Log storage method and system, and electronic device

Abstract

The present application discloses a log storage method, a system, and an electronic device. The method includes: dividing a plurality of logs received within a P-th preset period based on a preset priority policy to obtain a sorted data set; determining whether the total amount of the sorted data set is greater than a preset storage threshold N of a database. If not, writing the sorted data set into the database; if so, writing the first N logs in the sorted data set into the database, and storing the remaining logs in a preset circular queue; recording the logs stored in the preset circular queue as a buffered log set; determining whether the number of the buffered log sets is greater than a preset storage threshold. If so, implementing a first policy; if not, implementing a second policy. This method can ensure the timely and effective storage of logs with higher priorities, that is, important logs, prevent log loss, reduce the storage pressure on the database, and improve the storage efficiency when reaching the storage performance bottleneck of the database.

Description

Technical Field

[0001] The present disclosure relates to the technical field of database log storage, and particularly to a log storage method, a system, and an electronic device. Background Art

[0002] As important data, logs play a very crucial role in facilitating users to timely track the working status of the system and conduct centralized and visual comprehensive audit and analysis of devices and systems.

[0003] With the continuous upgrade of devices and systems, the log storage volume is increasing. Currently, it is common to store logs in a database, that is, store logs according to the database writing performance. However, when the writing speed of the database is exceeded, log loss will occur, and the stored data lacks consistency and integrity, resulting in the data in the database no longer accurately reflecting the actual operations; when a failure or error occurs, due to the loss of logs, it will be very difficult or impossible to perform effective fault recovery, and it may be necessary to perform a full database backup and recovery, resulting in the loss of other data, business suspension, and even long-term downtime for database reconstruction; in addition, if the lost logs are very important for security compliance and audit tracking, due to the loss of logs, the behavior of the database cannot be accurately traced and audited, which may violate compliance requirements or miss important security events. Summary of the Invention

[0004] In view of this, embodiments of the present disclosure provide a log storage method, a system, and an electronic device, which can solve the problem of log loss when logs are stored in a database in the prior art.

[0005] In a first aspect, embodiments of the present disclosure provide a log storage method, including:

[0006] S100, based on a preset priority policy, divide a number of logs received within the P-th preset period to obtain a sorted data set;

[0007] Judge whether the total amount of the sorted data set is greater than a preset storage threshold N of the database. If not, write the sorted data set into the database;

[0008] If so, write the first N logs in the sorted data set into the database, and store the remaining logs in a preset circular queue;

[0009] S200, record the logs stored in the preset circular queue as a buffered log set;

[0010] Judge whether the number of the buffered log set is greater than the preset storage threshold. If so, execute a first strategy;

[0011] If not, execute a second strategy.

[0012] Optionally, the preset priority policy includes several priority lists set by polling;

[0013] The priority list includes AV security engine logs, access control logs, IPS security engine logs, and configuration management logs with decreasing priorities in sequence.

[0014] Optionally, the numbers of AV security engine logs, access control logs, IPS security engine logs, and configuration management logs in each round of the priority list are F1, F2, F3, and F4 respectively;

[0015] 0 ≤ F1 ≤ 4;

[0016] 0 ≤ F2 ≤ 3;

[0017] 0 ≤ F3 ≤ 2;

[0018] 0 ≤ F4 ≤ 1.

[0019] Optionally, the dividing the several logs received within the Pth preset period to obtain a sorted data set includes:

[0020] Obtaining the type information of the several logs;

[0021] Sorting the type information according to the preset priority policy to obtain the sorted data set;

[0022] Among them, the type information includes one or more of AV security engine logs, access control logs, IPS security engine logs, and configuration management logs.

[0023] Optionally, the executing the first policy includes:

[0024] S300, writing the first N logs in the buffered log set into the database in the (P + 1)th preset period;

[0025] Storing the logs received in the (P + 1)th preset period into the preset circular queue according to the preset priority policy;

[0026] S400, setting P = P + 1, and returning to execute S200.

[0027] Optionally, the executing the second policy includes:

[0028] S500, writing the buffered log set into the database in the (P + 1)th preset period;

[0029] S600, judging whether the amount of logs received in the (P + 1)th preset period is greater than a first preset value. If not, writing the logs received in the (P + 1)th preset period into the database in the (P + 1)th preset period;

[0030] If so, write the first M logs received in the (P + 1)-th preset period into the database, store the remaining logs in a preset circular queue, and execute S400;

[0031] Wherein, the first preset value is M.

[0032] Optionally, the first preset value is the difference between the preset storage threshold and the total amount of the remaining logs in the P-th preset period;

[0033] The total amount of the remaining logs in the P-th preset period is the difference between the total amount of a plurality of logs received in the P-th preset period and the preset storage threshold.

[0034] In a second aspect, the present application discloses a log storage system, including:

[0035] An obtaining module, configured to divide a plurality of logs received in the P-th preset period based on a preset priority policy to obtain a sorted data set;

[0036] A first judgment module, configured to judge whether the total amount of the sorted data set is greater than the preset storage threshold of the database. If not, write the sorted data set into the database; the preset storage threshold is N;

[0037] If so, write the first N logs in the sorted data set into the database, and store the remaining logs in a preset circular queue;

[0038] A transition module, configured to record the logs stored in the preset circular queue as a buffered log set;

[0039] A second judgment module, configured to judge whether the number of the buffered log set is greater than the preset storage threshold. If so, execute a first policy;

[0040] If not, execute a second policy.

[0041] In a third aspect, an embodiment of the present disclosure further provides an electronic device, adopting the following technical solution:

[0042] The electronic device includes:

[0043] At least one processor; and

[0044] A memory communicatively connected to the at least one processor; wherein

[0045] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the above log storage methods.

[0046] Fourthly, embodiments of the present disclosure further provide a computer-readable storage medium storing computer instructions for causing a computer to execute the log storage method described in any one of the above.

[0047] The log storage method disclosed in this application classifies the received logs according to a preset priority policy to obtain a sorted data set sorted according to the priority level. When the database storage performance bottleneck is reached, it can ensure the timely and effective storage of the logs with higher priority, that is, important logs, prevent log loss, reduce the storage pressure of the database, and improve the storage efficiency. Then, the logs with relatively lower priority are temporarily stored in a preset circular queue. After the log writing speed of the database returns to normal, the logs stored in the preset circular queue are written into the database again, which can not only meet the storage requirements of the database, not affect the storage efficiency of the database, ensure the effective utilization of the real-time storage space of the database, but also ensure the writing of all logs into the database ultimately, effectively improving the storage efficiency of database logs and the comprehensive integrity of data storage.

[0048] The above description is only an overview of the technical solution of the present disclosure. In order to understand the technical means of the present disclosure more clearly, it can be implemented according to the content of the specification. In order to make the above and other purposes, features and advantages of the present disclosure more obvious and understandable, the following specifically enumerates preferred embodiments and describes them in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required to be used in the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present disclosure. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0050] Figure 1 It is a flowchart of the log storage method in this application.

[0051] Figure 2 For Figure 1 It is a flowchart of the method for obtaining the sorted data set in

[0052] Figure 3 For Figure 1 It is a flowchart of the method for executing the first strategy in

[0053] Figure 4 For Figure 1 It is a flowchart of the method for executing the second strategy in

[0054] Figure 5 It is a flowchart of a specific embodiment of the log storage method in this application.

[0055] Figure 6 This is a schematic block diagram of the log storage system provided by the embodiments of the present disclosure.

[0056] Figure 7 This is a schematic structural diagram of an electronic device provided by the embodiments of the present disclosure. Detailed implementation manners

[0057] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0058] It should be clear that the following uses specific specific examples to illustrate the implementation manners of the present disclosure. Those skilled in the art can easily understand the other advantages and effects of the present disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. The present disclosure can also be implemented or applied through other different specific implementation manners. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that, without conflict, the following embodiments and the features in the embodiments can be combined with each other. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present disclosure without making creative efforts belong to the scope of protection of the present disclosure.

[0059] It should be noted that the following describes various aspects of the embodiments within the scope of the appended claims. It should be obvious that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is illustrative only. Based on the present disclosure, those skilled in the art should understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, this device and / or this method can be implemented using other structures and / or functions in addition to one or more of the aspects described herein.

[0060] It should also be noted that the diagrams provided in the following embodiments only illustrate the basic concept of the present disclosure schematically. Only the components related to the present disclosure are shown in the diagrams, rather than being drawn according to the number, shape and size of the components in actual implementation. The type, quantity and proportion of each component in its actual implementation can be an arbitrary change, and the component layout type may also be more complex.

[0061] In addition, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0062] Refer toFigure 1 , this application discloses a log storage method, which includes the following steps:

[0063] S100, based on a preset priority policy, divide several logs received within the P-th preset period to obtain a sorted data set;

[0064] Judge whether the total amount of the sorted data set is greater than the preset storage threshold of the database. If not, write the sorted data set into the database; the preset storage threshold is N;

[0065] If so, write the first N logs in the sorted data set into the database, and store the remaining logs in a preset circular queue.

[0066] S200, record the logs stored in the preset circular queue as a buffered log set;

[0067] Judge whether the number of the buffered log set (that is, the number of logs stored in the preset circular queue) is greater than the preset storage threshold. If so, execute the first policy; if not, execute the second policy.

[0068] Among them, the preset priority policy includes several priority lists set by polling. Both P and N are positive integers.

[0069] Each priority list includes a first priority, a second priority, a third priority, and a fourth priority with decreasing priorities; among them, the first priority includes AV security engine logs, the second priority includes access control logs, the third priority includes IPS security engine logs, and the fourth priority includes configuration management logs.

[0070] In this embodiment, the numbers of AV security engine logs, access control logs, IPS security engine logs, and configuration management logs in each round of the priority list are F1, F2, F3, and F4 respectively; 0 ≤ F1 ≤ 4, 0 ≤ F2 ≤ 3, 0 ≤ F3 ≤ 2, 0 ≤ F4 ≤ 1, that is, in each round of the priority list, the maximum number of AV security engine logs is 4, the maximum number of access control logs is 3, the maximum number of IPS security engine logs is 2, and the maximum number of configuration management logs is 1.

[0071] If in each round of the priority list, all four types of logs exist, the preset priority policy is specifically at most 4 AV security engine logs + at most 3 access control logs + at most 2 IPS security engine logs + at most 1 configuration management log + at most 4 AV security engine logs + at most 3 access control logs + at most 2 IPS security engine logs + at most 1 configuration management log + ……, that is, sort by polling according to the above rules.

[0072] The log storage method disclosed in this application classifies the received logs according to a preset priority policy, obtains a sorted data set sorted according to the priority level. When the database storage performance bottleneck is reached, it can ensure the timely and effective storage of logs with higher priority, that is, important logs, prevent log loss, reduce the storage pressure of the database, and improve the storage efficiency. Then, the logs with relatively lower priority are temporarily stored in a preset circular queue. After the log writing speed of the database returns to normal, the logs stored in the preset circular queue are written into the database again. This can not only meet the storage requirements of the database, not affect the storage efficiency of the database, ensure the effective utilization of the real-time storage space of the database, but also ensure the writing of all logs into the database finally, effectively improving the storage efficiency of database logs and the comprehensive integrity of data storage.

[0073] Refer to Figure 2 , in this embodiment, the method for obtaining the sorted data set specifically includes the following steps:

[0074] Obtain the type information of several logs; where the type information includes one or more of AV security engine logs, access control logs, IPS security engine logs, and configuration management logs.

[0075] Sort the type information according to the preset priority policy to obtain the sorted data set.

[0076] Refer to Figure 3 , the execution method of the first policy specifically includes the following steps:

[0077] S300, write the first N logs in the buffered log set into the database in the (P + 1)-th preset cycle;

[0078] Store the logs received in the (P + 1)-th preset cycle in the preset circular queue according to the preset priority policy.

[0079] S400, let P = P + 1, and return to execute S200.

[0080] Among them, for the logs received in the (P + 1)-th preset cycle, first classify the type information of all the received logs, and then sort them according to the preset priority policy, and store them in the preset circular queue in a polling storage manner.

[0081] In this step, the number of buffered log sets is greater than the preset storage threshold. Therefore, at the (P + 1)-th preset cycle, although the logs temporarily stored in the preset circular queue in the previous preset cycle are preferentially processed, they cannot all be written into the database within the (P + 1)-th preset cycle. Therefore, the first N logs in the buffered log set are first written into the database, and the remaining logs continue to be stored in the preset circular queue. At the same time, to prevent log loss, the new logs received within the (P + 1)-th preset cycle are also temporarily stored in the preset circular queue in a polling storage manner according to the preset priority policy, which not only does not affect the log storage performance of the database at the (P + 1)-th preset cycle but also ensures the effective storage of all received logs.

[0082] Refer to Figure 4 , the execution method of the second strategy specifically includes:

[0083] S500, write the buffered log set into the database within the (P + 1)-th preset cycle;

[0084] S600, determine whether the amount of logs received within the (P + 1)-th preset cycle is greater than the first preset value. If not, within the (P + 1)-th preset cycle, write the logs received within the (P + 1)-th preset cycle into the database;

[0085] If so, write the first M logs received within the (P + 1)-th preset cycle into the database, store the remaining logs in the preset circular queue, and execute S400.

[0086] Among them, the first preset value is M.

[0087] In this embodiment, the first preset value is the difference between the preset storage threshold and the total amount of the remaining logs in the P-th preset cycle; the total amount of the remaining logs in the P-th preset cycle is the difference between the total amount of a certain number of logs received in the P-th preset cycle and the preset storage threshold.

[0088] Among them, the writing method of the logs written into the database specifically includes: for the logs received within the (P + 1)-th preset cycle, first divide all the received logs according to the type information, and then sort them according to the preset priority policy and write them into the database in a polling storage manner.

[0089] In this step, the number of buffered log sets is not greater than the preset storage threshold N, that is, the normal storage performance of the database is satisfied. Therefore, all the logs in the buffered log set can be written into the database in the (P + 1)-th preset period. Then, it is determined whether all the newly received logs are stored in the database at the (P + 1)-th preset period. If the amount of logs received in the (P + 1)-th preset period is not greater than the first preset value, then all the new logs received in the (P + 1)-th preset period can also be written into the database. At this time, the preset circular queue is empty. If the amount of logs received in the (P + 1)-th preset period is greater than the first preset value, then at the (P + 1)-th preset period, only the first M logs received in the (P + 1)-th preset period can be written into the database, and the remaining logs are stored in the preset circular queue. At this time, the preset circular queue stores some of the logs received in the (P + 1)-th preset period.

[0090] It should be noted that in this embodiment, the P-th preset period is the current time period, and the (P + 1)-th preset period is the next time period.

[0091] For the sake of easy understanding, a specific embodiment is described in detail below. At this time, P is 1 and N is 2000 entries.

[0092] Refer to Figure 5 , S100, based on a preset priority policy, divide a number of logs received in the first preset period to obtain a sorted data set;

[0093] Determine whether the total amount n1 of a number of logs received in the first preset period (i.e., within the first second) (i.e., the total amount of the sorted data set) is greater than the preset storage threshold N of the database. If not, write all the logs (i.e., the logs in the sorted data set) into the database. If so, write the first N logs in the sorted data set into the database, and store the remaining logs (i.e., n1 - N logs) in the preset circular queue.

[0094] In this embodiment, the remaining logs in the first preset period are denoted as Q.

[0095] Case 1: When n1 is 1500 entries, then the 1500 received entries can be directly written into the database in a polling storage manner. In this case, there are no remaining logs, that is, Q = 0.

[0096] Case 2: When n1 is 2500 entries, based on the preset priority policy, divide these 2500 logs. Specifically, first obtain the types of all the logs, and then sort them from high to low according to the priority of the specific types. That is, after all the logs are sorted in a polling storage form, a sorted data set is obtained. Then write the first 2000 logs in the sorted data set into the database, and store the remaining 500 logs in the preset circular queue.

[0097] At this time, the log written in the database is the poll-sorted log.

[0098] In this case, Q = n1 - N = 2500 - 2000 = 500.

[0099] Case 3: When n1 is 5000, based on the preset priority policy, these 5000 logs are divided. Specifically, first obtain the types of all logs, and then sort them from high to low according to the priority of the specific type. That is, after all are sorted in the form of poll storage, a sorted data set is obtained; then the first 2000 logs in the sorted data set are written into the database, and the remaining 3000 logs are stored in a preset circular queue.

[0100] In this case, Q = n1 - N = 5000 - 2000 = 3000.

[0101] S200, mark the logs stored in the preset circular queue as the buffered log set; determine whether the number of the buffered log set is greater than the preset storage threshold N. If so, execute S300; if not, execute S500.

[0102] At this time, the buffered log set is the remaining 500 logs in Case 2, or the remaining 3000 logs in Case 3.

[0103] For Case 2 (i.e., Q = 500), that is, the number of the buffered log set is not greater than the preset storage threshold N, then execute S500. For S500 specifically: write the buffered log set into the database within the second preset period (i.e., within the 2nd second). That is, within the 2nd second, the 500 logs in the buffered queue will be preferentially written into the database.

[0104] Then execute S600, and determine whether the amount of logs n2 received within the second preset period (i.e., within the 2nd second) is greater than the first preset value M (i.e., 2000 - 500). That is, the first preset value is the difference between the preset storage threshold and the total amount of the remaining logs within the first preset period.

[0105] Among them, M = N - Q = 2000 - 500 = 1500.

[0106] If not (i.e., the amount of logs received within the second preset period is not greater than the first preset value), within the second preset period, write the logs received within the second preset period into the database. That is, within the second preset period, not only can the logs buffered in the preset circular queue within the previous preset period (i.e., within the 1st second) be written into the database, but also the newly received logs within the second preset period (i.e., within the 2nd second) can be written into the database.

[0107] If so (i.e., the amount of logs received within the second preset period is greater than the first preset value), write the first M (i.e., the first 1500) logs received within the second preset period into the database, store the remaining logs in the preset circular queue, and return to execute S400.

[0108] Specifically, if n2 is 2000, since n2 > 1500, it means that within the second preset period (i.e., within the 2nd second), after first writing the logs buffered in the preset circular queue within the previous preset period (i.e., within the 1st second) into the database, not all the newly received logs within the 2nd second can be written into the database. Therefore, within the second preset period (i.e., within the 2nd second), write the first 1500 of the newly received logs within the 2nd second into the database, and then store the remaining 500 in the preset circular queue, waiting for the next preset period, i.e., at the 3rd second, to perform corresponding processing, that is, return to execute S400.

[0109] In S200, for case three, the number of buffered log sets is 3000, that is, the number of buffered log sets is greater than the preset storage threshold N, then execute S300.

[0110] S300, write the first N of the buffered log sets into the database within the (P + 1)th preset period; store the logs n2 received within the (P + 1)th preset period in the preset circular queue according to the preset priority policy.

[0111] In this step, that is, within the second preset period (i.e., within the 2nd second), write the first 2000 of the 3000 into the database. At this time, the database write limit within the second preset period has been reached, that is, it is no longer possible to write the newly received logs within this period into the database within the second preset period. To prevent log loss, store the newly received logs within the second preset period in the preset circular queue according to the preset order.

[0112] After executing S300, execute S400, that is, set P = P + 1, and return to execute S200, that is, start the loop.

[0113] In the case of returning to execute S200 in one loop, at this time, the buffered log set includes the remaining 1000 logs of the 3000 and the new n2 logs received within the second preset period.

[0114] If n2 is 1500, that is, the number of buffered log sets is 2500, which is greater than 2000 (i.e., the preset storage threshold N), then execute S300; specifically, write the first 2000 of the 2500 into the database within the third preset period. At this time, the database write limit within the third preset period has been reached. Therefore, store the logs received within the third preset period in the preset circular queue according to the preset order; then proceed to the next step.

[0115] If n2 is 800, that is, the number of buffered log sets is 1800, which is less than 2000 (i.e., the preset storage threshold N), S500 is executed; specifically, these 1800 logs are written to the database within the third preset period, and then S600 is executed to determine whether the amount of new logs received within the third preset period is greater than the first preset value (i.e., 2000-1800);

[0116] If not (i.e., the amount of new logs received within the third preset period is not greater than the first preset value), within the third preset period, the logs received within the third preset period are written to the database, that is, within the third preset period, not only the logs buffered in the preset ring queue within the previous preset period (i.e., within the 2nd second) can be written to the database, but also the newly received logs within the third preset period (i.e., within the 3rd second) can be written to the database. At this time, the preset ring queue is empty.

[0117] If yes (ie the amount of logs received in the third preset period is greater than the first preset value), write the first M logs (ie the first 1500) received in the third preset period into the database, store the remaining logs into the preset circular queue, and return to execute S400.

[0118] Through the log storage method disclosed in the present application, under the premise that the log storage performance of the database objectively exists, by setting the priority of each type of received log, the logs that have reached the log storage performance bottleneck can be temporarily stored in a preset ring queue (i.e., memory) in a polling storage manner. After the log writing speed of the database returns to normal, the logs temporarily stored in the preset ring queue are recorded again, effectively avoiding log loss.

[0119] Reference Figure 6 The second aspect of the present application provides a log storage system, comprising:

[0120] an acquisition module configured to divide a number of logs received in a Pth preset period based on a preset priority strategy to obtain a sorted data set;

[0121] A first judgment module is configured to judge whether the total amount of the sorted data set is greater than a preset storage threshold of the database, and if not, write the sorted data set into the database; the preset storage threshold is N;

[0122] If so, write the first N logs in the sorted data set to the database and store the remaining logs in the preset ring queue;

[0123] A transition module is configured to record the logs stored in the preset ring queue as a buffer log set;

[0124] a second determination module configured to determine whether the number of buffered log sets is greater than a preset storage threshold, and if so, execute a first strategy;

[0125] If not, execute the second strategy.

[0126] The electronic device according to an embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-temporary computer-readable instructions. Specifically, the memory may include one or more computer program products, and the computer program products may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory, etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0127] The processor may be a central processing unit (CPU) or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In an embodiment of the present disclosure, the processor is used to run the computer-readable instructions stored in the memory, so that the electronic device executes all or part of the steps of the log storage method of the foregoing embodiments of the present disclosure.

[0128] Those skilled in the art should understand that, in order to solve the technical problem of how to obtain good user experience effects, known structures such as communication buses and interfaces may also be included in this embodiment, and these known structures should also be included in the protection scope of the present disclosure.

[0129] As Figure 7 FIG. is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure. It shows a schematic structural diagram of an electronic device suitable for implementing the electronic device in the embodiments of the present disclosure. Figure 4 The shown electronic device is only an example, and should not bring any limitation to the functions and usage scope of the embodiments of the present disclosure.

[0130] As Figure 7 As shown, the electronic device may include a processor (such as a central processing unit, a graphics processing unit, etc.), which may perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) or the program loaded from the storage device into the random access memory (RAM). In the RAM, various programs and data required for the operation of the electronic device are also stored. The processor, ROM, and RAM are connected to each other through a bus. The input / output (I / O) interface is also connected to the bus.

[0131] Typically, the following devices can be connected to the I / O interface: input devices including, for example, sensors or visual information acquisition devices; output devices including, for example, display screens; storage devices including, for example, magnetic tapes, hard disks, etc.; and communication devices. The communication device can allow the electronic device to communicate wirelessly or wired with other devices (such as edge computing devices) to exchange data. Although Figure 7 an electronic device with various devices is shown, it should be understood that it is not required to implement or have all the shown devices. Instead, more or fewer devices can be implemented or had.

[0132] Specifically, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program codes for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device, or installed from the storage device, or installed from the ROM. When the computer program is executed by the processor, all or part of the steps of the log storage method of the embodiments of the present disclosure are executed.

[0133] For a detailed description of this embodiment, reference can be made to the corresponding descriptions in the foregoing embodiments, and details will not be repeated here.

[0134] A computer-readable storage medium according to an embodiment of the present disclosure has non-temporary computer-readable instructions stored thereon. When the non-temporary computer-readable instructions are run by the processor, all or part of the steps of the log storage methods of the foregoing embodiments of the present disclosure are executed.

[0135] The above computer-readable storage medium includes but is not limited to: optical storage media (such as: CD-ROM and DVD), magneto-optical storage media (such as: MO), magnetic storage media (such as: magnetic tapes or external hard drives), media with built-in rewritable non-volatile memories (such as: memory cards), and media with built-in ROMs (such as: ROM cartridges).

[0136] For a detailed description of this embodiment, reference can be made to the corresponding descriptions in the foregoing embodiments, and details will not be repeated here.

[0137] The basic principles of the present disclosure have been described above in conjunction with specific embodiments. However, it should be noted that the advantages, benefits, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, benefits, effects, etc. are essential for each embodiment of the present disclosure. In addition, the above disclosed specific details are only for the purposes of illustration and easy understanding, rather than limitations, and the above details do not limit the present disclosure to necessarily adopt the above specific details for implementation.

[0138] In this disclosure, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and do not intend to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open-ended terms, meaning "including but not limited to", and can be used interchangeably with each other. The words "or" and "and" used herein refer to the phrase "and / or", and can be used interchangeably with each other, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to", and can be used interchangeably with each other.

[0139] In addition, as used herein, the "or" used in the listing of items starting with "at least one" indicates a disjunctive listing, so that for example, the listing of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the term "exemplary" does not mean that the described examples are preferred or better than other examples.

[0140] It should also be noted that in the systems and methods of this disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent solutions of this disclosure.

[0141] Various changes, substitutions, and alterations to the technologies described herein can be made without departing from the teachings defined by the appended claims. In addition, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and acts described above. Current or later-developed processes, machines, manufactures, compositions of events, means, methods, or acts that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or acts within their scope.

[0142] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects are very obvious to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to the broadest scope consistent with the principles and novel features disclosed herein.

[0143] The foregoing description has been presented for purposes of illustration and description. In addition, this description is not intended to limit embodiments of the present disclosure to the form disclosed herein. Although several example aspects and embodiments have been discussed above, those skilled in the art will recognize some of their variations, modifications, alterations, additions, and subcombinations.

Claims

1. A log storage method, characterized in that: include: S100, dividing a number of logs received in a Pth preset period based on a preset priority strategy to obtain a sorted data set; Determine whether the total amount of the sorted data set is greater than a preset storage threshold N of the database; if not, write the sorted data set into the database; If yes, write the first N logs in the sorted data set into the database and store the remaining logs into a preset ring queue; S200, recording the logs stored in the preset ring queue as a buffer log set; Determine whether the number of the buffered log sets is greater than the preset storage threshold, and if so, execute the first strategy; If not, execute the second strategy.

2. The log storage method according to claim 1, wherein: The preset priority strategy includes a plurality of priority lists set by polling; The priority list includes AV security engine logs, access control logs, IPS security engine logs, and configuration management logs in descending order of priority.

3. The log storage method according to claim 2, characterized in that: The numbers of AV security engine logs, access control logs, IPS security engine logs, and configuration management logs in the priority list in each round are F1, F2, F3, and F4 respectively; 0≤F1≤4； 0≤F2≤3； 0≤F3≤2； 0≤F4≤1。 4. The log storage method according to claim 3, wherein: The step of dividing the plurality of logs received in the Pth preset period to obtain a sorted data set includes: Obtaining type information of several logs; Sorting the type information according to the preset priority strategy to obtain the sorted data set; The type information includes one or more of AV security engine logs, access control logs, IPS security engine logs, and configuration management logs.

5. The log storage method according to claim 4, characterized in that: The executing the first strategy includes: S300, writing the first N logs in the buffer log set into the database within the P+1th preset period; The logs received in the P+1th preset period are stored in the preset ring queue according to the preset priority policy; S400, set P=P+1, and return to execute S200.

6. The log storage method according to claim 5, characterized in that: The executing the second strategy includes: S500, writing the buffered log set into a database within the P+1th preset period; S600, determining whether the amount of logs received in the P+1th preset period is greater than a first preset value, and if not, writing the logs received in the P+1th preset period into a database in the P+1th preset period; If yes, write the first M logs received in the P+1th preset period into the database, store the remaining logs into the preset ring queue, and execute S400; Among them, the first preset value is M.

7. The log storage method according to claim 6, characterized in that: The first preset value is the difference between the preset storage threshold and the total amount of remaining logs in the Pth preset period; The total amount of remaining logs in the Pth preset period is the difference between the total amount of logs received in the Pth preset period and the preset storage threshold.

8. A log storage system, characterized in that: include: an acquisition module configured to divide a number of logs received in a Pth preset period based on a preset priority strategy to obtain a sorted data set; A first judgment module is configured to judge whether the total amount of the sorted data set is greater than a preset storage threshold of the database, and if not, write the sorted data set into the database; the preset storage threshold is N; If yes, write the first N logs in the sorted data set into the database and store the remaining logs into a preset ring queue; a transition module configured to record the logs stored in the preset ring queue as a buffer log set; A second judgment module is configured to judge whether the number of the buffered log sets is greater than the preset storage threshold, and if so, execute the first strategy; If not, execute the second strategy.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the log storage method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the log storage method according to any one of claims 1 to 7.

Images