Load-balanced security log system and management method thereof
By designing a load-balanced secure log system, using API interfaces and configuration tools, the existing log system's insufficient security and poor performance are solved, effective log management and storage are achieved, and the security and performance of the system are improved.
Patent Information
- Application Number
- CN202411511467.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-28
- Publication Date
- 2025-02-11
AI Technical Summary
Existing logging systems lack effective security measures, are vulnerable to attacks, and have problems such as imbalance in read and write performance and poor management of duplicate logs when processing large amounts of log data.
A load-balanced secure logging system is designed, including access to application program interfaces, log servers, and configuration tools. Through the API interface external applications, the log server can interact with the log server. The log server performs log configuration modification, writing, reading and legality checks based on the parameters of the configuration tool to ensure the security and performance of the log.
Set the maximum entry for log storage and the maximum entry for duplicate logs through the configuration tool to effectively control the number of logs to prevent storage overflow and performance degradation. The legality checking and buffer pooling mechanism of the log server improve log security and write performance, reduce disk I/O operations, and improve system response speed and processing capabilities.
Smart Images
Figure CN119415490A_ABST
Abstract
Description
Technical Field
[0001] The present application belongs to the field of computer information processing, and more specifically, to a load-balanced security log system and a management method thereof. Background Art
[0002] System logs record information about hardware, software, and system problems in the system, and can also monitor events that occur in the system. Users can use them to check the cause of an error or find traces left by an attacker when attacked.
[0003] The existing log system has the following defects:
[0004] 1. Lack of effective security measures may result in log entries being tampered with or forged by malicious users. Log systems that lack verification mechanisms are vulnerable to attacks, making the security of log information unguaranteed.
[0005] 2. Many traditional log systems have the problem of unbalanced read and write performance when processing large amounts of log data. Especially in high-concurrency scenarios, log writing may cause file IO performance to decline, thus affecting the overall response speed and efficiency of the system.
[0006] 3. The current log system may fail to effectively manage duplicate log entries, resulting in redundant storage of the same type of log information and wasted storage space. Especially in high-frequency event recording, failure to delete old logs in time will cause storage burden and affect query and processing performance.
[0007] Therefore, how to improve the security of the log system and optimize the performance of the log system is a technical problem that needs to be solved urgently. Summary of the invention
[0008] In view of the defects of the prior art, the purpose of the present application is to provide a load-balanced secure log system and a management method thereof, aiming to solve the problems of insufficient security and poor performance of the log system in the prior art.
[0009] The present application provides a load-balanced security log system, including: an access application program interface, a log server, and a configuration tool;
[0010] The access application program interface is used to provide an API interface so that an external application can send instructions to the log server to perform log processing by accessing the API interface;
[0011] The configuration tool is used to configure the parameters of the log server, including the maximum entries of log storage, the maximum entries of duplicate logs, log viewing configuration parameters, and log writing configuration parameters;
[0012] The log server is used to perform log configuration modification, log writing, log reading and legality checking in response to the input instructions according to the configuration parameters of the configuration tool combined with the input instructions of the access application program interface to ensure effective management and storage of logs.
[0013] Optionally, the log server is specifically used for:
[0014] Receiving a configuration modification instruction sent via the access application program interface, determining whether the configuration modification instruction is a corresponding instruction for modifying the total number of log entries, and obtaining a determination result;
[0015] If the modification instruction is an instruction corresponding to modifying the total number of log entries, record the new total number of log entries configuration;
[0016] Compare the current stored value of the total number of log entries with the new configured value of the total number of log entries to obtain a comparison result;
[0017] If the storage value exceeds the configured value, the log entries corresponding to the exceeding value will be deleted according to the log recording time, and the configuration will be replied successfully.
[0018] Optionally, the log server is specifically used for:
[0019] If the modification instruction is a repeatable log entry, then record the new repeatable log entry configuration and reply that the configuration is successful;
[0020] If the modification instruction involves other unsupported configurations other than modifying the total number of log entries and repeatable log entries, the configuration reply fails.
[0021] Optionally, the log server is further used for:
[0022] receiving a log write instruction sent via the access application program interface, placing the log to be written into a buffer pool in response to the log write instruction, and returning a write success response;
[0023] Monitoring the buffer pool status in a sub-thread, and determining whether the buffer pool is empty based on the buffer pool status;
[0024] If the buffer pool is not empty, taking the target log from the buffer pool;
[0025] Calculate the checksum and index code of the target log, and save the target log into a log file;
[0026] Searching for all log entries identical to the target log in the log file according to the index code, and if the number of the found log entries exceeds the number of repeatable log entries, deleting the log entries corresponding to the number exceeding the value according to the log recording time;
[0027] Check the total number of log entries in the log file. If the total number of log entries is greater than the configured number of log entries, delete the log entries that exceed the value according to the log recording time.
[0028] Optionally, the log server is further used for:
[0029] Receiving a log reading instruction sent via the access application program interface;
[0030] According to the log filter condition in the read instruction, all logs meeting the condition are read from the log file to obtain a read result;
[0031] determining an extraction log of a designated position from the reading result according to a display condition;
[0032] The check code of the extracted log is calculated, and the check code is compared with the check code carried by the log to determine the legitimacy of all the extracted logs, and log caching is performed based on the legitimacy.
[0033] Optionally, the log server is further used for:
[0034] If the extracted log is illegal, the current extracted log is recorded as an error log;
[0035] If the extracted log is legal, caching the current extracted log as a legal log;
[0036] Repeat the validity check of all extracted logs and return all cached valid logs.
[0037] Optionally, the log storage format includes log type, log level, log time, log content, index code and check code; the log filter includes log type, log level, start time, end time and keywords; the log display includes display starting position and display number.
[0038] In a second aspect, the present application also provides a load-balanced log system management method, comprising:
[0039] Provide an API interface by accessing the application program interface, so that external applications can send instructions to the log server to process logs by accessing the API interface;
[0040] Configuring the parameters of the log server through a configuration tool, the parameters including the maximum entries of log storage, the maximum entries of duplicate logs, viewing log configuration parameters, and writing log configuration parameters;
[0041] The log server performs log configuration modification, log writing, log reading and legality checking in response to the input instructions according to the configuration parameters of the configuration tool and the input instructions of the access application program interface, so as to ensure the effective management and storage of the log.
[0042] In a third aspect, the present application provides an electronic device comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory. When the program stored in the memory is executed, the processor is used to execute the method described in the first aspect or any possible implementation of the first aspect.
[0043] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.
[0044] In a fifth aspect, the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method described in the first aspect or any possible implementation of the first aspect.
[0045] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.
[0046] In general, the above technical solutions conceived by this application have the following beneficial effects compared with the prior art:
[0047] (1) This application can set the maximum entries for log storage and the maximum entries for duplicate logs through the configuration tool, which can effectively control the number of logs and avoid storage overflow or performance degradation due to too many logs. The log server performs a legitimacy check when reading and processing logs to ensure that only legal logs are cached and stored, which can prevent malicious tampering or forgery of log records and enhance the security of the system. By accessing the application programming interface (API), external applications can safely interact with the log server, thereby enhancing the security of the system. Furthermore, by configuring the maximum entry limit, the storage space and performance of the log can be effectively controlled, storage overload can be avoided, and the response speed of the system can be improved. The API interface can support batch log writing and reading operations, reduce the number of network requests, and improve throughput and system performance.
[0048] (2) When the log server of the present application responds to a log write instruction, it puts the log into the buffer pool, which can reduce frequent disk I / O operations and improve write performance. By writing logs in batches, the write efficiency can be significantly improved, and by monitoring the buffer pool status and processing logs in separate threads, asynchronous log writing and reading can be achieved, further improving the system's response speed and processing capabilities.
[0049] (3) This application uses verification to protect log entries, which can effectively prevent logs from being tampered with. At the same time, the use of a buffer pool brings load balancing capabilities, effectively balancing the file read and write IO performance and the log read and write performance, improving the overall access performance of the log system. It also has an automatic deletion function for duplicate logs. For the same type of log information, only the latest few logs are recorded, and old logs are automatically deleted, effectively preventing the problem of other logs being deleted when there are too many logs of one type. BRIEF DESCRIPTION OF THE DRAWINGS
[0050] Figure 1 It is a structural diagram of a load-balanced security log system provided in an embodiment of the present application;
[0051] Figure 2 It is a functional schematic diagram of server configuration modification of a log server provided in an embodiment of the present application;
[0052] Figure 3 This is a functional schematic diagram of writing a log to a log server provided in an embodiment of the present application;
[0053] Figure 4 This is a functional schematic diagram of a log reading server provided in an embodiment of the present application;
[0054] Figure 5 The log, filter and display structure provided in the embodiment of the present application;
[0055] Figure 6 It is a flow chart of a load-balanced log system management method provided in an embodiment of the present application;
[0056] Figure 7 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0057] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0058] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.
[0059] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of the objects. For example, a first response message and a second response message are used to distinguish different response messages rather than to describe a specific order of the response messages.
[0060] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.
[0061] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.
[0062] Next, the technical solutions provided in the embodiments of the present application are introduced.
[0063] The present application provides a load-balanced security log system, including: an access application program interface, a log server, and a configuration tool;
[0064] The access application program interface is used to provide an API interface so that an external application can send instructions to the log server to perform log processing by accessing the API interface;
[0065] The configuration tool is used to configure the parameters of the log server, including the maximum entries of log storage, the maximum entries of duplicate logs, log viewing configuration parameters, and log writing configuration parameters;
[0066] The log server is used to perform log configuration modification, log writing, log reading and legality checking in response to the input instructions according to the configuration parameters of the configuration tool combined with the input instructions of the access application program interface to ensure effective management and storage of logs.
[0067] Specifically, refer to Figure 1The load-balanced security log system of this application adopts CS architecture, which consists of log server, access API and configuration tool. The "write" function is realized by configuring parameters, adding checksums and checking duplicate logs, and the "read" function is realized by checking checksums and filtering logs.
[0068] The system provided in the embodiment of the present application provides an API interface, configuration tools and a log server. The system can support external applications in writing, reading and configuring logs to ensure the security and validity of log data.
[0069] The access application program interface (API) provides a standardized API interface, allowing external applications to interact with the log server. The specific functions are as follows:
[0070] Log writing: External applications send log data to the log server through the API interface, and the system receives and stores it.
[0071] Log reading: External applications can request specific log data through the API interface, and the system will respond and return the requested log information.
[0072] Instruction sending: The API interface supports external applications to send a variety of instructions, including log configuration modification requests, log status viewing, etc.
[0073] The configuration tool is used to configure and manage the parameters of the log server to ensure the flexibility and customizability of the system. The main parameters include but are not limited to: the maximum number of entries in the log storage, the maximum number of entries in the duplicate log, the viewing log configuration parameters, and the writing log configuration parameters;
[0074] Maximum entries for log storage: Defines the maximum number of log entries that the log server can store to avoid storage overflow. Maximum entries for duplicate logs: Sets the number of duplicate logs allowed to be stored to optimize storage space and improve data uniqueness. View log configuration parameters: Allows users to view the status of current log storage and configuration in order to make necessary adjustments. Write log configuration parameters: Configure the log writing rules and format to ensure that the input logs meet the predetermined standards.
[0075] The log server is the core component responsible for log processing and management. Its specific functions are as follows:
[0076] Log configuration modification: Update the configuration of log storage and processing according to the parameters of the configuration tool. Log writing: Receive log data sent by external applications through the API and store it in the specified location. Log reading: Process the read request of the external application, return the corresponding log data, and support filtering by conditions. Legality check: Verify the legality of the input log data to ensure that the data format and content meet the expected requirements to maintain the integrity and accuracy of the log.
[0077] The specific workflow of the embodiment of the present application is as follows: an external application sends a log write or read request by accessing the API interface. After receiving the request, the log server performs the corresponding operation according to the parameters set in the configuration tool. For example, when writing a log, the system first performs a legitimacy check. If the log data meets the standard, it is stored; otherwise, an error message is returned.
[0078] This application can set the maximum entries of log storage and the maximum entries of duplicate logs through the configuration tool, which can effectively control the number of logs, avoid storage overflow or performance degradation caused by too many logs, and prevent malicious users from exploiting log storage vulnerabilities to attack through reasonable log management strategies. The log server performs a legitimacy check when reading and processing logs to ensure that only legal logs are cached and stored, which can prevent malicious tampering or forgery of log records and enhance the security of the system. By accessing the application program interface (API), external applications can interact with the log server securely, and implement authentication and authorization mechanisms at the API level to ensure that only authenticated users or applications can send instructions, thereby enhancing the security of the system. Furthermore, by configuring the maximum entry limit, the storage space and performance of the log can be effectively controlled, storage overload can be avoided, and the response speed of the system can be improved. The API interface can support batch log write and read operations, reduce the number of network requests, and improve throughput and system performance.
[0079] Optionally, the log server is specifically used for:
[0080] Receiving a configuration modification instruction sent via the access application program interface, determining whether the configuration modification instruction is a corresponding instruction for modifying the total number of log entries, and obtaining a determination result;
[0081] If the modification instruction is an instruction corresponding to modifying the total number of log entries, record the new total number of log entries configuration;
[0082] Compare the current stored value of the total number of log entries with the new configured value of the total number of log entries to obtain a comparison result;
[0083] If the storage value exceeds the configured value, the log entries corresponding to the exceeding value will be deleted according to the log recording time, and the configuration will be replied successfully.
[0084] If the modification instruction is a repeatable log entry, then record the new repeatable log entry configuration and reply that the configuration is successful;
[0085] If the modification instruction involves other unsupported configurations other than modifying the total number of log entries and repeatable log entries, the configuration reply fails.
[0086] like Figure 2 As shown in the figure, after the log server receives the configuration modification instruction, if the total number of log entries is modified, it will first record the configuration, and then compare the total number of log entries currently stored with the configured total number of log entries. If the stored value exceeds the configured value, the oldest excess logs will be deleted, and then the configuration will be replied successfully, otherwise it will be replied directly that the configuration is successful; if the modification is a repeatable log entry, the configuration will be recorded and the configuration will be replied successfully; if it is other unsupported configurations, the configuration will be replied failed.
[0087] Specifically, the embodiment of the present application is mainly used to process the configuration modification instructions received by the log server to achieve dynamic adjustment of the total number of log entries and the configuration of repeatable log entries. This process ensures that the configuration management of the system is flexible and efficient, and does not affect the normal storage and management of the log when changing.
[0088] First, receive configuration modification instructions from external applications or management tools, and execute corresponding processing logic according to the instruction type. The received configuration modification instructions need to be parsed to determine whether they are instructions to modify the total number of log entries or instructions to modify repeatable log entries. If the instructions belong to these two types, proceed to the next step; otherwise, record and reply "configuration failed".
[0089] When it is determined that the instruction is an instruction to modify the total number of log entries, the system records the new total number of log entries in the corresponding configuration storage. Read the total number of log entries currently stored (that is, the number of existing log entries). Compare the current number of log entries with the new configuration value: If the current storage value exceeds the new configuration value, the system will delete the redundant old log entries, that is, delete the redundant log entries to ensure that the number of logs does not exceed the new configuration value.
[0090] After successfully deleting the redundant logs, the system confirms to the caller that the configuration has been successfully implemented. If the current storage value does not exceed the new configuration value, the system does not need to delete the logs and directly replies "Configuration successful".
[0091] When the instruction is to modify the configuration of repeatable log entries, the system records the new number of repeatable log entries into the corresponding configuration storage. After successfully recording the new repeatable log entry configuration, the system confirms to the caller that the configuration has been successfully implemented.
[0092] If the received instruction is neither an instruction to modify the total number of log entries nor an instruction to modify repeatable log entries, the system will reply "Configuration failed" and record the reason for the failure for subsequent auditing and troubleshooting.
[0093] The configuration modification instruction processing scheme provided in the embodiment of the present application ensures dynamic management of the total number of log entries and repeatable log entries through clear steps and logic. When the system executes configuration modification, it can effectively perform legality checks, storage management and status monitoring to ensure the stability and security of the system.
[0094] Optionally, the log server is further used for:
[0095] receiving a log write instruction sent via the access application program interface, placing the log to be written into a buffer pool in response to the log write instruction, and returning a write success response;
[0096] Monitoring the buffer pool status in a sub-thread, and determining whether the buffer pool is empty based on the buffer pool status;
[0097] If the buffer pool is not empty, taking the target log from the buffer pool;
[0098] Calculate the checksum and index code of the target log, and save the target log into a log file;
[0099] Searching for all log entries identical to the target log in the log file according to the index code, and if the number of the found log entries exceeds the number of repeatable log entries, deleting the log entries corresponding to the number exceeding the value according to the log recording time;
[0100] Check the total number of log entries in the log file. If the total number of log entries is greater than the configured number of log entries, delete the log entries that exceed the value according to the log recording time.
[0101] like Figure 3 As shown, the log server Server receives the log write instruction, puts the written log into the buffer pool, and returns success. The server monitors the status of the buffer pool in its own thread. If the buffer pool is not empty, it takes a log from the buffer pool, calculates the log's check code and index code, and then saves the log to the log file. After saving, it searches for all identical logs in the log file according to the index code. If the number of log entries found exceeds the number of repeatable log entries, delete the oldest log that exceeds the number. Then check the total number of log entries in the log file. If the total number of log entries is greater than the configured total number of log entries, delete the oldest log that exceeds the number. After completing the relevant operations, continue to check the buffer pool status.
[0102] The embodiment of the present application mainly describes the processing flow of the log server after receiving the write log instruction sent via the access application program interface, including putting the log into the buffer pool, monitoring the buffer pool status, log preservation, verification and duplicate log management. By dividing the threads, the efficiency and accuracy of log writing are ensured.
[0103] When the log server receives the instruction to write the log, it immediately stores the log information to be written into the buffer pool and replies with a response of "successful writing". The buffer pool in this embodiment is a temporary storage area for storing the logs to be written, so as to facilitate batch processing and improve writing efficiency.
[0104] First, after receiving the log write instruction, the system puts the log content into the buffer pool and records the write time and log metadata (such as log level, source address, etc.). The system will immediately reply "write successful" to confirm that the instruction has been processed. The system will start a sub-thread to regularly check the status of the buffer pool to determine whether it is empty.
[0105] Secondly, if the buffer pool is not empty, proceed to the next step; if it is empty, the thread waits for a while and then continues to check, taking out the target log to be processed from the buffer pool. Verify the target log to ensure data integrity and generate a unique index code for subsequent search and management. Save the target log and its related verification code and index code into the log file to ensure persistent storage of the log.
[0106] Search the log file for all log entries that are identical to the target log according to the index code. If the number of log entries found exceeds the configured number of repeatable log entries, delete the excess old log entries according to the set deletion policy to ensure that the number of entries retained in the log file does not exceed the specified repeatable number. After saving the target log, check the total number of entries in the current log file to determine whether it exceeds the set total number of log entries. If the current total number of log entries is greater than the configured number, delete the excess old log entries according to the pre-set deletion policy to ensure that the total number of entries meets the configuration requirements.
[0107] Through the above processing scheme, the log server can efficiently manage log writing operations and ensure the integrity and manageability of log data. At the same time, the performance and stability of the system are improved by managing duplicate logs and the total number of entries.
[0108] Optionally, the log server is further used for:
[0109] Receiving a log reading instruction sent via the access application program interface;
[0110] According to the log filter condition in the read instruction, all logs meeting the condition are read from the log file to obtain a read result;
[0111] determining an extraction log of a designated position from the reading result according to a display condition;
[0112] The check code of the extracted log is calculated, and the check code is compared with the check code carried by the log to determine the legitimacy of all the extracted logs, and log caching is performed based on the legitimacy.
[0113] If the extracted log is illegal, the current extracted log is recorded as an error log;
[0114] If the extracted log is legal, caching the current extracted log as a legal log;
[0115] Repeat the validity check of all extracted logs and return all cached valid logs.
[0116] like Figure 4 As shown, the log server receives the log reading instruction, reads all qualified logs from the log file according to the filter conditions in the reading instruction, and then extracts the log at the specified position from the result according to the display conditions, and checks the legality of the extracted logs in turn by comparing the calculated log check code with the check code carried by the log. If the log is illegal, an error log is recorded, otherwise the legal log is cached. After completing the check of all extracted logs, all cached logs are returned.
[0117] The embodiment of the present application describes how the log server receives a log reading instruction and extracts the logs that meet the requirements from the log file according to specific filtering conditions. By verifying the legitimacy of the logs, it ensures that the system can correctly process and cache the legal logs, and records the error logs for subsequent analysis.
[0118] First, after receiving the instruction to read the log, the log server immediately starts processing and reads the log according to the log filter conditions in the instruction. The read instruction contains the log filter conditions. According to the parsed filter conditions, the log files are scanned one by one, and all the log entries that meet the conditions are extracted to form the reading results.
[0119] According to the display conditions, the log entries at the specified position are extracted from the reading results as the extracted logs for subsequent legitimacy checks. The checksum is calculated for each extracted log and compared with the checksum carried in the log to ensure the integrity and legitimacy of the log data.
[0120] If the extracted log is legal, it is stored as a legal log for caching.
[0121] If the log extraction is illegal, the current log extraction is recorded as an error log and stored for subsequent audit. The error log record should contain relevant information of the log extraction (such as timestamp, log content, etc.) for subsequent analysis and troubleshooting.
[0122] Repeat the validity check process for all logs extracted from the read results to ensure that all cached logs are valid logs. After completing all validity checks, return all cached valid logs for further processing or display.
[0123] Through the above scheme, the embodiment of the present application can enable the log server to effectively process log reading instructions, screen qualified logs, perform legitimacy checks, and properly manage legal and error logs, which not only improves the reliability of the system, but also enhances the traceability of log data, further improving the security of the log system.
[0124] Optionally, the log storage format includes log type, log level, log time, log content, index code and check code; the log filter includes log type, log level, start time, end time and keywords; the log display includes display starting position and display number.
[0125] Reference Figure 5 The embodiment of the present application defines a log storage format, a log filter and a log display structure, wherein the index code and the check code of the log storage format are calculated and generated by the log server, and the other fields are the basic elements of the log. The index code is used to quickly confirm duplicate logs, and the check code is used to prevent log tampering; the log filter is used to set filtering conditions when reading logs, and the log display is used to control the output range of the read logs in the logs that meet the conditions.
[0126] Reference Figure 6 The present application also provides a load-balanced log system management method, including:
[0127] S1 provides an API interface by accessing the application program interface, so that external applications can send instructions to the log server by accessing the API interface for log processing;
[0128] S2. Configure the parameters of the log server through the configuration tool, including the maximum log storage entries, the maximum number of duplicate log entries, view log configuration parameters, and write log configuration parameters;
[0129] S3. The log server performs log configuration modification, log writing, log reading and legality checking in response to the input instructions according to the configuration parameters of the configuration tool and the input instructions of the access application program interface to ensure effective management and storage of logs.
[0130] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method, which will not be repeated here.
[0131] Reference Figure 7 Based on the method in the above embodiment, the embodiment of the present application provides an electronic device, which may include: a processor (processor) 710, a communication interface (CommunicationsInterface) 720, a memory (memory) 730 and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 can call the logic instructions in the memory 730 to execute the method in the above embodiment.
[0132] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.
[0133] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the method in the above embodiment.
[0134] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the method in the above embodiment.
[0135] It is understandable that the processor in the embodiment of the present application can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.
[0136] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.
[0137] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.
[0138] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.
[0139] It will be easily understood by those skilled in the art that the above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.
Claims
1. A load-balanced security log system, characterized in that: include: Log server, access API, and configuration tools; The access application program interface is used to provide an API interface so that an external application can send instructions to the log server to perform log processing by accessing the API interface; The configuration tool is used to configure the parameters of the log server, including the maximum entries of log storage, the maximum entries of duplicate logs, log viewing configuration parameters, and log writing configuration parameters; The log server is used to perform log configuration modification, log writing, log reading and legality checking in response to the input instructions according to the configuration parameters of the configuration tool combined with the input instructions of the access application program interface to ensure effective management and storage of logs.
2. The load-balanced security log system according to claim 1, characterized in that: The log server is specifically used for: Receiving a configuration modification instruction sent via the access application program interface, determining whether the configuration modification instruction is a corresponding instruction for modifying the total number of log entries, and obtaining a determination result; If the modification instruction is an instruction corresponding to modifying the total number of log entries, record the new total number of log entries configuration; Compare the current stored value of the total number of log entries with the new configured value of the total number of log entries to obtain a comparison result; If the storage value exceeds the configured value, the log entries corresponding to the exceeding value will be deleted according to the log recording time, and the configuration will be replied successfully.
3. The load-balanced security log system according to claim 2, characterized in that: The log server is specifically used for: If the modification instruction is a repeatable log entry, then record the new repeatable log entry configuration and reply that the configuration is successful; If the modification instruction involves other unsupported configurations other than modifying the total number of log entries and repeatable log entries, the configuration reply fails.
4. The load-balanced security log system according to claim 1, characterized in that: The log server is also used for: receiving a log write instruction sent via the access application program interface, placing the log to be written into a buffer pool in response to the log write instruction, and returning a write success response; Monitoring the buffer pool status in a sub-thread, and determining whether the buffer pool is empty based on the buffer pool status; If the buffer pool is not empty, taking the target log from the buffer pool; Calculate the checksum and index code of the target log, and save the target log into a log file; Searching for all log entries identical to the target log in the log file according to the index code, and if the number of the found log entries exceeds the number of repeatable log entries, deleting the log entries corresponding to the number exceeding the value according to the log recording time; Check the total number of log entries in the log file. If the total number of log entries is greater than the configured number of log entries, delete the log entries that exceed the value according to the log recording time.
5. The load-balanced security log system according to claim 1, characterized in that: The log server is also used for: Receiving a log reading instruction sent via the access application program interface; According to the log filter condition in the read instruction, all logs meeting the condition are read from the log file to obtain a read result; determining an extraction log of a designated position from the reading result according to a display condition; The check code of the extracted log is calculated, and the check code is compared with the check code carried by the log to determine the legitimacy of all the extracted logs, and log caching is performed based on the legitimacy.
6. The load-balanced security log system according to claim 5, characterized in that: The log server is also used for: If the extracted log is illegal, the current extracted log is recorded as an error log; If the extracted log is legal, caching the current extracted log as a legal log; Repeat the validity check of all extracted logs and return all cached valid logs.
7. The load-balanced security log system according to claim 5, characterized in that: The log storage format includes log type, log level, log time, log content, index code and check code; the log filter includes log type, log level, start time, end time and keywords; the log display includes display start position and display number.
8. A load-balanced log system management method implemented by a load-balanced security log system according to any one of claims 1 to 7, comprising: Provide an API interface by accessing the application program interface, so that external applications can send instructions to the log server to process logs by accessing the API interface; Configuring the parameters of the log server through a configuration tool, the parameters including the maximum entries of log storage, the maximum entries of duplicate logs, viewing log configuration parameters, and writing log configuration parameters; The log server performs log configuration modification, log writing, log reading and legality checking in response to the input instructions according to the configuration parameters of the configuration tool and the input instructions of the access application program interface, so as to ensure the effective management and storage of the log.
9. An electronic device, characterized in that: include: at least one memory for storing a computer program; At least one processor is used to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is used to execute the method according to claim 8.
10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is run on a processor, the processor is caused to execute the method as claimed in claim 8.