Summary of the invention
In consideration of it, it is necessary to provide a kind of log monitoring method, log monitoring device, terminal and computer-readable storagesThe warning function to monitored log may be implemented in medium, can timely find log exception, and by alarm notification, willThe risk being likely to occur is preferably minimized, while improving the analysis ability to log.
On the one hand the embodiment of the present invention provides a kind of log monitoring method, the log monitoring method includes:
Monitor journal file；
Keyword recognition is carried out to the content in the journal file；
Judge whether identified keyword matches with the test exception keyword in preset keyword library, whereinTest exception keyword in the preset keyword library is automatically updated every predetermined period；
If it is determined that when the test exception keyword in the keyword identified and the preset keyword library matches, thenGeneration alarm prompt is sent to default using responsible person.
Further, in above-mentioned log monitoring method provided in an embodiment of the present invention, described to the journal fileIn content carry out keyword recognition before, the method also includes:
The journal file is parsed；
Specified structure is converted by the journal file after parsing.
Further, in above-mentioned log monitoring method provided in an embodiment of the present invention, in the preset keyword libraryAbnormal keyword is tested to be divided with pre-set categories, the test exception keyword support in the pre-set categories increases, deletes,Modification, the operation searched.
Further, in above-mentioned log monitoring method provided in an embodiment of the present invention, in the preset keyword libraryThe abnormal keyword of test automatically update every predetermined period
Test exception keyword to be selected is obtained from appointed website；
It detects whether in the preset keyword library with the presence or absence of the test exception keyword to be selected；
If testing result be it is no, the test exception keyword to be selected is added to the preset keyword libraryIn.
Further, it in above-mentioned log monitoring method provided in an embodiment of the present invention, is sent by the alarm promptBefore default application responsible person, the method also includes:
Extract the test exception keyword in the journal file；
The exception information recorded in the journal file is confirmed according to the abnormal keyword of the test；
According to the incidence relation between pre-set exception information and application responsible person, the corresponding exception information is obtainedApply responsible person.
Further, in above-mentioned log monitoring method provided in an embodiment of the present invention, the pre-set abnormal letterIncidence relation between breath and application responsible person includes: that corresponding one application of the pre-set exception information is responsible forPeople, a pre-set exception information correspond to several using responsible person and several described pre-set exceptionsInformation corresponding one is applied responsible person.
Further, in above-mentioned log monitoring method provided in an embodiment of the present invention, the content packet of the alarm promptInclude: alarm level, the abnormal keyword of the test, with the test exception associated exception information of keyword and the surveyTry contextual information of the abnormal keyword in the journal file.
Another further aspect of the embodiment of the present invention also provides a kind of log monitoring device, and the log monitoring device includes:
Module is monitored in log, for monitoring journal file；
Keyword recognition module, for carrying out keyword recognition to the content in the journal file；
Abnormal judgment module, for judge identified keyword whether in preset keyword library test extremely closeKey word matches, wherein the test exception keyword in the preset keyword library is automatically updated every predetermined period；
Alarm prompt module, for determining that the test in identified keyword and the preset keyword library is abnormalWhen keyword matches, generation alarm prompt is sent to default using responsible person.
Another further aspect of the embodiment of the present invention also provides a kind of terminal, and the terminal includes processor, and the processor is used forThe step of realizing log monitoring method described in above-mentioned any one when executing the computer program stored in memory.
Another further aspect of the embodiment of the present invention also provides a kind of computer readable storage medium, the computer-readable upper storageThere is computer program, the computer program realizes log monitoring method described in above-mentioned any one when being executed by processorStep.
The embodiment of the present invention provides a kind of log monitoring method, log monitoring device, terminal and computer-readable storageMedium monitors journal file；Keyword recognition is carried out to the content in the journal file；Judging identified keyword isThe no test exception keyword with preset keyword library matches, wherein the test in the preset keyword library is closed extremelyKey word is automatically updated every predetermined period；If it is determined that the test in the keyword identified and the preset keyword libraryWhen abnormal keyword matches, then occur alarm prompt be sent to it is default using responsible person.It, can be with one using the embodiment of the present inventionDetermine to realize the warning function to monitored log in degree, can timely find log exception, and by alarm notification, it canThe risk that can occur is preferably minimized, while improving the analysis ability to log, and the embodiment of the present invention provides one kind about pre-If the interactive interface of key word library, user directly can increase preset keyword library on interactive interface, delete, repairThe operation change, searched reduces operation difficulty.
Specific embodiment
In order to be more clearly understood that the above objects, features, and advantages of the embodiment of the present invention, with reference to the accompanying drawing andThe present invention will be described in detail for specific embodiment.It should be noted that in the absence of conflict, the embodiment party of the applicationFeature in formula can be combined with each other.
Embodiment in the following description, numerous specific details are set forth in order to facilitate a full understanding of the present invention, described realityThe mode of applying is only some embodiments of the invention, rather than whole embodiments.Based on the embodiment in the present invention,Every other embodiment obtained by those of ordinary skill in the art without making creative efforts belongs to thisThe range of inventive embodiments protection.
Unless otherwise defined, all technical and scientific terms used herein and the technology for belonging to the embodiment of the present inventionThe normally understood meaning of the technical staff in field is identical.Term as used herein in the specification of the present invention is intended merely toThe purpose of specific embodiment is described, it is not intended that in the limitation embodiment of the present invention.
Fig. 1 is the flow chart of the log monitoring method of first embodiment of the invention, and the log monitoring method can answerFor terminal, the terminal can be the intelligence such as smart phone, laptop, desk-top/tablet computer, smartwatch and setIt is standby.As shown in Figure 1, the log monitoring method may include steps of:
S101: journal file is monitored.
Journal file is usually to record information according to row, normal operation information, exception information including programming systemAnd fault message.Therefore, in one embodiment, the variation of journal file can be monitored by row, i.e., record in journal fileDuring new information, the new information of record is monitored in real time, to find the exception or failure of programming system appearance.Specifically, a line log information in new write-in journal file is obtained and analyzed, keyword recognition is carried out to a line log information.
It is understood that due to generation journal file be random character string, for convenience to journal file intoRow subsequent processing, while engineers and technicians consult and enhance the readability of journal file for convenience, are monitoring log textBefore part, journal file can also be parsed, and convert the journal file after parsing to the format of specified structure.The format of the specified structure may include: log content, log rank, log generation time, log sender, log correspondenceApplication program etc..Wherein, the log rank successively may include DEBUG, INFO, WARN, ERROR, FATAL from low to highRank.
S102: keyword recognition is carried out to the content in journal file.
The keyword is the pre-set pass for indicating when destination application occurs abnormal during the testThe keyword of the exception information recorded in log.In the present embodiment, the content in journal file carries out crucialIt may include as follows that word, which knows method for distinguishing: by the way that real-time and/or (scheduled duration interval is usually the second according to scheduled duration intervalGrade, such as can choose is 2 seconds) keyword recognition is carried out to the content in journal file.It can set to one or simultaneouslyMultiple journal files are monitored.After monitoring the scanning journal file, the log text of Current Scan can also be recordedThe line number or byte number of part, to avoid part scanned before scanning, can be connected as the starting point of scanning next timeThe place of last scan continues to scan on, to further increase working efficiency.
S103: whether the identified keyword of judgement matches with the test exception keyword in preset keyword library,Wherein, the test exception keyword in the preset keyword library is automatically updated every predetermined period, however, it is determined that is identifiedWhen the test exception keyword in keyword and the preset keyword library out matches, then S104 is entered step.
In the present embodiment, the terminal can provide an interactive interface about preset keyword library, the friendshipThe test exception keyword in preset keyword library on mutual interface can be divided with pre-set categories, for example, described defaultClassification can be JAVA classification, ORACLE classification, Kafka classification etc..Test exception keyword in the pre-set categories can be withIt supports the operation such as increase, delete, modifying, searching.Test exception keyword in the preset keyword library is every predetermined periodIt is automatically updated, the predetermined period can be that system operators are pre-set for example, the predetermined period can beFive working days.It is understood that can also be detected whether by terminal there are predetermined registration operation (for example, detection at the endIt holds and whether there is clicking operation/detection on the predeterminable area of screen in the pre-determined distance apart from the terminal screen (for example, defaultDistance is 15 centimetres) in, if the singlehanded operation/detection for making hook is made in the pre-determined distance apart from the terminal screen, isIt is no to export default voice messaging (for example, phonetic order of output " update abnormal keyword ") etc.), predetermined registration operation if it exists, thenTest exception keyword in the preset keyword library is automatically updated.Specifically, the preset keyword library can be withIt is connected with several appointed websites, test exception keyword to be selected is obtained from appointed website；Detect the preset keywordIt whether there is the test exception keyword to be selected in library；If detecting, there is no described to be selected in the preset keyword libraryTest exception keyword, then the test exception keyword to be selected is added in preset keyword library.
In one embodiment, on the interactive interface in preset keyword library, there are JAVA classification, ORACLE classification,These three classification of Kafka classification, for each classification, inside can all have several and test abnormal keyword.With JAVAFor classification, the tests exception keyword such as java.lang.Error, Exception may include under JAVA classification.Described pre-If on the interactive interface of key word library, deletion label (for example, fork label) can be carried behind the abnormal keyword of each test,User selects (selection mode can be with clicking operation) described deletion label that can delete the abnormal keyword of the corresponding test of the label,Complete the delete operation that abnormal keyword is tested in preset keyword library.On the interactive interface in the preset keyword library, oftenA test can also carry newly-built label (for example, button of display " newly-built label " printed words), user behind abnormal keywordKeyword can be created in preset keyword library by clicking the newly-built label.For newly-built keyword, need to supplement simultaneouslyThe information such as the title of newly-built keyword, the founder for creating keyword, the system name for creating keyword and newly-built keyword.TogetherReason can also carry modification label behind the abnormal keyword of each test on the interactive interface in the preset keyword library(for example, Edit button of display pencil shape), user can be modified in preset keyword library by clicking modification labelKeyword.On the interactive interface in the preset keyword library, seeking can also be carried behind the abnormal keyword of each testLabel (for example, seeking button of display magnifying glass shape), user can be by clicking seeking label, in preset keyword libraryMiddle seeking keyword.
S104: alarm prompt is sent to default using responsible person.
It is understood that different servers corresponds to different test macros, different test macros is all corresponding specifiedIt is default apply responsible person.It is described default to be able to solve alarm received by its corresponding test macro using responsible person and askTopic.In the present embodiment, the test exception keyword in identified keyword and the preset keyword library is being determinedAfter matching, alarm prompt is sent to it is default using responsible person before, can be the following steps are included: extracting the dayTest exception keyword in will file；The abnormal letter recorded in the journal file is confirmed according to the exception keyword of testingBreath；According to the incidence relation between pre-set exception information and application responsible person, answering for the corresponding exception information is obtainedUse responsible person.Incidence relation between the pre-set exception information and application responsible person includes: one and described sets in advanceThe corresponding application responsible person of the exception information set, a pre-set exception information correspond to several using responsible personAnd several corresponding one of described pre-set exception informations apply responsible person.Wherein, for being preset described in oneException information correspond to several using for responsible person, the terminal can monitor it is current it is corresponding several using responsible personWhether it is in idle condition, namely whether current corresponding several of monitoring apply responsible person not in processing exception information, it is excellentThe application responsible person that first selection is in idle condition handles exception information.When several are in idle condition simultaneously using responsible personOr simultaneously in green state of hurrying, then exception information is randomly assigned to using responsible person, so as to save exception information processingTime improves the efficiency of journal file anomaly analysis.Application corresponding for pre-set exception information described in severalFor responsible person, it is preferred that several described pre-set exception informations belong to same field, corresponding application responsible person ratioIt is relatively good at this field, so that avoiding cannot due to being bad at the field using responsible person during exception information processingReach the inefficiency of accurate analysis part exception information or analysis journal file and since exception information excessively leads to technology peopleThe case where member misses key log file, being capable of more efficient, the accurate analysis for completing journal file.
The content of the alarm prompt includes but is not limited to: alarm level, the abnormal keyword of the test and the testThe abnormal associated exception information of keyword and the contextual information for testing abnormal keyword in the journal file.It can quickly confirm that the test is abnormal crucial from the contextual information for testing abnormal keyword in the journal filePosition of the word in journal file, it is convenient default to modify management using responsible person.It can be abnormal according to the test identifiedAlarm level A, B, C is arranged in the quantity of keyword, wherein A can indicate that alarm level is minimum, and the embodiment of the present invention does not do thisIt limits.Alarm level is set, can allow preset and responsible person is applied more intuitively to understand the case where journal file is abnormal.It can be withUnderstand, by alarm prompt be sent to it is default using responsible person while, can also be abnormal by exception information and triggeringInstruction is counted and is monitored, the reference frame as follow-up maintenance, accident analysis.It is negative that alarm prompt is sent to default applicationThe mode for blaming people includes but is not limited to the forms such as mail notification, short massage notice, Advise By Wire.
System language used in method provided in an embodiment of the present invention can for Python, Java, C++, Mysql orOracle etc., used database can be Postgresql, and application environment can be Linux environment, not make herein specificIt limits.
The embodiment of the present invention provides a kind of log monitoring method, monitors journal file；To the content in the journal fileCarry out keyword recognition；Judge identified keyword whether with the test exception keyword phase in preset keyword libraryMatch, wherein the test exception keyword in the preset keyword library is automatically updated every predetermined period；If it is determined that being knownNot Chu keyword and the preset keyword library in test exception keyword when matching, then alarm prompt occurs and is sent toIt is default to apply responsible person.Using the embodiment of the present invention, the warning function to monitored log can be realized to a certain extent, it canTimely discovery log is abnormal, and passes through alarm notification, it would be possible to which the risk of appearance is preferably minimized, while being improved to logAnalysis ability, and the embodiment of the present invention provides a kind of interactive interface about preset keyword library, user can be in interactive interfaceOn directly preset keyword library is increased, deletes, modify, searching operation, reduce operation difficulty.
It is the detailed description for being provided for the embodiments of the invention method progress above.Stream shown according to different requirements,The execution sequence of square can change in journey figure, and certain squares can be omitted.It is provided for the embodiments of the invention terminal belowIt is described.
The embodiment of the present invention also provides a kind of terminal, including memory 10, processor 30 and is stored on memory 10 simultaneouslyThe computer program that can be run on processor 30, the processor 30 realize any of the above-described embodiment when executing described programDescribed in log monitoring method the step of.
Fig. 2 is the structural schematic diagram of the terminal of an embodiment of the present invention, as shown in Fig. 2, terminal 1 includes memory 10,Log monitoring device 100 is stored in memory 10.The terminal 1 can be mobile phone, tablet computer, personal digital assistant etc.Terminal with application display function.The log monitoring device 100 can monitor journal file；To in the journal fileContent carries out keyword recognition；Judge identified keyword whether with the test exception keyword phase in preset keyword libraryMatching, wherein the test exception keyword in the preset keyword library is automatically updated every predetermined period；If it is determined that instituteWhen test exception keyword in the keyword identified and the preset keyword library matches, then alarm prompt transmission occursResponsible person is applied to default.Using the embodiment of the present invention, the warning function to monitored log, energy can be realized to a certain extentEnough timely discovery logs are abnormal, and pass through alarm notification, it would be possible to which the risk of appearance is preferably minimized, while being improved to logAnalysis ability, and the embodiment of the present invention provides a kind of interactive interface about preset keyword library, and user can be on interaction circleThe operation directly increased preset keyword library on face, delete, modify, searched reduces operation difficulty.
In present embodiment, terminal 1 can also include display screen 20 and processor 30.Memory 10, display screen 20 can be withIt is electrically connected respectively with processor 30.
The memory 10 can be different type storage equipment, for storing Various types of data.For example, it may be terminal1 memory, memory, can also be the storage card that can be external in the terminal 1, as flash memory, SM card (Smart Media Card,Smart media card), SD card (Secure Digital Card, safe digital card) etc..In addition, memory 10 may include high speedRandom access memory can also include nonvolatile memory, such as hard disk, memory, plug-in type hard disk, intelligent memory card(Smart Media Card, SMC), secure digital (Secure Digital, SD) card, flash card (Flash Card), at leastOne disk memory, flush memory device or other volatile solid-state parts.Memory 10 is used to store Various types of data,For example, the types of applications program (Applications) installed in the terminal 1, be arranged using above-mentioned log monitoring method,The information such as the data of acquisition.
Display screen 20 is installed on terminal 1, for showing information.
Processor 30 is used to execute all kinds of softwares installed in the log monitoring method and the terminal 1, such as graspsMake system and application display software etc..Processor 30 including but not limited to processor (Central Processing Unit,CPU), micro-control unit (Micro Controller Unit, MCU) etc. is for interpretive machine and processing computer softwareIn data device.
The log monitoring device 100 may include one or more module, and one or more of modules are depositedStorage is in the memory 10 of terminal 1 and is configured to be held by one or more processors (present embodiment is a processor 30)Row, to complete the embodiment of the present invention.For example, as shown in fig.3, the log monitoring device 100 may include that log is monitoredModule 101, keyword recognition module 103, abnormal judgment module 105, alarm prompt module 107.The embodiment of the present invention is so-calledModule can be the program segment for completing a specific function, the implementation procedure than program more suitable for description software in the processor.
It is understood that each embodiment in corresponding above-mentioned log monitoring method, terminal 1 may include institute in Fig. 3Part or all in each functional module shown, the function of each module will introduced in detail below.More than it should be noted thatIn each embodiment of log monitoring method identical noun related terms and its it is specific illustrate be readily applicable toUnder to the function introduction of each module.For the sake of saving space and avoiding repetition, details are not described herein again.
Module 101 is monitored in log can be used for monitoring journal file.
Keyword recognition module 103 can be used for carrying out keyword recognition to the content in the journal file.
Abnormal judgment module 105 can be used for judging identified keyword whether with the test in preset keyword libraryAbnormal keyword matches, wherein the test exception keyword in the preset keyword library carries out automatic every predetermined periodIt updates.
Alarm prompt module 107 can be used for determining the survey in identified keyword and the preset keyword libraryWhen the abnormal keyword of examination matches, generation alarm prompt is sent to default using responsible person.
The embodiment of the present invention also provides a kind of computer readable storage medium, is stored thereon with computer program, the meterThe step of calculation machine program realizes the log monitoring method in any of the above-described embodiment when being executed by processor 30.
If the integrated module/unit of 100/ terminal of log monitoring device, 1/ computer equipment is with SFU software functional unitForm realize and when sold or used as an independent product, can store in a computer readable storage medium.Based on this understanding, the present invention realizes all or part of the process in above embodiment method, can also pass through computerProgram is completed to instruct relevant hardware, and the computer program can be stored in a computer readable storage medium, shouldComputer program is when being executed by processor, it can be achieved that the step of above-mentioned each embodiment of the method.Wherein, the computer programIncluding computer program code, the computer program code can be source code form, object identification code form, executable fileOr certain intermediate forms etc..The computer readable storage medium may include: that can carry the computer program codeAny entity or device, recording medium, USB flash disk, mobile hard disk, magnetic disk, CD, computer storage, read-only memory (ROM,Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunications letterNumber and software distribution medium etc..
Alleged processor 30 can be central processing unit (Central Processing Unit, CPU), can also beOther general processors, digital signal processor (Digital Signal Processor, DSP), specific integrated circuit(Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) either other programmable logic device, discrete gate or transistor logic,Discrete hardware components etc..General processor can be microprocessor or the processor is also possible to any conventional processorDeng the processor 30 is the control centre of 100/ terminal 1 of log monitoring device, whole using various interfaces and connectionThe various pieces of a 100/ terminal 1 of log monitoring device.
For the memory 10 for storing the computer program and/or module, the processor 30 is by operation or holdsThe computer program and/or module that row is stored in the memory 10, and the data being stored in memory 10 are called, it is realThe various functions of existing 100/ terminal 1 of log monitoring device.The memory 10 can mainly include storing program area and storageData field, wherein storing program area can application program needed for storage program area, at least one function (for example sound playsFunction, image player function etc.) etc.；Storage data area, which can be stored, uses created data (such as audio number according to mobile phoneAccording to, phone directory etc.) etc..
In several specific embodiments provided by the present invention, it should be understood that disclosed terminal and method, it can be withIt realizes by another way.For example, system embodiment described above is only schematical, for example, the moduleDivision, only a kind of logical function partition, there may be another division manner in actual implementation.
It is obvious to a person skilled in the art that the embodiment of the present invention is not limited to the details of above-mentioned exemplary embodiment,And without departing substantially from the spirit or essential attributes of the embodiment of the present invention, this hair can be realized in other specific formsBright embodiment.Therefore, in all respects, the present embodiments are to be considered as illustrative and not restrictive, thisThe range of inventive embodiments is indicated by the appended claims rather than the foregoing description, it is intended that being equal for claim will be fallen inAll changes in the meaning and scope of important document are included in the embodiment of the present invention.It should not be by any attached drawing mark in claimNote is construed as limiting the claims involved.Multiple units, module or the device stated in system, device or terminal claimIt can also be implemented through software or hardware by the same unit, module or device.
Embodiment of above is only to illustrate the technical solution of the embodiment of the present invention rather than limits, although referring to above preferableThe embodiment of the present invention is described in detail in embodiment, those skilled in the art should understand that, it can be to this hairThe technical solution of bright embodiment is modified or equivalent replacement should not all be detached from the embodiment of the present invention technical solution spirit andRange.