System and method for analyzing large number of logs

Abstract

The invention discloses a system and a method for analyzing a large number of logs. The system comprises a task node cluster, management nodes and a database. The task node cluster comprises at least one task node which is used for collecting, storing and analyzing a large number of log files in a distributed type. The management nodes are used for formulating collecting strategies, carrying out dispatching management on the task node cluster, finishing distributed memory and analysis and writing final log analysis results and audit information in the database. The system for analyzing a large number of the logs is capable of high efficiently analyzing and storing a large number of the logs in a large scale network environment, and reliability and effectiveness of carrying out safe audit on the logs are improved.

Description

technical field [0001] The present invention relates to a log analysis system and method, in particular to a system and method for analyzing massive logs in a large complex network. Background technique [0002] At present, the number and types of threats to key information resources in the network environment are increasing sharply. How to make timely and active responses to network attacks has become a research hotspot in the field of network security in recent years. Assessing network security posture by analyzing log files has become more and more widely accepted. However, the current log analysis system is usually composed of a log collection agent and an analysis management system, which can perform security analysis on logs with a small amount of data, but in the face of massive log files in large and complex networks, it works in the form of a tool It cannot be well qualified for collection and analysis tasks, and lacks a comprehensive analysis of the overall log da...

AI Technical Summary

Problems solved by technology

However, the current log analysis system is usually composed of a log collection agent and an analysis management system, which can perform security analysis on logs with a small amount of data, but in the face of massive log files in large and complex networks, it works in the form of a tool It cannot be well qualified for collection and analysis tasks, and lacks a comprehensive analysis of the overall log data, and cannot make the network as a whole to deal with security incidents; and in large-scale networks, due to the complexity of the network, other network security devices, load balancing Equipment brings many uncertain factors, and it also requires stronger collection and analysis capabilities, and a more flexible log analysis system to deploy

Images