CN112069425A - Log management method and device, electronic equipment and readable storage medium - Google Patents

Abstract

The present application provides a log management method, apparatus, electronic device and readable storage medium. The method may include: acquiring first log information obtained from a login operation of logging in to an application system through a preconfigured login log collection and adaptation rule, where the first log information includes account information and a first log of the first user terminal corresponding to the account information. identity identifier; obtain the second log information obtained by accessing the access operation of the application system through the preconfigured access log collection and adaptation rules; when there is a second identity identifier identical to the first identity identifier in the second log information, the The account information corresponding to the first identity identifier is associated with the log corresponding to the second identity identifier, and the target log information is obtained, which can improve the log existence information obtained because the account information cannot be obtained from the log when the session/cookie mechanism is used to save the account information. missing question.

Description

Log management method, apparatus, electronic device and readable storage medium

technical field

The present invention relates to the technical field of computer log processing, and in particular, to a log management method, apparatus, electronic device and readable storage medium.

Background technique

In the browser/server architecture and the business application system that uses the public key infrastructure (Public Key Infrastructure, PKI)/digital certificate mode to log in, for the application access behavior that occurs on the application system logged in in the account password mode, due to the common use of The Session/Cookie mechanism is used to save account information. The saved user information is not readable, and account information cannot be obtained from the log. In the application system logged in in the account password mode, there is a problem of missing information in the obtained logs.

SUMMARY OF THE INVENTION

The present application provides a log management method, device, electronic device and readable storage medium, which can improve the problem of missing information in the obtained log in an application system logged in in an account password mode.

In order to achieve the above purpose, the technical solutions provided by the embodiments of the present application are as follows:

In a first aspect, an embodiment of the present application provides a log management method, the method includes:

Obtain the first log information obtained from the login operation of logging in to the application system by using the preconfigured login log collection and adaptation rules, where the first log information includes account information and the first log information of the first user terminal corresponding to the account information. identification;

Acquire second log information obtained from an access operation of accessing the application system through a preconfigured access log collection and adaptation rule, where the second log information includes the second identity of the second user terminal;

When there is a second identity identifier that is the same as the first identity identifier in the second log information, associate the account information corresponding to the first identity identifier with the log corresponding to the second identity identifier to obtain a target log information.

In the above-mentioned embodiment, the first log information generated in the login application system can be obtained through the preconfigured log-in log collection and adaptation rules, and the first log information may generally include account information. Then, in combination with the second log information obtained from the access log collection and adaptation rules, account information can be obtained in the application system logged in in the account password mode. There is a problem of missing information in the obtained logs.

With reference to the first aspect, in some optional implementation manners, the first log information obtained from the login operation of logging in to the application system is obtained through preconfigured login log collection and adaptation rules, including:

Determine the first URL information representing the login to the application system by collecting the adaptation rules through the login log;

Obtain log information including the account information from the first URL information;

A first identifier is added to the log information to obtain the first log information, where the first identifier is used to represent that the first log information is a login log.

In the above embodiment, by acquiring the URL information representing the login application system, the account information can be obtained by parsing the URL information.

With reference to the first aspect, in some optional implementation manners, the second log information obtained from the access operation of accessing the application system is obtained through preconfigured access log collection and adaptation rules, including:

Through the access log collection and adaptation rules, determine the second URL information representing the access to the application system;

Obtain log information from the second URL information;

A second identifier is added to the log information to obtain the second log information, where the second identifier is used to represent that the second log information is an access log.

In conjunction with the first aspect, in some optional embodiments, the method further includes:

According to a preset cleaning and classification strategy, cleaning and classifying the target log information is performed to obtain cleaned and classified log information.

In the above-mentioned embodiment, the preset cleaning and classification strategy facilitates the user to select the corresponding type of log information, which is beneficial to reduce the processing amount of the log.

With reference to the first aspect, in some optional implementations, according to a preset cleaning and classification strategy, the target log information is cleaned and classified, and the cleaned and classified log information is obtained, including:

The data of the specified data type is retained from the target log information, and the data not of the specified data type is deleted to obtain cleaned and classified log information.

In the above-mentioned embodiments, it is beneficial for the user to flexibly retain the corresponding types of log data according to actual needs, thereby helping to reduce the processing volume of the log.

In conjunction with the first aspect, in some optional embodiments, the method further includes:

The log information after cleaning and classification is displayed by outputting the display module.

In conjunction with the first aspect, in some optional embodiments, the method further includes:

The first log information and the second log information are stored in a key-value database, where the key is the identity of the user terminal and the value is account information.

In a second aspect, an embodiment of the present application further provides a log management device, the device comprising:

The first obtaining unit is configured to obtain the first log information obtained from the login operation of logging in to the application system through the preconfigured login log collection and adaptation rules, where the first log information includes account information, and the first log information corresponding to the account information. the first identity of the first user terminal;

The second obtaining unit obtains second log information obtained by accessing the access operation of the application system through a preconfigured access log collection and adaptation rule, where the second log information includes the second identity of the second user terminal;

The log processing unit is configured to, when the second log information has a second identity that is the same as the first identity, compare the account information corresponding to the first identity with the account information corresponding to the second identity. Log association to get the target log information.

In a third aspect, embodiments of the present application further provide an electronic device, the electronic device includes a memory and a processor coupled to each other, and a computer program is stored in the memory, and when the computer program is executed by the processor, the The electronic device performs the above-described method.

In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored in the readable storage medium, and when the computer program runs on a computer, the computer is made to execute the above method.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present application more clearly, the accompanying drawings required in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation of the scope. Other related figures are obtained from these figures.

FIG. 1 is a schematic diagram of a communication connection between an electronic device and an application system according to an embodiment of the present application.

FIG. 2 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

FIG. 3 is a schematic flowchart of a log management method provided by an embodiment of the present application.

FIG. 4 is a functional block diagram of a log management apparatus provided by an embodiment of the present application.

Icons: 10-electronic equipment; 11-processing module; 12-storage module; 13-communication module; 100-log management device; 110-first acquisition unit; 120-second acquisition unit; 130-log processing unit.

Detailed ways

The technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings in the embodiments of the present application. It should be noted that the terms "first", "second" and the like are only used for distinguishing descriptions, and cannot be understood as indicating or implying relative importance.

The embodiments of the present application will be described in detail below with reference to the accompanying drawings. The embodiments described below and features in the embodiments may be combined with each other without conflict.

Referring to FIG. 1 , an embodiment of the present application provides an electronic device 10 . The electronic device 10 may establish a communication connection with the application system through the network to perform data interaction. For example, the electronic device 10 may acquire log data of the user logging in and accessing the application system from the application system.

Understandably, the electronic device 10 provided in the embodiments of the present application can log in and access applications that occur on an application system that adopts a browser/server (Browser/Server, B/S) architecture and logs in using a PKI/digital certificate mode, Obtain log information including account information. It can improve the problem of missing information in the obtained logs due to the inability to obtain account information from the logs when the application system uses the Session/Cookie mechanism to save account information.

The electronic device 10 may be, but not limited to, a smart phone, a personal computer (Personal Computer, PC), a tablet computer, a personal digital assistant (Personal Digital Assistant, PDA), a server, and the like.

The application system can establish a communication connection with the user terminal through the network. The user terminal can access corresponding resources in the application system through the network. An application system can be understood as a server configured with application/business services. The application system can be configured according to different business scenarios and application scenarios. For example, the application system is a server for providing resources for video programs, or a server for providing a shopping platform.

The user terminal may be, but not limited to, a smart phone, a personal computer (Personal Computer, PC), a tablet computer, and the like.

Referring to FIG. 2 , in this embodiment, the electronic device 10 may include a processing module 11 , a storage module 12 , a communication module 13 , and a log management apparatus 100 . The processing module 11 , the communication module 13 , the storage module 12 , and the log management apparatus 100 each The components are directly or indirectly electrically connected to realize data transmission or interaction. For example, these elements may be electrically connected to each other through one or more communication buses or signal lines.

Understandably, a computer program is stored in the storage module 12 of the electronic device 10. When the computer program is executed by the processing module 11, the electronic device 10 can execute each step in the following log management method.

Referring to FIG. 3 , an embodiment of the present application also provides a log management method, which can be applied to the above-mentioned electronic device 10 , and the electronic device 10 executes or implements each step in the method, which can improve the application system for logging in in the account password mode. , there is a problem of missing information in the obtained logs. In this embodiment, the method may include the following steps:

Step S210: Obtain first log information obtained from a login operation of logging in to the application system through a preconfigured login log collection and adaptation rule, where the first log information includes account information and a first user terminal corresponding to the account information 's primary identity;

Step S220, obtaining second log information obtained by accessing the access operation of the application system through a preconfigured access log collection and adaptation rule, where the second log information includes the second identity of the second user terminal;

Step S230, when the second log information has the same second identity as the first identity, associate the account information corresponding to the first identity with the log corresponding to the second identity, Get the target log information.

In this embodiment, the first log information generated in the login application system can be acquired through the preconfigured login log collection and adaptation rules, and the first log information may generally include account information. Then, in combination with the second log information obtained from the access log collection and adaptation rules, account information can be obtained in the application system logged in in the account password mode. There is a problem of missing information in the obtained logs.

Each step in the method will be described in detail below:

In step S210, the electronic device 10 is pre-configured with a log log collection adaptation rule. Among them, the logging log collection adaptation rule can be set according to the actual situation, and can be used to obtain relevant information about logging in to the application system. For example, the login log collection adaptation rule may be a regular expression adaptation rule, and the log of the login operation of logging in to the application system may be obtained through the regular expression.

For example, the electronic device 10 can acquire uniform resource locator (Uniform Resource Locator, URL) information representing the login application system by using the regular expression adaptation rule. Understandably, when the user terminal adopts a browser/server (Browser/Server, B/S) architecture, or uses an application system to log in in the PKI/digital certificate mode, the user terminal needs to send the application system to the application system. URL information representing the login application system. . The URL information usually includes account information and an identity identifier of the user terminal, and the identity identifier is the first identity identifier. For example, it can be determined whether there is a field representing account information in the URL information through the regular expression adaptation rule. If there is a field representing account information in the URL information, the URL information is the URL information representing the login application system. At the same time, the electronic The device 10 can also obtain the account information in the login operation from the URL information. The first identity identifier may be determined according to the actual situation, and is used to identify the unique identity of the user terminal, and the identity identifiers of different user terminals are different. For example, the first identity identifier may be, but not limited to, the MAC address, IP address, etc. of the terminal device, which is not specifically limited here.

In this embodiment, step S210 may include: by collecting and adapting rules for the login log, determining first URL information representing logging in to the application system; obtaining a log including the account information from the first URL information information; adding a first identifier to the log information to obtain the first log information, where the first identifier is used to represent that the first log information is a login log.

Understandably, the login log collection and adaptation rules can distinguish the URL information for logging in to the application system and the URL information for accessing the application system. The URL information for logging in to the application system is the first URL information, and the URL information for accessing the application system is the following second URL information.

For example, after acquiring log information including account information from the first URL information, the electronic device 10 may automatically add an identifier indicating that the log information is a log of a login operation to the log information. The identifier is the first identifier, which can be set according to the actual situation. For example, it can be a number or a character, etc., which is used to distinguish it from the log information of the access operation, so as to facilitate the subsequent analysis and processing of the login log and the access log.

In step S220, the realization principle of the access log collection adaptation rule is similar to that of the login log collection adaptation rule. The access log collection adaptation rule can be set according to the actual situation, for example, it can be a regular expression adaptation rule used to detect access operations. For ease of distinction, the regular expression adaptation rule of the login log collection adaptation rule may be referred to as the first regular expression adaptation rule, and the regular expression adaptation rule of the access log collection adaptation rule may be referred to as the second regular expression. Adaptation rules. The second regular expression adaptation rule may detect URL information or other information sent by the user terminal when accessing the application system. The URL information is the following second URL information. The first log information may be referred to as a login log, and the second log information may be referred to as an access log.

Step S220 may include: determining second URL information representing access to the application system through the access log collection and adaptation rules; obtaining log information from the second URL information; adding a second identifier to the log information to obtain the second log information, where the second identifier is used to represent that the second log information is an access log.

In this embodiment, the second regular expression adaptation rule may perform matching detection on a corresponding field in the URL information through a regular expression. For example, it can be used to detect the MAC address, IP address of the user terminal in the matching URL information, and fields that characterize the access operation. The fields representing the access operation can be set according to the actual situation, which is not specifically limited here.

In this embodiment, the second regular expression adaptation rule may also detect whether there is a field representing account information in the URL information. If it is detected that there is no field representing account information in the URL information, it is determined that the URL information is the URL information corresponding to the access operation. The electronic device 10 can obtain second log information such as the second identity identifier of the terminal device by parsing the URL information through the second regular expression adaptation rule.

In step S230, after acquiring the first log information and the second log information, the electronic device 10 can perform correlation processing on the log information. Understandably, since the second log information is an access log obtained by the user terminal in accessing the application system, account information usually does not exist in this type of log. The first log information and the second log information may generally include identification information of the user terminal. If the same user terminal identification information exists in the first log information and the second log information, it means that the second log information is log information obtained by performing a corresponding operation on the account in the first log information. At this time, the account information in the first log information can be associated with the log corresponding to the second identity identifier, or the account information can be added to the second log information to obtain the target log information. Based on this, it is convenient to follow up and analyze the access operation of the account in combination with the account information.

For example, the electronic device 10 may, based on the target log obtained within a preset time period, count the number of visits, visit duration, visit frequency, etc. of the same account to the corresponding business module in the application system within the preset period of time. The preset duration can be set according to the actual situation, for example, it can be one day or one week. The business module can be determined according to the actual situation. For example, it can be a business module that provides news, a business module that provides video resources, and so on.

As an optional implementation manner, the method may further include: cleaning and classifying the target log information according to a preset cleaning and classification strategy to obtain cleaned and classified log information.

In this embodiment, the user can set a preset cleaning and classification policy according to actual business requirements, so as to filter and classify the logs. The method of classifying the log information may be: classifying the log information according to the account information; classifying the log information according to the type of the accessed module in the log. For example, logs corresponding to the same account are classified into one category, and logs corresponding to different accounts are classified into different categories. Assuming that the application system can include multiple business modules, the electronic device 10 can classify the logs obtained by accessing different business modules, and the logs accessing the same business module can be divided into one broad category; accessing different business modules can be classified into different categories.

In this embodiment, cleaning and classifying the target log information according to a preset cleaning and classification strategy, to obtain cleaned and classified log information, includes: retaining data of a specified data type from the target log information, deleting non-target log information Describe the data of the specified data type, and obtain the log information after cleaning and classification.

Understandably, the specified data type can be set according to the actual situation. For example, the specified data type may be a data type representing a specified service module in the access application system. The designated service module can be determined according to the actual situation, for example, a service module that provides video resources, a service module that provides audio resources, and a service module that provides news resources. Based on this, it is beneficial for the user to flexibly retain corresponding types of log data according to actual needs, thereby helping to reduce the processing volume of the log.

It should be noted that, in other embodiments, the electronic device 10 may send the obtained first log information, second log information, and target log information to other servers, and the other servers may The target log information is cleaned.

As an optional implementation manner, the method may further include: storing the first log information and the second log information through a key-value database, where the key is the identity identifier of the user terminal in the key-value database , the value is account information.

A key-value database can be understood as a Key-Value database. In the Key-Value database, Key is the identity identifier of the user terminal, and Value is account information. The Key may also include the serial number or identification of the application system, which is used to distinguish different application systems. The process of storing log information in the Key-Value database can be as follows:

The electronic device 10 extracts the account information in the login log (the first log information), and follows the form of key:value (key is the application system number_user terminal IP; value is account information, such as, for example, the application system number_user terminal IP is "100001_1.1.1.1", the account information is "admin", at this time, the key is "100001_1.1.1.1", the corresponding value is "admin"), which is stored in the redis database. If the key does not exist in the redis database, insert the key; if the key already exists in the redis database, update the value of value, for example, add one to the value of value to record the number of visits of the same user terminal.

The electronic device 10 extracts the application system number_user terminal IP (second identity identifier) of the user terminal in the access log (second log information) to form the above-mentioned key. According to the key, the redis database is correlated and queried, and the value of the corresponding key key, that is, the account information, is obtained. At this time, the account information can be filled into the second log information as the target log information.

In this embodiment, the obtained target log information may be stored in the corresponding cluster system, so that the user can subsequently download the corresponding log information from the cluster system according to requirements. The cluster system can be selected according to the actual situation. For example, the cluster system can be an Elasticsearch storage cluster, which can implement distributed storage.

As an optional implementation manner, the method may further include: outputting and displaying the log information after cleaning and classification through a display module.

In this embodiment, if the electronic device 10 is a terminal device, the terminal device may include a display module such as a display screen. The terminal device can output and display the log information after cleaning and classification through the display screen. The way of displaying log information can be set according to the actual situation. For example, the log information can be classified, and the log information can be displayed in the form of a statistical graph (such as a line graph, a bar graph, a fan graph, etc.) or a text document. Understandably, by visually displaying log information, it is convenient for users to pay attention to various types of log information intuitively, which is conducive to analysis and auditing of log data, and improves user experience.

If the electronic device 10 is a server. The server can send the cleaned and classified log information to a terminal device with a display module, and the terminal device can output and display the log information.

Referring to FIG. 4 , an embodiment of the present application further provides a log management apparatus 100 , which can be applied to the above-mentioned electronic device 10 for executing or implementing each step in the method. The log management apparatus 100 includes at least one software function module that can be stored in the storage module 12 in the form of software or firmware (Firmware) or fixed in an operating system (Operating System, OS) of the electronic device 10 . The processing module 11 is configured to execute executable modules stored in the storage module 12 , such as software function modules and computer programs included in the log management apparatus 100 .

The log management apparatus 100 may include a first acquisition unit 110 , a second acquisition unit 120 and a log processing unit 130 .

The first obtaining unit 110 is configured to obtain first log information obtained from a login operation of logging in to an application system through a preconfigured log-in log collection and adaptation rule, where the first log information includes account information and corresponds to the account information. the first identity of the first user terminal.

The second obtaining unit 120 obtains second log information obtained from an access operation of accessing the application system through a preconfigured access log collection and adaptation rule, where the second log information includes the second identity of the second user terminal .

The log processing unit 130 is configured to correspond the account information corresponding to the first identification to the second identification when there is a second identification identical to the first identification in the second log information log association to get the target log information.

Optionally, the first obtaining unit 110 may also be used for:

Determine the first URL information representing the login to the application system by collecting the adaptation rules through the login log;

Obtain log information including the account information from the first URL information;

A first identifier is added to the log information to obtain the first log information, where the first identifier is used to represent that the first log information is a login log.

Optionally, the second log unit can also be used to:

Through the access log collection and adaptation rules, determine the second URL information representing the access to the application system;

Obtain log information from the second URL information;

A second identifier is added to the log information to obtain the second log information, where the second identifier is used to represent that the second log information is an access log.

Optionally, the log management apparatus 100 may further include a cleaning unit, configured to perform cleaning and classification on the target log information according to a preset cleaning and classification strategy, to obtain cleaned and classified log information.

The cleaning unit may also be configured to: retain data of a specified data type from the target log information, delete data not of the specified data type, and obtain cleaned and classified log information.

Optionally, the log management apparatus 100 may further include a display unit, configured to output and display the cleaned and classified log information through a display module.

Optionally, the log management apparatus 100 may further include a storage unit configured to store the first log information and the second log information through a key-value database. In the key-value database, the key is the user terminal's Identifier, the value is account information.

In this embodiment, the processing module 11 may be an integrated circuit chip, which has signal processing capability. The above-mentioned processing module 11 may be a general-purpose processor. For example, the processor may be a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU), a network processor (Network Processor, NP), etc.; it may also be a digital signal processor (Digital Signal Processing, DSP), Application Specific Integrated Circuit (ASIC), Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components that can implement or The methods, steps and logic block diagrams disclosed in the embodiments of this application are executed.

The communication module 13 is used to establish a communication connection between the electronic device 10 and the application system through the network, and to send and receive data through the network.

The memory module 12 may be, but is not limited to, random access memory, read only memory, programmable read only memory, erasable programmable read only memory, electrically erasable programmable read only memory, and the like. In this embodiment, the storage module 12 may be used to store log information. Of course, the storage module 12 can also be used to store a program, and the processing module 11 executes the program after receiving the execution instruction.

It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the electronic device 10 and the log management method described above can refer to the corresponding process of each step in the aforementioned method. This will not be repeated here.

Embodiments of the present application further provide a computer-readable storage medium. A computer program is stored in the readable storage medium, and when the computer program runs on the computer, the computer executes the log management method described in the above embodiments.

From the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by hardware or by means of software plus a necessary general hardware platform. Based on this understanding, the technical solutions of the present application It can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.), and includes several instructions to make a computer device (which can be It is a personal computer, a server, or a network device, etc.) to execute the methods described in various implementation scenarios of this application.

In summary, the present application provides a log management method, apparatus, electronic device, and readable storage medium. The method may include: obtaining first log information obtained from a login operation of logging in to an application system through a preconfigured login log collection and adaptation rule, where the first log information includes account information and first log information of the first user terminal corresponding to the account information. identity identifier; through the preconfigured access log collection and adaptation rules, obtain the second log information obtained by accessing the access operation of the application system, and the second log information includes the second identity identifier of the second user terminal; when the second log information is in the second log information When there is a second identity that is the same as the first, the account information corresponding to the first identity is associated with the log corresponding to the second identity to obtain target log information. In this solution, the first log information generated in the login application system can be acquired through the preconfigured login log collection and adaptation rules, and the first log information can usually include account information. Then, in combination with the second log information obtained from the access log collection and adaptation rules, account information can be obtained in the application system logged in in the account password mode. There is a problem of missing information in the obtained logs.

In the embodiments provided in this application, it should be understood that the disclosed apparatus, system and method may also be implemented in other manners. The apparatus, system and method embodiments described above are merely schematic, for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture of possible implementations of systems, methods and computer program products according to various embodiments of the present application Architecture, functionality and operation. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code that contains one or more functions for implementing the specified logical function(s) executable instructions. It is also noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented in dedicated hardware-based systems that perform the specified functions or actions , or can be implemented in a combination of dedicated hardware and computer instructions. In addition, each functional module in each embodiment of the present application may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the protection scope of this application.

Claims (10)

1. A method of log management, the method comprising:

acquiring first log information obtained by logging operation of a logging application system through a pre-configured logging log acquisition adaptation rule, wherein the first log information comprises account information and a first identity identifier of a first user terminal corresponding to the account information;

acquiring second log information obtained by accessing the access operation of the application system through a pre-configured access log acquisition adaptation rule, wherein the second log information comprises a second identity of a second user terminal;

and when a second identity label identical to the first identity label exists in the second log information, associating the account information corresponding to the first identity label with the log corresponding to the second identity label to obtain target log information.

2. The method of claim 1, wherein obtaining the first log information obtained from the login operation of the login application system through the pre-configured login log collection adaptation rule comprises:

acquiring an adaptation rule through the login log, and determining first URL information representing the login of the application system;

acquiring log information including the account information from the first URL information;

adding a first identifier in the log information to obtain the first log information, wherein the first identifier is used for representing that the first log information is a login log.

3. The method of claim 1, wherein obtaining second log information obtained from an access operation accessing the application system by using a pre-configured access log collection adaptation rule comprises:

acquiring an adaptation rule through the access log, and determining second URL information representing access to the application system;

acquiring log information from the second URL information;

and adding a second identifier in the log information to obtain the second log information, wherein the second identifier is used for representing that the second log information is an access log.

4. The method of claim 1, further comprising:

and cleaning and classifying the target log information according to a preset cleaning and classifying strategy to obtain the cleaned and classified log information.

5. The method of claim 4, wherein the cleaning and classifying the target log information according to a preset cleaning and classifying strategy to obtain the cleaned and classified log information comprises:

and reserving data of the specified data type from the target log information, and deleting data of the non-specified data type to obtain the log information after cleaning and classification.

6. The method according to claim 4 or 5, characterized in that the method further comprises:

and outputting and displaying the log information after cleaning and classification through a display module.

7. The method of claim 1, further comprising:

and storing the first log information and the second log information through a key value database, wherein in the key value database, a key is the identity of the user terminal, and a value is account information.

8. An apparatus for log management, the apparatus comprising:

the system comprises a first acquisition unit, a second acquisition unit and a third acquisition unit, wherein the first acquisition unit is used for acquiring an adaptation rule through a pre-configured login log, and acquiring first log information obtained by login operation of a login application system, and the first log information comprises account information and a first identity of a first user terminal corresponding to the account information;

the second acquisition unit acquires adaptation rules through a pre-configured access log, and acquires second log information obtained by accessing the access operation of the application system, wherein the second log information comprises a second identity of a second user terminal;

and the log processing unit is used for associating the account information corresponding to the first identity with the log corresponding to the second identity to obtain target log information when the second identity identical to the first identity exists in the second log information.

9. An electronic device, characterized in that the electronic device comprises a memory, a processor, coupled to each other, in which memory a computer program is stored which, when executed by the processor, causes the electronic device to carry out the method according to any one of claims 1-7.

10. A computer-readable storage medium, in which a computer program is stored which, when run on a computer, causes the computer to carry out the method according to any one of claims 1-7.

Images