addresses, destination addresses, and operation details. Log inspection can be used to monitor the normal operating status of a system and promptly detect potential faults, abnormal behaviors, or performance bottlenecks. Log inspection is also an important means of ensuring information security.

[0044] In some embodiments of this application, log files are not centrally stored. When a fault occurs, logs are temporarily collected manually using SFTP (Secure File Transfer Protocol) or log download tools, and the judgment of log anomalies is done manually. The problem is that this method only analyzes a portion of the logs as needed after a fault occurs; it cannot detect anomalies in the logs before a fault occurs, resulting in a slow response; temporarily collecting logs during a fault requires obtaining an SFTP system account and temporary file transfers, leading to a poor user experience and low efficiency (downloading a single file can take 5-30 minutes, depends on account acquisition, and requires logging into multiple nodes), affecting fault recovery time; the large volume of downloaded logs, without filtering for abnormal time points, results in low analysis efficiency.

[0045] In some embodiments of this application, all logs in the system are collected in real time to a centralized storage platform, and then uniformly detected and analyzed. The log anomaly detection algorithms of the centralized analysis platform typically employ two methods: detection based on manually configured regular expressions and detection using AI models. The problems are: centralized collection and storage require significant network bandwidth and storage resources, resulting in high costs; centralized analysis requires high computing power, making it impossible to complete analysis and detection efficiently and in real time; regular expression-based detection is efficient, but manually configured regular expressions cannot construct complete anomaly regular expressions, and the construction efficiency is low; AI model detection generally has good universality, but it consumes large amounts of computing resources, requiring expensive GPU resources.

[0046] Therefore, in some embodiments of this application, suspicious abnormal logs are identified through rules or AI algorithms, and then confirmed by a large model. The confirmed logs are then considered abnormal logs. A common template is extracted from multiple abnormal logs to generate anomaly regular expressions. This achieves fully automated construction of anomaly regular expressions. Simultaneously, with the assistance of a large model, the accuracy requirements for identifying preceding suspicious abnormal logs can be reduced, lowering the costs of rule setting and AI training. A distributed detection agent is used to execute the anomaly regular expression detection, performing the detection on the virtual machine node where the log to be detected resides, saving over 95% of log transmission and storage costs.

[0047] In some embodiments of this application, generating log detection regular expressions based on a large model takes only about 1 second, while manually verifying and writing a log detection regular expression typically takes minutes. Therefore, the efficiency of generating detection rules can be improved by about 100 times. It also significantly improves the completeness of the detection rules. Assuming that abnormal logs account for only 1% of all logs, the amount of logs that the agent program needs to upload can be reduced by 99%. Even considering other fields of log event information, log-related network transmission can be reduced by 97%-98%, and the corresponding centralized log storage consumption can be reduced by 97%-98%. Distributed and lightweight detection avoids the computing power bottleneck of centralized processing, which can greatly improve the real-time performance of log analysis.

[0048] In some embodiments of this application, the automated generation of detection rules combined with large models significantly improves generation efficiency and rule coverage. Distributed local lightweight detection greatly reduces network and storage resource consumption and improves the real-time performance of log analysis.

[0049] Figure 1 shows a system architecture diagram of a log detection method according to an embodiment of this application.

[0050] As shown in Figure 1, the automated testing system is deployed in the test environment. The system periodically and automatically executes automated test cases to test the functionality of the software system. When a test case fails, the list of microservices associated with the test case is sent as a detection task to the log anomaly detection module for execution. The log anomaly detection module, deployed in the test environment, analyzes the logs of the microservices associated with the failed test cases based on certain rules or a pre-trained log anomaly detection AI model, identifying suspicious anomaly segments. It is also responsible for interacting with the large language model to confirm that suspicious log segments contain anomalies. For confirmed anomaly logs, the log anomaly detection module converts them into anomaly log regular expression rules. The large language model, deployed in the test environment, can be based on an open-source large model or use a commercial large model interface. General-purpose large language models have good log analysis capabilities and can identify suspicious anomaly segments in logs. Therefore, the large language model can be used to further confirm suspicious log segments to improve the accuracy of anomaly log segment identification. The log detection rule management module, deployed in the production environment (live network environment), is responsible for loading the log anomaly detection rules (regular expressions) for each microservice and distributing them to the log collection and detection agent programs of the virtual machines where the microservices reside. The log collection and detection agent is deployed on each virtual machine in the production environment. It is responsible for obtaining the abnormal log detection rules (regular expressions) corresponding to the microservices within that virtual machine and performing real-time log abnormality detection for different microservices. Upon detecting a log abnormality, it generates a log abnormality event and reports it to the alarm / event platform. The alarm / event management platform is responsible for collecting abnormal events and alarms reported by various components, including the log abnormality events reported by the log abnormality detection agent, and provides alarm and event query capabilities.

[0051] Figure 2 shows a schematic flowchart of a log detection method according to an embodiment of this application.

[0052] According to this embodiment, the log detection method includes steps S210 to S240, and each step is described in detail below.

[0053] S210. Identify abnormal sample logs from the sample logs.

[0054] In this embodiment, microservice logs can refer to logs generated during the operation of a specific computing device, computing device cluster, or software system to record execution status and anomalies. Microservices also generate logs during test case execution; these logs can be called sample logs. Anomaly sample logs can refer to logs or log fragments in the sample logs that show abnormal situations, such as records of errors or failures that occurred during the execution of test cases on the target device or system.

[0055] In this embodiment, identifying abnormal sample logs from the sample logs can refer to identifying those abnormal sample logs from multiple sample logs, or it can refer to identifying abnormal log portions or log lines from one or more sample logs. Abnormal log lines can be, for example, log lines containing abnormal keywords (e.g., error, fail, etc.), which constitute part of the entire sample log and are used to indicate errors or failures that occurred during the execution of the test cases.

[0056] Specifically, functional test cases for target computing devices or clusters of computing devices can be automated. Continuous testing across different iterations can be performed during development, accumulating a large number of failed test cases and detecting the associated microservice logs. The association between test cases and microservices is configured in advance before testing.

[0057] Specifically, an automated testing system can be deployed in a test environment relative to the production or live environment to periodically and automatically execute automated test cases to test the functionality of the software system. When a test case fails, the list of microservices associated with the test case is sent as a detection task to the log anomaly detection module for inspection. Then, in the test environment (relative to the production environment), the logs of the microservices associated with the failed test cases are analyzed based on certain rules or a trained log anomaly detection AI model to identify suspicious anomaly segments.

[0058] Specifically, test cases can be executed through an automated testing system, with some test cases failing. For each failed test case, log anomaly detection is initiated for multiple microservices corresponding to that test case. Log content of the microservices during test case execution is collected. Log anomaly detection (the detection algorithm here can be rule-based or AI-based) is performed to identify suspicious abnormal log lines.

[0059] As an example, in order to identify abnormal sample logs from sample logs, suspicious logs can first be identified from the sample logs through rules or artificial intelligence (AI) algorithms; then, the suspicious logs are input into a large language model to obtain the abnormal sample logs output by the large language model.

[0060] In this example, suspicious logs can refer to those logs that, based on preliminary or simple judgment, may possess some characteristics or identifiers of anomalous logs and thus be classified as anomalous logs. In this example, rules can refer to common characteristics or identifiers of anomalous logs summarized by humans or machines. In this example, identifying suspicious logs from sample logs using rules can mean finding logs or log fragments from sample logs that may be classified as anomalous logs based on some pre-defined rules or patterns. In this example, AI algorithms can refer to a collection of computational methods and program logic designed to enable computer systems to simulate human intelligent behavior and decision-making processes. AI algorithms typically utilize large amounts of data for training to learn and recognize patterns, rules, and relationships. AI algorithms can handle complex tasks and continuously optimize their performance and accuracy through data analysis and processing to adapt to different application scenarios and needs. In this example, identifying suspicious logs from sample logs using AI algorithms can mean using an iterative artificial intelligence model to find logs or log fragments from sample logs that may be classified as anomalous logs.

[0061] In this example, a large language model (LLM) can refer to an artificial intelligence language processing model trained using massive amounts of data and powerful computing capabilities. By learning from vast amounts of text data, encompassing various domains, styles, and linguistic expressions, it can understand and generate natural language. A LLM can understand input natural language text and generate high-quality language output based on a given task. For example, a LLM can be a language model composed of artificial neural networks with many parameters (typically billions or more weights), trained using self-supervised or semi-supervised learning on large amounts of unlabeled text. It typically refers to a deep learning model with billions or more parameters. LLMs are general-purpose models that perform well across a wide range of tasks, rather than being trained for a specific task (such as sentiment analysis, named entity recognition, or mathematical reasoning). In this example, identifying anomalous log samples from suspicious logs using a LLM can refer to further identifying anomalous logs with unusual characteristics from those initially identified as potentially faulty or abnormal logs, using a broadly applicable LLM model to prepare for further processing.

[0062] Specifically, the detection of anomalous log samples can include two methods: rule-based detection and AI algorithm-based detection. Rule-based detection involves first filtering out log lines with levels of WARN, ERROR, and FATAL, and then further filtering out suspicious log lines based on predefined keywords, such as error, fail, and exception. AI algorithm-based detection involves training a spherical single classifier using normal log data based on DeepSVDD (Deep Support Vector Data Description). If the feature values ​​of the detected log are within the sphere, it is considered normal; if they exceed the sphere's range, it is considered a suspicious anomalous log.

[0063] Specifically, large language models can be deployed in a test environment (as opposed to the production environment), either based on open-source large models or using commercial large model interfaces. General-purpose large language models possess strong log analysis capabilities and can identify anomalous segments in logs. Therefore, large language models can be used to further confirm suspicious log segments, improving the accuracy of anomalous log segment identification.

[0064] Specifically, abnormal log lines can be sent to a large model to determine if any anomalies exist. If no anomalies are found, the feedback is sent to the AI ​​algorithm or model for optimization and training. If anomalies are found, the log line is added to the abnormal log list for further processing.

[0065] S220. Generate an anomaly log template based on the anomaly sample logs. The anomaly log template includes common features shared by multiple anomaly sample logs.

[0066] In this embodiment, an exception log template can refer to a predefined format or structure in a computer system used to record abnormal situations that occur during system operation. It typically contains specific information fields to clearly describe the key characteristics of the abnormal event. For example, an exception log template can be a standardized template composed of common characteristics of a batch of exception logs. Each exception log template corresponds to one or more exception logs, and these exception logs have common characteristics or format structures that conform to the template.

[0067] Specifically, the list of exception logs can be periodically parsed and extracted using templates. Furthermore, the drain algorithm, used as the log parsing algorithm, can be used to extract templates from the exception logs confirmed by the large language model. For example, consider the following two exception log lines: 1) invoke URL: http: / / demo1.com / path1 failed. Error code is 0022. 2) invoke URL: http: / / demo2.com / path2 failed. Error code is 0033. The common log template that can be extracted is invokeURL:<*>failed. Error code is<*>.

[0068] The Drain algorithm can be considered an online log parsing algorithm. It primarily analyzes and processes continuously incoming log streams in real time to extract fixed patterns and structural information. It uses a tree structure to represent different log templates and, through progressive matching and updating, quickly and accurately identifies new log events and categorizes them into the corresponding templates. For example, the Drain algorithm performs log clustering by separating different types of logs, and the result of clustering is that variable parts in the logs are replaced with the asterisk (*).

[0069] S230. Convert the exception log template into a regular expression.

[0070] In this embodiment, a regular expression can refer to a tool used to describe, match, and process text patterns. It consists of a series of characters and special symbols and is used to define specific character sequences or pattern rules. Regular expressions can be used to quickly find, extract, and replace content that matches a specific pattern in a large amount of text.

[0071] In this embodiment, converting the exception log template into a regular expression can mean converting the constants and variables in the exception log template into constants and variables in a regular expression used to match specific text and characters. For example, the asterisk (*) used to represent variables in the log template can be converted into the "\S+" symbol used to represent variables in a regular expression.

[0072] Specifically, log templates can be converted into regular expressions. For example, the log template invokeURL:<*>failed.Error code is<*> can be converted into the regular expression: invokeURL:\S+failed.Error code is\S+.

[0073] S240. Use regular expressions to determine whether the log to be detected is an abnormal log.

[0074] In this embodiment, the log to be detected can refer to the log generated by the actual operation of computing devices or systems in the live network environment or production environment (as opposed to the test environment), and is prepared to determine whether it is or includes abnormal logs or abnormal log fragments.

[0075] As an example, to determine whether a log to be checked is an abnormal log using a regular expression, the regular expression can first be sent to multiple agent programs; then, the multiple agent programs can determine whether the log to be checked is an abnormal log based on the regular expression.

[0076] In this example, an agent can refer to a software agent that performs specific tasks and functions on behalf of a user, application, or system in a cloud computing environment. It can run on different computing nodes, interact with other components, and take actions according to preset rules and policies. In this example, a computing device cluster can refer to a cluster of servers used to provide cloud computing services. In this example, the distributed deployment of multiple agents within the computing device cluster can mean that multiple agents are distributed throughout the cluster, such that each computing device or virtual machine in the cluster has at least one agent deployed on it.

[0077] In this example, multiple agent programs determine whether the logs to be detected are abnormal logs based on regular expressions. This can mean that a list of regular expressions (there may be multiple regular expressions) (corresponding to each microservice) is sent to the corresponding agent program, which then checks the logs generated by the microservices in the computing device or virtual machine where the agent program is located to determine whether there are abnormal logs or abnormal log fragments in these logs.

[0078] As an example, each computing device in a computing device cluster has at least one agent deployed, or each virtual machine in a computing device cluster has at least one agent deployed.

[0079] In this example, a computing device can refer to a single physical computing entity that constitutes a cluster of computing devices, such as a single server. In this example, a virtual machine can refer to a computer simulated by software, running on a physical computer (also called a host machine). To the user, it appears as an independent, real computer, with its own operating system, CPU, memory, hard drive, and other resources. It can install various software and run various programs. In this example, if each computing device has an agent deployed, that agent is responsible for detecting all logs generated on that computing device. If each virtual machine (which may have multiple microservices installed) has an agent deployed, that agent is responsible for detecting all logs generated on that virtual machine.

[0080] Specifically, the agent program is deployed on each virtual machine in the live or production environment (as opposed to the test environment). It is responsible for obtaining the exception log detection rules (regular expressions) corresponding to the microservices within that virtual machine and performing real-time log exception detection for different microservices. Upon detecting a log exception, it generates a log exception event and reports it to the alarm / event platform. The alarm / event management platform is responsible for collecting exception events and alarms reported by various components, including log exception events reported by the log exception detection agent program, and providing alarm and event query capabilities.

[0081] Specifically, the process begins by importing log anomaly detection rules exported from the test environment (as opposed to the production environment). These rules contain regular expressions for log anomaly detection across multiple microservices. Next, the rules are broken down by microservice granularity and distributed to the log collection and detection agents on the virtual machines where each microservice resides. The agents then analyze the microservice logs on their respective nodes in real time, searching for matching anomaly log lines based on the microservice's list of anomaly log regular expressions. Once a matching anomaly log line is found, the agent encapsulates it into an anomaly log event message and sends it to the alarm / event management platform. Finally, the alarm / event management platform provides an interface to allow the front-end to query and display the collected log anomaly events.

[0082] Figure 3 shows a schematic flowchart of a log detection method according to an embodiment of this application.

[0083] According to this embodiment, the log detection method includes steps S310 to S370, and each step is described in detail below.

[0084] S310. Identify abnormal sample logs from the sample logs.

[0085] For details regarding S310, please refer to the detailed description of S210 in the embodiment of Figure 2 above, which will not be repeated here.

[0086] S320. Determine the anomaly score of the abnormal sample logs through a large language model.

[0087] In this embodiment, the anomaly score can refer to a score used to represent the severity of the faults or errors recorded in the anomaly log. More severe errors will have higher anomaly scores, while minor errors will have lower scores. The anomaly score can be given manually, by a machine, or by an artificial intelligence model. In this embodiment, determining the anomaly score of the anomaly sample log through a large language model means using a large language model to score the logs or log fragments containing errors or faults generated by failed test cases in the test cases, evaluating the severity of the errors or faults they represent, and assigning higher scores to those with higher severity.

[0088] As an example, in order to determine the anomaly score of an anomaly sample log through a large language model, we can first construct prompt words based on multiple reference logs and the multiple reference anomaly scores corresponding to each reference log; then, we input the anomaly sample log to be scored and the prompt words into the large language model, and query the large language model for the anomaly score of the anomaly sample log to be scored.

[0089] Specifically, the FewShot method can be used to construct prompt statements, providing several examples of log anomaly detection, along with suspicious logs to be analyzed. The larger model then determines whether there are anomalies and assigns anomaly scores. Figure 4 shows an example of a prompt and query statement.

[0090] S330. Generate an anomaly log template based on the anomaly sample logs. The anomaly log template includes common features shared by multiple anomaly sample logs.

[0091] For details regarding S330, please refer to the detailed description of S220 in the embodiment of Figure 2 above, which will not be repeated here.

[0092] S340. Based on the average of the abnormal scores of at least one abnormal sample log that conforms to the abnormal log template, determine the abnormal score of each of the M abnormal log templates.

[0093] In this embodiment, since the anomaly log template is derived by extracting commonalities from multiple anomaly sample logs, each anomaly log template corresponds to one or more anomaly sample logs; that is, there are usually multiple anomaly sample logs that conform to the template. The average of the anomaly scores of multiple anomaly sample logs that conform to a certain template can be used as the anomaly score of that anomaly log template.

[0094] S350. Convert the M exception log templates into M regular expressions, where each regular expression has the exception score of the corresponding exception log template.

[0095] In this embodiment, since there is a correspondence between the exception log template and the regular expression, and each regular expression is converted from an exception log template, the exception score of the regular expression can directly inherit the exception score of the exception log template. In other words, the exception score of the regular expression is the exception score of its corresponding exception log template.

[0096] S360. Sort the M regular expressions in descending order of their anomaly scores.

[0097] In this embodiment, to save computation and ensure the efficiency of log detection, some minor errors or faults can be left undetected. Therefore, all regular expressions can be sorted in descending order of their anomaly scores, with those representing more severe faults placed first and those representing less severe faults placed later. This highlights the regular expressions indicating the most severe faults, preparing for subsequent operations.

[0098] S370. Select the top N regular expressions of the abnormal scores from high to low to determine whether the log to be detected is an abnormal log, where M≥N.

[0099] In this embodiment, after sorting the M regular expressions in descending order of their anomaly scores, the top N regular expressions can be selected. Matching is performed only using these expressions, which represent the most severe faults, to detect whether the log to be detected is a fault log. This saves computational resources, ensures that the most severe faults are alerted and warned, and ignores less severe faults, thus guaranteeing detection performance.

[0100] Specifically, to ensure anomaly detection performance and limit the number of anomaly regular expressions, users can configure the system to only detect the top N most severe anomaly templates for each microservice, based on resource configuration. Therefore, the anomaly regular expressions for each microservice need to be sorted in descending order of their corresponding anomaly scores. Then, a list of regular expressions for the top N anomaly logs is exported at the microservice level.

[0101] This application also provides a log detection device 500, as shown in Figure 5, including:

[0102] The identification module 510 is used to identify abnormal sample logs from the sample logs;

[0103] The generation module 520 is used to generate an anomaly log template based on the anomaly sample logs. The anomaly log template includes common features shared by multiple anomaly sample logs.

[0104] The conversion module 530 is used to convert the exception log template into a regular expression.

[0105] The judgment module 540 is used to determine whether the log to be detected is an abnormal log using regular expressions.

[0106] The recognition module 510, generation module 520, conversion module 530, and judgment module 540 can all be implemented in software or in hardware. For example, the implementation of the recognition module 510 will be described below. Similarly, the implementation of the generation module 520, conversion module 530, and judgment module 540 can refer to the implementation of the recognition module 510.

[0107] As an example of a software functional unit, the identification module 510 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Further, the aforementioned computing instance may be one or more. For example, the identification module 510 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0108] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0109] As an example of a hardware functional unit, the identification module 510 may include at least one computing device, such as a server. Alternatively, the identification module 510 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0110] The multiple computing devices included in the identification module 510 can be distributed in the same region or in different regions. Similarly, the multiple computing devices included in the identification module 510 can be distributed in the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices included in the identification module 510 can be distributed in the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0111] It should be noted that, in other embodiments, the identification module 510 can be used to execute any step in the log detection method, the generation module 520 can be used to execute any step in the log detection method, the conversion module 530 can be used to execute any step in the log detection method, and the judgment module 540 can be used to execute any step in the log detection method. The steps implemented by the identification module 510, generation module 520, conversion module 530, and judgment module 540 can be specified as needed. By implementing different steps in the log detection method through the identification module 510, generation module 520, conversion module 530, and judgment module 540, all functions of the log detection device can be realized.

[0112] This application also provides a computing device 600. As shown in FIG6, the computing device 600 includes: a bus 602, a processor 604, a memory 606, and a communication interface 608. The processor 604, the memory 606, and the communication interface 608 communicate with each other via the bus 602. The computing device 600 may be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 600.

[0113] Bus 602 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only one line is used in Figure 6, but this does not imply that there is only one bus or one type of bus. Bus 602 can include pathways for transmitting information between various components of computing device 600 (e.g., memory 606, processor 604, communication interface 608).

[0114] Processor 604 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0115] Memory 606 may include volatile memory, such as random access memory (RAM). Processor 604 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0116] The memory 606 stores executable program code, and the processor 604 executes this executable program code to implement the functions of the aforementioned identification module, generation module, conversion module, and judgment module, thereby realizing the log detection method. That is, the memory 606 stores instructions for executing the log detection method.

[0117] The communication interface 608 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between the computing device 600 and other devices or communication networks.

[0118] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0119] As shown in Figure 7, the computing device cluster includes at least one computing device 600. The memory 606 of one or more computing devices 600 in the computing device cluster may store the same instructions for executing the log detection method.

[0120] In some possible implementations, the memory 606 of one or more computing devices 600 in the computing device cluster may also store partial instructions for executing the log detection method. In other words, a combination of one or more computing devices 600 can jointly execute the instructions for executing the log detection method.

[0121] It should be noted that the memory 606 in different computing devices 600 within the computing device cluster can store different instructions, each used to execute a portion of the functions of the log detection device. That is, the instructions stored in the memory 606 of different computing devices 600 can implement the functions of one or more modules among the identification module, generation module, conversion module, and judgment module.

[0122] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 8 illustrates one possible implementation. As shown in Figure 8, two computing devices 600A and 600B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this type of possible implementation, the memory 606 in computing device 600A stores instructions for executing the functions of the identification module and the generation module. Simultaneously, the memory 606 in computing device 600B stores instructions for executing the functions of the conversion module and the judgment module.

[0123] The connection method between the computing device clusters shown in Figure 8 can be considered as follows: taking into account that the log detection method provided in this application requires a large amount of data storage, the functions implemented by the conversion module and the judgment module are to be executed by the computing device 600B.

[0124] It should be understood that the functions of computing device 600A shown in Figure 8 can also be performed by multiple computing devices 600. Similarly, the functions of computing device 600B can also be performed by multiple computing devices 600.

[0125] This application embodiment also provides another computing device cluster. The connection relationship between the computing devices in this computing device cluster can be similarly referred to the connection method of the computing device cluster described in Figures 7 and 8. The difference is that the memory 606 of one or more computing devices 600 in this computing device cluster can store the same instructions for executing the log detection method.

[0126] In some possible implementations, the memory 606 of one or more computing devices 600 in the computing device cluster may also store partial instructions for executing the log detection method. In other words, a combination of one or more computing devices 600 can jointly execute the instructions for executing the log detection method.

[0127] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to execute a log detection method.

[0128] Embodiments of this application may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps in the knowledge base construction methods according to various embodiments of this application described above.

[0129] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0130] The concepts, principles, and ideas of this application have been described in detail above with reference to specific embodiments (including examples and instances). Those skilled in the art should understand that the embodiments of this application are not limited to those given above. After reading this application, those skilled in the art can make any possible improvements, substitutions, and equivalents to the steps, methods, apparatus, and components in the above embodiments, and such improvements, substitutions, and equivalents should be considered to fall within the scope of this application. The scope of protection of this application is limited to the claims.

Claims

1. A log detection method, characterized in that, The method includes: Identify anomalous sample logs from the sample logs; An anomaly log template is generated based on the anomaly sample logs, and the anomaly log template includes common features shared by multiple anomaly sample logs; Convert the exception log template into a regular expression; The regular expression is used to determine whether the log to be detected is an abnormal log.

2. The method according to claim 1, characterized in that, The process of identifying anomalous sample logs from sample logs includes: Suspicious logs are identified from sample logs using rules or artificial intelligence (AI) algorithms; The suspicious logs are input into the large language model to obtain the abnormal sample logs output by the large language model.

3. The method according to claim 1, characterized in that, There are M exception log templates. The step of generating exception log templates based on the exception sample logs includes: Determine the anomaly score for each of the M anomaly log templates; The step of converting the exception log template into a regular expression includes: The M exception log templates are converted into M regular expressions, where each regular expression has an exception score corresponding to the exception log template. The step of determining whether the log to be detected is an abnormal log using the regular expression includes: Arrange the M regular expressions in descending order of their anomaly scores; The top N regular expressions based on the anomaly scores from highest to lowest are selected to determine whether the log to be detected is an anomaly log, where M≥N.

4. The method according to claim 3, characterized in that, The process of identifying anomalous sample logs from sample logs includes: Determine the anomaly score of the abnormal sample logs; The step of determining the anomaly score of each of the M anomaly log templates includes: The abnormal score of the abnormal log template is determined based on the average of the abnormal scores of at least one abnormal sample log that conforms to the abnormal log template.

5. The method according to claim 4, characterized in that, Determining the anomaly score of the abnormal sample log includes: The anomaly score of the abnormal sample logs is determined using a large language model.

6. The method according to claim 5, characterized in that, The process of determining the anomaly score of the abnormal sample logs using a large language model includes: Based on multiple reference logs and the multiple reference anomaly scores corresponding to each of the multiple reference logs, construct prompt words; The abnormal sample logs to be scored and the prompt words are input into the large language model, and the abnormal score of the abnormal sample logs to be scored is queried to the large language model.

7. The method according to any one of claims 1 to 6, characterized in that, The step of determining whether the log to be detected is an abnormal log using the regular expression includes: The regular expression is sent to multiple agent programs; The multiple proxy programs determine whether the log to be detected is an abnormal log based on the regular expression.

8. A log detection device, characterized in that, The device includes: The identification module is used to identify abnormal sample logs from the sample logs; A generation module is used to generate an anomaly log template based on the anomaly sample logs, wherein the anomaly log template includes common features shared by multiple anomaly sample logs. The conversion module is used to convert the exception log template into a regular expression; The judgment module is used to determine whether the log to be detected is an abnormal log by using the regular expression.

9. The method according to claim 8, characterized in that, The identification module is further configured to: Suspicious logs are identified from sample logs using rules or artificial intelligence (AI) algorithms; The suspicious logs are input into the large language model to obtain the abnormal sample logs output by the large language model.

10. The method according to claim 8, characterized in that, There are M exception log templates, and the generation module is further configured to: Determine the anomaly score for each of the M anomaly log templates; The conversion module is further configured to: The M exception log templates are converted into M regular expressions, where each regular expression has an exception score corresponding to the exception log template. The judgment module is further configured to: Arrange the M regular expressions in descending order of their anomaly scores; The top N regular expressions based on the anomaly scores from highest to lowest are selected to determine whether the log to be detected is an anomaly log, where M≥N.

11. The method according to claim 10, characterized in that, The identification module is further configured to: Determine the anomaly score of the abnormal sample logs; The generation module is further configured to: The abnormal score of the abnormal log template is determined based on the average of the abnormal scores of at least one abnormal sample log that conforms to the abnormal log template.

12. The method according to claim 11, characterized in that, The identification module is further configured to: The anomaly score of the abnormal sample logs is determined using a large language model.

13. The method according to claim 12, characterized in that, The identification module is further configured to: Based on multiple reference logs and the multiple reference anomaly scores corresponding to each of the multiple reference logs, construct prompt words; The abnormal sample logs to be scored and the prompt words are input into the large language model, and the abnormal score of the abnormal sample logs to be scored is queried to the large language model.

14. The method according to any one of claims 8 to 13, characterized in that, The judgment module is further configured to: The regular expression is sent to multiple agent programs; The multiple proxy programs determine whether the log to be detected is an abnormal log based on the regular expression.

15. A computing device cluster, characterized in that, The system includes at least one computing device, each computing device including a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the log detection method as described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program for performing the log detection method according to any one of claims 1 to 7.

17. A computer program product comprising program code, which, when a computer runs the computer program product, causes the computer to implement the log detection method according to any one of claims 1 to 7.

Images