Monitoring device and method for real-time log abnormal content

Abstract

The invention discloses a monitoring device and method for real-time log abnormal content. The device comprises a parameter configuration management module, an alarm notice management module, a log anomaly monitoring management module, an abnormal information memory management module and a data storage management module, wherein the parameter configuration management module is used for performingcentralized management on all parameters and parameter configuration relevant to other modules; the abnormal information memory management module is used for managing matching rules and preprocessingstrategies of abnormal information according to the configured parameters / parameter configuration; the log anomaly monitoring management module mainly completes filtering, capture, transmission and saving of the log abnormal content; the alarm notice management module mainly performs alarm processing; and the data storage management module mainly records and stores operation behaviors of other modules. The method has universality and is applicable to log monitoring of various scene types.

Description

technical field [0001] The invention relates to a log information processing technology, in particular to a monitoring device and a monitoring method for real-time log abnormal content. Background technique [0002] The current society is already in the era of information-based big data, and various application service programs are running day and night. Among them, in order to ensure the stable operation of the program and maintain the correctness and stability of its services, developers will use the application The running information of the service is recorded in real time and continuously in the form of logs. At the same time, the servers and third-party applications that the application service programs depend on, such as middleware, databases, operating systems, etc., will also generate related log files for maintenance The personnel can quickly locate the problem. [0003] At present, the content of most log records covers various information, such as: interface cal...

AI Technical Summary

Problems solved by technology

Most of the existing detection methods and systems based on log collection convert all log data into structured data and store them in database tables. After collecting log data, manual intervention is basically required to capture abnormal content from the database for analysis. , such as Patent Application No. 201010536426.0, "A Log Collection Device and Log Collection Method", this processing method will cause two problems: first, the reading and writing of log data is relatively complicated, resulting in low system performance; second, this This post-event detection method lacks timeliness and cannot meet the real-time capture of abnormal error content in log data, and the processing efficiency is low. With the long-term operation of related systems, the stored log content is getting larger and larger. The capture and analysis of abnormal log content The longer it will take, the higher the operation and maintenance cost and the lower the efficiency, which is seriously contrary to the trend of the current information age

[0004] In addition, most of the detection methods and systems based on real-time log threat monitoring are currently detecting a single type of log content, and cannot adapt to multiple log types, and their versatility is poor.

Images