如何进行Log4j日志的分析-Simple Log Service(SLS)-阿里云帮助中心

This topic uses an e-commerce platform as an example to describe how to analyze Log4j logs.

Prerequisites

You have collected Log4j logs. For more information, see Collect Log4j logs.
You have created an index. For more information, see Create indexes.

For this example, configure the index as follows. In the Specified Field Query settings, include the text fields level, location, message, and thread, and select Enable Statistics.

Background information

Log4j is an open-source project from Apache. With Log4j, you can configure log destinations, such as consoles, files, GUI components, Socket servers, NT Event Loggers, and UNIX Syslog daemons. You can also control the output format of each log message. By defining the level for each log message, you can control the log generation process in greater detail. These settings can be flexibly configured in a configuration file without requiring changes to the application code. Log4j consists of three important components, as follows:

Layouts

Layouts format log messages. The following table describes common layouts.

Layout	Description
HTMLLayout	Formats log output as an HTML table.
SimpleLayout	Applies a simple output format, such as the default format for INFO-level messages.
PatternLayout	Outputs logs in a custom format. You can specify the arrangement and format of elements such as the timestamp, log level, thread name, class name, method name, and log message.

Appenders

Appenders send log messages to a destination. You can configure multiple appenders to send logs to various destinations. The following table describes common appenders.

Appender	Description
ConsoleAppender	Writes logs to the console.
FileAppender	Writes logs to a file.
DailyRollingFileAppender	Writes logs to a file and rolls over to a new file daily.
RollingFileAppender	When the file reaches a specified size, Log4j renames it and creates a new one.
JDBCAppender	Saves log messages to a database.

Loggers

Loggers capture log information. Each logger is assigned a log level based on its importance or severity. Log4j defines eight log levels, listed here from highest to lowest priority: OFF, FATAL, ERROR, WARN, INFO, DEBUG, TRACE, and ALL. Log levels are inherited, which means a child logger inherits all log levels of its parent. The following table describes each log level.

Log level	Description
OFF	Turns off all logging.
FATAL	Indicates a severe error that will cause the application to exit.
ERROR	Indicates an error that does not stop the application.
WARN	Warns of a potential error.
INFO	Tracks application progress at a high level.
DEBUG	Provides detailed information for debugging.
TRACE	Provides detailed information to trace program execution, such as variable values and execution flow.
ALL	Enables all log levels.

Note

A logger can be associated with multiple appenders, but an appender can be associated with only one layout.

Consider an e-commerce company that wants to optimize its platform operations. The company plans to analyze user behavior, platform stability, system errors, and data security. To gain insights, they analyze data such as login methods, session durations, pages viewed, and user spending habits. Simple Log Service provides a unified platform to collect, store, and analyze this log data.

The following are sample logs from Simple Log Service.

Log entry for a user login:

level:  INFO  
location:  com.aliyun.log4jappendertest.Log4jAppenderBizDemo.login(Log4jAppenderBizDemo.java:38)
message:  User login successfully. requestID=id4 userID=user8  
thread:  main  
time:  2022-01-26T15:31+0000

Log entry for a user purchase:

level:  INFO  
location:  com.aliyun.log4jappendertest.Log4jAppenderBizDemo.order(Log4jAppenderBizDemo.java:46)
message:  Place an order successfully. requestID=id44 userID=user8 itemID=item3 amount=9  
thread:  main  
time:  2022-01-26T15:31+0000

Procedure

Log on to the Simple Log Service console.
In the Projects section, click the one you want.
On the Log Storage > Logstores tab, click the logstore you want.

Enter a query statement, and then set the time range by clicking Last 15 Minutes.

For more information, see Step 1: Configure indexes.

Find the top three locations with the most errors in the last hour.

level: ERROR | select location ,count(*) as count GROUP BY  location  ORDER BY count DESC LIMIT 3

Count the number of log entries for each log level in the last 15 minutes.
```
* | select level ,count(*) as count GROUP BY level ORDER BY count DESC
```

Find the top three users with the most logins in the last hour.

login | SELECT regexp_extract(message, 'userID=(?<userID>[a-zA-Z\d]+)', 1) AS userID, count(*) as count GROUP BY userID ORDER BY count DESC LIMIT 3

Calculate the total payment amount for each user in the last 15 minutes.

order | SELECT regexp_extract(message, 'userID=(?<userID>[a-zA-Z\d]+)', 1) AS userID, sum(cast(regexp_extract(message, 'amount=(?<amount>[a-zA-Z\d]+)', 1) AS double)) AS amount GROUP BY userID