Log parsing method and log parsing node device

Abstract

The invention discloses a log parsing method and a log parsing node device, used for providing a high-efficiency strong-adaptability log parsing scheme. The method comprises the steps that a parsing node obtains a log and offset to be matched for indicating unparsed contents in the log; the parsing node parses the unparsed contents indicated by the offset to be matched by using a stored first regular expression so as to obtain field information matched with the first regular expression; the parsing node judges whether a subordinate parsing node exists; if judgment results shows no subordinate parsing node exists and event type information is pre-stored in the parsing node, the parsing node considers the event type information as the event type information of an event recorded in the log, wherein the event type information is determined according to the field information which can be parsed from the log by a regular expression stored in at least one parsing node included in a route along which the log is transmitted to the parsing node.

Description

technical field [0001] The invention relates to the fields of network information security and network management, in particular to a log parsing method and log parsing node equipment. Background technique [0002] A system log (Syslog) is a log widely used in a network environment, which can be officially supported by various operating systems, network devices, and security devices. For other types of logs, in practical applications, they are often converted into Syslog format through a log converter, which facilitates unified collection, management, and analysis. [0003] Syslog is a log with a very loose and free format. In fact, except for the mandatory requirement that the length of Syslog cannot exceed 1024 bytes, there are almost no other mandatory requirements for Syslog. Because the format of Syslog is very loose and free, there are huge differences in the format of Syslogs generated by different manufacturers or even different products of the same manufacturer. T...

AI Technical Summary

Problems solved by technology

However, the problem is: after receiving a log, how to determine which regular expression is appropriate, so how to quickly determine the format of the log and select the corresponding regular expression for parsing is the key point in the log parsing process. a difficulty

Therefore, devices that use the keyword method for log analysis often have to implement corresponding keyword extraction logic for the classification methods of mainstream manufacturers, and there are problems in scalability and adaptability.

Images