Distributed DNS inquiry log real-time statistic device and method thereof

Abstract

The invention provides a distributed DNS inquiry log real-time statistic device. The device comprises a site log server and a center log server, wherein the site log server comprises a data receiving processing module used for receiving a DNS request of the current site and extracting statistic object data of the logs from the DNS request, a statistic module used for counting the statistic objectdata of the logs in real time and buffering the corresponding statistic results, and a response module used for responding to a real-time log inquiry request of the center log server and feeding the statistic results corresponding to the request back to the center log server; and the center log server is used for collecting and processing the statistic results fed back by the log servers of all sites. The device can realize the global and huge data quantity real-time statistic analysis of the inquired logs based on the distributed type structure of the DNS.

Description

Technical field [0001] The invention relates to the field of network communication, in particular to a real-time statistical device for distributed DNS query logs and a real-time statistical method for distributed DNS query logs. Background technique [0002] DNS (Domain Name System, Domain Name System) is a core service provided by Internet infrastructure. The system includes a distributed database that maps domain names and IP addresses to each other, and can realize the function of domain name and IP address conversion. DNS servers are distributed in various sites of the wide area network to realize distributed network services. When the DNS server is running, it will generate log records of query access to the DNS server. By analyzing these query logs, not only can the current service problems be found, but also various security and specific events in the service process can be tracked. Analyze access attributes and DNS workflow, discover the usage of network resources, and ...

AI Technical Summary

Problems solved by technology

[0004] However, the built-in log function of this DNS server software can only perform single-machine log statistics, and cannot be used to complete global real-time log statistical analysis based on the distributed structure of the DNS system, such as real-time summary statistics of log data and centralized backup, etc.

[0005] At present, the most common method of distributed log statistics is to aggregate the logs of each site to a central log server, and then the central log server will perform statistical calculations on all log data; for some statistics that are easy to calculate, such as query volume For statistics, the global query volume of the distributed system can be obtained in real time by simply adding up the local query volume of each site using the above method, but for some more complex statistical calculations, such as the global Top-k domain name (finding the largest The first k domain names), due to the large amount of domain name data, the DNS query volume is also very large, due to the limitations of server processing performance and transmission performance, the existing site log server and central log server are obviously unable to complete a large number of Data transfer and summary statistics calculation work

Images