Method and device for collecting log

Abstract

The embodiment of the invention relates to a method and a device for collecting a log. The method comprises the following steps: reading at least one log knowledge module from a log knowledge module list by a log client side; executing the log knowledge module, analyzing a log file of the corresponding operation system or application system, and collecting target content information of the log file; and transmitting the collected target content information to a log server side. Therefore, the comprehensiveness and applicability of collected information can be improved; the collection method is simple; and the collection efficiency can be greatly improved.

Description

technical field [0001] The invention relates to the field of information technology, in particular to a log collection method and device. Background technique [0002] The operating system (such as Windows, Linux, etc.) on the server and the running applications have corresponding log files, the operating system has system log files, and the application system has application log files. The log file records information such as server startup, shutdown, user login, and application running. Collecting information in system log files and application log files plays an important role in analyzing server system performance, application performance, or diagnosing server system failures and application failures. [0003] In the prior art, the modes of collecting log files mainly include: a collection mode based on Simple Network Management Protocol (Simple Network Management Protocol, SNMP) trap (Trap), a collection mode based on System Log (SystemLog, Syslog) protocol, and a coll...

AI Technical Summary

Problems solved by technology

However, because the collection method based on SNMPTrap is based on event-driven, the agent only notifies the management system when it detects a fault, and the non-fault information will not be notified to the management system. As a result, the information obtained by the management system is not comprehensive. In addition, This method can only be carried out based on the SNMP protocol, and the format of the collected messages needs to be defined separately, which has certain limitations; the method based on the Syslog protocol uses the User Datagram Protocol (UserDatagramProtocol, UDP) as the transmission protocol, and can receive messages from the remote system. Log files, however, in this method, most applications write logs in a custom way and do not support the Syslog protocol, so usually this method cannot obtain information about log files of various types of operating systems or application systems; Telnet-based In this method, you need to log in to the managed terminal remotely, obtain the log file information through commands, and then send the log file information to the receiver through email or File Transfer Protocol (FTP). However, this method requires remote management Login information, and need to use mail server or FTP server, there are problems of poor security and complicated sending methods

[0004] To sum up, the log collection method in the prior art has the problems of incomplete collected information, poor applicability and complicated collection methods

Images