CN117336081A - Abnormal log monitoring method, device, equipment and computer storage medium - Google Patents

Abstract

The application provides an anomaly log monitoring method, an anomaly log monitoring device, anomaly log monitoring equipment and a computer storage medium. According to the method, the working state of the target system is obtained, and when the working state of the target system is an operation state, whether a log database corresponding to the client is configured at present is judged; if the log database corresponding to the client is configured at present, judging whether abnormal records exist in the log data in a first preset period; when abnormal records exist in a first preset period, acquiring log data in the first preset period, and sending the log data to a server; and when no abnormal record exists in the first preset period, the control log program monitors and records the target system in real time. The method reduces the data processing pressure of the server side caused by high concurrency, avoids the situation that a large amount of data are accumulated on the server side, reduces the pressure of data storage of the server side, realizes the accurate positioning of abnormal problems, and improves the use experience of users.

Description

Abnormal log monitoring method, device, equipment and computer storage medium

Technical field

The present application relates to the field of communication technology, and in particular to an abnormal log monitoring method, device, equipment and computer storage medium.

Background technique

In systems such as wireless networks, there are usually problems such as fast data iteration, large data volume, large and abnormal historical data, low and unstable data quality, and abnormal login after system iteration. The log monitoring system can record the user's behavioral operations before and after abnormal situations and the abnormal trigger time, so as to quickly locate the point where the problem occurs, and formulate targeted improvement plans in a timely manner, which is of great significance in improving user experience and agile iteration. meaning.

In the existing log system, most of the users perform an operation, and the client sends a log record to the server, thereby achieving the effect of real-time log monitoring; however, since the log itself is for the user, abnormal situations occur during the use process. The effect of quickly locating problems can be achieved in real time. Sending data in real time will inevitably lead to a large amount of junk data accumulating on the server, which will bring greater data processing and storage pressure to the server. Moreover, the actual value and significance of sending log records in real time are both lower.

Therefore, recording logs in a real-time manner causes the server to receive a large number of operation requests in a short period of time, which requires a lot of time in processing logs with high concurrency and massive garbage data, and when processing abnormal data , it is also necessary to filter out abnormal data from a large amount of data, which adds a lot of extra work.

Contents of the invention

This application provides an abnormal log monitoring method, device, equipment and computer storage medium to solve the existing technology's shortcomings in real-time logging, which results in increased storage pressure on the server, increased data processing requirements, and the inability to locate abnormal data in a timely manner. .

In the first aspect, this application provides an abnormal log monitoring method, including:

Obtain the working status of the target system, which is used to instruct the target user to select a front-end service to run;

When the working state of the target system is a running state, determine whether a log database corresponding to the client is currently configured;

If the log database corresponding to the client is currently configured, determine whether there are abnormal records in the log data within the first preset period;

When there is an abnormal record in the log data in the first preset period, the log data in the first preset period corresponding to the abnormal record is obtained, and the log data is sent to the server.

Optionally, before determining whether there are abnormal records in the log data within the first preset period, the method further includes:

Obtain the login event of the target user, and load a log program corresponding to the log database, where the log program is used to instruct the client to log the target system;

Control the log program to record the login event, and control the log program to monitor and record the target system in real time.

Optionally, the controlling the log program to monitor and record the target system in real time includes:

Control the log program to monitor the target system in real time;

According to the monitoring results of the log program, determine the current click event of the target system, and the click event is used to indicate the real-time operation of the target user;

The click event triggers the recording event of the log program, and controls the log program to record the log data corresponding to the recording event.

Optionally, the controlling the log program to record the log data corresponding to the recording event includes:

According to the log program, determine a data recording program corresponding to the log database;

According to the data recording program, record the log data to the log database;

If the currently recorded log data is abnormal log data, the abnormal log data is marked in the log database.

Optionally, the abnormal log monitoring method also includes:

If there is no abnormal record within the first preset period, control the log program to continue to monitor and record the target system in real time;

According to the monitoring results, determine whether an abnormal event occurs in the target system;

When an abnormal event occurs in the target system, determine the recorded event corresponding to the abnormal event according to the abnormal event;

Control the log program to record the abnormal log data corresponding to the recording event;

The abnormal log data is sent to the server, and the abnormal log data is marked in the log database.

Optionally, the abnormal log monitoring method also includes:

When the log database corresponding to the client is currently configured, obtain the current date of the target system;

Determine whether the current date is consistent with the preset date;

If the current date is consistent with the preset date, delete all log data within the second preset period in the log database;

If the current date is inconsistent with the preset date, the log program is controlled to continue to monitor and record the target system in real time.

Optionally, the abnormal log monitoring method also includes:

If the log database corresponding to the client is not configured, generate a data storage table corresponding to the target system according to the target system;

Load the log program corresponding to the target system;

According to the data storage table and the log program, re-establish a log database corresponding to the client;

Control the log program to monitor and record the target system in real time, and store the log data in the log database.

In the second aspect, this application provides an abnormal log monitoring device, including:

The acquisition module is used to acquire the working status of the target system, and the target system is used to instruct the target user to select a front-end service to run.

The judgment module is used to judge whether a log database corresponding to the client is currently configured when the working state of the target system is a running state.

If the log database corresponding to the client is currently configured, the determination module is also used to determine whether there is an abnormal record in the log data within the first preset period.

The acquisition module is also configured to acquire the log data in the first preset period corresponding to the abnormal record when there is an abnormal record in the log data in the first preset period.

A sending module is used to send the log data to the server.

Optionally, the acquisition module is also used to acquire the login event of the target user.

The abnormal log monitoring device also includes: a processing module.

The processing module is used to load a log program corresponding to the log database, and the log program is used to instruct the client to log the target system.

The abnormal log monitoring device also includes: a control module.

The control module is used to control the log program to record the login event, and to control the log program to monitor and record the target system in real time.

Optionally, the control module is also used to control the log program to monitor the target system in real time.

The abnormal log monitoring device also includes: a determination module.

The determination module is configured to determine the current click event of the target system according to the monitoring result of the log program, and the click event is used to indicate the real-time operation of the target user.

The control module is further configured to trigger a recording event of the log program through the click event, and control the log program to record the log data corresponding to the recording event.

Optionally, the determination module is also configured to determine a data recording program corresponding to the log database according to the log program.

The processing module is also configured to record the log data to the log database according to the data recording program.

If the currently recorded log data is abnormal log data, the processing module is also configured to mark the abnormal log data in the log database.

Optionally, if there is no abnormal record within the first preset period, the control module is also used to control the log program to continue to monitor and record the target system in real time.

The determination module is also used to determine whether an abnormal event occurs in the target system based on the monitoring results.

The determination module is also configured to determine, based on the abnormal event, the recording event corresponding to the abnormal event when an abnormal event occurs in the target system.

The control module is also used to control the log program to record the abnormal log data corresponding to the recording event.

The sending module is also used to send the abnormal log data to the server.

The processing module is also used to mark the abnormal log data in the log database.

Optionally, the acquisition module is also configured to acquire the current date of the target system when the log database corresponding to the client is currently configured.

The judgment module is also used to judge whether the current date is consistent with the preset date.

If the current date is consistent with the preset date, the processing module is also configured to delete all log data within the second preset period in the log database.

If the current date is inconsistent with the preset date, the control module is also used to control the log program to continue to monitor and record the target system in real time.

Optionally, the abnormal log monitoring device further includes: a generation module.

If the log database corresponding to the client is not configured, the generating module is configured to generate a data storage table corresponding to the target system according to the target system.

The processing module is also used to load a log program corresponding to the target system.

The generation module is also configured to re-establish a log database corresponding to the client according to the data storage table and the log program.

The processing module is also used to store the log data into the log database.

In the third aspect, this application provides an abnormal log monitoring device, including:

memory;

processor;

Wherein, the memory stores computer execution instructions;

The processor executes the computer execution instructions stored in the memory to implement the abnormal log monitoring method as described in the above first aspect and various possible implementations of the first aspect.

In a fourth aspect, the present application provides a computer storage medium on which computer execution instructions are stored, and the computer execution instructions are executed by a processor to implement the above-mentioned first aspect and various possible implementations of the first aspect. Exception log monitoring method.

The abnormal log monitoring method provided by this application obtains the working status of the target system, and when the working status of the target system is running, determines whether there is a log database corresponding to the client currently configured; if there is a log database corresponding to the client currently configured of the log database, then determine whether there is an abnormal record in the log data within the first preset period; when there is an abnormal record in the log data within the first preset period, obtain the abnormal record in the first preset period corresponding to the abnormal record Log data, and send the log data to the server; when there is no abnormal record in the log data within the first preset period, continue to monitor the operating data, and when an abnormal situation occurs, run the operation corresponding to the abnormal situation. Record the data, obtain the corresponding abnormal log data, and send the abnormal log data to the server. This method reduces the data processing pressure on the server due to high concurrency, avoids the accumulation of large amounts of data on the server, reduces the pressure on data storage on the server, achieves precise location of abnormal problems, and improves the user experience. .

Description of drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the application and together with the description, serve to explain the principles of the application.

Figure 1 is a schematic diagram of the scenario of the abnormal log monitoring method provided by this application;

Figure 2 is a schematic flow chart of the abnormal log monitoring method provided by this application;

Figure 3 is a flow diagram 2 of the abnormal log monitoring method provided by this application;

Figure 4 is a schematic structural diagram of the abnormal log monitoring device provided by this application;

Figure 5 is a schematic structural diagram of the abnormal log monitoring equipment provided by this application.

Through the above-mentioned drawings, clear embodiments of the present application have been shown, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present application's concepts in any way, but are intended to illustrate the application's concepts for those skilled in the art with reference to specific embodiments.

Detailed ways

Exemplary embodiments will be described in detail herein, examples of which are illustrated in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings refer to the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with this application. Rather, they are merely examples of apparatus and methods consistent with aspects of the application as detailed in the appended claims.

The terms "first", "second", "third", "fourth", etc. (if present) in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects without necessarily using Used to describe a specific order or sequence. It is to be understood that the figures so used are interchangeable under appropriate circumstances so that the embodiments of the invention described herein, for example, can be practiced in sequences other than those illustrated or described herein.

In the embodiments of this application, words such as "exemplary" or "for example" are used to express examples, illustrations or illustrations. Any embodiment or design described herein as "exemplary" or "such as" is not intended to be construed as preferred or advantageous over other embodiments or designs. Rather, use of the words "exemplary" or "such as" is intended to present the concept in a concrete manner.

It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all It is information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards, and a corresponding operation entrance is provided for the user to choose to authorize or refuse.

In systems such as wireless networks, there are usually problems such as fast data iteration, large data volume, large and abnormal historical data, low and unstable data quality, and abnormal login after system iteration. Logs are data generated when the server is running. It not only includes network equipment, systems and service programs, but also includes descriptions of related operations such as date, time, users and actions. Through user operation logs, it can help develop People quickly identify problems so they can fix and improve the system. The log monitoring system can record the user's behavioral operations before and after abnormal situations and the abnormal trigger time, so as to quickly locate the point where the problem occurs, and formulate targeted improvement plans in a timely manner, which is of great significance in improving user experience and agile iteration. meaning.

In existing log systems, logs are usually stored on the server. Most of the time, the client sends a log record to the server once the user performs an operation, thereby achieving the effect of real-time monitoring of the log; however, since the log itself is for the user, During use, it can achieve the effect of quickly locating problems when abnormal situations occur. Sending data in real time will inevitably lead to a large amount of junk data accumulating on the server, which will bring greater data processing and storage pressure to the server. Moreover, real-time log sending The actual value and significance of the record is low.

Therefore, recording logs in a real-time manner causes the server to receive a large number of operation requests in a short period of time, which requires a lot of time in processing logs with high concurrency and massive garbage data; in addition, the server needs to process the logs recorded in the logs. When the data is stored, the stored data may also contain the user's sensitive data, and the user does not want to store the data; when processing abnormal data, it is also necessary to filter out the abnormal data from a large amount of data, which increases A lot of extra work.

In response to the above problems, this application provides an abnormal log monitoring method.

First, the implementation scenarios involved in this application are described.

Figure 1 is a schematic diagram of the scenario of the abnormal log monitoring method provided by this application. As shown in Figure 1, client 1 communicates with server 2. Client 1 can use its own configured log monitoring program to monitor whether there are any abnormal conditions during the current operation, and when abnormal conditions exist, send corresponding log data to server 2. The client 1 may be, for example, a user terminal configured with a log monitoring program, and the server 2 may be, for example, a server.

The abnormal log monitoring method provided by this application can obtain log data by establishing a log database on the client and controlling the log monitoring system to monitor and record the running data information, and the monitored and recorded log data is stored in the log database. ; When an abnormal event occurs, the client can obtain the log data corresponding to the abnormal event from the log database, that is, the abnormal log data, and send the abnormal log data to the server to complete the monitoring and recording of the abnormal event. This method reduces the data processing pressure on the server due to high concurrency, avoids the accumulation of large amounts of data on the server, reduces the pressure on data storage on the server, achieves precise location of abnormal problems, and improves the user experience. .

It can be understood that in the following embodiments of the present application, there are no special restrictions on the target system selected by the target user. The target system is a corresponding front-end service that can be provided to the user in the client, and the front-end service can be, for example, browsing. browser, online APP, etc. The following embodiments take the target system selected by the target user as a browser as an example for detailed description.

The technical solution of the present application and how the technical solution of the present application solves the above technical problems will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

Figure 2 is a flowchart 1 of the abnormal log monitoring method provided by the embodiment of the present application. The execution subject of this embodiment may be, for example, a user terminal configured with a log monitoring program. As shown in Figure 2, the abnormal log monitoring method provided by this embodiment includes:

S201: Obtain the working status of the target system.

S202: When the working state of the target system is a running state, determine whether a log database corresponding to the client is currently configured.

Among them, the target system is used to instruct the target user to select the front-end service to run, the working status is used to indicate whether the target user logs in to the currently selected target system, and the log database is used to store data information during the operation of the target system.

It can be understood that the working status includes: running status and non-running status; the running status indicates that the target user has logged in to the currently selected target system, and the target system has started running and generated corresponding running data; the non-running status indicates that the target user has not logged in to the currently selected target system. The target system; the log can record the generated operating data, obtain the log data generated by the target user during the operation of the target system, and store the data in the log database; in order to realize the data information generated during the operation of the target system For real-time monitoring, the client is also configured with a log monitoring system corresponding to the log database.

The purpose of this step to determine whether a log database corresponding to the client is currently configured is to determine whether the data information has a storage location, and to establish a corresponding log database on the client, which can also reduce the processing and storage pressure of data on the server.

By detecting whether the target user logs into the target system, the working status of the target system can be determined; when the working status of the target system is running, it is determined whether the corresponding log database is configured in the current client, thereby determining the currently generated log data. storage location; if the current client is configured with a corresponding log database, it indicates that the log data can currently be monitored and recorded normally. At this time, the corresponding monitoring program is controlled to monitor the log data generated by the target user during the operation of the target system. Monitor and record; if the current client is not configured with a corresponding log database, in order to ensure that the generated log data can be stored promptly and accurately, a corresponding log database needs to be established based on the current client.

For example, the target system currently selected by the user can be a browser, and the user terminal can detect whether the user is logged in to the browser, thereby determining the user's current operation and whether the browser corresponding to the operation is running; when the user logs in to the corresponding browser After the server is installed, it is detected whether a log database currently exists, and the log database can be an indexed database; after it is determined that the indexed database exists, the operating data generated during the user's operation is monitored and processed through the log monitoring system configured by the user terminal itself. Record; if the indexed database does not exist, the indexed database will be re-established according to the user terminal. This embodiment places no special restrictions on the target browser.

S203: If the log database corresponding to the client is currently configured, determine whether there are abnormal records in the log data within the first preset period.

The exception record is used to instruct the target user to record corresponding information about abnormal events that occur while operating the target system; the first preset period may be, for example, 3 days.

The purpose of this step of determining whether there are abnormal records in the log data within the first preset period is to determine whether it is necessary to upload the log data to the server.

If there is a log database corresponding to the client currently configured, it means that the log data generated by the target user during the operation of the target system can be stored and recorded, and the log database currently configured by the client stores at least the log data generated during the previous run. Log data. At this time, the data in the log database is judged to determine whether there are abnormal records in the log data within the first preset period.

If there is an abnormal record in the log data within the first preset period, it indicates that there is an abnormal event during the operation of the client within the first preset period, and the log monitoring system has monitored and recorded the abnormal event, and the abnormal event is related to the abnormal event. The log data corresponding to the event is also stored in the log database, and the data is marked as abnormal data. At this time, in order to ensure that the server can accurately locate and handle abnormal events in a timely manner, it is necessary to obtain the log data in the log database within the first preset period. All log data and send the log data to the server to complete the monitoring of abnormal log data.

If there are no abnormal records in the log data within the first preset period, it means that the client's operation process during the first preset period is normal, there are no abnormal events, and the log data in the log database is also normal. The data information generated during the operation process. At this time, the current real-time monitoring and recording of the data generated during the operation process of the target system is maintained.

For example, if the current user terminal is configured with an indexed database and the server can be a Web server, then the current date when the browser is running is used as the time node to determine whether there are abnormal records in the browser log data within 3 days before the time node. And the abnormal record can be: "Interface loading time timeout"; if there are abnormal records in the browser log data within 3 days before the time node, it means that the log monitoring system detected an operating abnormality within 3 days before the current time node, and Record and store the abnormal data in the indexed database. At this time, obtain all log data within 3 days before the current time node, and upload all log data to the web server; if the browser log data within 3 days before the time node does not The existence of abnormal records indicates that the log monitoring system has not detected any operating abnormalities within 3 days before the current time node. At this time, the log monitoring system is running normally and monitors and records the data information generated by the current browser.

Optionally, the method also includes:

When the log database corresponding to the client is currently configured, obtain the current date of the target system; determine whether the current date is consistent with the preset date; if the current date is consistent with the preset date, then the second preset period in the log database is All log data within will be deleted; if the current date is inconsistent with the preset date, the control log program will continue to monitor and record the target system in real time.

The second preset period may be, for example, one month, and the preset date may be, for example, the first day of each month.

The purpose of this step to determine whether the current date is consistent with the preset date is to determine whether the data in the log database needs to be deleted.

When a log database corresponding to the client is currently configured, obtain the current date of the target system and determine whether the current date is consistent with the preset date; if the current date is consistent with the preset date, it means that the current log database has stored the first All log data within the second preset period. At this time, in order to reduce data storage pressure, all log data within the second preset period in the log database are deleted; if the current date is inconsistent with the preset date, it indicates that the current The log data stored in the log database is only all log data within a part of the second preset period. At this time, the log database can continue to store log data. Then, the control log program continues to monitor and control the target system in real time. Record.

It is understandable that the preset date can be the date when the log database currently configured on the client is established, or it can be set independently by the user. This application does not place special restrictions on the setting of the preset date.

For example, when the indexed database corresponding to the user terminal is currently configured, if the current date of the obtained browser is: "May 1st", and this date meets the conditions of the first of every month, it means that the current date is the same as the default date. Consistent, and the current indexed database has stored all the log data generated by the browser during the period from April 1 to May 1. At this time, delete all the log data within this period from the indexed database. Processing; if the current date of the obtained browser is: "May 12", which does not meet the conditions of the 1st of each month, it means that the current date is inconsistent with the preset date. At this time, the control log program continues to process the browser. Real-time monitoring and recording.

Optionally, the method also includes:

If the log database corresponding to the client is not configured, generate the data storage table corresponding to the target system based on the target system; load the log program corresponding to the target system; re-establish the database corresponding to the client based on the data storage table and log program Log database; control the log program to monitor and record the target system in real time, and store the log data in the log database.

Among them, the data storage table is used to indicate the format of data information storage in the log database, the log program is used to monitor and record the operating data generated during the operation of the target system, and the log program is loaded into the log monitoring system.

It is understandable that different client configurations have log databases adapted to the current user. There are differences in the log data stored in the log databases configured by different clients. According to the usage habits of different users, the front-end services provided on the corresponding clients There are differences, and therefore, the operational data that needs to be monitored and recorded is also different.

If the current client is not configured with a log database, it means that the log data currently obtained by monitoring and recording the target system cannot be stored in the client. At this time, the log data corresponding to the current client needs to be re-established; according to the target system, determine Establish the basic information required for the log database and generate the data storage table corresponding to the target system; load the log program corresponding to the target system, and the log program is used to monitor and record the data information when the target system is running; according to the data storage table and log program, re-establish the log database corresponding to the client; after re-establishing the log database, control the log program to monitor and record the target system in real time, and store the log data in the log database.

For example, if the current client is not configured with an indexed database, it means that the log data currently obtained by monitoring and recording the browser cannot be stored in the user terminal. In this case, the indexed database needs to be re-established; determine the log data based on the currently running browser. The basic information required to establish the database. The basic information can be: user device type, user ID, browser type, etc., generate a data storage table corresponding to the target system; load the log program corresponding to the target system, so that the user terminal can implement Monitor and record browser data information; re-establish the indexed database corresponding to the user terminal according to the data storage table and log program; after re-establishing the indexed database, control the log program to monitor and record the browser in real time, and save the log The data is stored in the indexed database.

S204: When there is an abnormal record in the log data in the first preset period, obtain the log data in the first preset period corresponding to the abnormal record, and send the log data to the server.

The abnormal log monitoring method provided in this embodiment obtains the working status of the target system, and when the working status of the target system is the running status, determines whether a log database corresponding to the client is currently configured; if there is a log database corresponding to the client currently configured; Corresponding to the log database, it is determined whether there is an abnormal record in the log data in the first preset period; when there is an abnormal record in the log data in the first preset period, the log data in the first preset period corresponding to the abnormal record is obtained. log data and send the log data to the server. This method avoids the accumulation of large amounts of data on the server side, reduces the pressure on data storage on the server side, and improves the user experience.

Figure 3 is a flow chart 2 of the abnormal log monitoring method provided by the embodiment of the present application. As shown in Figure 3, this embodiment provides a detailed description of the abnormal log monitoring method based on the embodiment of Figure 2. The abnormal log monitoring method shown in this embodiment includes:

S301: Obtain the working status of the target system.

S302: When the working state of the target system is a running state, determine whether a log database corresponding to the client is currently configured.

Steps S301-S302 are similar to the above-mentioned steps S201-S202, and will not be described again here.

S303: If the log database corresponding to the client is currently configured, obtain the login event of the target user, and load the log program corresponding to the log database.

The login event is used to indicate relevant information of the target system that the target user is currently logged into. The login event may be, for example: "browser type and version, browser width and height, device type, IP, geocoding". This embodiment places no special restrictions on the target user's login events.

When the current client is configured with a log database, the login event of the current user is obtained to obtain the basic information corresponding to the target system that the user is currently logged in to, and a log program that monitors and records the user terminal is loaded, thereby realizing the current log-in event. Monitoring and recording of operating data of running target systems.

For example, when the current user terminal is configured with an indexed database, the login event of the current user is obtained to obtain the basic information of the browser that the user is currently logged in to, and a log program that monitors and records the user terminal is loaded to achieve current monitoring of the user terminal. Monitoring and recording of browser operation data.

S304: Control the log program to record the login event, and control the log program to monitor and record the target system in real time.

The log program is controlled to record the currently acquired login events, and the basic information of the target system running at that time can be obtained, and the basic information is stored in the log database; and the log program is controlled to monitor and record the target system in real time, that is, the log monitoring system is normal run.

It is understandable that the login event contains sensitive data of the target user, that is, data that needs to be encrypted. Therefore, during the process of uploading log data, the corresponding sensitive data needs to be encrypted.

For example, the control log program records the currently acquired login events: "browser type and version, browser width and height, device type, IP, geocoding" and stores these basic information in the indexed database; the control log monitoring system monitors the browser Conduct real-time monitoring and recording.

Optionally, the control log program monitors and records the target system in real time, including:

The control log program monitors the target system in real time; determines the click event of the current target system based on the monitoring results of the log program; triggers the recording event of the log program through the click event, and controls the log program to record the log data corresponding to the recorded event.

Among them, the click event is used to indicate the real-time operation of the target user, and the recording event is used to instruct the log program to record the data information triggered by the click event.

It can be understood that the client is configured with a display device, and the target user can perform real-time operations on the display device, that is, the target user operates the display interface on the display device according to his own needs, and the display interface displays the information of the current target user. The selected target system; every operation of the target user on the display device corresponds one-to-one with the click events that can be monitored by the log program. Therefore, based on the click events monitored by the log program, the real-time operations of the target user can be monitored and Recording; there is a correlation between the click event and the recording event, and the data information recorded by the recording event is the data information generated by the operation of the target system triggered by the click event.

The control log program monitors the target system in real time; based on the monitoring results of the log program, the click event of the current target system is determined; based on the click event obtained at that time, the current running process of the target system and the corresponding running data can be determined. At the same time, Trigger the recording event of the target program, record the running data corresponding to the click event, and store it in the log database.

For example, the control log program monitors the browser in real time; according to the monitoring results, it can be obtained that the current click event is: "Search for existing mobile phone types", then the data information recorded in the corresponding recording event includes: "Search duration 5 seconds, page The access frequency is 1 time/day, the search interface stays for 5 minutes, and the geocode is 101". At this time, the control log program stores these data information in the indexed database; among them, "geocode 101" means that the current user is located in Beijing. This embodiment places no special restrictions on the data information corresponding to the recorded event.

Optionally, control the log program to record log data corresponding to the recorded events, including:

According to the log program, the data recording program corresponding to the log database is determined; according to the data recording program, the log data is recorded to the log database; if the currently recorded log data is abnormal log data, the abnormal log data is marked in the log database.

Among them, the data recording program is used to instruct the target system to record the operating data, and the abnormal log data is used to instruct the target system to send corresponding data information when abnormal events are sent.

It can be understood that during the operation of the target system, the operation data generated includes normal log data and abnormal log data, that is, data information generated during normal operation and data information generated when abnormal events occur during operation.

Filter the currently loaded log program to determine the data recording program corresponding to the log database; and record the log data to the log database through the data recording program; if the currently recorded log data is abnormal log data, it indicates that the current target system There are abnormal conditions in the operation, and the obtained abnormal log data cannot be stored directly. At this time, the abnormal log data needs to be marked in the log database to distinguish it from the normal log data; if the currently recorded log data is normal log data, No other operations are required, just store it in the log database normally.

For example, filter the currently loaded log program to determine the data recording program corresponding to the log database; and record the log data to the indexed database through the data recording program; if the currently recorded log data is abnormal log data, it indicates that the current There are exceptions in the operation of the browser, and the obtained abnormal log data cannot be directly stored. At this time, the log data needs to be marked as "abnormal" in the log database; if the currently recorded log data is normal log data, it will be stored normally. Just go to the indexed database.

S305: Determine whether there is an abnormal record in the log data within the first preset period; if yes, execute step S306; if not, execute step S308.

S306: Obtain the log data in the first preset period corresponding to the abnormal record.

S307: Send the log data to the server.

Steps S305-S307 are similar to steps S203-S204 and will not be described again.

S308: Control the log program to continue to monitor and record the target system in real time.

S309: Based on the monitoring results, determine whether an abnormal event occurs in the target system.

When there are no abnormal records in the log data within the first preset period, the control log program continues to monitor and record the target system in real time, that is, the control log monitoring system monitors and records the running process of the target system in real time; when the log program monitors and recording process, based on the results of real-time monitoring, it can be determined whether an abnormal event occurs in the target system; when an abnormal event occurs in the target system, the corresponding operating data of the target system can be obtained based on the currently occurring abnormal event, and the corresponding operation data of the target system can be determined and the corresponding abnormal event can be determined Record events; when no abnormal events occur in the target system, the control log program performs normal monitoring and recording.

For example, the abnormal event can be: "Search duration timeout". If there are no abnormal records in the browser log data within 3 days before the current time node, it means that the log monitoring system has not detected any operating abnormalities within 3 days before the current time node. At this time, the log monitoring system is running normally and monitors and records the data information generated by the current browser; according to the real-time monitoring of the log monitoring system, when an abnormal event "search timeout" occurs in the browser, the abnormal data can be quickly located. Therefore, during the running process of the browser, it can be determined in real time whether the abnormal event "search duration timeout" occurs in the browser; when the abnormal event "search duration timeout" occurs in the browser, it can be determined according to the "search duration timeout" and "search duration timeout". Recording events corresponding to "Search duration timeout"; when the abnormal event "Search duration timeout" does not occur in the browser, the control log program performs normal monitoring and recording.

S310: When an abnormal event occurs in the target system, determine the recording event corresponding to the abnormal event based on the abnormal event.

S311: Control the log program to record the abnormal log data corresponding to the recording event.

S312: Send the abnormal log data to the server, and mark the abnormal log data in the log database.

After determining the recording event corresponding to the current abnormal event, record the corresponding abnormal operating data of the target system to obtain the abnormal log data. At this time, the abnormal log data needs to be marked in the log database for comparison with the normal log data. Distinguishing; based on the current date of the target system, obtain all log data within the first preset period including the current date, and the currently obtained abnormal log data is also included, and send all log data to the server to facilitate service The server analyzes and processes the abnormal log data; after sending all the log data to the server, the abnormal log data is marked in the log database to indicate that the abnormal log data has been sent.

For example, record the abnormal operation data generated by the current browser operation, store the data in the indexed database, and mark the data as "abnormal"; if the current date is May 1, obtain the two days before May 1 As well as all log data stored in the log database on May 1st, and upload all currently acquired log data to the Web server; after sending all log data to the Web server, the abnormal log data is stored in the indexed database. Mark as "Sent". This application imposes no special restrictions on the method of marking log data in the log database.

The abnormal log monitoring method provided by this implementation obtains the working status of the target system, and when the working status of the target system is running status, it determines whether there is a log database corresponding to the client currently configured; if there is a log database corresponding to the client currently configured of the log database, obtain the login event of the target user, load the log program corresponding to the log database, control the log program to record the login event, and control the log program to monitor the target system in real time; according to the monitoring results of the log program, determine The click event of the current target system; trigger the recording event of the log program through the click event, and control the log program to record the log data corresponding to the recording event; determine whether there are abnormal records in the log data within the first preset period; in the first preset When there is an abnormal record in the log data within the period, the log data in the first preset period corresponding to the abnormal record is obtained, and the log data is sent to the server; there is no abnormal record in the log data in the first preset period. When, the control log program continues to monitor and record the target system in real time, and once again determines whether an abnormal event occurs in the target system; based on the determination results, the control log program performs corresponding recording, and when an abnormal event exists, sends corresponding abnormal log data to the server. This method reduces the data processing pressure on the server due to high concurrency, avoids the accumulation of large amounts of data on the server, reduces the pressure on data storage on the server, achieves precise location of abnormal problems, and improves the user experience. .

Figure 4 is a schematic structural diagram of the abnormal log monitoring device provided by this application. As shown in Figure 4, this application provides an abnormal log monitoring device. The abnormal log monitoring device 400 includes:

The acquisition module 401 is used to acquire the working status of the target system, and the target system is used to instruct the target user to select a front-end service to run.

The determination module 402 is used to determine whether a log database corresponding to the client is currently configured when the working state of the target system is a running state.

If the log database corresponding to the client is currently configured, the determination module 402 is also used to determine whether there is an abnormal record in the log data within the first preset period.

The acquisition module 401 is also configured to acquire the log data in the first preset period corresponding to the abnormal record when there is an abnormal record in the log data in the first preset period.

The sending module 403 is used to send the log data to the server.

Optionally, the obtaining module 401 is also used to obtain the login event of the target user.

The abnormal log monitoring device also includes: a processing module 404.

The processing module 404 is used to load a log program corresponding to the log database, and the log program is used to instruct the client to log the target system.

The abnormal log monitoring device also includes: a control module 405.

The control module 405 is used to control the log program to record the login event, and to control the log program to monitor and record the target system in real time.

Optionally, the control module 405 is also used to control the log program to monitor the target system in real time.

The abnormal log monitoring device also includes: a determination module 406.

The determination module 406 is configured to determine the current click event of the target system according to the monitoring result of the log program, where the click event is used to indicate the real-time operation of the target user.

The control module 405 is also configured to trigger a recording event of the log program through the click event, and control the log program to record the log data corresponding to the recording event.

Optionally, the determination module 406 is also configured to determine a data recording program corresponding to the log database according to the log program.

The processing module 404 is also configured to record the log data to the log database according to the data recording program.

If the currently recorded log data is abnormal log data, the processing module 404 is also configured to mark the abnormal log data in the log database.

Optionally, if there is no abnormal record within the first preset period, the control module 405 is also used to control the log program to continue to monitor and record the target system in real time.

The determination module 406 is also used to determine whether an abnormal event occurs in the target system according to the monitoring results.

The determination module 406 is also configured to determine the recording event corresponding to the abnormal event based on the abnormal event when an abnormal event occurs in the target system.

The control module 405 is also used to control the log program to record the abnormal log data corresponding to the recording event.

The sending module 403 is also used to send the exception log data to the server.

The processing module 404 is also used to mark the abnormal log data in the log database.

Optionally, the obtaining module 401 is also configured to obtain the current date of the target system when the log database corresponding to the client is currently configured.

The judgment module 402 is also used to judge whether the current date is consistent with the preset date.

If the current date is consistent with the preset date, the processing module 404 is also configured to delete all log data within the second preset period in the log database.

If the current date is inconsistent with the preset date, the control module 405 is also used to control the log program to continue to monitor and record the target system in real time.

Optionally, the abnormal log monitoring device also includes: a generation module 407.

If the log database corresponding to the client is not configured, the generating module 407 is configured to generate a data storage table corresponding to the target system according to the target system.

The processing module 404 is also used to load a log program corresponding to the target system.

The generation module 407 is also configured to re-establish a log database corresponding to the client according to the data storage table and the log program.

The processing module 404 is also used to store the log data in the log database.

Figure 5 is a schematic structural diagram of the abnormal log monitoring equipment provided by this application. As shown in Figure 5, this application provides an abnormality log monitoring device. The abnormality log monitoring device 500 includes: a receiver 501, a transmitter 502, a processor 503, and a memory 504.

Receiver 501, used to receive instructions and data;

Transmitter 502, used to send instructions and data;

Memory 504, used to store computer execution instructions;

The processor 503 is configured to execute computer execution instructions stored in the memory 504 to implement various steps performed by the exception log monitoring method in the above embodiment. For details, please refer to the relevant descriptions in the foregoing exception log monitoring method embodiments.

Optionally, the above-mentioned memory 504 can be independent or integrated with the processor 503 .

When the memory 504 is provided independently, the electronic device also includes a bus for connecting the memory 504 and the processor 503 .

This application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the processor executes the computer-executed instructions, the abnormal log monitoring method executed by the above-mentioned abnormal log monitoring device is implemented.

It should be noted that for the sake of simple description, the foregoing method embodiments are expressed as a series of action combinations. However, those skilled in the art should know that the present application is not limited by the described action sequence. Because certain steps may be performed in other orders or simultaneously according to this application. Secondly, those skilled in the art should also know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily necessary for this application.

It should be further noted that although the steps in the flowchart are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated in this article, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least some of the steps in the flow chart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times. The execution of these sub-steps or stages The sequence is not necessarily sequential, but may be performed in turn or alternately with other steps or sub-steps of other steps or at least part of the stages.

Those of ordinary skill in the art can understand that all or some steps, systems, and functional modules/units in the devices disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may consist of several physical components. Components execute cooperatively. Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit . Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is known to those of ordinary skill in the art, the term computer storage media includes volatile and nonvolatile media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. removable, removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disk (DVD) or other optical disk storage, magnetic cassettes, tapes, disk storage or other magnetic storage devices, or may Any other medium used to store the desired information and that can be accessed by a computer. Additionally, it is known to those of ordinary skill in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media .

In the above embodiments, each embodiment is described with its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined in any way. To simplify the description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, all possible combinations should be used. It is considered to be within the scope of this manual.

Other embodiments of the present application will be readily apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary technical means in the technical field that are not disclosed in this application. . It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

So far, the technical solution of the present application has been described in conjunction with the preferred embodiments shown in the drawings. However, those skilled in the art can easily understand that the protection scope of the present application is obviously not limited to these specific embodiments. The above embodiments are only It is used to illustrate the technical solution of the present application, but not to limit it; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still apply the technology described in the foregoing embodiments. Modify the solution, or make equivalent substitutions for some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solution to depart from the scope of the technical solutions of the embodiments of the present application.

Claims (10)

1. An anomaly log monitoring method, the method comprising:

acquiring the working state of a target system, wherein the target system is used for indicating a front-end service selected to run by a target user;

when the working state of the target system is an operation state, judging whether a log database corresponding to the client is configured at present;

if the log database corresponding to the client is currently configured, judging whether abnormal records exist in the log data in a first preset period or not;

when the log data in the first preset period has abnormal records, the log data in the first preset period corresponding to the abnormal records is obtained, and the log data is sent to a server.

2. The method of claim 1, wherein prior to said determining whether there is an abnormal record in the log data within the first predetermined period, the method further comprises:

acquiring a login event of the target user, and loading a log program corresponding to the log database, wherein the log program is used for indicating the client to log the target system;

and controlling the log program to record the login event, and controlling the log program to monitor and record the target system in real time.

3. The method of claim 2, wherein said controlling said logging program to monitor and record said target system in real time comprises:

controlling the log program to monitor the target system in real time;

determining a click event of the current target system according to the monitoring result of the log program, wherein the click event is used for indicating the real-time operation of the target user;

triggering a recording event of the log program through the clicking event, and controlling the log program to record the log data corresponding to the recording event.

4. A method according to claim 3, wherein said controlling said logging program to log said log data corresponding to said logged event comprises:

determining a data record program corresponding to the log database according to the log program;

recording the log data to the log database according to the data recording program;

and if the currently recorded log data is abnormal log data, marking the abnormal log data in the log database.

5. The method according to claim 4, wherein the method further comprises:

If no abnormal record exists in the first preset period, the log program is controlled to continuously monitor and record the target system in real time;

determining whether an abnormal event occurs to the target system according to the monitoring result;

when the target system has an abnormal event, determining the recorded event corresponding to the abnormal event according to the abnormal event;

controlling the log program to record the abnormal log data corresponding to the record event;

and sending the abnormal log data to the server, and marking the abnormal log data in the log database.

6. The method according to claim 4, wherein the method further comprises:

when the log database corresponding to the client is currently configured, acquiring the current date of the target system;

judging whether the current date is consistent with a preset date or not;

if the current date is consistent with the preset date, deleting all log data in a second preset period in the log database;

and if the current date is inconsistent with the preset date, controlling the log program to continuously monitor and record the target system in real time.

7. The method according to claim 1, wherein the method further comprises:

if the log database corresponding to the client is not configured, generating a data storage table corresponding to the target system according to the target system;

loading a log program corresponding to the target system;

reestablishing a log database corresponding to the client according to the data storage table and the log program;

and controlling the log program to monitor and record the target system in real time, and storing the log data into the log database.

8. An anomaly log monitoring device, comprising:

the system comprises an acquisition module, a control module and a control module, wherein the acquisition module is used for acquiring the working state of a target system, and the target system is used for indicating a front-end service selected to run by a target user;

the judging module is used for judging whether a log database corresponding to the client is configured at present or not when the working state of the target system is an operation state;

if the log database corresponding to the client is currently configured, the judging module is further configured to judge whether the log data in the first preset period has an abnormal record;

The acquisition module is further configured to acquire log data in a first preset period corresponding to the abnormal record when the log data in the first preset period has the abnormal record;

and the sending module is used for sending the log data to a server.

9. An abnormality log monitoring apparatus, characterized by comprising:

a memory;

a processor;

wherein the memory stores computer-executable instructions;

the processor executes computer-executable instructions stored in the memory to implement the anomaly log monitoring method of any one of claims 1 to 7.

10. A computer readable storage medium having stored therein computer executable instructions which when executed by a processor are for implementing the anomaly log monitoring method of any one of claims 1 to 7.