CN120578698B - Statistical method and system for system event and application event - Google Patents
Statistical method and system for system event and application eventInfo
- Publication number
- CN120578698B CN120578698B CN202511080274.0A CN202511080274A CN120578698B CN 120578698 B CN120578698 B CN 120578698B CN 202511080274 A CN202511080274 A CN 202511080274A CN 120578698 B CN120578698 B CN 120578698B
- Authority
- CN
- China
- Prior art keywords
- event
- statistical
- statistics
- time
- group
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Debugging And Monitoring (AREA)
Abstract
The application relates to the technical field of computer event statistics, in particular to a statistical method and a statistical system for system events and application events, which comprise presetting event character strings based on event definition rules and integrating the event character strings into an event list; the method comprises the steps of receiving a local socket to collect event messages, splitting the event messages to obtain a plurality of event sub-strings, mapping the event sub-strings in an event list for the first time and the second time to obtain matched main type segments and sub-scene segments, carrying out event statistics after mapping is matched to carry out quantity accumulation in statistics groups corresponding to different statistics time periods based on event message segmentation, carrying out zero clearing and/or recording on the counts in the statistics groups based on timers in the statistics groups, responding to a real-time data request, and outputting current statistics information according to time period requirements of the real-time data request. The application has the effect of realizing high-speed statistics of event occurrence in the embedded equipment with limited resources.
Description
Technical Field
The application relates to the technical field of computer event statistics, in particular to a statistical method and a statistical system for system events and application events.
Background
In the energy storage field, on an embedded device with limited resources, a large number of system and business events can be generated (in a short time) due to external environment changes, such as network disconnection and connection, timeout of operation of peripheral devices, power-on and power-off of the energy storage device, and the like.
These events are time dependent and are important to observe the operational status of the embedded device, and the quantified, centralized information can help field engineers quickly determine if an abnormality has occurred in the device.
The statistics of the system and business application events is carried out by traversing and searching in the operation log of the system so as to find the field information related to the events, on one hand, the log occupies a large amount of resources and cannot be matched with the embedded equipment with limited resources, on the other hand, the log cannot be directly written into Flash, a compression process is needed, and if abnormal conditions such as power failure are encountered in the compression process, the log is lost, so that the accuracy of event statistics results can be influenced.
Disclosure of Invention
In order to realize high-speed statistics of event occurrence in embedded equipment with limited resources, the application provides a statistical method and a statistical system of system events and application events.
In a first aspect, the present application provides a statistical method for system events and application events, which adopts the following technical scheme:
A statistical method of system events and application events, comprising the steps of:
Presetting an event character string based on an event definition rule and integrating the event character string into an event list, wherein the event character string at least comprises a main type section, a sub scene section and a spacer;
Receiving a local socket to collect event messages, and splitting the event messages to obtain a plurality of event substrings;
mapping the event sub-character string for the first time in the event list to obtain a matched main type segment, and mapping for the second time in the main type segment to obtain a matched sub-scene segment;
carrying out event statistics after mapping is matched so as to carry out quantity accumulation in a corresponding statistics group based on the event message segmentation, wherein different statistics groups are distinguished based on a statistics time period;
Resetting and/or recording counts in the statistical groups based on timers in the statistical groups;
Responding to the real-time data request, and outputting current statistical information according to the time period requirement of the real-time data request.
In some embodiments, the event character string is preset and integrated into an event list based on the event definition rule, and the method further comprises the following steps:
separating the main type segment and the sub-scene segment by the spacer;
Judging whether an event corresponding to the event character string is in a periodic state or not, and adding a state prefix in the event character string based on a judging result, wherein the state prefix is used for distinguishing a persistent event from a disposable event;
And adding an attribute segment in the event character string, wherein the attribute segment is used for adding context attribute content corresponding to the event, and the attribute segment and the sub-scene segment are separated by an attribute suffix.
In some embodiments, the event character string is preset and integrated into an event list based on the event definition rule, and the method further comprises the following steps:
And configuring a format check rule in the event list, periodically checking the format of the event character strings in the event list based on the format check rule, and if the event character strings which do not pass the format check are screened, generating an abnormal alarm and marking the event character strings and the counts corresponding to the event character strings and the statistics groups in the event list.
In some of these embodiments, when the first mapping or the second mapping does not match, the event is defined as an unknown event and no statistics are made on the unknown event.
In some embodiments, the event message is a structure body including an event string and a system start time, receives a local socket to collect the event message, and performs splitting processing on the event message to obtain a plurality of event substrings, including the following steps:
Synchronously acquiring the current system action time when splitting the event information;
and calculating the difference between the current system action time and the system start time in the event information, and discarding the event information when the difference is larger than a preset value.
In some embodiments, the event statistics are performed after the mapping is matched to perform the number accumulation in the corresponding statistics group based on the event message segments, including the steps of:
acquiring the statistical time periods corresponding to the statistical groups and arranging the statistical time periods in sequence;
adding one to the number of the event messages with one mapping match in the statistics group with the shortest statistics time period;
And if the statistical time reaches the shortest statistical time period, adding the statistical quantity in the statistical group into the adjacent statistical group with longer statistical time period, and clearing the statistical quantity in the current statistical group after adding.
In some embodiments, the event statistics are performed after the mapping is matched to perform the number accumulation in the corresponding statistics group based on the event message segments, including the steps of:
Acquiring the statistical time period corresponding to each statistical group;
Adding one to the number of the event messages with one mapping match in all the statistics groups;
when the statistical time reaches each statistical time period, the corresponding statistical quantity in the statistical group is cleared.
In some embodiments, the statistical time period includes minutes, hours and days, and the counting in the statistical groups is cleared and/or recorded based on the timers in each statistical group, including the following steps:
Acquiring the statistical time period n of a minute system and the statistical time period m of an hour system, wherein n is smaller than 60, and m is larger than or equal to 60;
Triggering the timer every time a preset time passes so as to enable each statistical group to perform time condition comparison, specifically,
For the statistical group of the minutes:
acquiring the sub-information of the current time, judging whether the sub-information can be divided by n, and if so, resetting all the statistical quantities in the statistical group;
for the statistical group of the hour system:
Calculating whether the m/60 is an integer;
if yes, obtaining the time information of the current time and judging whether the time information is zero, if yes, obtaining the time information of the current time and judging whether m/60 can be divided completely, and if yes, resetting all the statistical quantities in the statistical group;
If not, acquiring the partial information of the current time and judging whether the remainder of m/60 can be divided, if so, acquiring the time information of the current time and judging whether the quotient of m/60 can be divided, and if so, resetting all the statistical quantities in the statistical group;
The statistical group for the current day system:
And acquiring the time information and the time information of the current time and judging whether the time information and the time information are 0, if so, recording all the statistical quantity in the statistical group into a statistical file, and resetting the statistical quantity after recording.
In some embodiments, when the event corresponding to the event string is a periodic state, the method further includes the following steps:
acquiring and recording the system start time corresponding to the event character string, and stopping recording the system start time when the event of the periodic state is ended;
integrating a plurality of system starting events corresponding to the events to be used as duration and associated to the events.
In a second aspect, the present application provides a statistical system for system events and application events, which adopts the following technical scheme:
A system event and application event statistics system, comprising:
the event predefining module is used for predefining event character strings based on event definition rules and integrating the event character strings into an event list, wherein the event character strings at least comprise a main type section, a sub scene section and a spacer;
The event receiving module is used for receiving a local socket to collect event messages and splitting the event messages to obtain a plurality of event substrings;
mapping the event sub-character string for the first time in the event list to obtain a matched main type segment, and mapping for the second time in the main type segment to obtain a matched sub-scene segment;
the event statistics module is used for carrying out event statistics after mapping is matched so as to carry out quantity accumulation in a corresponding statistics group based on the event message segmentation, wherein different statistics groups are distinguished based on a statistics time period;
A timer for triggering at regular time to zero out and/or record the count in the statistics group;
And the output module is used for responding to the real-time data request and outputting the current statistical information according to the time period requirement of the real-time data request.
By the technical scheme provided by the embodiment of the application, the following technical effects are achieved:
The method comprises the steps of defining various known events in a predefined character string mode, designing a local inter-process communication mode and communication protocol, rapidly forwarding events generated by other services or applications to a statistical service, recording the time and the number of event generation by the statistical service, and carrying out high-speed statistics on the events of various systems and services in a period of time on an embedded device with limited resources without excessively using system resources along with the mass generation of the events.
Drawings
Fig. 1 is a schematic diagram of steps of a statistical method of system events and application events according to the present embodiment.
Fig. 2 is a schematic diagram of module connection of a statistical system for system events and application events according to the present application.
Detailed Description
The present application will be described and illustrated with reference to the accompanying drawings and examples for a clearer understanding of the objects, technical solutions and advantages of the present application. However, it will be apparent to one of ordinary skill in the art that the present application may be practiced without these specific details. In some instances, well known methods, procedures, systems, components, and/or circuits have been described at a high-level so as not to obscure aspects of the present application with unnecessary description. It will be apparent to those having ordinary skill in the art that various changes can be made to the disclosed embodiments of the application and that the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the application. Thus, the present application is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the scope of the application as claimed.
The description of these embodiments is provided to assist understanding of the present invention, but is not intended to limit the present invention. In addition, the technical features of the embodiments of the present invention described below may be combined with each other as long as they do not collide with each other.
In the description of the present application, a number means one or more, a number means two or more, and greater than, less than, exceeding, etc. are understood to not include the present number, and above, below, within, etc. are understood to include the present number. The description of the first and second is only for the purpose of distinguishing between technical features and should not be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated or implicitly indicating the precedence of the technical features indicated.
In the description of the present application, the descriptions of the terms "one embodiment," "some embodiments," "illustrative embodiments," "examples," "specific examples," or "some examples," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the present application. In this specification, schematic line representations of the above terms do not necessarily refer to the same embodiments or examples. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
As shown in fig. 1, the embodiment of the application discloses a statistical method for system events and application events, which comprises the following steps:
S100, presetting event character strings based on event definition rules and integrating the event character strings into an event list.
When an exception occurs in an embedded device that is operating properly, the exceptions are known and can be predefined, and then the known exceptions can be classified and counted in a counting manner.
The application does not pay attention to unknown anomalies, and the anomalies cannot be counted or are not needed because the attributes of the events cannot be known.
Then the naming rule-based predefining of each type of known event is first required to refine and assign a type of event to the event string that can be read and judged by the system.
The event string includes at least a main type segment, a sub-scene segment, and a spacer. The main type section is characterized by an overall large class name of the event type, for example, the main type section is characterized by 'network 4G' which is characterized by an abnormal event related to the 4G network, the sub-scene section is characterized by a detailed event scene name, for example, the main type section is characterized by 'nosimcard' which is characterized by that the 4G network module does not detect the SIM card. And a spacer is located between the main type segment and the sub-scene segment for separating two different string components.
Through the event definition rule, different events can be defined in a differentiated mode based on types and scenes, and event character strings with the following event definition meanings are generated:
network4g.nosimcard- "no SIM card detected by the 4G network module", network4g.sigallow- "4G network module detected a low 4G signal (so that no base station is registered)", network4g.registerfail- "failed registration to the 4G base station (possibly caused by the SIM card being locked)";
For example, an application for reading ModBus data exists on the device, and the main type section is predefined as 'ModBus', and the corresponding event string can comprise that data cannot be read after 'first serial port opening failure' of modbus.tty1openerror ',' second serial port opening failure 'of modbus.tty2openerror', and 'third serial port opening'.
And integrating the event character strings to obtain an event list, wherein the event list comprises event character string names corresponding to various main types and sub scenes.
The configuration file content of the event list is concise, and in the embodiment of the application, the configuration file content is organized by json format, and the event list is used for statically making what events (events contained in the event list) should be recorded and what events (events not contained in the event list) should not be recorded when the events are counted later.
The event list does not contain a complete character string defined by a certain event, but is stored by grouping and splicing, and the specific steps are as follows:
{
"events" : {
"network4g" : [ "nosimcard", "signallow", "registerfail" ],
"modbus" : [ "tty1openerror", "tty2openerror", "tty3nodata" ]
}
}
The event is characterized as an event, network4g and modbus are both main type segments, and each main type segment can record and store the matched sub-scene segment, so that the system does not need to store each event character string completely when storing an event list, and only needs to place the character string corresponding to the sub-scene segment when a new event exists. The event adding and deleting can be conveniently carried out on a certain embedded device, and the development of service functions is accelerated.
S200, receiving the local socket to collect the event message, and splitting the event message to obtain a plurality of event substrings.
And receiving event information sent by other applications and services, and splitting the received event information, so that the received complete event character string is split into sub character strings matched with the main type section and the sub scene section in the event character string.
S300, mapping the event sub-character strings in the event list for the first time to obtain matched main type segments, and mapping the event sub-character strings in the main type segments for the second time to obtain matched sub-scene segments.
Mapping and comparing a plurality of sub-strings of the received event with the main type segment and the sub-scene segment respectively, judging whether fields which are successfully matched exist in the event list, if so, considering that the event is a known event, and carrying out subsequent statistics, if any unmatched condition exists in the matching process, if the first mapping is unmatched, considering that the event type which is matched does not exist in the event list, and if the first mapping is matched but the second mapping is unmatched, considering that the event scene subdivided under the type does not exist in the event list. Any situation is characterized in that the received event is an unknown event, and statistics are not carried out.
The data input interface is used as an event statistics service, and receives events generated by other services and applications through a 'UNIX' local data message socket when receiving the events.
S400, carrying out event statistics after mapping is matched so as to carry out quantity accumulation in a corresponding statistical group based on event message segmentation, wherein different statistical groups are distinguished based on a statistical time period.
The setting of the statistics groups is distinguished based on different statistics times, such as that an event received within several ten minutes corresponds to one statistics group, an event received within several hours corresponds to one statistics group, and an event received within one day corresponds to one statistics group.
When event information which is matched through mapping to confirm known events exists, the number accumulation is carried out in the corresponding statistical group according to the corresponding occurrence event.
S500, resetting and/or recording the count in each statistic group based on the timer in each statistic group.
And when the timer is triggered, the counts in each statistics group meeting the time requirements are cleared and/or recorded, wherein the clearing is characterized in that all the statistics counts in the statistics group are deleted to zero, and the recording is characterized in that the current statistics counts in the statistics group are recorded in numerical value.
By regularly cleaning the counts in each statistics group, on one hand, the occurrence time of the counted events in one statistics group is prevented from exceeding the corresponding statistics time period of the statistics group, for example, one statistics group is used for counting the event times in ten minutes, if the events in the statistics group are not regularly cleaned, the event times exceeding ten minutes exist in the statistics group, and error abnormality exists for the subsequent number statistics inquiry. On the other hand, the memory occupation can be reduced, and the consumption of the content resource is prevented from being increased due to excessive events.
S600, responding to the real-time data request, and outputting current statistical information according to the time period requirement of the real-time data request.
The user makes the system module output the event statistics record in a period of time through the command line tool, and the system module responds to the real-time data request to output the statistics information which meets the period requirement currently.
Specifically, the command line tool establishes connection with the event statistics master module through the TCP socket, and obtains statistics conditions of all current events. The output result is the same as the statistical data format written into the file every day, and the output data format at least corresponds to the event character string and the occurrence number of each event. The follow-up may also include a sustain event of the partial event.
Specific formats are as follows:
network4g.nosimcard: 20;
modbus.tty1openerror: 25。
Thus, the operation and maintenance personnel accessing the system can know the known event counting conditions which occur in the past tens of minutes, hours and one day, and great convenience is provided for solving the operation state of the embedded device with limited system resources.
By the scheme, various known events are defined in a predefined character string mode, a local inter-process communication mode and a communication protocol are designed, events generated by other services or applications are rapidly forwarded to a statistics service, the statistics service records the time and the number of event generation, system resources are not excessively used along with the mass generation of the events in the process, and the events of various systems and services in a period of time can be rapidly counted on the embedded equipment with limited resources.
Through testing, the event statistics method based on the application can achieve the event statistics effect of more than 1000 events per second on the embedded device with 128MB memory.
In other embodiments, the event character string is preset and integrated into an event list based on the event definition rule, and the method further comprises the following steps:
s110, separating the main type segment and the sub scene segment through a spacer.
S120, judging whether an event corresponding to the event character string is in a periodic state, and adding a state prefix in the event character string based on a judging result, wherein the state prefix is used for distinguishing a persistent event from a disposable event.
A persistence event is characterized by the persistence of data or traffic corresponding to an event, such as "nosimcard" characterized by the 4G network module not detecting the SIM card, which is a persistence state of the 4G network of the device, and for example, the registration behavior is a single operation attempt, one registration failure corresponds to a failure event, and for such event corresponds to a disposable event.
Because there should be a certain difference between the statistics modes of the number of the persistent event and the number of the disposable event, for example, the number of the disposable event is recorded once every time the disposable event occurs, and for the persistent event, the information of the triggered mode, the triggered frequency, the maintenance time and the like of the event needs to be considered, so that the specific type of the event is judged based on whether the periodic state of the time exists or not, and the state prefix is added in the event character string based on the judging result.
The function of the state prefix is to distinguish a specific type of an event, in the present application, the state prefix is "@ state", if the state prefix exists in the event string, the state prefix corresponds to a persistent event, and if the state prefix does not exist, the state prefix corresponds to a disposable event.
For example, for a "SIM card not detected by the 4G network module" event, the corresponding event string is net4g.
S130, adding an attribute segment in the event character string, wherein the attribute segment is used for adding context attribute content corresponding to the event, and the attribute segment and the sub-scene segment are separated by an attribute suffix.
In the embodiment of the application, the event character string can be further added with an attribute segment, wherein the attribute segment is characterized by an additional context attribute corresponding to the event, and the attribute segment can be used for acquiring a subdivision scene corresponding to an event reason based on attribute extraction for a certain event.
The attribute section contains the context attribute content corresponding to the event, which is mainly presented in a character+value mode, and meanwhile, the attribute section is positioned at the rear section of the event character string and is separated from the sub-scene section by an attribute suffix symbol, wherein the attribute suffix symbol is "#" in the embodiment of the application.
For example, when an application of ModBus data is read on a device, if a first serial port fails to open, and meanwhile, the attribute state of the event is characterized in that the serial port fails to open at the baud rate 9600, the attribute and the event character string may be formed into a context association, so as to generate an attribute segment of "baud9600", and the attribute segment and the event character string are separated and associated by "#", where the final event character string is "modbus.tty1openerr #baud9600".
By the method, personalized customization of the custom field is realized, different character definitions are carried out on different data information based on the use scene, the use requirement and the use precision, the occurrence times of the events can be counted, other attributes and types of the events can be further shown in the character string, the original technical logic is not influenced, other additional contents can be added for the events, and the more subdivided scene can be queried through a screening tool.
In other embodiments, the event definition rule may further include other personalized customization schemes, for example, when the event definition rule needs iteration (such as interface change and scene upgrade), version numbers (such as V1 and V2) may be added in the character string, the statistics service may count events of different versions respectively, and may implement summary statistics through fuzzy matching, so as to be compatible with new and old system transition scenes, for the equipment deployed in multiple regions, language identifiers (such as zh and en) may be added in the event character string, multiple language versions may be stored in the event list at the same time, and the statistics result automatically matches the event character string of the corresponding language according to the area where the equipment is located when output, and outputs event description of the corresponding language, so as to promote usability of the operation tool.
In other embodiments, a format check rule is configured in the event list, the format check is periodically performed on event strings in the event list based on the format check rule, and if event strings which do not pass the format check are screened, an abnormal alarm is generated and corresponding event strings in the event list and the statistics group are marked.
The above-mentioned custom rule is configured based on the actual scene, but any event definition mode needs to be matched with the standardization requirement, for example, each character string must be a predefined module name, the custom of the character string name is not allowed, the total length of the event character string does not exceed 64 characters, and the occupation of the content by overlong character strings is avoided.
If the event character string with irregular definition exists, the system can generate an alarm to remind an operation and maintenance person to check whether the event definition rule has errors or not, the abnormal character string in the event list is marked, and the counting numerical value related to the abnormal character string in the statistics group is marked, so that the operation and maintenance person can check conveniently.
In other embodiments, when the first mapping or the second mapping does not match, an event is defined as an unknown event and no statistics are made on the unknown event.
If the mapping is not passed at any time, defining the event corresponding to the event character string as an unknown event, and counting the unknown event because the unknown event does not belong to the event counting process category to be performed by the method.
In other embodiments, the event message is a structure body including an event string and a system start time, and the method includes the steps of receiving a local socket to collect the event message, and splitting the event message to obtain a plurality of event substrings, including the following steps:
s210, synchronously acquiring the current system action time when splitting the event information.
The format of the acquired event information is also defined when the event is received, and in order to improve the analysis efficiency of the data, a simple structure body is directly defined instead of adopting a JSON and other data serialization message format package:
struct event_message {
char eventid[128];
time_t uptime;
}
Wherein eventid in the structure, i.e., an event string of an event, such as "network4g. Nosimcard," and "128" is characterized by the character length of the event string, and "uptime" is characterized by the system start-up time in seconds for generating the event.
S220, calculating the difference between the current system action time and the system start time in the event information, and discarding the event information when the difference is larger than a preset value.
The system start-up time is mainly used for preventing excessive event information from being generated in a short time, and the statistical service is not processed timely and erroneously takes the time generated a few minutes before as the current generation time.
In other words, when receiving an event, not only the corresponding system time when the event occurs, but also the current system time needs to be obtained and compared, if the comparison with "uptime" in certain event information is too different (for example, three minutes), the event is discarded and not entered into the statistics count.
Because of the corresponding statistical period time requirements in different statistical groups, if the time generated by the event is obtained by mistake, a certain deviation can occur in the final counting target statistical group of the event, so that the final counting quantity has an influence on accuracy.
In other embodiments, event statistics are performed after the mappings are matched to perform a number accumulation in a corresponding statistics set based on event message segmentation, comprising the steps of:
s410, acquiring the statistical time periods corresponding to the statistical groups and arranging the statistical time periods in sequence.
The statistical groups are orderly arranged based on the length of the corresponding statistical time period of each statistical group, and the application adopts the order arrangement from short to long.
S420, adding one to the number of the statistics groups with the shortest statistics time period when each mapping-matched event message exists.
The count is incremented by one in the statistics group with the shortest statistics time period whenever a known event is received, and the statistics groups of other lengths are not counted.
And S430, if the statistical time reaches the shortest statistical time period, adding the statistical quantity in the statistical group into the adjacent statistical group with longer statistical time period, and clearing the statistical quantity in the current statistical group after adding.
When the statistics time reaches the shortest statistics time period, if the statistics time period of the statistics group A is 10 minutes, the number of events occurring ten minutes before the current time is counted in the statistics group, when the statistics time exceeds 10 minutes, the corresponding time of the newly received event is not matched with the statistics group A, then the statistics amount in the statistics group A needs to be added into the statistics group B with the next longer statistics time period at first, if the statistics time period corresponding to the statistics group B is 1 hour, then the statistics time exceeds 10 minutes, and the statistics time belongs to the time category corresponding to the statistics group B.
At the same time, the statistics in statistics group a are cleared to begin statistics of the next 10 minutes of event count, and the current event count is added to statistics group B every ten minutes.
Similarly, when the statistical time reaches one hour, the statistical amount in the statistical group B is added to the statistical group C with a statistical time period of 1 day.
According to the method, an increment snapshot mechanism of the counter is realized, the accumulation of event values only acts on one statistical group at a time, an increment recording function is provided, the statistical groups with long statistical periods are added in a timed batch mode independently, all data counting deviation anomalies caused by event loss at the moment of triggering the timer are avoided, the statistical accuracy is improved, and meanwhile, the data increment of each statistical group is independently carried out, so that the memory occupation of the embedded equipment is less.
In other embodiments, event statistics are performed after the mappings are matched to perform a number accumulation in a corresponding statistics set based on event message segmentation, comprising the steps of:
s440, obtaining the statistical time period corresponding to each statistical group.
S450, adding one to the number of event messages with one mapping match in all the statistics groups.
S460, when the statistical time reaches each statistical time period, the statistical quantity in the corresponding statistical group is cleared.
In the embodiment of the application, besides the incremental snapshot mechanism, a synchronous incremental mechanism can be adopted.
Under the synchronous increment mechanism, the event statistics service can synchronously count one event for a plurality of times after monitoring one event information, namely each event can count the statistics in a plurality of statistics groups.
For example, the event information is monitored and then counted and incremented synchronously in a statistics group A of ten minutes in a statistics time period, a statistics group B of one hour in a statistics time period and a statistics group C of one day in a statistics time period.
Under the synchronous increment mechanism, redundant counting of events can be realized, so that when a statistical abnormality occurs in one statistical group, the statistical accuracy in other statistical groups is not influenced.
In other embodiments, the statistical time period includes minutes, hours and days, and the counting in the statistical groups is cleared and/or recorded based on the timers in each statistical group, including the steps of:
s510, acquiring a statistical time period n of a minute system and acquiring a statistical time period m of an hour system, wherein n is smaller than 60, and m is larger than or equal to 60.
All times in the timer are in minutes, then different statistics groups in embodiments of the present application are classified based on minute metrics, hour metrics, day metrics, with the overall statistics time for the statistics group for the minute metrics being the shortest, less than 60 minutes, with the overall statistics time for the statistics group for the hour metrics being longer, exceeding 60 minutes, and with the statistics group for the day metrics generally being in a unit of one day.
S520, triggering a timer every time a preset time passes so that each statistical group performs time condition comparison.
The main function of the timer is to judge whether the current statistical time reaches the matching condition of each statistical time period through timing triggering, for example, counting the number of times of occurrence time in the past 10 minutes, and the timer needs to be cleared once every 10 minutes to perform the statistical work of the next 10 minutes period.
The timer may trigger once in the trigger period (every 60 s) to compare the event conditions of each statistic group, so as to determine whether the statistics in one or more statistic groups need to be cleared and/or recorded.
In particular, the method comprises the steps of,
Statistical group for min:
S530, obtaining the partial information of the current time, judging whether the partial information can be divided by n, and if so, resetting all the statistical quantity in the statistical group.
For the statistics group of minutes, the statistics time is not longer than 1 hour, so that the day and the time are always 0, and only the information of the minutes is needed to be paid attention to.
The timer is triggered once every minute, and if the current sub-information is judged to be divided by n in a whole way when the timer is triggered, the timer is characterized in that the time for the statistics group to reach the zero clearing is reached, and at the moment, all the current statistics quantity in the statistics group is cleared.
If the statistics group a counts the number of times of occurrence time in ten minutes, n=10, and the current time is represented as the current time which is 10 or an integer multiple of 10 as long as the partial information can be divided by 10, but the partial information cannot exceed 10 minutes because the partial information is directly cleared when the partial information is 10 and the condition is satisfied.
Statistical group for hour system:
s540, calculating whether m/60 is an integer.
S541, if yes, obtaining the time division information of the current time and judging whether the time division information is zero, if yes, obtaining the time division information of the current time and judging whether m/60 can be divided completely, and if yes, resetting all the statistical quantity in the statistical group.
S542, if not, obtaining the partial information of the current time and judging whether the remainder of m/60 can be divided, if so, obtaining the time information of the current time and judging whether the quotient of m/60 can be divided, and if so, resetting all the statistical quantity in the statistical group.
For the statistics group of hour system, because the unit of timer defaults to minute and the current time format is "hour and minute second", the two units are inconsistent, so it needs to judge whether the statistics time period m corresponding to one statistics group can be divided by 60, if it can be divided by, it indicates that the corresponding statistics time period is integer hours, if it can not be divided by, it indicates that the corresponding statistics time period is x hours xx minutes.
For integer hours, firstly, whether the partial information of the current time is zero or not needs to be judged, if the partial information is not equal to zero, the current statistical time is not the whole point, the requirement is not met, and then, the comparison of the time information is not needed.
If the time information is equal to zero, the current statistical time is represented as an integer point, and then whether the time information of the current time can be divided by m/60, namely, an integer number of hours is judged, and if the time information is equal to zero, the statistical count in the statistical group is cleared.
If not zero, then the corresponding hour and minute values need to be determined based on m, and when m is divided by 60, the calculated quotient is characterized as the hour data and the calculated remainder is characterized as the minute value. If m is 150 minutes, the quotient is 2, the remainder is 30, and the remainder is matched with 2 hours and 30 minutes.
Therefore, whether the fractional information of the current time can be divided by m/60 is judged, whether the fractional information of the current time is matched with the minute value corresponding to m is analyzed, and if so, the comparison of the time information is carried out, so as to judge whether the quotient of the time information after m/60 can be divided by m/60 is judged, and whether the time information can be matched with the hour value corresponding to m is judged.
If the statistics are matched, the statistics count currently existing in the statistics group is completely cleared.
Statistical group for the current day system:
S550, obtaining the time information and the time information of the current time and judging whether the time information and the time information are 0, if so, recording all the statistical quantity in the statistical group into a statistical file, and resetting the statistical quantity after recording.
The current system is characterized by all the counted event numbers in one day, and only needs to judge whether the time information and the score information of the current time are all 0.
For the time information, the statistics quantity is cleared, all data counted currently are required to be recorded in the statistics file for storage, and further, the system can delete the recorded file 15 days ago at regular time to reduce the storage content.
It should also be noted that when event statistics is just started, the count of various events is zero, which allocates memory for each event, and after initialization, when event statistics is performed, the content is not redistributed, because consumption of content resources is not increased due to excessive events.
In other embodiments, when the event corresponding to the event string is a periodic state, the method further includes the following steps:
S121, acquiring and recording the system start time corresponding to the event character string, and stopping recording the system start time when the event of the periodic state is ended.
When the event corresponds to the persistent event, in order to facilitate the operation and maintenance personnel to check the state information corresponding to the analysis event, the application counts the number of the event and also counts the maintenance time.
If the status of the 4G network module does not detect the SIM card, which is a continuous status of the 4G network, the number of times and the duration of the event are analyzed, and the status of the 4G module is read at intervals (for example, two minutes) based on the dialing service of the 4G network, and if the SIM card is not found during one reading, an event is correspondingly generated.
S122, integrating a plurality of system start-up times corresponding to the event as duration and associating the duration to the event.
Counting the number of times of repeatedly occurring the event as the counted number of times, acquiring the corresponding system starting time when each event occurs, and integrating the records until the event is finished so as to calculate the maintenance time.
The time is associated with the event after the maintenance time is calculated, so that the occurrence number and the maintenance duration of the persistent event can be generated when the user inquires based on the command line.
The application also discloses a system event and application event statistics system, which comprises:
The event predefining module is used for predefining event character strings based on event definition rules and integrating the event character strings into an event list, wherein the event character strings at least comprise a main type section, a sub scene section and a spacer;
the event receiving module is used for receiving the local socket to collect event messages and splitting the event messages to obtain a plurality of event substrings;
Mapping the event sub-character strings in the event list for the first time to obtain a matched main type segment, and mapping the event sub-character strings in the main type segment for the second time to obtain a matched sub-scene segment;
The event statistics module is used for carrying out event statistics after mapping is matched so as to carry out quantity accumulation in a corresponding statistics group based on event message segmentation, wherein different statistics groups are distinguished based on a statistics time period;
a timer for triggering at regular time to zero out and/or record the count in the statistics group;
and the output module is used for responding to the real-time data request and outputting the current statistical information according to the time period requirement of the real-time data request.
The implementation principle is as follows:
The method comprises the steps of defining various known events in a predefined character string mode, designing a local inter-process communication mode and communication protocol, rapidly forwarding events generated by other services or applications to a statistical service, recording the time and the number of event generation by the statistical service, and carrying out high-speed statistics on the events of various systems and services in a period of time on an embedded device with limited resources without excessively using system resources along with the mass generation of the events.
It should be understood that, although the steps in the flowcharts of the figures are shown in order as indicated by the arrows, these steps are not necessarily performed in order as indicated by the arrows. The steps are not strictly limited in order and may be performed in other orders, unless explicitly stated herein.
The above embodiments are not intended to limit the scope of the application, so that the equivalent changes of the structure, shape and principle of the application are covered by the scope of the application.
Claims (9)
1. A method for statistics of system events and application events, comprising the steps of:
Presetting event character strings based on event definition rules and integrating the event character strings into an event list, wherein the event character strings at least comprise a main type section, a sub scene section and a spacer, in particular,
Separating the main type segment and the sub-scene segment by the spacer;
Judging whether an event corresponding to the event character string is in a periodic state or not, and adding a state prefix in the event character string based on a judging result, wherein the state prefix is used for distinguishing a persistent event from a disposable event;
adding an attribute segment in the event character string, wherein the attribute segment is used for adding context attribute content corresponding to the event, and the attribute segment and the sub-scene segment are separated by an attribute suffix;
Receiving a local socket to collect event messages, and splitting the event messages to obtain a plurality of event substrings;
mapping the event sub-character string for the first time in the event list to obtain a matched main type segment, and mapping for the second time in the main type segment to obtain a matched sub-scene segment;
carrying out event statistics after mapping is matched so as to carry out quantity accumulation in a corresponding statistics group based on the event message segmentation, wherein different statistics groups are distinguished based on a statistics time period;
Resetting and/or recording counts in the statistical groups based on timers in the statistical groups;
Responding to the real-time data request, and outputting current statistical information according to the time period requirement of the real-time data request.
2. The statistical method of system events and application events according to claim 1, wherein the event character strings are preset and integrated into an event list based on event definition rules, further comprising the steps of:
And configuring a format check rule in the event list, periodically checking the format of the event character strings in the event list based on the format check rule, and if the event character strings which do not pass the format check are screened, generating an abnormal alarm and marking the event character strings and the counts corresponding to the event character strings and the statistics groups in the event list.
3. The method of claim 1, wherein when the first mapping or the second mapping does not match, defining the event as an unknown event and not counting the unknown event.
4. The statistical method of system events and application events according to claim 1, wherein the event message is a structure body including an event string and a system start time, a local socket is received to collect the event message, and the event message is split to obtain a plurality of event substrings, comprising the steps of:
Synchronously acquiring the current system action time when splitting the event information;
and calculating the difference between the current system action time and the system start time in the event information, and discarding the event information when the difference is larger than a preset value.
5. The method of statistics of system events and application events according to claim 1, wherein the mapping is matched and then event statistics are performed to accumulate numbers in corresponding statistics groups based on the event message segments, comprising the steps of:
acquiring the statistical time periods corresponding to the statistical groups and arranging the statistical time periods in sequence;
adding one to the number of the event messages with one mapping match in the statistics group with the shortest statistics time period;
And if the statistical time reaches the shortest statistical time period, adding the statistical quantity in the statistical group into the adjacent statistical group with longer statistical time period, and clearing the statistical quantity in the current statistical group after adding.
6. The method of statistics of system events and application events according to claim 1, wherein the mapping is matched and then event statistics are performed to accumulate numbers in corresponding statistics groups based on the event message segments, comprising the steps of:
Acquiring the statistical time period corresponding to each statistical group;
Adding one to the number of the event messages with one mapping match in all the statistics groups;
when the statistical time reaches each statistical time period, the corresponding statistical quantity in the statistical group is cleared.
7. A method of counting system events and application events according to claim 5 or 6, wherein the statistical time period includes minutes, hours and days, and wherein the counting in the statistics groups is cleared and/or recorded based on timers in the statistics groups, comprising the steps of:
Acquiring the statistical time period n of a minute system and the statistical time period m of an hour system, wherein n is smaller than 60, and m is larger than or equal to 60;
Triggering the timer every time a preset time passes so as to enable each statistical group to perform time condition comparison, specifically,
For the statistical group of the minutes:
acquiring the sub-information of the current time, judging whether the sub-information can be divided by n, and if so, resetting all the statistical quantities in the statistical group;
for the statistical group of the hour system:
Calculating whether the m/60 is an integer;
if yes, obtaining the time information of the current time and judging whether the time information is zero, if yes, obtaining the time information of the current time and judging whether m/60 can be divided completely, and if yes, resetting all the statistical quantities in the statistical group;
If not, acquiring the partial information of the current time and judging whether the remainder of m/60 can be divided, if so, acquiring the time information of the current time and judging whether the quotient of m/60 can be divided, and if so, resetting all the statistical quantities in the statistical group;
The statistical group for the current day system:
And acquiring the time information and the time information of the current time and judging whether the time information and the time information are 0, if so, recording all the statistical quantity in the statistical group into a statistical file, and resetting the statistical quantity after recording.
8. The statistical method of system events and application events according to claim 4, wherein when the event corresponding to the event string is a periodic state, further comprising the steps of:
acquiring and recording the system start time corresponding to the event character string, and stopping recording the system start time when the event of the periodic state is ended;
integrating a plurality of system start-up times corresponding to the event as duration and associating the duration to the event.
9. A system event and application event statistics system, comprising:
An event predefining module for predefining event character strings based on event definition rules and integrating the event character strings into an event list, wherein the event character strings at least comprise a main type section, a sub scene section and a spacer, and in particular,
Separating the main type segment and the sub-scene segment by the spacer;
Judging whether an event corresponding to the event character string is in a periodic state or not, and adding a state prefix in the event character string based on a judging result, wherein the state prefix is used for distinguishing a persistent event from a disposable event;
adding an attribute segment in the event character string, wherein the attribute segment is used for adding context attribute content corresponding to the event, and the attribute segment and the sub-scene segment are separated by an attribute suffix;
The event receiving module is used for receiving a local socket to collect event messages and splitting the event messages to obtain a plurality of event substrings;
mapping the event substring for the first time in the event list to obtain a matched main type segment, and mapping for the second time in the main type segment to obtain a matched sub-scene segment
The event statistics module is used for carrying out event statistics after mapping is matched so as to carry out quantity accumulation in a corresponding statistics group based on the event message segmentation, wherein different statistics groups are distinguished based on a statistics time period;
A timer for triggering at regular time to zero out and/or record the count in the statistics group;
And the output module is used for responding to the real-time data request and outputting the current statistical information according to the time period requirement of the real-time data request.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202511080274.0A CN120578698B (en) | 2025-08-04 | 2025-08-04 | Statistical method and system for system event and application event |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202511080274.0A CN120578698B (en) | 2025-08-04 | 2025-08-04 | Statistical method and system for system event and application event |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN120578698A CN120578698A (en) | 2025-09-02 |
| CN120578698B true CN120578698B (en) | 2025-10-17 |
Family
ID=96858620
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202511080274.0A Active CN120578698B (en) | 2025-08-04 | 2025-08-04 | Statistical method and system for system event and application event |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN120578698B (en) |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN119001298A (en) * | 2024-08-30 | 2024-11-22 | 深圳友讯达科技股份有限公司 | DTU remote monitoring method and system |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113468333B (en) * | 2021-09-02 | 2021-11-19 | 华东交通大学 | Event detection method and system fusing hierarchical category information |
| CN115033688B (en) * | 2022-05-11 | 2025-04-11 | 阿里巴巴（中国）有限公司 | Method, device, equipment and storage medium for identifying alarm event type |
| US12093230B1 (en) * | 2023-08-14 | 2024-09-17 | Oracle International Corporation | Semantic deduplication of event logs |
| CN119166637A (en) * | 2024-09-14 | 2024-12-20 | 海尔消费金融有限公司 | A business data processing method, system, computer device and storage medium |
-
2025
- 2025-08-04 CN CN202511080274.0A patent/CN120578698B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN119001298A (en) * | 2024-08-30 | 2024-11-22 | 深圳友讯达科技股份有限公司 | DTU remote monitoring method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN120578698A (en) | 2025-09-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7050931B2 (en) | Computing performance thresholds based on variations in network traffic patterns | |
| US6453346B1 (en) | Method and apparatus for intelligent storage and reduction of network information | |
| US8392385B2 (en) | Flexible event data content management for relevant event and alert analysis within a distributed processing system | |
| US7408441B2 (en) | System and method for analyzing user-generated event information and message information from network devices | |
| US6633834B2 (en) | Baselining of data collector data | |
| JPH10293704A (en) | Information processing device that collects and manages log data | |
| CN111538563A (en) | Event analysis method and device for Kubernetes | |
| CN113420032A (en) | Classification storage method and device for logs | |
| US20060168170A1 (en) | System and method for analyzing information relating to network devices | |
| CN116132395B (en) | Message processing method, electronic device and computer readable storage medium | |
| CN114124655A (en) | Network monitoring method, system, device, computer equipment and storage medium | |
| US20060087408A1 (en) | System and method for analyzing message information from diverse network devices | |
| CN110795264A (en) | Monitoring management method and system and intelligent management terminal | |
| CN113472881A (en) | Statistical method and device for online terminal equipment | |
| CN114911677B (en) | Monitoring method, device and computer-readable storage medium for containers in a cluster | |
| CN107635003A (en) | System log management method, device and system | |
| JP2002366394A (en) | Collection and management of log data | |
| JP2003216457A (en) | Error log collection and analysis agent system | |
| CN120578698B (en) | Statistical method and system for system event and application event | |
| WO2018122889A1 (en) | Abnormality detection method, system, and program | |
| CN117641165A (en) | Alarm processing method, device, equipment, system and storage medium | |
| CN114978885A (en) | Log management method and device, computer equipment and system | |
| CN116955439A (en) | Positioning analysis method and device for equipment abnormality, storage medium and electronic equipment | |
| JP2022092037A (en) | Anomaly detection methods, systems and programs | |
| CN113518006A (en) | Method and system for processing alarm message of Internet of things equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |