WO2011079690A1 - Journal monitoring method and device - Google Patents

Abstract

A journal monitoring method and a device are provided. They relate to the technical field of an intelligent traffic system. The method includes obtaining a journal record to be analyzed in the journal file ( 101 ) judging whether the time of the journal record to be analyzed exceeds the preset analysis time or not ( 102); analyzing the journal record to be analyzed if the time of the journal record to be analyzed does not exceed the preset analysis time ( 103 ); and stopping monitoring the journal record if the time of the journal record to be analyzed exceeds the preset analysis time ( 104).

Description

 The present invention claims the priority of the Chinese patent application filed on December 29, 2009, the Chinese Patent Office, the application number is 200910244105. 0, the invention name is "a monitoring method and device for a log" The entire contents of which are incorporated herein by reference.

Technical field

 The invention relates to the technical field of intelligent transportation systems, and in particular to a method and a device for monitoring logs. Background technique

 Currently, the operating procedures on the operating systems in the Intelligent Transportation Systems (ITS) field each have their own records. The log of the record includes various program processing progress records, operation records, and the like. These logs are important for the operation and maintenance of each program in the system, program operation analysis, and program status monitoring. The log monitoring process of the running program on the operating system is specifically: acquiring the entire content of the log file of the running program on the operating system; performing sequence analysis according to the entire content of the obtained log file, and providing the parsing result According to the analysis result, the corresponding processing is performed.

 In the process of implementing the present invention, the inventors have found that at least the following problems exist in the prior art: Since the current monitoring process needs to parse the entire log file content, it requires a large amount of system resources, and the monitoring efficiency is also relatively high. low. In this way, when the program runs abnormally or the amount of data is abnormal, it cannot be alarmed in time.

Summary of the invention

 Embodiments of the present invention provide a method and apparatus for monitoring logs.

 In order to achieve the above object, the embodiment of the present invention adopts the following technical solutions:

 A method for monitoring logs, including:

 Obtain the log records to be parsed in the log file.

 Determining whether the time of the log record to be parsed exceeds a preset parsing time;

Parsing the to-be-resolved if the time of the log record to be parsed does not exceed the preset parsing time 曰志"^已录;

 If the time of the log record to be parsed exceeds the preset parsing time, the log monitoring is stopped. A log monitoring device includes:

 The log record obtaining unit is configured to obtain a log record to be parsed in the log file;

 a determining unit, configured to determine whether the time of the log record to be parsed exceeds a preset parsing time, and a parsing unit, configured to parse the to-be-parsed if the time of the log record to be parsed does not exceed a preset parsing time Log record

 The monitoring stop unit is configured to stop the log monitoring if the time of the log record to be parsed exceeds a preset parsing time.

 The method and device for monitoring the log provided by the embodiment of the present invention, by obtaining the log record to be parsed in the log file; determining whether the time of the log record to be parsed exceeds a preset parsing time; If the time is not exceeded, the log record to be parsed is parsed; if the time of the log record to be parsed exceeds the preset parsing time, the log monitoring is stopped. Compared with the prior art, the embodiment of the present invention only analyzes and monitors the log records to be parsed in the log file, and does not need to parse and monitor the entire log file, thereby greatly reducing the system resource usage and improving. The efficiency of monitoring, and timely alarms of abnormal operation or abnormal data volume.

DRAWINGS

 FIG. 1 is a flowchart of a method for monitoring a log according to an embodiment of the present invention;

 FIG. 2 is a flowchart of a specific implementation of obtaining a log record to be parsed in the log file according to the method for monitoring a log according to an embodiment of the present disclosure;

 FIG. 3 is a flowchart of a specific implementation of a method for monitoring a log according to an embodiment of the present invention; FIG. 4 is a schematic structural diagram of a device for monitoring a log according to an embodiment of the present invention.

detailed description

 The method and device for monitoring the log of the embodiment of the present invention are described in detail below with reference to the accompanying drawings.

As shown in FIG. 1 , a method for monitoring a log according to an embodiment of the present invention includes: 1 01: Obtain the log records to be parsed in the log file;

 1 02: determining whether the time of the log record to be parsed exceeds a preset parsing time;

 1 03: If the time of the log record to be parsed does not exceed the preset parsing time, parse the log record to be parsed;

 1 04: If the time of the log record to be parsed exceeds the preset resolution time, log monitoring is stopped.

 It should be noted that the log records to be parsed include: start field information, time field information, priority field information, program name and version field information, monitoring data field information, extended field information, and end field information. Its specific format is as follows:

 [# I Time I level | Program Name and Version I mes sage | Option 1 I Option 2 I Option n I #]

 The symbols of the log records to be parsed specifically indicate the meanings as shown in Table 1 below.

 Table 1

Cannot contain the end of the log record, that is, the end field information

7 #] non-empty separator

 " ,,

Note 1: When the log information priority level is "info", the message field can be marked with the following "data information identifier" to indicate the meaning of each value:

Data information identification:

 Dataln^ Enter the number of data,

 Data0ut=the number of output data,

 LinkCnt The number of roads with road conditions,

 ClslCnt=Number and length of the primary road with road conditions,

 Cls2Cnt=Number and length of secondary roads with road conditions,

 Cls3Cnt=Number and length of three-way roads with road conditions,

 Cls4Cnt=Number and length of four-way roads with road conditions,

 ClsOtherCnt has the number and length of roads of level 5 and above.

expdCnt The number and length of the channel

_S lowCnt=the number and length of slow roads,

jamCnt The number and length of roads that are congested,

 ErrCnt=The number of incorrect data entered,

 ErrT i me=the number of time errors,

 The number of ErrFmt data format errors,

 ErrCoor=the number of coordinates over bound,

 ErrSpeed=the number of speed errors,

 ErrDirect=The number of wrong directions,

 ErrNoGPS=The number of invalid GPS signals,

 TmFeedback=Information average return period,

 CarCnt=Number of vehicles

 0ther=

The above information can pick the output, you can not write, or write one or more

In other cases, the format of the message is not agreed. If it is WARN, it will give an alarm message; if it is ERROR, it will give an error message; if it is FATAL, it will give a fatal reason. As shown in FIG. 2, a specific implementation process of obtaining a log record to be parsed in a log file is provided in the method for monitoring a log according to an embodiment of the present invention;

 201: Obtain a time interval between the record time of the log record to be parsed and the current system time. For example: the system may first parse the time field information Time in the log record to be parsed, such as the time and date of generation of the log record; then, read the current date and time of the system; and compare the current date of the system with The time is compared with the generation time and the date of generation of the log record in the Time, and the time interval is obtained.

 202: Extract the log records to be parsed in sequence according to the time interval from short to long. This means extracting from the log records that are the shortest from the current system time interval.

It should be noted that the process can also include: Recording the location of the log record to be parsed for the first time. This step can be used to determine the starting position of reading the log file when the system opens the log file again.

 As shown in FIG. 3, a specific implementation process of a log monitoring method according to an embodiment of the present invention is provided. The log record format in the process is as shown in Table 1. The specific process of the method is as follows:

 301: Open a log file, and obtain the length of the log file.

 302: Clear the historical error or alarm information, and send the cleared historical data information to the file for recording.

 303: Determine whether the log file is opened for the first time; if it is opened for the first time, execute step 304; if it is not the first time, perform step 305.

 304: Read the entire contents of the log file. Specifically, the end position of the log file in the memory storing the log file is read to the end position of the log file; the read log file is read into the memory for further processing. data processing.

 305: Read the new log record of the log file. Specifically, in the system, the end position of the log file when the log file is last opened may be recorded; the content read this time is from the end position of the log file when the file was last opened to the current opening of the log file. The end position of the file.

 306: After reading the content of the log file, read the log record one by one from the last log record data of the log file, that is, from the last log record of the log file "#] The "symbol forward lookup" [#" symbol gets the last log record of the log file; it finds the second last count, the third last count record, and so on.

 307: Read a log record.

 For example, the step may: obtain a time interval between the record time of the log record to be parsed and the current system time; and sequentially extract the log records to be parsed according to the time interval from short to long.

 308: Determine whether the time of the log record to be parsed exceeds a preset parsing time.

For example: You can set the default resolution time to be within 5 minutes of the current system date and time; then determine the date and time of the current recorded log record and the current system date and time difference, whether the preset resolution in the settings Within 5 minutes of the time. If within the preset resolution time, then The following steps are performed; if the preset resolution time is exceeded, step 314 is performed.

 309 : According to the log record read, judge its priority LEVEL type. If it is type one, for example: WARN, ERROR or FATAL type, go to step 31 0; if it is type 2 INFO type, go to step 31 1 .

 31 0: Get the content in the MESSAGE field and send the content as a history error or alarm message; go to step 31 3.

 31 1: Determine whether there is a data information identifier in the MESSAGE field of the log record; if it exists, go to step 31 2; if it does not exist, go to step 31 3.

 312: Parse the data information identifier, give the log monitoring result and send it, and perform step 31 3.

31 3: It is judged whether the content of the read log file is processed; if the processing is completed, step 314 is performed, otherwise, the process returns to step 307.

 314: End the monitoring process.

 As shown in FIG. 4, a log monitoring device is provided in the embodiment of the present invention; the device includes: a log record obtaining unit 401, configured to obtain a log record to be parsed in a log file;

 The determining unit 402 is configured to determine whether the time of the log record to be parsed exceeds a preset parsing time;

 The parsing unit 403 is configured to parse the log record to be parsed if the time of the log record to be parsed does not exceed the preset parsing time;

 The monitoring stop unit 404 is configured to stop the log monitoring if the time of the log record to be parsed exceeds a preset resolution time.

 It should be noted that, when the log record to be parsed includes: start field information, time field information, priority field information, program name and version field information, monitoring data field information, extended field information, and end field information, The log record obtaining unit 401 includes:

 The time interval acquisition sub-unit is configured to acquire a time interval between the record time of the log record to be parsed and the current system time;

The log record extraction subunit is configured to sequentially extract the log records to be parsed according to the time interval from short to long. It is also to be noted that the log record obtaining unit 401 further includes:

 a location record subunit, configured to record the location of the log record to be parsed for the first time. It is also noted that the parsing unit 403 includes:

 An information obtaining subunit, configured to obtain priority field information in the log record to be parsed; a type information determining subunit, configured to determine a type of the priority field information;

 The information parsing sub-unit is configured to parse and process the monitoring data field information in the log record to be parsed according to the type in the priority field information, and provide a log monitoring result.

 It should also be noted that the device also includes:

 An information sending unit, configured to send the log monitoring result;

 The processing unit determining unit is configured to determine whether the log record to be parsed is processed; and the monitoring stopping unit is configured to end the monitoring process if the log record to be parsed is processed;

 The log record obtaining unit is configured to continue to obtain the log record to be parsed in the log file if the log record to be parsed is not processed.

 The method and device for monitoring the log provided by the embodiment of the present invention, by obtaining the log record to be parsed in the log file; determining whether the time of the log record to be parsed exceeds a preset parsing time; If the time is not exceeded, the log record to be parsed is parsed; if the time of the log record to be parsed exceeds the preset parsing time, the log monitoring is stopped. Compared with the prior art, the embodiment of the present invention only analyzes and monitors the log records to be parsed in the log file, and does not need to parse and monitor the entire log file, thereby greatly reducing the system resource usage and improving. The efficiency of monitoring, and timely alarms of abnormal operation or abnormal data volume.

 Through the description of the above embodiments, those skilled in the art can understand that all or part of the steps of the foregoing embodiment can be implemented by a program to instruct related hardware, and the program can be stored in a computer readable manner. In the storage medium, when the program is executed, the method includes the steps of the foregoing method embodiment, such as: FLASH, ROM/RAM, disk, optical disk, and the like.

The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that are readily conceivable within the scope of the present invention are intended to be included within the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Claim

 A method for monitoring a log, comprising:

 Obtain the log records to be parsed in the log file.

 Determining whether the time of the log record to be parsed exceeds a preset parsing time;

 If the time of the log record to be parsed does not exceed the preset parsing time, parsing the to-be-resolved slogan "^ has been recorded;

 If the time of the log record to be parsed exceeds the preset parsing time, the log monitoring is stopped.

The method for monitoring a log according to claim 1, wherein the log record to be parsed comprises: start field information, time field information, priority field information, program name and version field information, and monitoring data field. Information, extended field information, and end field information.

 The method for monitoring a log according to claim 2, wherein the step of obtaining a log record to be parsed in the log file includes:

 Obtaining a time interval between the record time of the log record to be parsed and the current system time; and sequentially extracting the log record to be parsed according to the time interval from short to long.

The method for monitoring the log according to claim 3, wherein the step of obtaining the log record to be parsed in the log file further includes:

 Record the location where the log record to be parsed is extracted for the first time.

 The method for monitoring a log according to any one of claims 2 to 4, wherein the step of parsing the log record to be parsed comprises:

 Obtaining priority field information in the log record to be parsed;

 Determining the type of the priority field information;

 The monitoring data field information in the log record to be parsed is parsed according to the type in the priority field information, and the log monitoring result is given.

 The method for monitoring a log according to claim 5, further comprising: transmitting the log monitoring result;

 Determining whether the log record to be parsed is processed;

If the log record to be parsed is processed, the monitoring process ends. If the log record to be parsed is not processed, continue to obtain the log record to be parsed in the log file.

 7. A log monitoring device, comprising:

 The log record obtaining unit is configured to obtain a log record to be parsed in the log file;

 a determining unit, configured to determine whether the time of the log record to be parsed exceeds a preset parsing time, and a parsing unit, configured to parse the to-be-parsed if the time of the log record to be parsed does not exceed a preset parsing time Log record

 The monitoring stop unit is configured to stop the log monitoring if the time of the log record to be parsed exceeds a preset parsing time.

 The log monitoring device according to claim 7, wherein the log record to be parsed comprises: start field information, time field information, priority field information, program name and version field information, and monitoring data. The field record obtaining unit includes: field information, extended field information, and end field information, including:

 The time interval acquisition sub-unit is configured to acquire a time interval between the record time of the log record to be parsed and the current system time;

 The log record extraction subunit is configured to sequentially extract the log records to be parsed according to the time interval from short to long.

 The log monitoring device according to claim 8, wherein the log record obtaining unit further comprises:

 a location record subunit, configured to record the location of the log record to be parsed for the first time.

The apparatus for monitoring a log according to claim 8 or 9, wherein the parsing unit comprises:

 An information obtaining subunit, configured to obtain priority field information in the log record to be parsed; a type information determining subunit, configured to determine a type of the priority field information;

 The information parsing sub-unit is configured to parse and process the monitoring data field information in the log record to be parsed according to the type in the priority field information, and provide a log monitoring result.

The apparatus for monitoring a log according to claim 10, further comprising: An information sending unit, configured to send the log monitoring result;

 The processing unit determining unit is configured to determine whether the log record to be parsed is processed; and the monitoring stopping unit is configured to end the monitoring process if the log record to be parsed is processed;

 The log record obtaining unit is configured to continue to obtain the log record to be parsed in the log file if the log record to be parsed is not processed.