Java日志异常检测案例

wen java案例 2026-07-30 179

本文目录导读：

Java日志异常检测案例

项目结构
核心实现代码
运行说明
功能特性

我来为您提供一个完整的Java日志异常检测案例,包含实时监控和异常分析功能。

项目结构

log-anomaly-detector/
├── src/main/java/com/example/logdetector/
│   ├── model/
│   │   ├── LogEntry.java
│   │   └── AnomalyEvent.java
│   ├── detector/
│   │   ├── LogAnalyzer.java
│   │   └── AnomalyDetector.java
│   ├── parser/
│   │   └── LogParser.java
│   ├── storage/
│   │   └── LogStorage.java
│   └── alert/
│       └── AlertManager.java
└── pom.xml

核心实现代码

1 日志模型

// LogEntry.java
package com.example.logdetector.model;
import java.time.LocalDateTime;
public class LogEntry {
    private LocalDateTime timestamp;
    private String level;
    private String logger;
    private String message;
    private String threadName;
    private String exceptionType;
    private String stackTrace;
    // 构造函数
    public LogEntry(LocalDateTime timestamp, String level, String logger, 
                   String message, String threadName) {
        this.timestamp = timestamp;
        this.level = level;
        this.logger = logger;
        this.message = message;
        this.threadName = threadName;
    }
    // Getters and Setters
    public LocalDateTime getTimestamp() { return timestamp; }
    public void setTimestamp(LocalDateTime timestamp) { this.timestamp = timestamp; }
    public String getLevel() { return level; }
    public void setLevel(String level) { this.level = level; }
    public String getLogger() { return logger; }
    public void setLogger(String logger) { this.logger = logger; }
    public String getMessage() { return message; }
    public void setMessage(String message) { this.message = message; }
    public String getThreadName() { return threadName; }
    public void setThreadName(String threadName) { this.threadName = threadName; }
    public String getExceptionType() { return exceptionType; }
    public void setExceptionType(String exceptionType) { this.exceptionType = exceptionType; }
    public String getStackTrace() { return stackTrace; }
    public void setStackTrace(String stackTrace) { this.stackTrace = stackTrace; }
    @Override
    public String toString() {
        return String.format("[%s] [%s] [%s] %s - %s", 
            timestamp, level, threadName, logger, message);
    }
}
// AnomalyEvent.java
package com.example.logdetector.model;
import java.time.LocalDateTime;
import java.util.List;
public class AnomalyEvent {
    private String id;
    private LocalDateTime detectedTime;
    private String anomalyType;
    private String severity;
    private String description;
    private List<LogEntry> relatedLogs;
    private String suggestedAction;
    // 构造函数
    public AnomalyEvent(String anomalyType, String severity, String description) {
        this.detectedTime = LocalDateTime.now();
        this.anomalyType = anomalyType;
        this.severity = severity;
        this.description = description;
        this.id = generateId();
    }
    private String generateId() {
        return "ANOM-" + System.currentTimeMillis() + "-" + 
               (int)(Math.random() * 1000);
    }
    // Getters and Setters
    public String getId() { return id; }
    public void setId(String id) { this.id = id; }
    public LocalDateTime getDetectedTime() { return detectedTime; }
    public String getAnomalyType() { return anomalyType; }
    public void setAnomalyType(String anomalyType) { this.anomalyType = anomalyType; }
    public String getSeverity() { return severity; }
    public void setSeverity(String severity) { this.severity = severity; }
    public String getDescription() { return description; }
    public void setDescription(String description) { this.description = description; }
    public List<LogEntry> getRelatedLogs() { return relatedLogs; }
    public void setRelatedLogs(List<LogEntry> relatedLogs) { this.relatedLogs = relatedLogs; }
    public String getSuggestedAction() { return suggestedAction; }
    public void setSuggestedAction(String suggestedAction) { this.suggestedAction = suggestedAction; }
}

2 日志解析器

// LogParser.java
package com.example.logdetector.parser;
import com.example.logdetector.model.LogEntry;
import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class LogParser {
    // 日志模式匹配 - 支持多种格式
    private static final Pattern LOG_PATTERN = 
        Pattern.compile("(\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}\\.\\d{3})\\s+" +
                       "\\[(\\w+)\\]\\s+" +
                       "\\[(\\w+)\\]\\s+" +
                       "(\\S+)\\s+" +
                       "\\-\\s+" +
                       "(.*)");
    private static final DateTimeFormatter FORMATTER = 
        DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SSS");
    public LogEntry parse(String logLine) {
        if (logLine == null || logLine.trim().isEmpty()) {
            return null;
        }
        Matcher matcher = LOG_PATTERN.matcher(logLine);
        if (matcher.matches()) {
            LocalDateTime timestamp = LocalDateTime.parse(matcher.group(1), FORMATTER);
            String level = matcher.group(2);
            String threadName = matcher.group(3);
            String logger = matcher.group(4);
            String message = matcher.group(5);
            LogEntry entry = new LogEntry(timestamp, level, logger, message, threadName);
            // 检测异常信息
            detectException(entry, message);
            return entry;
        }
        return null;
    }
    private void detectException(LogEntry entry, String message) {
        // 常见的异常类型
        String[] exceptionPatterns = {
            "Exception", "Error", "NullPointer", "ArrayIndexOutOfBounds",
            "ClassNotFoundException", "IOException", "SQLException",
            "NumberFormatException", "IllegalArgumentException"
        };
        for (String pattern : exceptionPatterns) {
            if (message.contains(pattern)) {
                entry.setExceptionType(pattern);
                // 提取堆栈跟踪信息
                extractStackTrace(entry, message);
                break;
            }
        }
    }
    private void extractStackTrace(LogEntry entry, String message) {
        // 简化的堆栈跟踪提取
        if (entry.getExceptionType() != null) {
            int startIndex = message.indexOf("at ");
            if (startIndex > 0) {
                entry.setStackTrace(message.substring(startIndex));
            }
        }
    }
}

3 异常检测器

// AnomalyDetector.java
package com.example.logdetector.detector;
import com.example.logdetector.model.AnomalyEvent;
import com.example.logdetector.model.LogEntry;
import java.time.LocalDateTime;
import java.time.temporal.ChronoUnit;
import java.util.*;
import java.util.stream.Collectors;
public class AnomalyDetector {
    private static final int ERROR_THRESHOLD = 5; // 错误阈值
    private static final int TIME_WINDOW_MINUTES = 1; // 时间窗口
    private Map<String, List<LocalDateTime>> recentErrors = new HashMap<>();
    private Map<String, Integer> errorCounts = new HashMap<>();
    public List<AnomalyEvent> detectAnomalies(List<LogEntry> logs) {
        List<AnomalyEvent> anomalies = new ArrayList<>();
        for (LogEntry log : logs) {
            // 检测异常
            AnomalyEvent anomaly = analyzeLog(log);
            if (anomaly != null) {
                anomalies.add(anomaly);
            }
        }
        // 检测模式异常
        anomalies.addAll(detectPatternAnomalies(logs));
        return anomalies;
    }
    private AnomalyEvent analyzeLog(LogEntry log) {
        // 1. 检测错误级别日志
        if ("ERROR".equals(log.getLevel()) || "FATAL".equals(log.getLevel())) {
            return createErrorAnomaly(log);
        }
        // 2. 检测异常类型
        if (log.getExceptionType() != null) {
            return createExceptionAnomaly(log);
        }
        // 3. 检测关键错误信息
        if (containsCriticalKeywords(log.getMessage())) {
            return createCriticalAnomaly(log);
        }
        return null;
    }
    private AnomalyEvent createErrorAnomaly(LogEntry log) {
        AnomalyEvent anomaly = new AnomalyEvent("ERROR_LOG", "HIGH", 
            "Detected error: " + log.getMessage());
        anomaly.setSuggestedAction("Check the application logs for more details");
        anomaly.setRelatedLogs(Collections.singletonList(log));
        return anomaly;
    }
    private AnomalyEvent createExceptionAnomaly(LogEntry log) {
        AnomalyEvent anomaly = new AnomalyEvent("EXCEPTION", "CRITICAL", 
            "Exception '" + log.getExceptionType() + "' detected: " + log.getMessage());
        anomaly.setSuggestedAction("Review stack trace and fix the issue");
        anomaly.setRelatedLogs(Collections.singletonList(log));
        return anomaly;
    }
    private AnomalyEvent createCriticalAnomaly(LogEntry log) {
        AnomalyEvent anomaly = new AnomalyEvent("CRITICAL_KEYWORD", "HIGH", 
            "Critical keyword detected: " + log.getMessage());
        anomaly.setSuggestedAction("Immediate investigation required");
        anomaly.setRelatedLogs(Collections.singletonList(log));
        return anomaly;
    }
    private boolean containsCriticalKeywords(String message) {
        String[] keywords = {"out of memory", "connection refused", "deadlock", 
                            "disk full", "system crash"};
        if (message != null) {
            String lowerMessage = message.toLowerCase();
            return Arrays.stream(keywords).anyMatch(lowerMessage::contains);
        }
        return false;
    }
    private List<AnomalyEvent> detectPatternAnomalies(List<LogEntry> logs) {
        List<AnomalyEvent> anomalies = new ArrayList<>();
        // 1. 检测错误频率异常
        AnomalyEvent frequencyAnomaly = detectErrorFrequencyAnomaly(logs);
        if (frequencyAnomaly != null) {
            anomalies.add(frequencyAnomaly);
        }
        // 2. 检测特定模式
        AnomalyEvent patternAnomaly = detectSpecificPatterns(logs);
        if (patternAnomaly != null) {
            anomalies.add(patternAnomaly);
        }
        return anomalies;
    }
    private AnomalyEvent detectErrorFrequencyAnomaly(List<LogEntry> logs) {
        // 统计时间窗口内的错误数量
        long recentErrorCount = logs.stream()
            .filter(log -> "ERROR".equals(log.getLevel()) || "FATAL".equals(log.getLevel()))
            .count();
        if (recentErrorCount >= ERROR_THRESHOLD) {
            AnomalyEvent anomaly = new AnomalyEvent("HIGH_ERROR_RATE", "CRITICAL",
                String.format("High error rate detected: %d errors in recent logs", 
                            recentErrorCount));
            anomaly.setSuggestedAction("Investigate system stability immediately");
            anomaly.setRelatedLogs(logs.stream()
                .filter(log -> "ERROR".equals(log.getLevel()))
                .collect(Collectors.toList()));
            return anomaly;
        }
        return null;
    }
    private AnomalyEvent detectSpecificPatterns(List<LogEntry> logs) {
        // 检测连续失败模式
        String lastLogger = null;
        int consecutiveFailures = 0;
        for (LogEntry log : logs) {
            if (log.getExceptionType() != null || "ERROR".equals(log.getLevel())) {
                if (log.getLogger().equals(lastLogger)) {
                    consecutiveFailures++;
                    if (consecutiveFailures >= 3) {
                        AnomalyEvent anomaly = new AnomalyEvent("CONSECUTIVE_FAILURES", "HIGH",
                            String.format("Consecutive failures detected in %s: %d times", 
                                        log.getLogger(), consecutiveFailures));
                        anomaly.setSuggestedAction("Check the component for bugs");
                        return anomaly;
                    }
                } else {
                    lastLogger = log.getLogger();
                    consecutiveFailures = 1;
                }
            }
        }
        return null;
    }
}

4 日志分析器组合

// LogAnalyzer.java
package com.example.logdetector.detector;
import com.example.logdetector.model.AnomalyEvent;
import com.example.logdetector.model.LogEntry;
import com.example.logdetector.parser.LogParser;
import com.example.logdetector.storage.LogStorage;
import com.example.logdetector.alert.AlertManager;
import java.io.*;
import java.nio.file.*;
import java.time.LocalDateTime;
import java.util.*;
import java.util.concurrent.*;
import java.util.stream.Collectors;
public class LogAnalyzer {
    private final LogParser parser;
    private final AnomalyDetector detector;
    private final LogStorage storage;
    private final AlertManager alertManager;
    private ScheduledExecutorService scheduler;
    private long lastFileSize = 0;
    private Path logFilePath;
    public LogAnalyzer() {
        this.parser = new LogParser();
        this.detector = new AnomalyDetector();
        this.storage = new LogStorage();
        this.alertManager = new AlertManager();
    }
    public void startMonitoring(String logFilePath) throws IOException {
        this.logFilePath = Paths.get(logFilePath);
        this.scheduler = Executors.newScheduledThreadPool(1);
        // 每5秒检查一次新日志
        scheduler.scheduleAtFixedRate(() -> {
            try {
                analyzeNewLogs();
            } catch (Exception e) {
                System.err.println("Error analyzing logs: " + e.getMessage());
            }
        }, 0, 5, TimeUnit.SECONDS);
        System.out.println("Log monitoring started for: " + logFilePath);
    }
    private void analyzeNewLogs() throws IOException {
        File logFile = logFilePath.toFile();
        if (!logFile.exists()) {
            System.err.println("Log file not found: " + logFilePath);
            return;
        }
        long currentSize = logFile.length();
        // 只读取新增的内容
        if (currentSize > lastFileSize) {
            try (RandomAccessFile file = new RandomAccessFile(logFile, "r")) {
                file.seek(lastFileSize);
                String line;
                List<LogEntry> newLogs = new ArrayList<>();
                while ((line = file.readLine()) != null) {
                    LogEntry entry = parser.parse(line);
                    if (entry != null) {
                        newLogs.add(entry);
                        storage.storeLog(entry);
                    }
                }
                if (!newLogs.isEmpty()) {
                    // 检测异常
                    List<AnomalyEvent> anomalies = detector.detectAnomalies(newLogs);
                    // 处理异常
                    for (AnomalyEvent anomaly : anomalies) {
                        storage.storeAnomaly(anomaly);
                        alertManager.sendAlert(anomaly);
                    }
                    // 生成报告
                    if (!anomalies.isEmpty()) {
                        generateReport(anomalies);
                    }
                }
                lastFileSize = currentSize;
            }
        }
    }
    public void analyzeBatch(List<String> logLines) {
        List<LogEntry> logs = logLines.stream()
            .map(parser::parse)
            .filter(Objects::nonNull)
            .collect(Collectors.toList());
        System.out.println("Analyzing " + logs.size() + " log entries...");
        // 存储所有日志
        logs.forEach(storage::storeLog);
        // 检测异常
        List<AnomalyEvent> anomalies = detector.detectAnomalies(logs);
        // 输出结果
        System.out.println("\n=== Anomaly Detection Results ===");
        System.out.println("Total log entries: " + logs.size());
        System.out.println("Anomalies detected: " + anomalies.size());
        for (AnomalyEvent anomaly : anomalies) {
            System.out.println("\n" + anomaly.getId());
            System.out.println("Type: " + anomaly.getAnomalyType());
            System.out.println("Severity: " + anomaly.getSeverity());
            System.out.println("Time: " + anomaly.getDetectedTime());
            System.out.println("Description: " + anomaly.getDescription());
            System.out.println("Suggested Action: " + anomaly.getSuggestedAction());
            if (anomaly.getRelatedLogs() != null) {
                System.out.println("Related logs:");
                anomaly.getRelatedLogs().forEach(log -> 
                    System.out.println("  - " + log));
            }
        }
    }
    private void generateReport(List<AnomalyEvent> anomalies) {
        System.out.println("\n=== Real-time Anomaly Report ===");
        System.out.println("Time: " + LocalDateTime.now());
        long criticalCount = anomalies.stream()
            .filter(a -> "CRITICAL".equals(a.getSeverity()))
            .count();
        long highCount = anomalies.stream()
            .filter(a -> "HIGH".equals(a.getSeverity()))
            .count();
        System.out.println("Critical anomalies: " + criticalCount);
        System.out.println("High severity anomalies: " + highCount);
        System.out.println("Total anomalies: " + anomalies.size());
        // 按类型统计
        Map<String, Long> typeStats = anomalies.stream()
            .collect(Collectors.groupingBy(AnomalyEvent::getAnomalyType, 
                                          Collectors.counting()));
        System.out.println("\nAnomaly type statistics:");
        typeStats.forEach((type, count) -> 
            System.out.println("  " + type + ": " + count));
    }
    public void stopMonitoring() {
        if (scheduler != null) {
            scheduler.shutdown();
        }
        System.out.println("Log monitoring stopped.");
    }
}

5 存储层

// LogStorage.java
package com.example.logdetector.storage;
import com.example.logdetector.model.AnomalyEvent;
import com.example.logdetector.model.LogEntry;
import java.time.LocalDateTime;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import java.util.stream.Collectors;
public class LogStorage {
    private final Map<String, LogEntry> logStore = new ConcurrentHashMap<>();
    private final Map<String, AnomalyEvent> anomalyStore = new ConcurrentHashMap<>();
    private final int MAX_LOGS = 10000;
    private final int MAX_ANOMALIES = 1000;
    public void storeLog(LogEntry log) {
        String key = log.getTimestamp() + "-" + log.getThreadName() + "-" + 
                     System.nanoTime();
        if (logStore.size() >= MAX_LOGS) {
            // 移除最旧的日志
            String oldestKey = logStore.keySet().iterator().next();
            logStore.remove(oldestKey);
        }
        logStore.put(key, log);
    }
    public void storeAnomaly(AnomalyEvent anomaly) {
        if (anomalyStore.size() >= MAX_ANOMALIES) {
            // 移除最旧的异常
            String oldestKey = anomalyStore.keySet().iterator().next();
            anomalyStore.remove(oldestKey);
        }
        anomalyStore.put(anomaly.getId(), anomaly);
    }
    public List<LogEntry> getRecentLogs(int count) {
        return logStore.values().stream()
            .sorted((a, b) -> b.getTimestamp().compareTo(a.getTimestamp()))
            .limit(count)
            .collect(Collectors.toList());
    }
    public List<AnomalyEvent> getRecentAnomalies(int count) {
        return anomalyStore.values().stream()
            .sorted((a, b) -> b.getDetectedTime().compareTo(a.getDetectedTime()))
            .limit(count)
            .collect(Collectors.toList());
    }
    public List<LogEntry> getLogsByLevel(String level, LocalDateTime start, LocalDateTime end) {
        return logStore.values().stream()
            .filter(log -> log.getLevel().equals(level))
            .filter(log -> !log.getTimestamp().isBefore(start) && 
                          !log.getTimestamp().isAfter(end))
            .sorted((a, b) -> b.getTimestamp().compareTo(a.getTimestamp()))
            .collect(Collectors.toList());
    }
    public long getErrorCountInTimeWindow(LocalDateTime start, LocalDateTime end) {
        return logStore.values().stream()
            .filter(log -> "ERROR".equals(log.getLevel()) || 
                          "FATAL".equals(log.getLevel()))
            .filter(log -> !log.getTimestamp().isBefore(start) && 
                          !log.getTimestamp().isAfter(end))
            .count();
    }
    public Map<String, Long> getAnomalyStatistics() {
        return anomalyStore.values().stream()
            .collect(Collectors.groupingBy(AnomalyEvent::getAnomalyType, 
                                          Collectors.counting()));
    }
    public void clear() {
        logStore.clear();
        anomalyStore.clear();
    }
}

6 告警管理器

// AlertManager.java
package com.example.logdetector.alert;
import com.example.logdetector.model.AnomalyEvent;
import java.time.format.DateTimeFormatter;
import java.util.logging.Logger;
public class AlertManager {
    private static final Logger LOGGER = Logger.getLogger(AlertManager.class.getName());
    public void sendAlert(AnomalyEvent anomaly) {
        // 根据严重级别发送不同级别的告警
        switch (anomaly.getSeverity()) {
            case "CRITICAL":
                sendCriticalAlert(anomaly);
                break;
            case "HIGH":
                sendHighAlert(anomaly);
                break;
            case "MEDIUM":
                sendMediumAlert(anomaly);
                break;
            default:
                sendInfoAlert(anomaly);
        }
    }
    private void sendCriticalAlert(AnomalyEvent anomaly) {
        String alertMessage = formatAlert("CRITICAL", anomaly);
        System.err.println(alertMessage);
        sendEmail(anomaly, "CRITICAL");
        sendSMS(anomaly);
        // Log to system
        LOGGER.severe(alertMessage);
    }
    private void sendHighAlert(AnomalyEvent anomaly) {
        String alertMessage = formatAlert("HIGH", anomaly);
        System.out.println(alertMessage);
        sendEmail(anomaly, "HIGH");
        LOGGER.warning(alertMessage);
    }
    private void sendMediumAlert(AnomalyEvent anomaly) {
        String alertMessage = formatAlert("MEDIUM", anomaly);
        System.out.println(alertMessage);
        LOGGER.info(alertMessage);
    }
    private void sendInfoAlert(AnomalyEvent anomaly) {
        String alertMessage = formatAlert("INFO", anomaly);
        System.out.println(alertMessage);
        LOGGER.fine(alertMessage);
    }
    private String formatAlert(String severity, AnomalyEvent anomaly) {
        StringBuilder sb = new StringBuilder();
        sb.append("\n=== ").append(severity).append(" ALERT ===");
        sb.append("\nTime: ").append(anomaly.getDetectedTime()
            .format(DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss")));
        sb.append("\nType: ").append(anomaly.getAnomalyType());
        sb.append("\nDescription: ").append(anomaly.getDescription());
        sb.append("\nSuggested Action: ").append(anomaly.getSuggestedAction());
        sb.append("\n====================================\n");
        return sb.toString();
    }
    // 模拟邮件发送
    private void sendEmail(AnomalyEvent anomaly, String severity) {
        System.out.println("[EMAIL] Sending " + severity + " alert email for: " + 
                         anomaly.getAnomalyType());
        // 实际实现中应该使用邮件API
    }
    // 模拟短信发送（仅严重告警）
    private void sendSMS(AnomalyEvent anomaly) {
        System.out.println("[SMS] Sending critical alert SMS for: " + 
                         anomaly.getAnomalyType());
        // 实际实现中应该使用短信API
    }
    // Webhook通知
    public void sendWebhook(AnomalyEvent anomaly, String webhookUrl) {
        System.out.println("[WEBHOOK] Sending notification to: " + webhookUrl);
        // 实际实现中应该发送HTTP请求
    }
}

7 主程序和测试

// Main.java
package com.example.logdetector;
import com.example.logdetector.detector.LogAnalyzer;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;
public class Main {
    public static void main(String[] args) {
        LogAnalyzer analyzer = new LogAnalyzer();
        // 测试数据 - 模拟日志行
        List<String> testLogs = Arrays.asList(
            "2024-01-15 10:30:45.123 [INFO] [main] com.example.service.UserService - User login successful: user123",
            "2024-01-15 10:30:46.234 [WARN] [http-nio-8080-exec-1] com.example.service.PaymentService - Payment processing delay detected",
            "2024-01-15 10:30:47.345 [ERROR] [http-nio-8080-exec-2] com.example.controller.OrderController - NullPointerException occurred while processing order",
            "2024-01-15 10:30:48.456 [ERROR] [http-nio-8080-exec-3] com.example.service.DatabaseService - Connection refused to database server",
            "2024-01-15 10:30:49.567 [FATAL] [main] com.example.Application - System crash detected: out of memory",
            "2024-01-15 10:30:50.678 [ERROR] [pool-1-thread-1] com.example.service.DataSyncService - IOException: File not found",
            "2024-01-15 10:30:51.789 [INFO] [http-nio-8080-exec-4] com.example.service.UserService - User logout: user456",
            "2024-01-15 10:30:52.890 [ERROR] [http-nio-8080-exec-5] com.example.controller.OrderController - SQLException: Deadlock detected",
            "2024-01-15 10:30:53.901 [ERROR] [http-nio-8080-exec-6] com.example.controller.OrderController - SQLException: Transaction rollback",
            "2024-01-15 10:30:54.012 [ERROR] [http-nio-8080-exec-7] com.example.controller.OrderController - SQLException: Connection timeout"
        );
        System.out.println("=== Java Log Anomaly Detection Demo ===\n");
        // 执行批量分析
        analyzer.analyzeBatch(testLogs);
        // 演示实时监控
        System.out.println("\n=== Starting Real-time Monitoring Demo ===");
        try {
            // 创建一个临时日志文件用于演示
            java.nio.file.Path tempFile = java.nio.file.Files.createTempFile("test-log", ".log");
            System.out.println("Monitoring log file: " + tempFile);
            analyzer.startMonitoring(tempFile.toString());
            // 模拟实时日志写入
            Thread.sleep(2000);
            java.nio.file.Files.write(tempFile, Arrays.asList(
                "2024-01-15 11:00:00.000 [ERROR] [main] com.example.service.CriticalService - Connection refused to external API"
            ));
            Thread.sleep(2000);
            java.nio.file.Files.write(tempFile, Arrays.asList(
                "2024-01-15 11:00:05.000 [FATAL] [main] com.example.Application - System resources exhausted"
            ));
            // 等待处理
            Thread.sleep(3000);
            // 停止监控
            analyzer.stopMonitoring();
            // 清理临时文件
            java.nio.file.Files.deleteIfExists(tempFile);
        } catch (IOException | InterruptedException e) {
            e.printStackTrace();
        }
        System.out.println("\n=== Demo Completed ===");
    }
}

8 Maven依赖配置

<!-- pom.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
         http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.example</groupId>
    <artifactId>log-anomaly-detector</artifactId>
    <version>1.0-SNAPSHOT</version>
    <packaging>jar</packaging>
    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>
    <dependencies>
        <!-- 日志框架 -->
        <dependency>
            <groupId>ch.qos.logback</groupId>
            <artifactId>logback-classic</artifactId>
            <version>1.2.11</version>
        </dependency>
        <!-- JSON处理 -->
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.9.0</version>
        </dependency>
        <!-- 邮件发送 -->
        <dependency>
            <groupId>javax.mail</groupId>
            <artifactId>mail</artifactId>
            <version>1.4.7</version>
        </dependency>
        <!-- 单元测试 -->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.13.2</version>
            <scope>test</scope>
        </dependency>
    </dependencies>
    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.8.1</version>
                <configuration>
                    <source>${maven.compiler.source}</source>
                    <target>${maven.compiler.target}</target>
                </configuration>
            </plugin>
        </plugins>
    </build>
</project>

运行说明

编译项目：
```
mvn clean compile
```

运行测试：

mvn exec:java -Dexec.mainClass="com.example.logdetector.Main"

监控真实日志文件：

// 修改日志文件路径
analyzer.startMonitoring("/var/log/application/app.log");

功能特性

检测能力：

错误级别日志检测
异常类型识别
错误频率分析
连续失败模式检测
关键字匹配

告警级别：

CRITICAL: 系统崩溃、资源耗尽
HIGH: 数据库连接失败、死锁
MEDIUM: 性能问题、警告
INFO: 普通信息

扩展功能：

实时日志监控
邮件/SMS告警
异常统计报告
日志存储与查询

这个案例展示了完整的Java日志异常检测系统,可以直接运行和扩展使用。

本文地址： https://www.bmjup.com/post/34202.html