CN111930702A

CN111930702A - Log processing method, device, system and medium

Info

Publication number: CN111930702A
Application number: CN202010822771.4A
Authority: CN
Inventors: 杨毅; 刘利辉; 李洪业; 孙启兵
Original assignee: ICBC Technology Co Ltd
Current assignee: Industrial and Commercial Bank of China Ltd ICBC; ICBC Technology Co Ltd
Priority date: 2020-08-14
Filing date: 2020-08-14
Publication date: 2020-11-13

Abstract

The present disclosure provides a log processing method. Scanning a log file in a disk, wherein the application program stores the log file generated in the running process into the disk; when the first log file is found to be updated by scanning, reading incremental log content in the first log file, wherein the incremental log content is content which is not read in the first log file; the incremental log content comprises N logs, wherein N is an integer greater than or equal to 1; the first log file is any log file generated in the running process of the application program; and establishing an index for each log in the incremental log content to obtain N indexes respectively corresponding to the N logs. The disclosure also provides a log processing device, a log processing system and a log processing medium.

Description

Log processing method, device, system and medium

Technical Field

The present disclosure relates to the field of computer technologies and the field of big data, and more particularly, to a method, an apparatus, a system, and a medium for processing a log.

Background

Network equipment, a system, a service program and the like can generate one or more log files for recording events during operation; each log in the log file records the description of the date, time, user and action.

In the prior art, when log processing is performed, an application program writes operation records into log files in a disk, a log collection service collects contents in the log files and classifies the logs, the logs are forwarded to a log storage service, the log storage service stores the logs and establishes corresponding indexes for each log, and finally, a log analysis service provides services such as real-time log analysis and retrieval, and the operation condition of the application is judged according to the services.

In the course of implementing the disclosed concept, the inventors found that there are at least the following problems in the prior art: in the prior art, in the process of log processing, a log needs to be read from a disk and then stored for the second time by a log storage service. Moreover, when the application deletes some expired log files according to its own log management policy, the expired log files are still stored in the log storage service, which may cause waste of storage resources.

Disclosure of Invention

In view of this, the embodiments of the present disclosure provide an index-based log processing method, apparatus, system, and medium

In one aspect of the disclosed embodiments, a log processing method is provided. The method comprises the following steps: scanning a log file in a disk, wherein the application program stores the log file generated in the running process into the disk; when the first log file is found to be updated by scanning, reading incremental log content in the first log file, wherein the incremental log content is content which is not read in the first log file; the incremental log content comprises N logs, wherein N is an integer greater than or equal to 1; the first log file is any log file generated in the running process of the application program; and establishing an index for each log in the incremental log content to obtain N indexes respectively corresponding to the N logs.

According to an embodiment of the present disclosure, the reading the incremental log content in the first log file includes: acquiring a first offset for recording an end position of reading of the first log file; and reading the first log file beginning from the first offset to read the incremental log content.

According to an embodiment of the present disclosure, the reading the first log file from the first offset to read the incremental log content includes reading the first log file in batches. Wherein, the following operations are executed in each batch until the incremental log content is completely read, including: reading the first log file beginning at the first offset; recording a second offset of the end position of the batch reading when the batch reading is finished; and updating the first offset with the second offset.

According to an embodiment of the present disclosure, the indexing each of the incremental log contents includes: analyzing the content of the incremental log to obtain N logs; classifying each log to obtain classification information of each log; and establishing an index of each log based on the classification information of each log.

According to an embodiment of the present disclosure, the method further comprises: analyzing each log in the incremental log content to determine whether the log has abnormal information; and sending alarm information when the log is determined to have abnormal information.

According to an embodiment of the present disclosure, the scanning the log files in the disk includes scanning the log files in the disk in a polling manner.

According to an embodiment of the present disclosure, the method further includes deleting the index built for the log in the first log file when the scan finds that the first log file is deleted.

In another aspect of the disclosed embodiments, a log processing apparatus is provided. The device comprises a scanning module, a reading module and an index establishing module. The scanning module is used for scanning the log file in the disk, wherein the application program stores the log file generated in the running process into the disk. The reading module is used for reading incremental log contents in a first log file when the first log file is found to be updated by scanning, wherein the incremental log contents are contents which are not read in the first log file; the incremental log content comprises N logs, wherein N is an integer greater than or equal to 1; the first log file is any log file generated in the running process of the application program. The index establishing module is used for establishing an index for each log in the incremental log content to obtain N indexes respectively corresponding to the N logs.

According to an embodiment of the present disclosure, the apparatus further includes an analysis module and an alarm module. The analysis module is used for analyzing each log in the incremental log content to determine whether the log has abnormal information. And the alarm module is used for sending alarm information when the log is determined to have abnormal information.

According to the embodiment of the disclosure, the scanning module is further configured to scan the log files in the disk in a polling manner. According to an embodiment of the present disclosure, the apparatus further includes an index deletion module. The index deleting module is used for deleting the index established for the log in the first log file when the first log file is found to be deleted by scanning.

In another aspect of the disclosed embodiments, a log processing system is provided. The system includes one or more memories, and one or more processors. The memory has stored thereon computer-executable instructions. The processor executes the instructions to implement the method as described above.

Another aspect of the embodiments of the present disclosure provides a computer-readable storage medium storing computer-executable instructions for implementing the method as described above when executed.

Another aspect of embodiments of the present disclosure provides a computer program comprising computer executable instructions for implementing the method as described above when executed.

One or more of the above-described embodiments may provide the following advantages or benefits: the problem of secondary dump of log files can be avoided, the storage space of logs is saved and the processing flow of the logs is simplified by reading the logs from the disk written in the logs by the application program and creating indexes for each log.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure with reference to the accompanying drawings, in which:

fig. 1 schematically shows a system architecture of a log processing method and apparatus according to an embodiment of the present disclosure;

FIG. 2 schematically shows a flow chart of a log processing method according to an embodiment of the present disclosure;

FIG. 3 schematically illustrates a method flow for batch reading incremental log contents in a log processing method according to an embodiment of the present disclosure;

FIG. 4 schematically shows a flow chart of a log processing method according to another embodiment of the present disclosure;

FIG. 5 schematically illustrates a flow diagram of a log processing method according to yet another embodiment of the present disclosure;

FIG. 6 schematically illustrates a block diagram of a log processing apparatus according to yet another embodiment of the present disclosure; and

FIG. 7 schematically illustrates a block diagram of a computer system suitable for implementing log processing according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.). Where a convention analogous to "A, B or at least one of C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B or C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

The embodiment of the disclosure provides a log processing method, a log processing device, a log processing system and a log processing medium. Scanning a log file in a disk, wherein the application program stores the log file generated in the running process into the disk; when the first log file is found to be updated by scanning, reading incremental log content in the first log file, wherein the incremental log content is content which is not read in the first log file; the incremental log content comprises N logs, wherein N is an integer greater than or equal to 1; the first log file is any log file generated in the running process of the application program; and establishing an index for each log in the incremental log content to obtain N indexes respectively corresponding to the N logs.

According to the embodiment of the disclosure, the logs can be read from the disk in which the application program writes the logs, and the index is created for each log, so that the problem of secondary dump of the logs in the prior art is solved, and the storage space of the logs is saved.

According to other embodiments of the present disclosure, when a certain log file is deleted by an application program when a disk is scanned, an index established for a log in the log file may also be deleted, thereby releasing an index space.

Fig. 1 schematically illustrates a system architecture 100 of a log processing method and apparatus according to an embodiment of the present disclosure. It should be noted that fig. 1 is only an example of a system architecture to which the embodiments of the present disclosure may be applied to help those skilled in the art understand the technical content of the present disclosure, and does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments or scenarios.

As shown in fig. 1, the system architecture 100 according to this embodiment may include an application 101, a disk 102, and a log processing device 103. Where the disk 102 may be a local disk of a device running the application 101, or may be a disk of a remote storage server of the application 101.

Application 101 may generate one or more log files during runtime. These log files may be stored in disk 102 by application 101. The application 101 may correspondingly write the running record into a corresponding log file in the form of a log.

The log processing device 103 may execute the method according to the embodiment of the present disclosure to scan the log file in the disk 102, read the newly added log content in the log file, and then establish an index for each log. So that the user or the external device can quickly search for a desired log according to the index. The log processing apparatus 103 may be embodied as the log processing apparatus 600, or the computer system 700, or a computer readable storage medium, or a computer program, etc., as described below.

It should be noted that the log processing method and apparatus in the embodiments of the present disclosure may be used in the financial field, and may also be used in any field other than the financial field, and the application field is not limited by the present disclosure.

Fig. 2 schematically shows a flow chart of a log processing method according to an embodiment of the present disclosure.

As shown in fig. 2, the log processing method according to an embodiment of the present disclosure may include operations S210 to S230.

In operation S210, a log file in the disk 102 is scanned, wherein the application 101 stores the log file generated in the running process in the disk 102. The log file in the magnetic disk 102 scanned in operation S210 may be continuously scanned in a polling manner, or may be triggered to be scanned according to a user operation, or may be scanned according to a certain period.

In operation S220, when the first log file is found to be updated by scanning, reading incremental log content in the first log file, where the incremental log content is content in the first log file that has not been read; the incremental log content comprises N logs, wherein N is an integer greater than or equal to 1; the first log file is any log file generated by the application program 101 in the running process.

In one embodiment, reading the incremental log content in the first log file may be acquiring a first offset for recording an end position of reading of the first log file before, and reading the first log file starting from the first offset to read the incremental log content.

In operation S230, an index is established for each of the logs in the incremental log content, so as to obtain N indexes corresponding to the N logs, respectively.

For example, N logs may be obtained by analyzing the incremental log content, then each log may be classified to obtain classification information of each log, and then an index of each log may be established based on the classification information of each log.

Specifically, in one embodiment, the application 101 may separate different logs by line breaks when writing the logs, so that different logs may be identified in the future according to the read line breaks in operation S230. Each log is then classified, resulting in classification information such as the log level (e.g., error log or debug log), the log creation time, or information of the log file in which the log resides, and/or the purpose of the operation recorded by the log. Therefore, an index can be established based on the classification information, and log retrieval from multiple dimensions through the index is facilitated.

According to some embodiments of the present disclosure, operations S220 and S230 may be performed in parallel. That is, the incremental log contents are read in operation S220, and an index is built for each log read in operation S230.

According to the embodiment of the disclosure, the log processing method, in addition to operations S210 to S230, may further include analyzing each log in the incremental log content to determine whether the log has abnormal information, and sending alarm information when it is determined that the log has the abnormal information.

Fig. 3 schematically shows a flow of a method for batch reading incremental log contents in a log processing method according to an embodiment of the present disclosure.

As shown in fig. 3, according to the embodiment of the present disclosure, reading the incremental log content in operation S220 may be batch reading, and specifically may include operations S221 to S226.

In operation S221, a first offset for recording an end position of reading of the first log file up to then is acquired.

Then, in operation S222, the first log file is read starting from the first offset.

Next, in operation S223, a second offset of the end position of the batch reading is recorded at the end of the batch reading.

Thereafter, the first offset is updated with the second offset in operation S224.

Next, in operation S225, it is determined whether there is log content in the first log file that has not been read yet. If yes, repeatedly executing the operation S222 to the operation S224; if not, operation S226 is performed.

In operation S226, when there is no log content in the first log file that has not been read yet, it is determined that there is no readable incremental log content in the first file, which indicates that the incremental log content in the first log file is completely read currently.

Fig. 4 schematically shows a flowchart of a log processing method according to another embodiment of the present disclosure.

As shown in fig. 4, the log processing method according to the embodiment of the present disclosure may include operations S440 and S450 in addition to operations S210 to S230.

In operation S440, the log file in the scan disk 102 is polled again.

Then, in operation S450, when the first log file is found to be deleted upon the re-scanning, the index established for the log in the first log file is deleted. In this way, when the first log file is deleted by the application 101, the log processing apparatus 103 can correspondingly delete the index created for the log in the first log file. The memory and space to store the index may be freed.

Fig. 5 schematically shows a flowchart of a log processing method according to still another embodiment of the present disclosure.

As shown in fig. 5, the process flow may include the following steps:

in the first step, the application 101 generates log files a and B during running and stores the log files a and B in the disk 102 or the disk 102 of the remote storage server.

Second, the log processing means 103 scans the disk 102 for log file information.

Third, the log processing means 103 reads the log file A, B, performs batch reading of the incremental log contents therein, and records the offset of the last reading each time.

Fourthly, the log processing device 103 parses the contents of the read log A, B, classifies each log, and creates an index according to the classification.

Fifth, the application 101 repeatedly adds the log contents to the logs a and B of the disk 102.

Sixth, the log processing means 103 repeats the above third step, fourth step, and fifth step.

Seventhly, the log processing device 103 asynchronously analyzes the content of the log A, B and sends related alarm information according to actual conditions.

Eighth, application 101 deletes log B.

Ninth, the log processing device 103 finds that the log file B is deleted and the log file a is added as new content as it is in the process of repeatedly reading the log file in the disk 102.

Tenth, the log processing means 103 reads and processes the contents of the log file a.

Eleventh, the log processing apparatus 103 deletes the index created for the log file B, and releases the memory and stores the index space.

Fig. 6 schematically shows a block diagram of a log processing apparatus 600 according to yet another embodiment of the present disclosure. The log processing apparatus 600 may be a specific embodiment of the log processing apparatus 103.

As shown in fig. 6, according to an embodiment of the present disclosure, the log processing apparatus 600 may include a scanning module 610, a reading module 620, and an index establishing module 630. According to another embodiment of the present disclosure, the apparatus 600 may further include an analysis module 640, an alarm module 650, and/or an index deletion module 660. The apparatus 600 may be used to implement the methods described with reference to fig. 2-5.

The scanning module 610 is configured to scan a log file in the disk 102, where the application 101 stores the log file generated in the running process in the disk 102.

The reading module 620 is configured to read incremental log content in a first log file when the first log file is found to be updated by scanning, where the incremental log content is content in the first log file that has not been read; the incremental log content comprises N logs, wherein N is an integer greater than or equal to 1; the first log file is any log file generated by the application program 101 in the running process.

The index creating module 630 is configured to create an index for each of the logs in the incremental log content, so as to obtain N indexes corresponding to the N logs respectively.

The analysis module 640 is configured to analyze each of the logs in the incremental log content to determine whether there is abnormal information in the log. The alarm module 650 is configured to send alarm information when it is determined that the log has abnormal information.

According to an embodiment of the present disclosure, the scanning module 610 is further configured to scan log files in the disk 102 in a polling manner. The index deleting module 660 is configured to delete the index created for the log in the first log file when the scan finds that the first log file is deleted.

Any number of modules, sub-modules, units, sub-units, or at least part of the functionality of any number thereof according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure may be implemented by being split into a plurality of modules. Any one or more of the modules, sub-modules, units, sub-units according to embodiments of the present disclosure may be implemented at least in part as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in any other reasonable manner of hardware or firmware by integrating or packaging a circuit, or in any one of or a suitable combination of software, hardware, and firmware implementations. Alternatively, one or more of the modules, sub-modules, units, sub-units according to embodiments of the disclosure may be at least partially implemented as a computer program module, which when executed may perform the corresponding functions.

For example, any of the scanning module 610, the reading module 620, the index creating module 630, the analyzing module 640, the alerting module 650, and the index deleting module 660 may be combined in one module to be implemented, or any one of them may be split into a plurality of modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of the other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the scanning module 610, the reading module 620, the index creating module 630, the analyzing module 640, the alarming module 650, and the index deleting module 660 may be implemented at least partially as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, or as any one of three manners of software, hardware, and firmware, or as a suitable combination of any of them. Alternatively, at least one of the scanning module 610, the reading module 620, the index creation module 630, the analysis module 640, the alert module 650, and the index deletion module 660 may be implemented at least in part as a computer program module that, when executed, may perform a corresponding function.

FIG. 7 schematically illustrates a block diagram of a computer system 700 suitable for implementing log processing according to an embodiment of the present disclosure. The computer system 700 shown in fig. 7 is only an example and should not bring any limitations to the functionality or scope of use of the embodiments of the present disclosure. The computer system 700 may be a specific embodiment of the log processing device 103.

As shown in fig. 7, a computer system 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)702 or a program loaded from a storage section 708 into a Random Access Memory (RAM) 703. The processor 701 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 701 may also include on-board memory for caching purposes. The processor 701 may comprise a single processing unit or a plurality of processing units for performing the different actions of the method flows according to embodiments of the present disclosure.

In the RAM 703, various programs and data necessary for the operation of the computer system 700 are stored. The processor 701, the ROM702, and the RAM 703 are connected to each other by a bus 704. The processor 701 performs various operations of the method flows according to the embodiments of the present disclosure by executing programs in the ROM702 and/or the RAM 703. It is noted that the programs may also be stored in one or more memories other than the ROM702 and RAM 703. The processor 701 may also perform various operations of method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

According to an embodiment of the present disclosure, the computer system 700 may also include an input/output (I/O) interface 705, the input/output (I/O) interface 705 also being connected to the bus 704. The computer system 700 may also include one or more of the following components connected to the I/O interface 705: an input portion 706 including a keyboard, a mouse, and the like; an output section 707 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 708 including a hard disk and the like; and a communication section 709 including a network interface card such as a LAN card, a modem, or the like. The communication section 709 performs communication processing via a network such as the internet. A drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 710 as necessary, so that a computer program read out therefrom is mounted into the storage section 708 as necessary.

According to embodiments of the present disclosure, method flows according to embodiments of the present disclosure may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable storage medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program can be downloaded and installed from a network through the communication section 709, and/or installed from the removable medium 711. The computer program, when executed by the processor 701, performs the above-described functions defined in the system of the embodiment of the present disclosure. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM702 and/or the RAM 703 and/or one or more memories other than the ROM702 and the RAM 703 described above.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. In particular, various combinations and/or combinations of the features recited in the various embodiments and/or claims of the present disclosure may be made without departing from the spirit or teaching of the present disclosure. All such combinations and/or associations are within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. A log processing method, comprising:

scanning a log file in a disk, wherein the application program stores the log file generated in the running process into the disk;

when the first log file is found to be updated by scanning, reading incremental log content in the first log file, wherein the incremental log content is content which is not read in the first log file; the incremental log content comprises N logs, wherein N is an integer greater than or equal to 1; the first log file is any log file generated in the running process of the application program; and

and establishing an index for each log in the incremental log content to obtain N indexes respectively corresponding to the N logs.

2. The method of claim 1, wherein the reading the delta log content in the first log file comprises:

acquiring a first offset for recording an end position of reading of the first log file; and

reading the first log file beginning at the first offset to read the incremental log content.

3. The method of claim 2, wherein the reading the first log file starting from the first offset to read the incremental log content comprises:

reading the first log file in batches, wherein the following operations are executed in each batch until the incremental log contents are completely read, and the method comprises the following steps:

reading the first log file beginning at the first offset;

recording a second offset of the end position of the batch reading when the batch reading is finished; and

updating the first offset with the second offset.

4. The method of claim 1, wherein said indexing each of said logs of said incremental log content comprises:

analyzing the content of the incremental log to obtain N logs;

classifying each log to obtain classification information of each log; and

and establishing an index of each log based on the classification information of each log.

5. The method of claim 1 or 4, wherein the method further comprises:

analyzing each log in the incremental log content to determine whether the log has abnormal information; and

and sending alarm information when the log is determined to have abnormal information.

6. The method of claim 1, wherein the scanning log files in disk comprises:

and scanning the log files in the disk in a polling mode.

7. The method of claim 5, wherein the method further comprises:

and when the scanning finds that the first log file is deleted, deleting the index built for the log in the first log file.

8. A log processing apparatus comprising:

the scanning module is used for scanning the log file in the disk, wherein the application program stores the log file generated in the running process into the disk;

the reading module is used for reading the increment log content in the first log file when the first log file is found to be updated by scanning, wherein the increment log content is the content which is not read in the first log file; the incremental log content comprises N logs, wherein N is an integer greater than or equal to 1; the first log file is any log file generated in the running process of the application program; and

and the index establishing module is used for establishing an index for each log in the incremental log content so as to obtain N indexes respectively corresponding to the N logs.

9. A log processing system, comprising:

one or more memories having stored thereon computer-executable instructions;

one or more processors executing the instructions to implement the method of any one of claims 1-7.

10. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to perform the method of any one of claims 1 to 7.