Granted Patent B2

US 12,554,614 · App. 17/387,023 · Granted Feb 17, 2026

Inventors: Weiyang Liu (Shanghai, CN); Lihui Su (Shanghai, CN); Qi Wang (Shanghai, CN); Min Liu (Shanghai, CN); Yujun Liang (Shanghai, CN)

Assignee: EMC IP HOLDING COMPANY LLC

G06F11/3075G06F11/0772G06F11/0775G06F11/3006G06F11/327

Abstract

Claims (84)

1 . A computer-implemented method for data processing, comprising:

identifying, in a computing system, invocation of a microservice by an operation of the computing system;

generating, in response to invocation of the microservice, identification information for the operation by encoding information related to invocation of the microservice into at least one field indicating content of the operation;

recording, in a log file, the identification information for the operation in a log entry corresponding to the operation;

analyzing a plurality of log entries of the computing system to determine a set of identification information for a group of operations corresponding to a type of operation of a target log for a target operation, wherein each identification information in the set of identification information corresponds to a respective operation in the group of operations and each identification information includes at least one field indicating content of the target operation and a field indicating a unique identification of the type of operation, wherein the log entry is included in the plurality of log entries and the operation is included in the group of operations;

identifying, based on the set of identification information, log entries for the group of operations in a plurality of log files for the microservice invoked by the type of operation, wherein the plurality of log files include the log file;

determining a group of logs for the group of operations, the group of logs including a first log for the type of operation and a second log for the type of operation, wherein the first log includes a first portion of the identified log entries corresponding to a first execution of the type of operation and the second log includes a second portion of the identified log entries corresponding to a second execution of the type of operation;

determining, by electronic circuitry implementing a machine learning algorithm, a log pattern corresponding to the group of operations based on pattern matching between at least the first and second logs in the group of logs, wherein the log pattern includes a first pattern of a first corresponding log entry of the first and second logs and a second pattern of a second corresponding log entry of the first and second logs;

determining an abnormality degree for the target operation based on comparison of the log pattern with the target log; and

identifying an abnormal log entry in the target log based on comparison of the abnormality degree for the target operation with a threshold,

wherein the abnormality degree for the target log of the target operation is based on a weight assigned to each respective log entry in the target log and the weight is assigned based on a level of each respective log entry in the target log, and

wherein the level comprises a debug level, an information level, a warning level, an error level, and a fatal error level with the respective weights of 1.0, 1.0, 1.1, 1.2, and 1.3.

2 . The method according to claim 1 , wherein the content of the target operation comprises at least one of:

a property of the target operation;

an action performed by the target operation; and

an object targeted by the target operation.

3 . The method according to claim 1 , wherein the log pattern includes a variable of string type or numeric type, and wherein the method further comprises:

determining, based on a comparison between the target log for the target operation and the log pattern, a value in the target log corresponding to the variable, wherein identification information for the target operation includes the at least one identical field; and

when determining that the value does not satisfy a predefined condition for the variable, determining at least one of the following:

that the target operation is an abnormal operation; and

abnormal log entries in the target log.

4 . The method according to claim 1 , further comprising:

extracting structured data from the target log for the target operation;

based on an analysis of the structured data, performing at least one of:

determining abnormal log entries in the target log; and

predicting an abnormality related to the target operation.

5 . The method according to claim 1 , wherein the abnormal log entry in the target log is identified based on comparison of the first pattern in the log pattern with a corresponding log entry in the target log.

6 . The method according to claim 1 , wherein the log pattern includes at least one string or number included in at least one variable corresponding to unmatched strings or numbers in logs included in the group of logs.

7 . The method according to claim 1 , wherein the abnormality degree for the target operation is determined based on at least one of a length of identical strings between the target log and the log pattern or a number of identical strings between the target log and the log pattern.

8 . The method according to claim 1 , wherein encoding information related to invocation of the microservice into the at least one field indicating content of the operation includes encoding the information into a hexadecimal number.

9 . The method according to claim 1 , further comprising predicting an abnormality with a subsequent execution of the target operation based on the abnormal log entry.

10 . An electronic device, comprising:

a processor; and

a memory coupled to the processor, the memory having instructions stored therein that, when executed by the processor, cause the processor to perform actions, the actions comprising:

identifying, in a computing system, invocation of a microservice by an operation of the computing system;

generating, in response to invocation of the microservice, identification information for the operation by encoding information related to invocation of the microservice into at least one field indicating content of the operation;

recording, in a log file, the identification information for the operation in a log entry corresponding to the operation;

analyzing a plurality of log entries of the computing system to determine a set of identification information for a group of operations corresponding to a type of operation of a target log for a target operation, wherein each identification information in the set of identification information corresponds to a respective operation in the group of operations and each identification information includes at least one field indicating content of the target operation and a field indicating a unique identification of the type of operation, wherein the log entry is included in the plurality of log entries and the operation is included in the group of operations;

identifying, based on the set of identification information, log entries for the group of operations in a plurality of log files for the microservice invoked by the type of operation, wherein the plurality of log files include the log file;

determining a group of logs for the group of operations, the group of logs including a first log for the type of operation and a second a log for the type of operation, wherein the first log includes a first portion of the identified log entries corresponding to a first execution of the type of operation and the second log includes a second portion of the identified log entries corresponding to a second execution of the type of operation;

determining, via a machine learning algorithm, a log pattern corresponding to the group of operations based on pattern matching between at least the first and second logs in the group of logs, wherein the log pattern includes a first pattern of a first corresponding log entry of the first and second logs and a second pattern of a second corresponding log entry of the first and second logs;

determining an abnormality degree for the target operation based on comparison of the log pattern with the target log; and

identifying, via a machine learning algorithm, an abnormal log entry in the target log based on comparison of the abnormality degree for the target operation with a threshold,

wherein the abnormality degree for the target log of the target operation is based on a weight assigned to each respective log entry in the target log and the weight is assigned based on a level of each respective log entry in the target log, and

wherein the level comprises a debug level, an information level, a warning level, an error level, and a fatal error level with the respective weights of 1.0, 1.0, 1.1, 1.2, and 1.3.

11 . The device according to claim 10 , wherein the content of the target operation comprises at least one of:

a property of the target operation;

an action performed by the target operation; and

an object targeted by the target operation.

12 . The device according to claim 10 , wherein the log pattern comprises a variable of string type or numeric type, and wherein the actions further comprise:

determining, based on a comparison between the target log for the target operation and the log pattern, a value in the target log corresponding to the variable, wherein identification information for the target operation comprises the at least one identical field; and

when determining that the value does not satisfy a predefined condition for the variable, determining at least one of the following:

that the target operation is an abnormal operation; and

abnormal log entries in the target log.

13 . The device according to claim 10 , wherein the actions further comprise:

extracting structured data from the target log for the target operation;

based on an analysis of the structured data, performing at least one of:

determining abnormal log entries in the target log; and

predicting an abnormality related to the target operation.

14 . The device according to claim 10 , wherein the log pattern includes at least one string or number included in at least one variable corresponding to unmatched strings or numbers in logs included in the group of logs.

15 . The device according to claim 10 , wherein the abnormality degree for the target operation is determined based on at least one of a length of identical strings between the target log and the log pattern or a number of identical strings between the target log and the log pattern.

16 . A non-transitory computer-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform actions, the actions comprising:

identifying, in a computing system, invocation of a microservice by an operation of the computing system;

generating, in response to invocation of the microservice, identification information for the operation by encoding information related to invocation of the microservice into at least one field indicating content of the operation;

recording, in a log file, the identification information for the operation in a log entry corresponding to the operation;

analyzing a plurality of log entries of the computing system to determine a set of identification information for a group of operations corresponding to a type of operation of a target log for a target operation, wherein each identification information in the set of identification information corresponds to a respective operation in the group of operations and each identification information includes at least one field indicating content of the target operation and a field indicating a unique identification of the type of operation, wherein the log entry is included in the plurality of log entries and the operation is included in the group of operations;

identifying, based on the set of identification information, log entries for the group of operations in a plurality of log files for the microservice invoked by the type of operation, wherein the plurality of log files include the log file;

determining a group of logs for the group of operations, the group of logs including a first log for the type of operation and a second log for the type of operation, wherein the first log includes a first portion of the identified log entries corresponding to a first execution of the type of operation and the second log includes a second portion of the identified log entries corresponding to a second execution of the type of operation;

determining, via a machine learning algorithm, a log pattern corresponding to the group of operations based on pattern matching between at least the first and second logs in the group of logs, wherein the log pattern includes a first pattern of a first corresponding log entry of the first and second logs and a second pattern of a second corresponding log entry of the first and second logs;

determining an abnormality degree for the target operation based on comparison of the log pattern with the target log; and

identifying an abnormal log entry in the target log based on comparison of the abnormality degree for the target operation with a threshold,

wherein the abnormality degree for the target log of the target operation is based on a weight assigned to each respective log entry in the target log and the weight is assigned based on a level of each respective log entry in the target log, and

wherein the level comprises a debug level, an information level, a warning level, an error level, and a fatal error level with the respective weights of 1.0, 1.0, 1.1, 1.2, and 1.3.

17 . The computer-readable medium according to claim 16 , wherein the content of the target operation comprises at least one of:

a property of the target operation;

an action performed by the target operation; and

an object targeted by the target operation.

18 . The computer-readable medium according to claim 16 , wherein the log pattern comprises a variable of string type or numeric type, and wherein the actions further comprise:

determining, based on a comparison between the target log for the target operation and the log pattern, a value in the target log corresponding to the variable, wherein identification information for the target operation comprises the at least one identical field; and

when determining that the value does not satisfy a predefined condition for the variable, determining at least one of the following:

that the target operation is an abnormal operation; and

abnormal log entries in the target log.

19 . The computer-readable medium according to claim 16 , wherein the log pattern includes at least one string or number included in at least one variable corresponding to unmatched strings or numbers in logs included in the group of logs.

20 . The computer-readable medium according to claim 16 , wherein the abnormality degree for the target operation is determined based on at least one of a length of identical strings between the target log and the log pattern or a number of identical strings between the target log and the log pattern.

Assignments (8)

Priority Claims (1)

Continuity (1)

References Cited (22)