Audit log storage method and device, electronic equipment and readable storage medium

Abstract

The invention provides an audit log storage method and device, electronic equipment and a readable storage medium, and the method comprises the steps: for each product system, obtaining an audit log from the product system in real time; based on a target application function in the product system to which the audit log belongs and a target time period to which the generation time of the audit log belongs, storing the audit log in a target index corresponding to the target time period under the target application function in the product system in real time; and generating a snapshot of the target index at a specified time point after the target time period, storing the snapshot in a snapshot library, and deleting the target index. Through the method, the storage cost is reduced on the premise of ensuring that the storage deadline of the audit log meets the specification.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a storage method, device, electronic device and readable storage medium for an audit log. Background Art

[0002] In technology products, especially software systems involving sensitive industries such as finance and healthcare, the storage and management of audit logs are key links to ensure data security and compliance. However, in the prior art, hot data storage is usually used to store audit logs, where hot data storage refers to fast real-time storage. This hot data storage method has a high storage cost. And as audit logs continue to accumulate, the storage space in the memory is rapidly consumed. In order to ensure that the storage period of the audit logs meets the regulations, more memory needs to be added, resulting in high storage costs. If you want to reduce storage costs, you need to reduce the number of memories, which makes it impossible to ensure that the storage period of the audit logs meets the regulations. Summary of the invention

[0003] In view of this, the purpose of the present application is to provide a storage method, device, electronic device and readable storage medium for audit logs, so as to reduce storage costs while ensuring that the storage period of the audit logs meets the regulations.

[0004] In a first aspect, an embodiment of the present application provides a method for storing an audit log, the method comprising:

[0005] For each product system, obtain audit logs from the product system in real time;

[0006] Based on the target application function in the product system to which the audit log belongs and the target time period to which the generation time of the audit log belongs, the audit log is stored in real time in the target index corresponding to the target time period under the target application function in the product system;

[0007] At a specified time point after the target time period, a snapshot of the target index is generated, the snapshot is stored in a snapshot library, and the target index is deleted.

[0008] In combination with the first aspect, an embodiment of the present application provides a first possible implementation of the first aspect, wherein the product system is used to determine in real time whether the log is an audit log according to a preset audit log judgment standard when generating a log, and when the log is an audit log, mark the log with a first field value used to represent the audit log, and when the log is not an audit log, mark the log with a second field value used to represent a non-audit log;

[0009] For each product system, the audit log is obtained from the product system in real time, including:

[0010] For each product system, obtain the logs generated by the product system in real time from the product system;

[0011] According to the first field value or the second field value marked in each of the logs obtained in real time, the audit log is filtered out from the logs obtained in real time.

[0012] In combination with the first possible implementation of the first aspect, the embodiment of the present application provides a second possible implementation of the first aspect, wherein the step of filtering out the audit log from each of the logs obtained in real time according to the first field value or the second field value marked in each of the logs obtained in real time includes:

[0013] For each of the logs obtained in real time, regular matching is performed on the log to split the log into multiple field values, and a corresponding key is matched for each field value corresponding to the log;

[0014] Determine a target key for representing a log type from multiple keys, and determine whether a field value corresponding to the target key in the log is the first field value;

[0015] If the field value corresponding to the target key in the log is the first field value, the log is determined to be an audit log.

[0016] In combination with the first aspect, an embodiment of the present application provides a third possible implementation of the first aspect, wherein, after generating a snapshot of the target index at a specified time point after the target time period, storing the snapshot in a snapshot library, and deleting the target index, the method further includes:

[0017] For each snapshot in the snapshot library, monitoring the storage duration of the snapshot;

[0018] When the storage time of the snapshot reaches the preset storage time, the snapshot is deleted from the snapshot library.

[0019] In combination with the third possible implementation of the first aspect, an embodiment of the present application provides a fourth possible implementation of the first aspect, wherein the duration between any time point within the target time period and the specified time point is less than the preset storage duration.

[0020] In a second aspect, an embodiment of the present application further provides a storage device for an audit log, the device comprising:

[0021] An acquisition module is used to acquire audit logs from each product system in real time;

[0022] A first storage module is used to store the audit log in real time into a target index corresponding to the target time period under the target application function in the product system based on the target application function in the product system to which the audit log belongs and the target time period to which the generation time of the audit log belongs;

[0023] The second storage module is used to generate a snapshot of the target index at a specified time point after the target time period, store the snapshot in a snapshot library, and delete the target index.

[0024] In combination with the second aspect, an embodiment of the present application provides a first possible implementation of the second aspect, wherein the product system is used to determine in real time whether the log is an audit log according to a preset audit log judgment standard when generating a log, and when the log is an audit log, mark the log with a first field value used to represent the audit log, and when the log is not an audit log, mark the log with a second field value used to represent a non-audit log;

[0025] When the acquisition module is used to acquire the audit log from each product system in real time, the acquisition module is specifically used to:

[0026] For each product system, obtain the logs generated by the product system in real time from the product system;

[0027] According to the first field value or the second field value marked in each of the logs obtained in real time, the audit log is filtered out from the logs obtained in real time.

[0028] In combination with the first possible implementation of the second aspect, the embodiment of the present application provides a second possible implementation of the second aspect, wherein the acquisition module is used to filter out the audit log from each of the logs acquired in real time according to the first field value or the second field value marked in each of the logs acquired in real time, and is specifically used to:

[0029] For each of the logs obtained in real time, regular matching is performed on the log to split the log into multiple field values, and a corresponding key is matched for each field value corresponding to the log;

[0030] Determine a target key for representing a log type from multiple keys, and determine whether a field value corresponding to the target key in the log is the first field value;

[0031] If the field value corresponding to the target key in the log is the first field value, the log is determined to be an audit log.

[0032] In combination with the second aspect, the embodiment of the present application provides a third possible implementation of the second aspect, wherein the device further includes:

[0033] a monitoring module, configured to generate a snapshot of the target index at a specified time point after the target time period by the second storage module, store the snapshot in a snapshot library, and monitor the storage duration of each snapshot in the snapshot library after deleting the target index;

[0034] The deleting module is used to delete the snapshot from the snapshot library when the storage time of the snapshot reaches a preset storage time.

[0035] In combination with the third possible implementation of the second aspect, an embodiment of the present application provides a fourth possible implementation of the second aspect, wherein the duration between any time point within the target time period and the specified time point is less than the preset storage duration.

[0036] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps in any possible implementation of the first aspect above are performed.

[0037] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in any possible implementation of the first aspect described above are executed.

[0038] The storage method, device, electronic device and readable storage medium of the audit log provided by the embodiment of the present application, wherein in the method, the audit log is obtained from the product system in real time, and then based on the target application function in the product system to which the audit log belongs and the target time period to which the generation time of the audit log belongs, the audit log is stored in real time (i.e., hot storage) in the target index corresponding to the target time period under the target application function in the product system. At a specified time point after the target time period, a snapshot of the target index is generated, and the snapshot is stored in the snapshot library, and the target index is deleted. In this embodiment, after the audit log obtained in real time is temporarily stored by the storage method of hot storage, the temporarily stored audit log is transferred to the snapshot library for long-term storage. Among them, since the storage cost of snapshot storage is lower than the storage cost of hot storage, the storage method of this embodiment can not only ensure the real-time storage by the storage method of hot storage, but also reduce the storage cost by transferring to snapshot storage while ensuring that the storage period of the audit log meets the regulations.

[0039] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 A flowchart of a method for storing an audit log provided in an embodiment of the present application is shown;

[0042] Figure 2 A schematic diagram showing the interaction between a product system, a log system, a scheduling platform and a snapshot library provided in an embodiment of the present application is shown;

[0043] Figure 3 A schematic diagram of the structure of a storage device for an audit log provided in an embodiment of the present application is shown;

[0044] Figure 4 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0045] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0046] Considering that in the prior art, audit logs are usually stored in a hot data storage method, where hot data storage refers to fast real-time storage, and the storage cost of this hot data storage method is relatively high. And as the audit logs continue to accumulate, the storage space in the memory is rapidly consumed. In order to ensure that the storage period of the audit logs meets the regulations, more memories need to be added, resulting in high storage costs. If you want to reduce the storage cost, you need to reduce the number of memories, so that it is impossible to ensure that the storage period of the audit logs meets the regulations. Based on this, the embodiments of the present application provide a storage method, device, electronic device and readable storage medium for an audit log, so as to ensure the real-time storage through the hot storage storage method, and can also reduce the storage cost by transferring it to a snapshot storage method while ensuring that the storage period of the audit logs meets the regulations. The following is described through an embodiment.

[0047] To facilitate understanding of this embodiment, a storage method of an audit log disclosed in an embodiment of the present application is first described in detail. Figure 1 As shown, the method includes the following steps S101-S103:

[0048] S101: For each product system, obtain an audit log from the product system in real time.

[0049] In this embodiment, each technology product corresponds to its own product system, where the technology product is, for example, a bank APP. The audit log usually records the user's operation actions when using the technology product in chronological order, such as login operations, transfer operations, etc.

[0050] In a possible implementation, there are multiple types of logs generated in the product system, and the audit log is only one of them. Figure 2 As shown, for each product system, when generating a log, the product system is used to determine in real time whether the log is an audit log according to a preset audit log judgment standard. When the log is an audit log, the log is marked with a first field value used to indicate an audit log, and when the log is not an audit log, the log is marked with a second field value used to indicate a non-audit log. The first field value is AUDIT, and the second field value is NORMAL.

[0051] In this embodiment, the pre-set audit log judgment criteria can be the trigger operation information (i.e., start) and result information (i.e., result) of the user's operation. For example, taking the business operation of transfer as an example, the user needs to first click transfer - then select the account - enter the amount - enter the password - transfer is completed, and the audit log only records the two actions of "click transfer - transfer completed".

[0052] When executing step S101, the following steps S1011-S1012 may be specifically performed:

[0053] S1011: For each product system, a log generated by the product system is obtained from the product system in real time.

[0054] In this embodiment, if Figure 2 As shown, after the product system generates logs and marks the logs in real time according to the types of the logs (the types include audit logs and non-audit logs), the log system obtains the marked logs from the product system in real time.

[0055] S1012: Filter out audit logs from the logs obtained in real time according to the first field value or the second field value marked in each log obtained in real time.

[0056] In this embodiment, the log system filters out the audit log from each log obtained in real time according to the first field value or the second field value marked in each log obtained in real time.

[0057] In a possible implementation, a log is usually unformatted data, and a plurality of field values ​​are usually recorded in the log. For example, a log is: 2020 / 5 / 8, L, AUDIT.

[0058] When executing step S1012, the log system may specifically execute the following steps S10121-S10123:

[0059] S10121: For each log obtained in real time, regular expression matching is performed on the log to split the log into multiple field values, and a corresponding key is matched for each field value corresponding to the log.

[0060] In this embodiment, for each log obtained by the log system in real time, the log system divides the log into multiple field values ​​according to the separator in the log.

[0061] For example, when the log is "2020 / 05 / 08, L, AUDIT", assuming that the comma is the delimiter, then three field values ​​are obtained after the log is split, namely: "2020 / 05 / 08", "L", and "AUDIT".

[0062] After matching the corresponding keys for each field value corresponding to the log, the formatted data is obtained as follows: "Time: 2020 / 05 / 08; Server: L; Log type: AUDIT. Among them, "Time", "Server", and "Log type" are all matched keys, and "2020 / 05 / 08", "L", and "AUDIT" are the field values.

[0063] S10122: Determine a target key for characterizing the log type from the multiple keys, and determine whether a field value corresponding to the target key in the log is the first field value.

[0064] S10123: If the field value corresponding to the target key in the log is the first field value, the log is determined to be an audit log.

[0065] In the above example, the target key is "log type", and the field value corresponding to the target key "log type" in the log is AUDIT, which is the first field value. At this time, the log can be determined as an audit log.

[0066] If the field value corresponding to the target key in the log is the second field value, the log is determined to be a non-audit log.

[0067] S102: Based on the target application function in the product system to which the audit log belongs and the target time period to which the audit log is generated, the audit log is stored in real time in a target index corresponding to the target time period under the target application function in the product system.

[0068] In this embodiment, each target application function under each product system corresponds to a target index in different target time periods. The index name format of the target index can be: product system name + target application function name + first field value + target time period. Among them, the target time period can be one day, one week, or one month, which is not limited in this application.

[0069] Taking the target time period as one day as an example, the target time period can be from 24:00 on May 7, 2020 to 24:00 on May 8, 2020. At this time, the target index stores all audit logs generated by the target application function under the product system during the target time period.

[0070] The target application function is a function under the product system. For example, when the product system is a bank APP, the target application function can be a transfer function in the bank APP.

[0071] S103: At a specified time point after the target time period, a snapshot of the target index is generated, the snapshot is stored in a snapshot library, and the target index is deleted.

[0072] In this embodiment, the storage method of storing the audit log in real time in the target index corresponding to the target time period under the target application function in the product system is essentially a hot data storage method. This storage method has a high storage cost. As the number of audit logs accumulates, the storage space required will become larger and larger, thereby making the storage cost higher and higher.

[0073] Based on this, in this embodiment, exemplarily, when the target time period is from 24:00 on 2020 / 05 / 07 to 24:00 on 2020 / 05 / 08, the specified time period may be a time point after 24:00 on 2020 / 05 / 08, for example, the specified time point corresponding to the target time period may be 2:00 a.m. on 2020 / 05 / 09. Before the specified time point, the audit logs generated by the target application service under the product system in the target time period are stored in the target index. When the specified time point is reached, the scheduling platform generates a snapshot of the target index, and stores (that is, transfers) the snapshot to the snapshot library, and deletes the target index at the same time. Among them, since the storage cost of the snapshot storage method is lower than the storage cost of the real-time storage method (i.e., the hot storage method), therefore, after the audit log is stored in the snapshot library by means of a snapshot, the audit log stored by the real-time storage method (i.e., the audit log stored in the target index) is deleted, which can save the storage space of the real-time storage method (i.e., the hot storage method), thereby reducing the storage cost of the hot storage method.

[0074] In a possible implementation manner, after executing step S103, the following steps may also be performed:

[0075] For each snapshot in the snapshot library, monitor the storage duration of the snapshot;

[0076] When the storage duration of the snapshot reaches the preset storage duration, the snapshot is deleted from the snapshot library.

[0077] In this embodiment, according to the audit regulations, the scheduling platform is used to regularly execute the audit log snapshot lifecycle management script to automatically delete the audit logs that exceed the preset storage time in the snapshot library to ensure the compliance and efficiency of data management. The preset storage time can be 180 days.

[0078] In this embodiment, the audit log is only temporarily stored in the target index, and is stored for a long time in the snapshot library. Therefore, the duration between any time point in the target time period and the specified time point is less than the preset storage duration. For example, when the target time period is from 24:00 on 2020 / 05 / 07 to 24:00 on 2020 / 05 / 08, and the specified time point is 2:00 a.m. on 2020 / 05 / 09, the longest duration between the target time period and the specified time point is the duration between 24:00 on 2020 / 05 / 07 to 2:00 a.m. on 2020 / 05 / 09, that is, 26 hours, which is less than the preset storage duration (e.g., 180 days).

[0079] Based on the same technical concept, the present application also provides a storage device for audit logs, such as Figure 3 As shown, the device comprises:

[0080] The acquisition module 301 is used to acquire the audit log from each product system in real time;

[0081] The first storage module 302 is used to store the audit log in real time into a target index corresponding to the target time period under the target application function in the product system based on the target application function in the product system to which the audit log belongs and the target time period to which the generation time of the audit log belongs;

[0082] The second storage module 303 is used to generate a snapshot of the target index at a specified time point after the target time period, store the snapshot in a snapshot library, and delete the target index.

[0083] Optionally, the product system is used to determine in real time whether the log is an audit log according to a preset audit log judgment standard when generating a log, and when the log is an audit log, mark the log with a first field value used to indicate an audit log, and when the log is not an audit log, mark the log with a second field value used to indicate a non-audit log;

[0084] When the acquisition module 301 is used to acquire the audit log from each product system in real time, it is specifically used to:

[0085] For each product system, obtain the logs generated by the product system in real time from the product system;

[0086] According to the first field value or the second field value marked in each of the logs obtained in real time, the audit log is filtered out from the logs obtained in real time.

[0087] Optionally, when the acquisition module 301 is used to filter out the audit log from each of the logs acquired in real time according to the first field value or the second field value marked in each of the logs acquired in real time, it is specifically used to:

[0088] For each of the logs obtained in real time, regular matching is performed on the log to split the log into multiple field values, and a corresponding key is matched for each field value corresponding to the log;

[0089] Determine a target key for representing a log type from multiple keys, and determine whether a field value corresponding to the target key in the log is the first field value;

[0090] If the field value corresponding to the target key in the log is the first field value, the log is determined to be an audit log.

[0091] Optionally, the device further comprises:

[0092] A monitoring module, configured to generate a snapshot of the target index at a specified time point after the target time period by the second storage module 303, store the snapshot in a snapshot library, and monitor the storage duration of each snapshot in the snapshot library after deleting the target index;

[0093] The deleting module is used to delete the snapshot from the snapshot library when the storage time of the snapshot reaches a preset storage time.

[0094] Optionally, the duration between any time point in the target time period and the specified time point is shorter than the preset storage duration.

[0095] Figure 4 A structural diagram of an electronic device provided for an embodiment of the present application includes: a processor 401, a memory 402 and a bus 403, wherein the memory 402 stores machine-readable instructions executable by the processor 401. When the electronic device runs the above-mentioned information processing method, the processor 401 communicates with the memory 402 through the bus 403, and the processor 401 executes the machine-readable instructions to perform the method steps described in Example 1.

[0096] The embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the method steps described in the first embodiment are executed.

[0097] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices, electronic devices, and computer-readable storage media can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0098] In the several embodiments provided in the present application, it should be understood that the disclosed methods, devices, electronic devices and computer-readable storage media can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or modules can be electrical, mechanical or other forms.

[0099] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0100] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0101] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0102] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for storing an audit log, characterized in that: The method comprises: For each product system, obtain audit logs from the product system in real time; Based on the target application function in the product system to which the audit log belongs and the target time period to which the generation time of the audit log belongs, the audit log is stored in real time in the target index corresponding to the target time period under the target application function in the product system; At a specified time point after the target time period, a snapshot of the target index is generated, the snapshot is stored in a snapshot library, and the target index is deleted.

2. The method according to claim 1, characterized in that: The product system is used to determine in real time whether the log is an audit log according to a preset audit log judgment standard when generating a log, and when the log is an audit log, mark the log with a first field value used to indicate an audit log, and when the log is not an audit log, mark the log with a second field value used to indicate a non-audit log; For each product system, the audit log is obtained from the product system in real time, including: For each product system, obtain the logs generated by the product system in real time from the product system; According to the first field value or the second field value marked in each of the logs obtained in real time, the audit log is filtered out from the logs obtained in real time.

3. The method according to claim 2, characterized in that: The step of filtering out the audit log from each of the logs obtained in real time according to the first field value or the second field value marked in each of the logs obtained in real time includes: For each of the logs obtained in real time, regular matching is performed on the log to split the log into multiple field values, and a corresponding key is matched for each field value corresponding to the log; Determine a target key for representing a log type from multiple keys, and determine whether a field value corresponding to the target key in the log is the first field value; If the field value corresponding to the target key in the log is the first field value, the log is determined to be an audit log.

4. The method according to claim 1, characterized in that: After generating a snapshot of the target index at a specified time point after the target time period, storing the snapshot in a snapshot library, and deleting the target index, the method further includes: For each snapshot in the snapshot library, monitoring the storage duration of the snapshot; When the storage time of the snapshot reaches the preset storage time, the snapshot is deleted from the snapshot library.

5. The method according to claim 4, characterized in that: The duration between any time point within the target time period and the specified time point is less than the preset storage duration.

6. A storage device for an audit log, characterized in that: The device comprises: An acquisition module is used to acquire audit logs from each product system in real time; A first storage module is used to store the audit log in real time into a target index corresponding to the target time period under the target application function in the product system based on the target application function in the product system to which the audit log belongs and the target time period to which the generation time of the audit log belongs; The second storage module is used to generate a snapshot of the target index at a specified time point after the target time period, store the snapshot in a snapshot library, and delete the target index.

7. The device according to claim 6, characterized in that: The product system is used to determine in real time whether the log is an audit log according to a preset audit log judgment standard when generating a log, and when the log is an audit log, mark the log with a first field value used to indicate an audit log, and when the log is not an audit log, mark the log with a second field value used to indicate a non-audit log; When the acquisition module is used to acquire the audit log from each product system in real time, the acquisition module is specifically used to: For each product system, obtain the logs generated by the product system in real time from the product system; According to the first field value or the second field value marked in each of the logs obtained in real time, the audit log is filtered out from the logs obtained in real time.

8. The device according to claim 7, characterized in that: When the acquisition module is used to filter out the audit log from each of the logs acquired in real time according to the first field value or the second field value marked in each of the logs acquired in real time, it is specifically used to: For each of the logs obtained in real time, regular matching is performed on the log to split the log into multiple field values, and a corresponding key is matched for each field value corresponding to the log; Determine a target key for representing a log type from multiple keys, and determine whether a field value corresponding to the target key in the log is the first field value; If the field value corresponding to the target key in the log is the first field value, the log is determined to be an audit log.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the method as claimed in any one of claims 1 to 5 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are executed.

Images