A key field-based switch log rapid aggregation method

Abstract

The invention relates to a key field-based switch log rapid aggregation method. The method comprises the steps of: S1, establishing a switch log key field set and a key field value extracting method; S2, performing log aggregation analysis: establishing a cluster set which includes {key fields, the key field value set}, performing initialization of a log aggregation analysis module and processing single log records with switches as units to obtain a classification set; S3, performing log aggregation result output, wherein a log output module processes the classification set and outputs log records meeting output conditions. The log rapid aggregation method can aggregate log records containing identical event information or similar log information, reduce log output entries, and facilitate rapid analysis of network operation and maintenance staff.

Description

Technical field [0001] The invention belongs to the field of electric power information network, and specifically relates to a method for fast aggregation of switch logs based on key fields. Background technique [0002] The scale of power information network is expanding day by day, and the number of switch equipment in the network is increasing. A large amount of event information will be generated during the operation of the switch. The event information includes a wealth of data such as switch operation status, user operations, and potential security alarms. The timely and effective analysis of switch logs can help network operation and maintenance personnel to grasp the switch operation status and potential security risks in a timely manner, and adopt corresponding treatment measures. However, the switch log system will give a large number of similar logs for the same event or the same type of event in a short period of time. At the same time, some switch operations or event...

AI Technical Summary

Problems solved by technology

However, the switch log system will give a large number of similar logs for the same event or the same type of event in a short period of time. At the same time, some switch operations or events will occur frequently in a short period of time. For example, a large number of ssh login attempts in a short period of time will cause Multiple switch login failure logs; for a large number of log information, if relying on manual analysis one by one, it is time-consuming and labor-intensive, and at the same time it is impossible to grasp the correlation information between logs

Images