CN109284269B - Abnormal log analysis method and device, storage medium and server - Google Patents
Abnormal log analysis method and device, storage medium and server Download PDFInfo
- Publication number
- CN109284269B CN109284269B CN201811312937.7A CN201811312937A CN109284269B CN 109284269 B CN109284269 B CN 109284269B CN 201811312937 A CN201811312937 A CN 201811312937A CN 109284269 B CN109284269 B CN 109284269B
- Authority
- CN
- China
- Prior art keywords
- log
- exception
- abnormal
- information
- analysis
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 210
- 238000004458 analytical method Methods 0.000 title claims abstract description 148
- 238000000034 method Methods 0.000 claims description 41
- 238000012360 testing method Methods 0.000 claims description 24
- 230000008569 process Effects 0.000 claims description 19
- 230000005856 abnormality Effects 0.000 claims description 13
- 238000004590 computer program Methods 0.000 claims description 10
- 238000012545 processing Methods 0.000 claims description 8
- 238000003745 diagnosis Methods 0.000 claims description 7
- 238000007726 management method Methods 0.000 description 12
- 239000002609 medium Substances 0.000 description 12
- 238000010586 diagram Methods 0.000 description 4
- 239000000284 extract Substances 0.000 description 4
- 230000009471 action Effects 0.000 description 3
- 239000011230 binding agent Substances 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 238000013524 data verification Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000032683 aging Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 239000012120 mounting media Substances 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000008707 rearrangement Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
Images
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The embodiment of the application discloses an abnormal log analysis method, an abnormal log analysis device, a storage medium and a server. The abnormal log analysis method comprises the following steps: acquiring an abnormal log; extracting keyword information of the abnormal log, and determining an analysis result of the abnormal log according to the keyword information; and storing the analysis result in a local database, and counting the analysis result in the local database to obtain a statistical result. By adopting the technical scheme, the embodiment of the application not only can accurately and quickly determine the analysis result of the abnormal logs, but also can enrich the local data of the server, and can count and analyze all the analysis results in the local database of the server, so that a user can clearly know the distribution conditions of the abnormal logs of different types.
Description
Technical Field
The embodiment of the application relates to the technical field of automatic testing, in particular to an abnormal log analysis method, an abnormal log analysis device, a storage medium and a server.
Background
At present, terminals such as smart phones, tablet computers, and notebook computers have become essential electronic devices in daily life. In the using process of the terminal equipment, problems such as system errors or application program operation errors and the like often occur, and when the error problems occur, an abnormal log can be automatically generated. How to accurately and quickly determine the analysis result of the abnormal log and know the existing abnormal log and the analysis result thereof becomes important.
Disclosure of Invention
The embodiment of the application provides an abnormal log analysis method, an abnormal log analysis device, a storage medium and a server, and can optimize an analysis scheme of an abnormal log.
In a first aspect, an embodiment of the present application provides an abnormal log analysis method, including:
acquiring an abnormal log;
extracting keyword information of the abnormal log, and determining an analysis result of the abnormal log according to the keyword information;
and storing the analysis result in a local database, and counting the analysis result in the local database to obtain a statistical result.
In a second aspect, an embodiment of the present application provides an anomaly log analysis apparatus, including:
the abnormal log obtaining module is used for obtaining an abnormal log;
the abnormal log analysis module is used for extracting keyword information of the abnormal log and determining an analysis result of the abnormal log according to the keyword information;
and the analysis result storage module is used for storing the analysis results in a local database and counting the analysis results in the local database to obtain statistical results.
In a third aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the abnormality log analysis method according to the first aspect of the embodiment of the present application.
In a fourth aspect, an embodiment of the present application provides a server, including a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor executes the computer program to implement the method for analyzing an exception log according to the first aspect of the embodiment of the present application.
According to the abnormal log analysis scheme provided by the embodiment of the application, the abnormal log is obtained, the keyword information of the abnormal log is extracted, the analysis result of the abnormal log is determined according to the keyword information, then the analysis result is stored in a local database, and the analysis result in the local database is counted to obtain a statistical result. By adopting the technical scheme, the analysis result of the abnormal logs can be accurately and quickly determined, the local data of the server can be enriched, all the analysis results in the local database of the server are counted and analyzed, and a user can clearly know the distribution conditions of the abnormal logs of different types.
Drawings
Fig. 1 is a schematic flowchart of an abnormal log analysis method according to an embodiment of the present application;
fig. 2 is a schematic flowchart of another abnormal log analysis method according to an embodiment of the present application;
fig. 3 is a schematic flowchart of another abnormal log analysis method according to an embodiment of the present application;
fig. 4 is a schematic structural diagram of an abnormal log analysis apparatus according to an embodiment of the present application;
fig. 5 is a schematic structural diagram of a server according to an embodiment of the present application.
Detailed Description
The technical scheme of the application is further explained by the specific implementation mode in combination with the attached drawings. It is to be understood that the specific embodiments described herein are merely illustrative of the application and are not limiting of the application. It should be further noted that, for the convenience of description, only some of the structures related to the present application are shown in the drawings, not all of the structures.
Before discussing exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although a flowchart may describe the steps as a sequential process, many of the steps can be performed in parallel, concurrently or simultaneously. In addition, the order of the steps may be rearranged. The process may be terminated when its operations are completed, but may have additional steps not included in the figure. The processes may correspond to methods, functions, procedures, subroutines, and the like.
Fig. 1 is a schematic flowchart of an anomaly log analysis method provided in an embodiment of the present application, where the method may be executed by an anomaly log analysis apparatus, where the apparatus may be implemented by software and/or hardware, and may be generally integrated in a server. As shown in fig. 1, the method includes:
In an embodiment of the present application, the manner of obtaining the exception log includes at least one of: the method comprises the steps of obtaining an abnormal log sent by a terminal after-sale diagnosis tool, obtaining an abnormal log generated locally when the terminal is abnormal, and obtaining the abnormal log sent by a developer based on a test tool in the terminal test process. The obtaining of the abnormal log sent by the terminal after-sales diagnostic tool can be understood as: when the terminal equipment has an abnormal problem in the using process, a user generally sends the terminal equipment to after-sale detection, after-sale workers or developers adopt a terminal after-sale diagnosis tool to detect the reason of the abnormal occurrence of the equipment, and extract abnormal logs recorded by the terminal equipment from a large number of log files in the terminal equipment, at the moment, the terminal after-sale diagnosis tool can establish communication connection with a server, and the extracted abnormal logs in the terminal equipment are sent to the server. It should be noted that the abnormality log sent by the terminal after-sale diagnostic tool may include abnormality logs extracted from the respective terminal devices. Obtaining the locally generated exception log when the terminal is abnormal can be understood as: the Log includes an operation record generated when an operating system or an application program of the terminal is subjected to some operation processing, and may also be understood as an operation record generated in an operation process of the terminal system or the mobile program. The journal generally has no fixed format, usually is a text file, and can be opened with a notepad to view the contents therein. And the log generated when the terminal runs abnormally is an abnormal log, and the generated abnormal log comprises key error information generated when the terminal runs abnormally, so that when the terminal is detected to be abnormal, the corresponding abnormal log generated due to the abnormal terminal is sent to the server, and the abnormal log stored locally and generated by the terminal in the preset time period can be sent to the server at intervals of a preset time period. Obtaining an exception log sent by a developer based on a test tool in a terminal test process can be understood as follows: before the terminal leaves a factory or after the terminal returns to the factory, developers are required to test a large quantity of terminals, in the process of testing the terminal, the terminal can generate corresponding log files, and each test action or each test state in the test process is expressed in the log files. Any fault information in the test action or the test state is recorded in the log file, a log generated when the test action or the test state has a fault can be called an abnormal log, and the test tool can send each abnormal log generated in the test process to the server.
And 102, extracting the keyword information of the abnormal log, and determining the analysis result of the abnormal log according to the keyword information.
Optionally, the analysis result of the anomaly log includes: at least one of an exception type of the exception log, an exception source of the exception log, and a solution to which the exception log corresponds. The exception types of the exception log may include a network exception type, an application unresponsive ANR type, a system shutdown type, an application exception exit, an aging exception type, and the like; the abnormal source of the abnormal log can understand the reason of the abnormal log; the solution corresponding to the abnormal log can be understood as a solution given for the abnormal operation of the terminal equipment.
In the embodiment of the application, the keyword information of the abnormal log is extracted, and the analysis result of the abnormal log is determined according to the keyword information. Optionally, the exception source of the exception log and the exception type of the exception log may be determined according to the keyword information of the exception log. For example, when the extracted keyword information includes "ANR" and a field of Binder transmission failure, it indicates that the exception type of the exception log is an application unresponsive ANR type exception log, and an exception source of the exception log is specifically a Binder transmission failure in the ANR; for another example, when the extracted keyword information includes "Crash", it indicates that the terminal operation abnormality is caused by abnormal exit of the application program; for another example, the extracted keyword information includes "Crash" and "oom-killer", which indicates that the exception type of the exception log is an application exception exit type exception log, and the exception source of the exception log includes: the system is forced to kill the process, namely the terminal abnormal operation is caused by the fact that the low memory is the process forced to be killed by the system. Optionally, the solution corresponding to the exception log may be determined based on the correspondence between the keyword information and the solution. Illustratively, the correspondence relationship between the keyword information and the solution is obtained, and the solution corresponding to the keyword information extracted from the abnormal log is searched from the correspondence relationship between the keyword information and the solution as the solution of the abnormal log. Optionally, the solution corresponding to the exception log may be determined based on the correspondence between the exception source and the solution. Illustratively, after determining an abnormal source of the abnormal log according to the keyword information extracted from the abnormal log, obtaining a corresponding relation between the abnormal source and a solution, and searching the solution corresponding to the abnormal source of the abnormal log from the corresponding relation between the abnormal source and the solution based on the abnormal source of the abnormal log as the solution of the abnormal log.
Optionally, determining an analysis result of the abnormal log according to the keyword information includes: and performing fuzzy matching processing in a preset feature template library according to the keyword information to obtain an analysis result of the abnormal log. It can be understood that the server obtains a large number of different abnormal logs and analysis results of the abnormal logs, stores the abnormal logs locally in the server, and generates a preset feature template block, where the feature template block may include different abnormal logs, keywords of the different abnormal logs, analysis results corresponding to the different abnormal logs, trigger times of the different abnormal logs, and code file names and line numbers of the different abnormal logs. Therefore, fuzzy matching processing can be carried out in a preset feature template library according to the extracted keyword information of the abnormal log, and the analysis result of the abnormal log is obtained. Optionally, fuzzy processing may be directly performed in a preset feature template library according to the abnormal log to obtain an analysis result of the abnormal log.
And 103, storing the analysis result in a local database, and counting the analysis result in the local database to obtain a statistical result.
In the embodiment of the application, the analysis result is stored in the local database, so that the local database of the server can be further enriched. The local database may include analysis results for different exception logs. Of course, the local database may also include: the method comprises the following steps of key words of different abnormal logs, trigger time of different abnormal logs, and code file names and line numbers of different abnormal logs. After the analysis results are stored in the local database, if the local database contains the analysis results identical to the analysis results, the number of the analysis results in the local database can be correspondingly increased by one, and if the local database does not contain the analysis results identical to the analysis results, namely, although the analysis results are recorded in the feature template feature library, the analysis results are not recorded in the local database before the current time, the analysis results are re-added to the local database to serve as the analysis results of a new abnormal log. When the analysis result is stored in the local database, the abnormal log and the contents of the keyword message and the like of the abnormal log can be correspondingly stored in the local database.
And counting and analyzing all analysis results in the local database to obtain a statistical result. Illustratively, the local database contains ten-thousandth abnormal logs and respective corresponding analysis results, and the ten-thousandth daily logs can be classified according to abnormal sources of the abnormal logs, abnormal types of the abnormal logs and solutions corresponding to the abnormal logs respectively, and the total number and the ratio of the various types of abnormal logs classified according to different forms can also be calculated. Optionally, the classification and statistics may also be performed according to the keyword characteristics of the abnormal log.
According to the abnormal log analysis method provided by the embodiment of the application, the abnormal log is obtained, the keyword information of the abnormal log is extracted, the analysis result of the abnormal log is determined according to the keyword information, then the analysis result is stored in a local database, and the analysis result in the local database is counted to obtain the statistical result. By adopting the technical scheme, the analysis result of the abnormal logs can be accurately and quickly determined, the local data of the server can be analyzed, all the analysis results in the local database of the server are counted and analyzed, and a user can clearly know the distribution conditions of the abnormal logs of different types.
In some embodiments, the exception log comprises an application unresponsive ANR exception log; correspondingly, the keyword information of the exception log comprises: CPU load information, state information of a main thread, state information of a main stack and data read-write waiting io wait information.
In some embodiments, the exception types of the application unresponsive ANR exception log include third party application exceptions and system exceptions; correspondingly, determining the analysis result of the abnormal log according to the keyword information comprises: when the keyword information meets a first preset condition, determining that the exception type of the unresponsive ANR exception log of the application program is a third-party application exception; wherein the first preset condition comprises: the state information of the main thread is in a blocked native state, the state information of the main stack points to a dynamic link so library in a third party, and the CPU load information and the data read-write waiting io wait information are both smaller than a first preset threshold; when the keyword information meets a second preset condition, determining that the exception type of the application program unresponsive ANR exception log is a system exception; wherein the second preset condition comprises: the state information of the main thread is in a native state, the abnormal calling layer number in the state information of the main stack is a preset layer number, and the CPU load information and the data read-write waiting io wait information are both smaller than a second preset threshold.
For example, among all the exception logs, the application unresponsive ANR exception log is the most common, and the probability of occurrence of the application unresponsive ANR exception log is the greatest, so that analysis of the ANR exception log and statistics of analysis results of the ANR exception log in the local data become more important. The extracted key information of the ANR exception log may include CPU load information, state information of the main thread, state information of the main stack, and data read-write wait io wait information. It should be noted that, in the embodiment of the present application, specific content of the extracted key information of the ANT exception Log is not limited, and the key information may further include information such as cause information component information of ANR generation, Message Log Message _ Log information, translation dex2oat information of old and new running files, and process number information. Optionally, when the ANR log is a broadcast ANR exception log, the extracted keyword information may further include broadcast ANR type information.
Optionally, when the extracted key word information of the ANR exception log meets a first preset condition, it is determined that the exception type of the application unresponsive ANR exception log is a third-party application exception. When the state information of the master thread is in a stuck native state, the state information of the master stack points to a third-party internal dynamic link so library, and both the CPU load information and the data read-write waiting io wait information are smaller than a first preset threshold, it is indicated that the keyword information of the ANR exception log meets a first preset condition, and at this time, it may be determined that the exception type of the ANR exception log is a third-party application exception. The first preset threshold may be obtained according to a large amount of data verification, for example, the first preset threshold may be set to 30%, and at this time, it may be understood that both the CPU load information and the data read-write waiting io wait information are smaller than the first preset threshold: the load of the CPU is less than 30%, and the data read-write waiting ratio io wait information is less than 30%. The third-party application exception may be understood as an exception of the application itself, and if the exception problem needs to be solved, a developer of the application may be consulted, or the provided solution of the ANR exception log includes a modification scheme for the third-party application, such as upgrading the version of the application, and the like. Optionally, when the ANR exception log is a broadcast ANR exception log, if it is determined that the exception type of the broadcast ANR exception log is a third-party application exception, the first preset condition further includes that the broadcast ANR type information is an input timeout type, that is, when the ANR exception log is the broadcast ANR exception log, if the keyword information simultaneously satisfies the following four conditions: the state information of the main thread is a blocked native state, the state information of the main stack points to a dynamic link so library in a third party, and when the CPU load information and the data read-write waiting io wait information are both smaller than a first preset threshold value and the broadcast ANR type information is input timeout, the exception type of the broadcast ANR exception log can be determined to be a third party application exception.
Illustratively, the ANR exception log is as follows:
0％31542/kworker/4:0:0％user+0％kernel
25％TOTAL：16％user+6.9％kernel+0.8％iowait+0.6％irq+0.1％softirq
“main”prio＝5tid＝1Native
native：#00pc 00018e10/system/libc.so(syscall+28)
native：#01pc 0004773b/system/libc.so(pthread join+130)
native：#02 pc 00a5deb7/data/app/com.autonatti.minimap-4rtEJnRL7u7coqYffpgnTA＝＝/lib/arm/libdice/so( )
in the above-mentioned exception log, "25% TOTAL" indicates that CPU load information is 25%, "0.8% iowait" indicates that data read/write wait ratio iowait information is 0.8%, "main" prio ═ 5tid ═ 1 Native "," state information indicating that the state information of the main thread is in a stuck Native state, "Native: and #02 pc 00a5deb7/data/app/com, autonatti, minimap-4rtEJnRL7u7coqYffpgnTA ═ lib/arm/libdie/so () shows that the state information of the main stack points to the inside dynamic link so library of the third party, obviously, the keyword information of the ANR exception log meets a first preset condition, and the type of the exception of the ANR exception log is the third party application exception.
Optionally, when the keyword information meets a second preset condition, determining that the exception type of the application unresponsive ANR exception log is a system exception. When the state information of the main thread is in a stuck native state, an exception calling layer number in the state information of the main stack is a preset layer number, and both the CPU load information and the data read-write waiting io wait information are smaller than a second preset threshold, it is indicated that the keyword information of the ANR exception log meets a second preset condition, and at this time, it is determined that the exception type of the ANR exception log is a system exception. The second preset threshold may be obtained according to a large amount of data verification, for example, the second preset threshold may be set to 35%, at this time, it may be understood that both the CPU load information and the data read-write waiting io wait information are smaller than the first preset threshold: the load of the CPU is less than 35%, and the data read-write waiting ratio io wait information is less than 35%. The system exception may be understood as an exception of the terminal itself, and if the exception problem needs to be solved, a developer of the terminal equipment may be consulted, or the solution of the ANR exception log provided includes a modification scheme for the terminal system, such as upgrading the system version of the terminal, and the like. Optionally, when the ANR exception log is the broadcast ANR exception log, if it is determined that the exception type of the broadcast ANR exception log is a system exception, the second preset condition further includes that the broadcast ANR type information is an execution service type, that is, when the ANR exception log is the broadcast ANR exception log, if the keyword information simultaneously satisfies the following four conditions: and when the state information of the main thread is a blocked native state, an exception calling layer number in the state information of the main stack is a preset layer number, and the CPU load information and the data read-write waiting io wait information are both smaller than a second preset threshold value and the broadcast ANR type information is an execution service class, determining that the exception type of the broadcast ANR exception log is a system exception.
Illustratively, the ANR exception log is as follows:
0％14821/com.oppo.tzupdate:0％user+0％kernel
531％TOTAL：15％user+611％kernel+0.5％iowait+02.5％irq+1％softirq
“main”prio＝5tid＝1Native
native：#00pc 00048e38/system/libc.so(_ioctl+8)
native：#01pc 0001dffd/system/libc.so(ioctl+32)
native：#02 pc 0004617f/system/lib/libbinder/so(android::IPCThreadAtate::talkkwithDriver(bool)+202
in the above-mentioned exception log, "31% TOTAL" indicates that CPU load information is 31%, "0.5% iowait" indicates that data read/write wait ratio iowait information is 0.5%, "main" prio ═ 5tid ═ 1 Native "," state information indicating that the main thread is in a stuck Native state, "Native: #02 pc 0004617f/system/lib/libbinder/so (android:: IPCThreadatate:: talktwithdriver (pool) +202 "indicates that the exception call layer number in the state information of the main stack is a preset layer number, and obviously, the keyword information of the ANR exception log satisfies a second preset condition, which indicates that the exception type of the ANR exception log is a system exception.
Fig. 2 is a schematic flowchart of an exception log method according to an embodiment of the present application, and as shown in fig. 2, the method includes:
Optionally, the manner of obtaining the exception log includes at least one of: the method comprises the steps of obtaining an abnormal log sent by a terminal after-sale diagnosis tool, obtaining an abnormal log generated locally when the terminal is abnormal, and obtaining an abnormal log sent by a developer based on a test tool in the terminal test process.
In the embodiment of the application, the analysis result of the current exception log is displayed on the management interface, so that a user can clearly know the exception source, the exception type, the solution corresponding to the exception log and other contents of the current exception log.
In the embodiment of the present application, the statistical result obtained by counting all the analysis results in the local database of the server is displayed on the management interface in a graphical form, and for example, the statistical result may be displayed on the management interface in a form of a pie chart, a bar chart, or a distribution graph. Therefore, the user can more vividly and intuitively know the distribution conditions of the abnormal logs of different categories.
Optionally, the analysis result of the exception log and the statistical result of performing statistics on all analysis results in the local database may be displayed on the management interface. Therefore, the user can clearly know the content of the current abnormal log such as the abnormal source, the abnormal type and the solution corresponding to the abnormal log, and can more vividly and intuitively know the distribution condition of the abnormal logs of different types.
The abnormal log analysis method provided by the embodiment of the application comprises the steps of obtaining an abnormal log, extracting keyword information of the abnormal log, performing fuzzy matching processing in a preset feature template library according to the keyword information to obtain an analysis result of the abnormal log, storing the analysis result in a local database, counting the analysis result in the local database to obtain a statistical result, and finally displaying the analysis result of the abnormal log on a management interface; or displaying the statistical result in a management interface in a graphical form. By adopting the technical scheme, the analysis result of the abnormal log can be accurately and quickly determined, the local data of the server can be analyzed, all the analysis results in the local database of the server are counted and analyzed, the analysis result of the current abnormal log is displayed on the management interface, and a user can clearly know the contents of the abnormal source, the abnormal type, the solution corresponding to the abnormal log and the like of the current abnormal log. The statistical results obtained by counting all the analysis results in the local database are displayed on the management interface in a charting mode, so that the user can more vividly and intuitively know the distribution conditions of the abnormal logs of different categories.
Fig. 3 is a flowchart illustrating an exception log method according to an embodiment of the present application, where an exception log is used as an application unresponsive ANR log for example to explain in the embodiment of the present application, and as shown in fig. 3, the method includes:
and 301, acquiring an unresponsive ANR exception log of the application program.
Wherein the first preset condition comprises: the state information of the main thread is in a blocked native state, the state information of the main stack points to a dynamic link so library in a third party, and the CPU load information and the data read-write waiting io wait information are both smaller than a first preset threshold.
And step 304, when the keyword information meets a second preset condition, determining that the exception type of the application unresponsive ANR exception log is a system exception.
Wherein the second preset condition comprises: the state information of the main thread is in a native state, the abnormal calling layer number in the state information of the main stack is a preset layer number, and the CPU load information and the data read-write waiting io wait information are both smaller than a second preset threshold; wherein the second preset threshold is greater than the first preset threshold.
It should be noted that, in the embodiment of the present application, the execution sequence of step 303 and step 304 is not limited, and step 303 may be executed first, and then step 304 may be executed; step 304 may be performed first, followed by step 303; step 303 and step 304 may also be performed simultaneously.
The method for analyzing the abnormal log obtains the ANR abnormal log, extracts key information such as CPU load information, state information of a main thread, state information of a main stack, and data read-write waiting io wait information of the ANR abnormal log, determines whether the ANR abnormal log belongs to a third-party application abnormality or a system abnormality according to the key information, stores an analysis result of an abnormality type in a local database, and obtains a statistical result by performing statistics on the abnormality type in the local database. By adopting the technical scheme, the abnormal type of the ANR abnormal log can be accurately and quickly determined, the local data of the server can be enriched, the analysis results of all the ANR abnormal logs in the local database of the server are counted and analyzed, and a user can clearly know the distribution condition of the ANR abnormal log.
Fig. 4 is a schematic structural diagram of an abnormality log analysis apparatus according to an embodiment of the present disclosure, where the apparatus may be implemented by software and/or hardware, and is generally integrated in a server, and may analyze an abnormality log by executing an abnormality log analysis method. As shown in fig. 4, the apparatus includes:
an exception log obtaining module 401, configured to obtain an exception log;
an abnormal log analysis module 402, configured to extract keyword information of the abnormal log, and determine an analysis result of the abnormal log according to the keyword information;
an analysis result storage module 403, configured to store the analysis result in a local database, and count the analysis result in the local database to obtain a statistical result.
The abnormal log analysis device provided in the embodiment of the application obtains an abnormal log, extracts keyword information of the abnormal log, determines an analysis result of the abnormal log according to the keyword information, stores the analysis result in a local database, and counts the analysis result in the local database to obtain a statistical result. By adopting the technical scheme, the analysis result of the abnormal logs can be accurately and quickly determined, the local data of the server can be enriched, all the analysis results in the local database of the server are counted and analyzed, and a user can clearly know the distribution conditions of the abnormal logs of different types.
Optionally, the manner of obtaining the exception log includes at least one of:
the method comprises the steps of obtaining an abnormal log sent by a terminal after-sale diagnosis tool, obtaining an abnormal log generated locally when the terminal is abnormal, and obtaining an abnormal log sent by a developer based on a test tool in the terminal test process.
Optionally, the abnormal log analysis module is configured to:
and performing fuzzy matching processing in a preset feature template library according to the keyword information to obtain an analysis result of the abnormal log.
Optionally, the analysis result of the anomaly log includes: at least one of an exception type of the exception log, an exception source of the exception log, and a solution to which the exception log corresponds.
Optionally, the exception log includes an application unresponsive ANR exception log;
correspondingly, the keyword information of the exception log comprises:
CPU load information, state information of a main thread, state information of a main stack and data read-write waiting io wait information.
Optionally, the exception types of the application unresponsive ANR exception log include third-party application exceptions and system exceptions;
correspondingly, determining the analysis result of the abnormal log according to the keyword information comprises:
when the keyword information meets a first preset condition, determining that the exception type of the unresponsive ANR exception log of the application program is a third-party application exception; wherein the first preset condition comprises: the state information of the main thread is in a blocked native state, the state information of the main stack points to a dynamic link so library in a third party, and the CPU load information and the data read-write waiting io wait information are both smaller than a first preset threshold;
when the keyword information meets a second preset condition, determining that the exception type of the application program unresponsive ANR exception log is a system exception; wherein the second preset condition comprises: the state information of the main thread is in a native state, the abnormal calling layer number in the state information of the main stack is a preset layer number, and the CPU load information and the data read-write waiting io wait information are both smaller than a second preset threshold; wherein the second preset threshold is greater than the first preset threshold.
Optionally, the apparatus further comprises:
the display module is used for displaying the analysis result of the abnormal log on a management interface after the analysis result in the local database is counted to obtain a statistical result; or displaying the statistical result in a management interface in a graphical form.
Embodiments of the present application also provide a storage medium containing computer-executable instructions, which when executed by a computer processor, perform a method for anomaly log analysis, the method comprising:
acquiring an abnormal log;
extracting keyword information of the abnormal log, and determining an analysis result of the abnormal log according to the keyword information;
and storing the analysis result in a local database, and counting the analysis result in the local database to obtain a statistical result.
Storage medium-any of various types of memory devices or storage devices. The term "storage medium" is intended to include: mounting media such as CD-ROM, floppy disk, or tape devices; computer system memory or random access memory such as DRAM, DDRRAM, SRAM, EDORAM, Lanbas (Rambus) RAM, etc.; non-volatile memory such as flash memory, magnetic media (e.g., hard disk or optical storage); registers or other similar types of memory elements, etc. The storage medium may also include other types of memory or combinations thereof. In addition, the storage medium may be located in a first computer system in which the program is executed, or may be located in a different second computer system connected to the first computer system through a network (such as the internet). The second computer system may provide program instructions to the first computer for execution. The term "storage medium" may include two or more storage media that may reside in different locations, such as in different computer systems that are connected by a network. The storage medium may store program instructions (e.g., embodied as a computer program) that are executable by one or more processors.
Of course, the storage medium provided in the embodiments of the present application and containing computer-executable instructions is not limited to the above-described exception log analysis operation, and may also perform related operations in the exception log analysis method provided in any embodiment of the present application.
The embodiment of the application provides a server, and the server can be integrated with the abnormal log analysis device provided by the embodiment of the application. Fig. 5 is a schematic structural diagram of a server according to an embodiment of the present application. The server 500 may include: the system comprises a memory 501, a processor 502 and a computer program stored on the memory and executable by the processor, wherein the processor 502 implements the method for analyzing the abnormal log according to the embodiment of the present application when executing the computer program.
The server provided by the embodiment of the application acquires the abnormal log, extracts the keyword information of the abnormal log, determines the analysis result of the abnormal log according to the keyword information, stores the analysis result in the local database, and counts the analysis result in the local database to obtain the statistical result. By adopting the technical scheme, the analysis result of the abnormal logs can be accurately and quickly determined, the local data of the server can be enriched, all the analysis results in the local database of the server are counted and analyzed, and a user can clearly know the distribution conditions of the abnormal logs of different types.
The abnormal log analysis device, the storage medium and the server provided in the above embodiments may execute the abnormal log analysis method provided in any embodiment of the present application, and have corresponding functional modules and beneficial effects for executing the method. Technical details that are not described in detail in the above embodiments may be referred to an anomaly log analysis method provided in any embodiments of the present application.
It is to be noted that the foregoing is only illustrative of the preferred embodiments of the present application and the technical principles employed. It will be understood by those skilled in the art that the present application is not limited to the particular embodiments described herein, but is capable of various obvious changes, rearrangements and substitutions as will now become apparent to those skilled in the art without departing from the scope of the application. Therefore, although the present application has been described in more detail with reference to the above embodiments, the present application is not limited to the above embodiments, and may include other equivalent embodiments without departing from the spirit of the present application, and the scope of the present application is determined by the scope of the appended claims.
Claims (6)
1. An anomaly log analysis method, comprising:
acquiring an abnormal log;
extracting keyword information of the abnormal log, and determining an analysis result of the abnormal log according to the keyword information; wherein the analysis result of the abnormal log comprises: at least one of an exception type of the exception log, an exception source of the exception log, and a solution corresponding to the exception log;
storing the analysis results in a local database, and counting all the analysis results in the local database to obtain statistical results; wherein, the local database comprises: the analysis results of different abnormal logs, the keywords of different abnormal logs, the trigger time of different abnormal logs, and the code file names and line numbers of different abnormal logs;
wherein the manner of obtaining the exception log comprises at least one of the following:
acquiring an abnormal log sent by a terminal after-sale diagnosis tool, acquiring an abnormal log generated locally when the terminal is abnormal, and acquiring an abnormal log sent by a developer based on a test tool in the terminal test process;
wherein the exception log comprises an application unresponsive ANR exception log;
correspondingly, the keyword information of the exception log comprises:
CPU load information, state information of a main thread, state information of a main stack and data read-write waiting io wait information;
wherein the exception types of the application unresponsive ANR exception log comprise third party application exceptions and system exceptions;
correspondingly, determining the analysis result of the abnormal log according to the keyword information comprises:
when the keyword information meets a first preset condition, determining that the exception type of the unresponsive ANR exception log of the application program is a third-party application exception; wherein the first preset condition comprises: the state information of the main thread is in a blocked native state, the state information of the main stack points to a dynamic link so library in a third party, and the CPU load information and the data read-write waiting io wait information are both smaller than a first preset threshold;
when the keyword information meets a second preset condition, determining that the exception type of the application program unresponsive ANR exception log is a system exception; wherein the second preset condition comprises: the state information of the main thread is in a native state, the abnormal calling layer number in the state information of the main stack is a preset layer number, and the CPU load information and the data read-write waiting io wait information are both smaller than a second preset threshold; wherein the second preset threshold is greater than the first preset threshold.
2. The method of claim 1, wherein determining the analysis result of the anomaly log according to the keyword information comprises:
and performing fuzzy matching processing in a preset feature template library according to the keyword information to obtain an analysis result of the abnormal log.
3. The method according to any one of claims 1-2, further comprising, after counting the analysis results in the local database to obtain statistical results:
displaying the analysis result of the abnormal log on a management interface; or
And displaying the statistical result on a management interface in a graphical form.
4. An abnormality log analysis apparatus, comprising:
the abnormal log obtaining module is used for obtaining an abnormal log;
the abnormal log analysis module is used for extracting keyword information of the abnormal log and determining an analysis result of the abnormal log according to the keyword information; wherein the analysis result of the abnormal log comprises: at least one of an exception type of the exception log, an exception source of the exception log, and a solution corresponding to the exception log;
the analysis result storage module is used for storing the analysis results in a local database and counting the analysis results in the local database to obtain statistical results; wherein, the local database comprises: keywords of different abnormal logs, triggering time of different abnormal logs, code file names and line numbers of different abnormal logs;
wherein the manner of obtaining the exception log comprises at least one of the following:
acquiring an abnormal log sent by a terminal after-sale diagnosis tool, acquiring an abnormal log generated locally when the terminal is abnormal, and acquiring an abnormal log sent by a developer based on a test tool in the terminal test process;
wherein the exception log comprises an application unresponsive ANR exception log;
correspondingly, the keyword information of the exception log comprises:
CPU load information, state information of a main thread, state information of a main stack and data read-write waiting io wait information;
wherein the exception types of the application unresponsive ANR exception log comprise third party application exceptions and system exceptions;
correspondingly, determining the analysis result of the abnormal log according to the keyword information comprises:
when the keyword information meets a first preset condition, determining that the exception type of the unresponsive ANR exception log of the application program is a third-party application exception; wherein the first preset condition comprises: the state information of the main thread is in a blocked native state, the state information of the main stack points to a dynamic link so library in a third party, and the CPU load information and the data read-write waiting io wait information are both smaller than a first preset threshold;
when the keyword information meets a second preset condition, determining that the exception type of the application program unresponsive ANR exception log is a system exception; wherein the second preset condition comprises: the state information of the main thread is in a native state, the abnormal calling layer number in the state information of the main stack is a preset layer number, and the CPU load information and the data read-write waiting io wait information are both smaller than a second preset threshold; wherein the second preset threshold is greater than the first preset threshold.
5. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the abnormality log analyzing method according to any one of claims 1 to 3.
6. A server comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the anomaly log analysis method of any one of claims 1-3 when executing the computer program.
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811210790 | 2018-10-17 | ||
| CN2018112107900 | 2018-10-17 |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109284269A CN109284269A (en) | 2019-01-29 |
| CN109284269B true CN109284269B (en) | 2021-03-02 |
Family
ID=65174890
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811312937.7A Expired - Fee Related CN109284269B (en) | 2018-10-17 | 2018-11-06 | Abnormal log analysis method and device, storage medium and server |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109284269B (en) |
Families Citing this family (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109871290B (en) * | 2019-03-07 | 2021-02-05 | 腾讯科技（深圳）有限公司 | Call stack tracking method and device applied to Java and storage medium |
| CN111181759B (en) * | 2019-08-08 | 2021-09-14 | 腾讯科技（深圳）有限公司 | Method, device, equipment and storage medium for identifying abnormality of network equipment |
| CN111061628B (en) * | 2019-11-21 | 2023-09-01 | 天翼数字生活科技有限公司 | Data analysis method, system, device, computer equipment and storage medium |
| CN111221671B (en) * | 2019-11-27 | 2024-03-22 | 中国银行股份有限公司 | Processing method and device for abnormal exit of application program |
| CN111190792B (en) * | 2019-12-20 | 2023-10-27 | 中移（杭州）信息技术有限公司 | Log storage method and device, electronic equipment and readable storage medium |
| CN111968735A (en) * | 2020-01-07 | 2020-11-20 | 济南鸿泰医疗管理集团有限公司 | Equipment state management method and device |
| CN111563016B (en) * | 2020-04-27 | 2022-08-23 | 深圳平安医疗健康科技服务有限公司 | Log collection and analysis method and device, computer system and readable storage medium |
| CN113626227A (en) * | 2020-05-06 | 2021-11-09 | 深圳Tcl新技术有限公司 | Abnormal log information reporting method, intelligent terminal and storage medium |
| CN111625384B (en) * | 2020-05-25 | 2024-05-14 | 广东小天才科技有限公司 | Mobile terminal abnormal problem analysis method, system, terminal equipment and storage medium |
| CN111694686B (en) * | 2020-06-03 | 2023-08-04 | 北京百度网讯科技有限公司 | Processing method and device for abnormal service, electronic equipment and storage medium |
| CN114077525A (en) * | 2020-08-17 | 2022-02-22 | 鸿富锦精密电子(天津)有限公司 | Abnormal log processing method and device, terminal equipment, cloud server and system |
| CN114257534A (en) * | 2020-09-24 | 2022-03-29 | 北京小米移动软件有限公司 | Test result processing method, device and system and storage medium |
| CN112363904B (en) * | 2020-11-30 | 2022-11-22 | 歌尔科技有限公司 | Log data analysis positioning method and device and computer readable storage medium |
| CN112905399B (en) * | 2021-01-29 | 2023-04-07 | 北京紫光展锐通信技术有限公司 | Data processing method, abnormal situation prediction method and related product |
| CN112988503A (en) * | 2021-02-05 | 2021-06-18 | 深圳市锐尔觅移动通信有限公司 | Analysis method, analysis device, electronic device, and storage medium |
| CN113626244B (en) * | 2021-08-26 | 2024-05-28 | 广州市百果园网络科技有限公司 | ANR abnormal data collection method, display method, device and equipment |
| CN114328147B (en) * | 2021-11-30 | 2023-12-29 | 浪潮(山东)计算机科技有限公司 | Test exception handling method and device, electronic equipment and storage medium |
| CN115686899A (en) * | 2022-10-12 | 2023-02-03 | 深圳市华曦达科技股份有限公司 | Terminal abnormity capture analysis method and device |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7395246B2 (en) * | 2000-06-30 | 2008-07-01 | Intel Corporation | Delegating digital credentials |
| US9015127B2 (en) * | 2006-12-27 | 2015-04-21 | Oracle America, Inc. | File archiving system and method |
| CN104424094B (en) * | 2013-08-26 | 2019-04-23 | 腾讯科技（深圳）有限公司 | A kind of exception information acquisition methods, device and intelligent terminal |
| CN104461786B (en) * | 2014-12-19 | 2018-07-13 | 上海斐讯数据通信技术有限公司 | The restoration methods of android system and the recovery system of android system |
| CN106155884A (en) * | 2015-03-31 | 2016-11-23 | 展讯通信（上海）有限公司 | A kind of log analysis method and system |
| CN106339303A (en) * | 2016-08-23 | 2017-01-18 | 浪潮电子信息产业股份有限公司 | Method for analyzing abnormity of running log |
| CN108121303A (en) * | 2016-11-30 | 2018-06-05 | 沈阳中科博微科技股份有限公司 | A kind of log recording method applied to manufacturing equipment statistical analysis process |
-
2018
- 2018-11-06 CN CN201811312937.7A patent/CN109284269B/en not_active Expired - Fee Related
Also Published As
| Publication number | Publication date |
|---|---|
| CN109284269A (en) | 2019-01-29 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109284269B (en) | Abnormal log analysis method and device, storage medium and server | |
| US11263071B2 (en) | Enabling symptom verification | |
| US7475387B2 (en) | Problem determination using system run-time behavior analysis | |
| US20120331449A1 (en) | Device, method and computer program product for evaluating a debugger script | |
| US10528456B2 (en) | Determining idle testing periods | |
| US20080098365A1 (en) | Performance analyzer | |
| US20190114246A1 (en) | Method for replicating production behaviours in a development environment | |
| CN110647472A (en) | Breakdown information statistical method and device, computer equipment and storage medium | |
| CN110879781A (en) | Program debugging method and device, electronic equipment and computer readable storage medium | |
| US7231634B2 (en) | Method for determining scope and cause of memory corruption | |
| CN112306833A (en) | Application program crash statistical method and device, computer equipment and storage medium | |
| CN113377719B (en) | System abnormal shutdown time acquisition method and system | |
| CN114048099A (en) | Java application monitoring method and device, storage medium and electronic equipment | |
| CN111767213B (en) | Database check point testing method and device, electronic equipment and storage medium | |
| CN111784176A (en) | Data processing method, device, server and medium | |
| US11010158B2 (en) | Determining the availability of memory optimizations by analyzing a running binary | |
| CN113934595A (en) | Data analysis method and system, storage medium and electronic terminal | |
| CN113468029A (en) | Log management method and device, electronic equipment and readable storage medium | |
| CN111741046B (en) | Data reporting method, data acquisition method, device, equipment and medium | |
| CN114637685A (en) | Performance test method, device, equipment and medium of application program in bank system | |
| CN115129539A (en) | Log optimization method, device, equipment and storage medium | |
| CN112631929A (en) | Test case generation method and device, storage medium and electronic equipment | |
| CN113760696A (en) | Program problem positioning method and device, electronic equipment and storage medium | |
| CN117874772B (en) | Application software vulnerability scanning method and system | |
| CN118331843B (en) | Hierarchical data automatic test method, device, equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20210302 |