The invention discloses a log real time monitoring and early warning method and a device employing the same. The log real time monitoring and early warning method comprises the following steps: server logs are collected; the collected server logs are aggregated and gathered according to predetermined time and predetermined businesses, and the aggregated and collected server logs are subjected to incremental computation at an interval of the predetermined time; by referring to preset threshold values, whether to issue early warnings is determined according to incremental computation results. According to the log real time monitoring and early warning method and the device employing the same, via use of a continuous real time incremental computation mode, monitoring and early warning that are high in timeliness and accuracy and low in computation cost are realized.