Granted Patent B2

US 11,301,355 · App. 17/002,333 · Granted Apr 12, 2022

Inventors: Min Gong (Shanghai, CN); Xiaogang Wang (Shanghai, CN); Chun Xi Chen (Shanghai, CN)

Assignee: EMC IP Holding Company LLC

G06F11/3476G06F11/079G06F11/0787G06K9/6215

Abstract

Claims (87)

1. A method for analyzing a log file, comprising:

determining, based at least in part on a plurality of reference patterns, corresponding patterns fora plurality of log records in the log file;

respectively determining the plurality of log records as a plurality of log identifiers associated with the corresponding patterns;

determining, from the plurality of log identifiers, a first log identifier associated with a first one of the plurality of log records to be analyzed corresponding to a predetermined event;

selecting a target reference log identifier from a plurality of reference log identifiers corresponding to the plurality of reference patterns, wherein a first similarity between the target reference log identifier and the first log identifier to be analyzed is higher than a first threshold similarity;

acquiring a context associated with the first log identifier, the context comprising one or more additional log identifiers associated with one or more additional ones of the plurality of log records collected at least one of before and after the first log record;

performing a diagnosis of one or more system issues associated with the first log record based at least in part on (i) analyzing a first log identifier sequence comprising the first log identifier and the one or more additional log identifiers and (ii) analyzing a predetermined diagnosis strategy of the target reference log identifier;

wherein analyzing the first log identifier sequence comprises:

generating the first log identifier sequence comprising the first log identifier and the one or more additional log identifiers;

generating a second log identifier sequence comprising the target reference log identifier and one or more additional reference context log identifiers associated with the target reference log identifier; and

utilizing one or more machine learning models to determine a second similarity between the first log identifier sequence and the second log identifier sequence; and

automatically remediating the one or more system issues associated with the first log record utilizing the predetermined diagnosis strategy responsive to determining that the second similarity between the first log identifier sequence and the second log identifier sequence is higher than a second threshold similarity.

2. The method according to claim 1 , further comprising:

processing, based at least in part on the predetermined diagnosis strategy of the target reference log identifier for the predetermined event, the first log record corresponding to the first log identifier to be analyzed.

3. The method according to claim 1 , wherein selecting the target reference log identifier comprises:

acquiring the one or more additional reference context log identifiers associated with the target reference log identifier;

determining a comprehensive similarity based at least in part on the first similarity and the second similarity; and

according to a determination that the comprehensive similarity is higher than a third threshold similarity, processing, based at least in part on the predetermined diagnosis strategy of the target reference log identifier for the predetermined event, the first log record corresponding to the first log identifier to be analyzed.

4. The method according to claim 3 , wherein a time interval between the one or more additional log identifiers and the first log identifier to be analyzed is less than a threshold time interval, and a time interval between the one or more additional reference context log identifiers and the target reference log identifier is less than the threshold time interval.

5. The method according to claim 1 , wherein determining the corresponding patterns for the plurality of log records comprises:

acquiring the plurality of reference patterns from a reference pattern database; and

in response to matching of the first log record in the plurality of log records with a first reference pattern in the plurality of reference patterns, determining the first reference pattern as a pattern of the first log record.

6. The method according to claim 5 , wherein respectively determining the plurality of log records as the plurality of log identifiers comprises:

acquiring, from the reference pattern database, a mapping relationship between the plurality of reference patterns and the plurality of reference log identifiers;

acquiring, based at least in part on the mapping relationship, a reference log identifier corresponding to the first reference pattern; and

determining the reference log identifier corresponding to the first reference pattern as the first log identifier of the first log record.

7. The method according to claim 1 , wherein determining the first log identifier to be analyzed corresponding to the predetermined event comprises:

determining, based at least in part on time stamp information of the log file, the first log identifier to be analyzed when the predetermined event occurs.

8. The method according to claim 1 , wherein the predetermined event comprises at least one of the following:

a thread crash event;

a user report event; and

a system indicator abnormity event.

9. An electronic device, comprising:

at least one processing unit; and

at least one memory coupled to the at least one processing unit and storing machine-executable instructions, wherein the instructions, when executed by the at least one processing unit, cause the device to perform actions comprising:

determining, based at least in part on a plurality of reference patterns, corresponding patterns fora plurality of log records in the log file;

respectively determining the plurality of log records as a plurality of log identifiers associated with the corresponding patterns;

determining, from the plurality of log identifiers, a first log identifier associated with a first one of the plurality of log records to be analyzed corresponding to a predetermined event;

selecting a target reference log identifier from a plurality of reference log identifiers corresponding to the plurality of reference patterns, wherein a first similarity between the target reference log identifier and the first log identifier to be analyzed is higher than a first threshold similarity;

acquiring a context associated with the first log identifier, the context comprising one or more additional log identifiers associated with one or more additional ones of the plurality of log records collected at least one of before and after the first log record;

performing a diagnosis of one or more system issues associated with the first log record based at least in part on (i) analyzing a first log identifier sequence comprising the first log identifier and the one or more additional log identifiers and (ii) analyzing a predetermined diagnosis strategy of the target reference log identifier;

wherein analyzing the first log identifier sequence comprises:

generating the first log identifier sequence comprising the first log identifier and the one or more additional log identifiers;

generating a second log identifier sequence comprising the target reference log identifier and one or more additional reference context log identifiers associated with the target reference log identifier; and

utilizing one or more machine learning models to determine a second similarity between the first log identifier sequence and the second log identifier sequence; and

automatically remediating the one or more system issues associated with the first log record utilizing the predetermined diagnosis strategy responsive to determining that the second similarity between the first log identifier sequence and the second log identifier sequence is higher than a second threshold similarity.

10. The device according to claim 9 , wherein the actions further comprise:

processing, based at least in part on the predetermined diagnosis strategy of the target reference log identifier for the predetermined event, the first log record corresponding to the first log identifier to be analyzed.

11. The device according to claim 9 , wherein selecting the target reference log identifier comprises:

acquiring the one or more additional reference context log identifiers associated with the target reference log identifier;

determining a comprehensive similarity based at least in part on the first similarity and the second similarity; and

according to a determination that the comprehensive similarity is higher than a third threshold similarity, processing, based at least in part on the predetermined diagnosis strategy of the target reference log identifier for the predetermined event, the first log record corresponding to the first log identifier to be analyzed.

12. The device according to claim 11 , wherein a time interval between the one or more additional log identifiers and the first log identifier to be analyzed is less than a threshold time interval, and a time interval between the one or more additional reference context log identifiers and the target reference log identifier is less than the threshold time interval.

13. The device according to claim 9 , wherein determining the corresponding patterns for the plurality of log records comprises:

acquiring the plurality of reference patterns from a reference pattern database; and

in response to matching of the first log record in the plurality of log records with a first reference pattern in the plurality of reference patterns, determining the first reference pattern as a pattern of the first log record.

14. The device according to claim 13 , wherein respectively determining the plurality of log records as the plurality of log identifiers comprises:

acquiring, from the reference pattern database, a mapping relationship between the plurality of reference patterns and the plurality of reference log identifiers;

acquiring, based at least in part on the mapping relationship, a reference log identifier corresponding to the first reference pattern; and

determining the reference log identifier corresponding to the first reference pattern as the first log identifier of the first log record.

15. The device according to claim 9 , wherein determining the first log identifier to be analyzed corresponding to the predetermined event comprises:

determining, based at least in part on time stamp information of the log file, the first log identifier to be analyzed when the predetermined event occurs.

16. The device according to claim 9 , wherein the predetermined event comprises at least one of the following:

a thread crash event;

a user report event; and

a system indicator abnormity event.

17. A computer program product tangibly stored on a non-transitory computer-readable medium and comprising machine-executable instructions, wherein the machine-executable instructions, when executed, cause a machine to perform a method for analyzing a log file, the method comprising:

determining, based at least in part on a plurality of reference patterns, corresponding patterns fora plurality of log records in the log file;

respectively determining the plurality of log records as a plurality of log identifiers associated with the corresponding patterns;

determining, from the plurality of log identifiers, a first log identifier associated with a first one of the plurality of log records to be analyzed corresponding to a predetermined event;

selecting a target reference log identifier from a plurality of reference log identifiers corresponding to the plurality of reference patterns, wherein a first similarity between the target reference log identifier and the first log identifier to be analyzed is higher than a first threshold similarity;

acquiring a context associated with the first log identifier, the context comprising one or more additional log identifiers associated with one or more additional ones of the plurality of log records collected at least one of before and after the first log record;

performing a diagnosis of one or more system issues associated with the first log record based at least in part on (i) analyzing a first log identifier sequence comprising the first log identifier and the one or more additional log identifiers and (ii) analyzing a predetermined diagnosis strategy of the target reference log identifier;

wherein analyzing the first log identifier sequence comprises:

generating the first log identifier sequence comprising the first log identifier and the one or more additional log identifiers;

generating a second log identifier sequence comprising the target reference log identifier and one or more additional reference context log identifiers associated with the target reference log identifier; and

utilizing one or more machine learning models to determine a second similarity between the first log identifier sequence and the second log identifier sequence; and

automatically remediating the one or more system issues associated with the first log record utilizing the predetermined diagnosis strategy responsive to determining that the second similarity between the first log identifier sequence and the second log identifier sequence is higher than a second threshold similarity.

18. The computer program product according to claim 17 , wherein the method further comprises:

processing, based at least in part on the predetermined diagnosis strategy of the target reference log identifier for the predetermined event, the first log record corresponding to the first log identifier to be analyzed.

19. The computer program product according to claim 17 , wherein selecting the target reference log identifier comprises:

acquiring the one or more additional reference context log identifiers associated with the target reference log identifier;

determining a comprehensive similarity based at least in part on the first similarity and the second similarity; and

according to a determination that the comprehensive similarity is higher than a third threshold similarity, processing, based at least in part on the predetermined diagnosis strategy of the target reference log identifier for the predetermined event, the first log record corresponding to the first log identifier to be analyzed.

20. The computer program product according to claim 17 , wherein determining the corresponding patterns for the plurality of log records comprises:

acquiring the plurality of reference patterns from a reference pattern database; and

in response to matching of the first log record in the plurality of log records with a first reference pattern in the plurality of reference patterns, determining the first reference pattern a s a pattern of the first log record.

Assignments (9)

Cited By (2)

US 12,547,489 US 12,554,614