Log real time monitoring and early warning method and device employing same

Abstract

The invention discloses a log real-time monitoring and early warning method and its device. The log real-time monitoring and early warning method comprises the following steps: collecting server logs; aggregating and summarizing the collected server logs according to predetermined time and business; Incremental calculations are performed according to the aggregated server logs; and the pre-set threshold is used to determine whether to issue an early warning based on the results of incremental calculations. The present invention realizes the monitoring and early warning with high timeliness, high accuracy and low calculation cost through the continuous real-time incremental calculation mode.

Description

technical field [0001] The invention relates to the field of server logs, in particular to a method and device for real-time monitoring and early warning of logs. Background technique [0002] With the continuous expansion of the scale of the Internet and the increasing number of applications, the Internet has penetrated into all aspects of our lives, bringing great convenience to our daily lives. In order to protect the security of system servers, many enterprises have adopted effective security measures such as firewalls, intrusion detection and virus protection systems. However, with the development of computer technology, intrusion and attack methods are becoming increasingly sophisticated, and even the best security measures cannot ensure the absolute security of the server system. Therefore, in order to easily and quickly discover the attack behavior and take measures when the server is attacked, various systems can be used to record the logs of the events that occur....

AI Technical Summary

Problems solved by technology

This method has the following disadvantages: (1) Because it is a fixed slice, it must be calculated after each natural hour, the threshold value judgment and early warning, and the timeliness is poor. If the first 10 minutes of this natural hour has exceeded The threshold setting of one hour must also wait until one hour before the warning, (2) When two consecutive time slices form an area, for example, two hour time slices at 4:00 and 5:00, 4:30 to 5:00 The service volume between 30 and 30 exceeds the threshold setting of one hour, but the service data of both of them does not exceed the threshold range setting of their respective time slices, and there will be no early warning, which leads to poor accuracy of early warning and will be missed Abnormal events, (c) If the above two problems are solved by calculating per second, because the calculation cost is too high, it cannot be widely used in actual application scenarios, and the practicability is not high

Images