A monitoring device and method for monitoring abnormal content of real-time logs

Abstract

The invention discloses a monitoring device and monitoring method for real-time log abnormal content. The device includes: a parameter configuration management module, an alarm notification management module, a log abnormality monitoring management module, an abnormal information inner library management module, and a data storage management module; Wherein, the parameter configuration management module is used for centralized management of all parameters and parameter configurations related to several other modules; the abnormal information internal library management module is used for matching rules for managing abnormal information according to configured parameters / parameter configurations and preprocessing strategies; the log exception monitoring management module mainly completes the filtering, capture, transmission, and storage of log exception content, and the alarm notification management module mainly performs alarm processing; the data storage management module mainly records the operation behaviors of other modules storage. The above method is universal and applicable to log monitoring of various scenarios.

Description

Technical field [0001] The present invention relates to a log information processing technique, and more particularly to a monitoring device and a monitoring method for real-time log abnormal content. Background technique [0002] The current society is already in the information of the information, and a variety of application service procedures are still running on day and night, where in order to ensure the stability operation of the program, maintain the correctness, stability of its services, and developers will apply The service running information is recorded in real time in the form of logs. At the same time, the server, third-party applications, such as middleware, database, operating systems, etc., which can also generate relevant log files, which will generate relevant log files for maintenance. Fast positioning of people. [0003] At present, most of the contents of the log record covers many information, such as interface calling data, program operation, abnormal err...

AI Technical Summary

Problems solved by technology

Most of the existing detection methods and systems based on log collection convert all log data into structured data and store them in database tables. After collecting log data, manual intervention is basically required to capture abnormal content from the database for analysis. , such as Patent Application No. 201010536426.0, "A Log Collection Device and Log Collection Method", this processing method will cause two problems: first, the reading and writing of log data is relatively complicated, resulting in low system performance; second, this This post-event detection method lacks timeliness and cannot meet the real-time capture of abnormal error content in log data, and the processing efficiency is low. With the long-term operation of related systems, the stored log content is getting larger and larger. The capture and analysis of abnormal log content The longer it will take, the higher the operation and maintenance cost and the lower the efficiency, which is seriously contrary to the trend of the current information age

[0004] In addition, most of the detection methods and systems based on real-time log threat monitoring are currently detecting a single type of log content, and cannot adapt to multiple log types, and their versatility is poor.

Images