Syslog log analysis method and device and related equipment

Abstract

The invention relates to the technical field of information processing, in particular to a syslog log analysis method and device and related equipment.The method is applied to a target server and comprises the steps that a syslog log forwarded by a syslog server side is received; wherein the syslog log is generated on the basis of an event at the syslog client side; analyzing the syslog log according to the operation rule to obtain an analysis result; if the analysis result indicates that the event is a violation operation, giving an alarm; wherein the violation operation comprises bypassing login, unauthorized operation and operation time violation. According to the application, the syslog log is analyzed and analyzed through the target server, so that the dependency on analysts can be effectively reduced; in addition, a plurality of target servers can be set, so that the number of the target servers can be specifically set according to actual requirements, and the syslog processing capability is further improved.

Description

Technical Field

[0001] The present application relates to the field of information processing technology, and in particular to a syslog log analysis method, device and related equipment. Background Art

[0002] In the existing syslog log analysis method, the syslog client sends the syslog logs generated during operation to the corresponding syslog server, so that analysts can perform planned analysis on the syslog logs on the syslog server. The purpose of the analysis is to confirm whether there are any illegal operations during the operation of the syslog client.

[0003] In actual implementation, with the development of technology and business expansion, the types and number of syslog clients are constantly increasing, resulting in a massive increase in the number of syslog logs. Specifically, in traditional Internet services, only certain servers and certain gateway devices generate syslog logs during operation. However, with the development of AI (Artificial Intelligence) technology, many IoT devices also generate syslog logs during operation.

[0004] With the massive increase in syslog logs, manual analysis by analysts is obviously difficult to meet the growing analysis needs of syslog logs. Summary of the invention

[0005] In view of this, the purpose of the present application is to provide a syslog log analysis method, apparatus and related equipment to solve the problem in the prior art that it is difficult to meet the growing analysis needs of syslog logs due to reliance on manual analysis by analysts.

[0006] In a first aspect, the present application provides a syslog log analysis method, the method is applied to a target server, the target server establishes a connection with a syslog server, the syslog server establishes a connection with a syslog client, the method comprises:

[0007] Receive the syslog log forwarded by the syslog server;

[0008] Wherein, the syslog log is generated based on the event in the syslog client;

[0009] Analyze the syslog log according to the operation rules to obtain an analysis result;

[0010] If the analysis result indicates that the event is an illegal operation, an alarm is issued;

[0011] Among them, the illegal operations include: bypassing login, unauthorized operation and illegal operation time.

[0012] Preferably, the target server includes: a first server, a second server and a third server, the first server establishes a connection with the syslog server; the receiving of the syslog log forwarded by the syslog server includes:

[0013] The first server receives syslog logs sent by the plurality of syslog servers and aggregates the received syslog logs to obtain an aggregated syslog log;

[0014] The first server sends the aggregated syslog log to the second server;

[0015] After receiving the syslog log forwarded by the syslog server, the method further includes:

[0016] The second server stores the received aggregated syslog log in a message sequence;

[0017] In response to the second server receiving the log sending request sent by the third server, the second server sends one of the aggregated syslog logs in the message sequence to the third server; the third server is used to analyze the aggregated syslog log according to the operation rules to obtain an analysis result.

[0018] Preferably, analyzing the syslog log according to the operation rules to obtain an analysis result includes:

[0019] Parsing the aggregated syslog log to obtain log information;

[0020] The log information includes: a plurality of attribute data corresponding to a plurality of attribute fields in a one-to-one correspondence;

[0021] Analyze the log information according to the operation rules to obtain an analysis result;

[0022] The operation rule includes: at least one rule condition, and the rule condition indicates the value range of the attribute data.

[0023] Preferably, the operation rules include: a first operation rule, a second operation rule and a third operation rule, the first operation rule is used to determine whether the event indicates the bypass login, the second operation rule is used to determine whether the event indicates the unauthorized operation, and the third operation rule is used to determine whether the event indicates an operation time violation; the analysis result obtained by analyzing the syslog log according to the operation rules includes:

[0024] The third server analyzes the syslog log according to the first operation rule, the second operation rule and the third operation rule to obtain a first analysis result, a second analysis result and a third analysis result.

[0025] Preferably, the first operation rule includes: a value range of a host name, a value range of a user account;

[0026] If the current host name is not within the host name value range, and / or the current user account is not within the user account value range, the first analysis result is "bypass login";

[0027] The second operation rule includes: a value range of device type, a value range of device manufacturer, a value range of user account, and a value range of user operation authority;

[0028] If any of the values ​​of the current device type, current device manufacturer, current user account, and current user operation authority is not within the corresponding value range, the second analysis result is "illegal login";

[0029] The third operation rule includes: the value range of the equipment manufacturer, the value range of the user operation command, and the value range of the timestamp of log generation;

[0030] If any one of the values ​​of the current user operation command, the current device manufacturer, and the current timestamp is not in the corresponding value range, the third analysis result is "operation time violation".

[0031] Preferably, if the analysis result indicates that the event is an illegal operation, issuing an alarm includes:

[0032] If the third server determines that the first analysis result is a bypass login, or determines that the second analysis result is an unauthorized operation, or determines that the third analysis result is an operation time violation, the third server issues an alarm.

[0033] Preferably, the method further comprises:

[0034] Storing the aggregated syslog log and the corresponding log information;

[0035] Receive log query requests;

[0036] Wherein, the log query request includes the target value of the attribute data;

[0037] According to the target value, the log information whose corresponding attribute data meets the target value and the corresponding aggregated syslog log are screened out from the stored log information.

[0038] In a second aspect, the present application provides a syslog log analysis device, the device is applied to a target server, the target server establishes a connection with a syslog server, the syslog server establishes a connection with a syslog client, and the device includes: a server docking module, a log analysis module and an alarm module;

[0039] The server docking module is used to receive the syslog log forwarded by the syslog server;

[0040] Wherein, the syslog log is generated based on the event in the syslog client;

[0041] The log analysis module is used to analyze the syslog log according to the operation rules to obtain the analysis result;

[0042] The alarm module is used to issue an alarm if the analysis result indicates that the event is an illegal operation; wherein the illegal operation includes: bypassing login, unauthorized operation and operation time violation.

[0043] In a third aspect, the present application provides an electronic device, comprising a processor and a memory, wherein the memory is used to store software programs, and the processor runs or executes the software programs stored in the memory so that the electronic device implements the syslog log analysis method as described above.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program codes executed by a processor, wherein the program codes include code for implementing the syslog log analysis method as described above.

[0045] Beneficial effects:

[0046] The present application provides a syslog log analysis method, which is applied to a target server, wherein the target server establishes a connection with a syslog server, and the syslog server establishes a connection with a syslog client. The method comprises: receiving a syslog log forwarded by a syslog server; wherein the syslog log is generated based on an event on a syslog client; analyzing the syslog log according to an operation rule to obtain an analysis result; if the analysis result indicates that the event is an illegal operation, an alarm is issued; wherein the illegal operation includes: bypassing login, unauthorized operation and illegal operation time;

[0047] In summary, the present application parses and analyzes syslog logs through the target server to automatically determine whether the event is any of bypass login, unauthorized operation and operation time violation, thereby effectively reducing the dependence on analysts; in addition, since multiple target servers can be set according to needs, the number of target servers can be specifically set according to actual needs, so as to further improve the processing capabilities of syslog logs. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. The following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A schematic diagram of a syslog log analysis method provided in an embodiment of the present application;

[0050] Figure 2 A flowchart of another syslog log analysis method provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of the structure of the syslog log analysis system provided in the embodiment of the present application;

[0052] Figure 4 An example diagram of a log management interface provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of the structure of a syslog log analysis device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0055] Syslog logs, which are standardized and transmitted based on the syslog protocol, are widely used in network devices, servers and applications due to their advantages of convenient centralized management, high security and strong scalability. Among them, network devices mainly refer to routers, switches or firewalls, servers mainly refer to Linux servers, and applications mainly refer to applications with intelligent interactive functions in terminal devices. The above-mentioned network devices, servers and applications are called syslog clients in the process of generating syslog logs.

[0056] When the syslog client generates a syslog log, it sends the generated syslog log to the corresponding syslog server for analysts to perform planned analysis on the syslog log on the syslog server. The purpose of the analysis is to confirm whether the event generated by the syslog client is an illegal operation.

[0057] With the development of technology and business expansion, the above manual analysis methods are increasingly unable to meet the analysis needs;

[0058] First, the analysis of syslog logs has high requirements for analysts. Specifically, the analysis of syslog logs requires analysts to not only understand the meaning of various fields in syslog logs, but also to have the skills to verify whether the processing configuration of syslog logs in the syslog server is correct. As a result, there are relatively few analysts who meet the requirements.

[0059] Secondly, with the development of AI technology, many IoT devices will also generate syslog logs, resulting in a massive increase in syslog logs, which further increases the demand for analysts. For example, in order to monitor the operating status in real time, sensors and actuators in some automated control systems will generate syslog logs during operation, and then send the syslog logs to the syslog server to analyze whether the events generated by the sensors and actuators are abnormal events or illegal operations. In actual applications, in order to meet the needs of real-time monitoring, a large number of analysts are required.

[0060] In addition, according to practical experience, manual analysis methods not only have the problem of low analysis efficiency, but are also prone to manual errors, resulting in low analysis quality;

[0061] In summary, it is now urgent to solve the problem of over-reliance on manual labor in existing syslog log analysis methods.

[0062] In order to solve the above problems, the present application proposes a syslog log analysis solution. The syslog log analysis solution provided by the present application is now further explained in conjunction with the accompanying drawings of the specification.

[0063] First, this application proposes a syslog log analysis method, which is applied to a target server, the target server establishes a connection with a syslog server, and the syslog server establishes a connection with a syslog client, such as Figure 1 As shown, Figure 1 A flow chart of a syslog log analysis method provided in an embodiment of the present application is as follows: Figure 1 The method shown includes: S100 to S400, the details of which are as follows:

[0064] S100: receiving syslog logs forwarded by the syslog server.

[0065] Specifically, in the prior art, an analyst analyzes the syslog log on the syslog server; in an embodiment of the present application, the syslog server directly forwards the syslog log to the target server, and then the syslog log is analyzed by the target server.

[0066] In actual implementation, it is necessary to install an application with log collection function on the syslog server to collect the logs sent by the syslog client and then forward the syslog logs.

[0067] The syslog log analysis method provided in this application supports the operation log management function, supports the complete collection and retention of log information of each network element, records including business issuance related operations and traditional operation and maintenance configuration operations, etc., and the log retention time is not less than 2 years. Supports the log query interface, and can query and export specific logs based on network elements, date and time, log level, operation type, operation user, log keywords and other fields. The log function should have user authority control, and only users with corresponding device or system management authority are allowed to access and extract the corresponding device and system log information. Log information should support encryption of original log data, and cannot be presented in plain text or accessed through any other form to bypass authority control.

[0068] Optionally, after receiving the syslog log forwarded by the syslog server, it is determined whether an operation rule is pre-configured, and if so, S200 is executed.

[0069] S200: Analyze the syslog log according to the operation rule to obtain an analysis result.

[0070] Specifically, in order to improve the accuracy of the target server's analysis of the syslog log and to facilitate the storage and query of the syslog log, before the log analysis is performed, the syslog log needs to be parsed according to the log format of the syslog log.

[0071] The analysis result indicates whether there is any illegal operation during the operation of the syslog client; the illegal operation includes: one of bypassing login, unauthorized operation and operation time violation.

[0072] Optionally, after receiving the syslog log, the present application intelligently identifies the log type; the log types include: login log, operation log, system log; based on the login log, it is determined whether there is a bypass login, and based on the operation log, it is determined whether there is an unauthorized operation and an operation time violation.

[0073] S300: Determine whether the analysis result indicates that the event is an illegal operation.

[0074] Specifically, different operation rules are set for different illegal operations. The operation rules specify the value ranges of multiple attribute data of the syslog log. When there is attribute data whose value does not conform to the value range among the multiple attribute data of the syslog log, the target server determines the syslog log as an illegal operation.

[0075] S400: If the analysis result indicates that the event is an illegal operation, an alarm is issued.

[0076] Specifically, "alarm" may refer to the process of generating alarm information, and may also refer to the process of sending the generated alarm information to the sys client, which is not specifically limited in this application. If the analysis result indicates that the event meets the operation rules, the target server continues to analyze the next syslog log.

[0077] In summary, firstly, parsing and analyzing syslog logs through the target server can effectively reduce the dependence on analysts; secondly, since multiple target servers can be set according to needs, the number of target servers can be set according to the number of syslog logs, further improving the processing capacity of syslog logs; in addition, the analysis process of syslog logs executed by the target server can avoid human errors and greatly improve the analysis efficiency and quality of syslog logs.

[0078] In one implementation, in order to further improve the processing capability of the syslog log analysis method for massive syslog logs, the present application proposes another syslog log analysis method, such as Figure 2 As shown, Figure 2 A flow chart of another syslog log analysis method provided in an embodiment of the present application, in which the functions of a target server when executing the syslog log analysis method are split into multiple servers to be executed separately in collaboration, and the multiple servers that collaboratively execute the syslog log analysis method constitute a log analysis system, that is, the present application splits the syslog log analysis method into multiple sub-processes and executes the multiple sub-processes separately through multiple servers in the log analysis system, so as to ensure the analysis efficiency and analysis quality of massive syslog logs; Figure 3 As shown, Figure 3 This is a structural diagram of the syslog log analysis system provided in an embodiment of the present application. The log analysis system 100 includes: a collection module 110, a first server 120, a second server 130 and a third server 140.

[0079] The collection module 110 is an application installed in the syslog server for collecting syslog logs. The collection module 110 sends the syslog logs sent by the syslog client to the syslog server to the first server 120; the first server 120 is used to aggregate the syslog logs sent by multiple syslog servers to obtain an aggregated syslog log, the second server 130 is used to store the aggregated syslog log in a message queue, and the third server 140 is used to request the aggregated syslog log in the message queue and analyze the received aggregated syslog log to obtain an analysis result; wherein the analysis result indicates whether the event generated based on the syslog client is an illegal operation; the illegal operations include: bypassing login, unauthorized operation and operation time violation; if the analysis result indicates that the event is an illegal operation, an alarm is issued.

[0080] Among them, the number of collection modules 110, first server 120, second server 130 and third server 140 can be multiple; the number of collection modules 110 is determined according to the number of syslog servers; the number of first servers 120, second servers 130 and third servers 140 is determined according to the order of magnitude of syslog logs to be analyzed, server load and server downtime rate and other factors affecting the efficiency of syslog log analysis, and this application does not make any specific restrictions on this.

[0081] like Figure 2 The method shown includes: S110 to S310, the details of which are as follows:

[0082] S110: The collection module receives the syslog log sent by the syslog server.

[0083] Specifically, the collecting module 110 is used to collect syslog logs sent by the syslog client in the syslog server.

[0084] S120: The collection module forwards the syslog log to the first server.

[0085] Specifically, the collection module 110 forwards the syslog logs collected in the syslog server to the first server 120 .

[0086] The first server 120 is used to collect syslog logs sent by multiple collection modules 110, and its purpose is to buffer the processing pressure of massive syslog logs on the third server 140; in detail, if the massive syslog logs sent by multiple collection modules 110 are directly sent to the third server 140, the massive syslog logs are likely to cause the third server 140 to crash, resulting in affecting the third server 140's analysis of the syslog logs. Therefore, in order to ensure the processing efficiency of the third server 140 for the syslog logs, the present application buffers the processing pressure of massive syslog logs by setting the first server 120.

[0087] S130: Receive, through the first server, syslog logs sent by multiple syslog servers and aggregate the received syslog logs to obtain an aggregated syslog log.

[0088] Specifically, after receiving the syslog logs sent by multiple syslog servers, the first server 120 aggregates the syslog logs to obtain an aggregated syslog log.

[0089] It should be emphasized that S110 to S140 are all executed in real time; in actual execution, the meaning of "aggregation" can be understood as placing the syslog logs sent by multiple syslog servers in a temporary storage area. When a preset number of syslog logs or a preset interval is received, the first server 120 sends the syslog logs in the storage area to the second server 130.

[0090] For example, each time the first server 120 receives the Ath syslog log, it sends the received A syslog logs to the second server 130 ; or the first server 120 sends the received multiple syslog logs to the second server 130 every 5 ms.

[0091] In actual implementation, a probe may be installed in the first server 120 , and the probe is used to collect syslog logs sent by multiple collection modules 110 .

[0092] S140: Transmitting the aggregated syslog log to the second server through the first server.

[0093] Specifically, in actual implementation, when a syslog log or an aggregated syslog log is sent across devices, the syslog log or the aggregated syslog log needs to be encrypted at the sending end, and accordingly, the encrypted syslog log or the aggregated syslog log needs to be decrypted at the receiving end to obtain the corresponding syslog log or the aggregated syslog log.

[0094] S150: The second server stores the received aggregated syslog log in a message sequence.

[0095] Specifically, the second server 130 is used to store the received aggregated syslog logs in a message sequence, and subsequently send the aggregated syslog logs in the message sequence to the third server 140 one by one. The purpose of setting it is to buffer the processing pressure of massive syslog logs on the third server 140.

[0096] In actual implementation, the message queue may be Kafka; as a distributed message queue, Kafka may receive a massive amount of aggregated syslog logs and serve as a buffer to store the massive amount of aggregated syslog logs.

[0097] S160: Send a log sending request to the second server through the third server.

[0098] Specifically, the third server 140 analyzes the aggregated syslog logs one by one. After completing the current analysis process each time, the third server 140 sends a log sending request to the second server 130 to request the aggregated syslog logs.

[0099] S170: In response to the second server receiving the log sending request sent by the third server, the second server retrieves an aggregated syslog log from the message sequence.

[0100] Specifically, after receiving the log sending request, the second server 130 retrieves an aggregated syslog log from the message queue.

[0101] S180: Send the retrieved aggregated syslog log to the third server through the second server.

[0102] In summary, when the syslog log analysis method is executed through a log analysis system, the processing pressure caused by massive syslog logs on the third server 140 can be effectively alleviated, and the analysis efficiency and analysis quality of the third server 140 in dealing with massive syslog logs can be improved.

[0103] In actual implementation, the third server 140 may process the aggregated syslog logs based on Flink; ZooKeeper may also be installed in the third server 140 to assist Flin in dynamically acquiring and updating configuration information.

[0104] In one implementation, S200 includes: Step (1) to Step (2), the details of which are as follows:

[0105] Step (1): parse and process the aggregated syslog log to obtain log information;

[0106] The log information includes: a plurality of attribute data corresponding one-to-one to a plurality of attribute fields.

[0107] Specifically, in the prior art, different versions of the syslog protocol need to follow different standards. Different versions of the syslog protocol usually correspond to different log formats. The syslog log displays the log content according to the log format. Now, a syslog log that complies with the RFC5424 standard is taken as an example;

[0108] Example: <34> 1 2024-07-10T18:30:01.234567+08:00myhost.example.com su-ID47-′su root′ failed for lonvick on / dev / pts / 8;

[0109] in, <34> , 1, 2024-07-10T18:30:01.234567+08:00, myhost.example.com, su, -, ID47, 'su root' failed for lonvick on / dev / pts / 8 are attribute data corresponding to various attribute fields in the log format, and the attribute fields are the log priority N1, the version number N2 of the syslog protocol, the timestamp N3 of the log generation, the host name N4 of the syslog client, the name N5 of the program or service that generates the syslog log, the process ID or name N6 that generates the syslog log, the log type N7, the separator N8, and the message content N9; wherein the message content may reflect information such as the user account, etc., which the third server 140 will extract and organize into attribute data accordingly;

[0110] The target server will pre-store the log format of the syslog log to be received; when the target server receives the syslog log, it will extract / split the syslog log according to the log format to obtain attribute data corresponding to different attribute fields; the target server will then convert the attribute data of some attribute fields into attribute data in natural language form.

[0111] In actual applications, in addition to being able to directly determine the above attribute data from the syslog log, the target server can also determine other multiple attribute data correspondingly based on the above attribute data and the pre-stored mapping information; in detail, in actual execution, the sys server connected to the third server 140 is determined, and the syslog client connected to the syslog server is also determined. When the syslog client is determined, the host name N4 of the syslog client, the device type M1 of the syslog client (when it is a device), the device manufacturer M2 of the syslog client (when it is a device), and the user account N9 of the user (set) who can operate the syslog client ′’ , the user operation authority M3 should be determined; in actual operation, the above-mentioned association relationships can be preset in the third server 140;

[0112] After the third server 140 extracts the above attribute data from the aggregated syslog log, it can determine the user account N9 operating the syslog client according to the message content N9. ′’ and user operation commands N9 9″’ , and then the host name N4 of the syslog client and the account N9 of the user who operates the syslog client in the attribute data can be used. ′’, the preset association relationship determines the device type M1 of the syslog client (when it is a device), the device manufacturer M2 of the syslog client (when it is a device), and the user operation authority M3.

[0113] In actual operation, the attribute data determined according to the association relationship can also be used as attribute data for analyzing the syslog log.

[0114] Step (2): Analyze the log information according to the operation rules to obtain analysis results;

[0115] The operation rule includes: at least one rule condition, and the rule condition indicates the value range of the attribute data. Specifically, the operation rule includes multiple rule conditions, each rule condition includes at least one value range of the attribute data, and the number and value range of the attribute data can be preset according to actual needs. The value of the attribute data is the specific value corresponding to the attribute data in the current aggregated syslog log. For example, the specific value corresponding to the device type M1 can be "router".

[0116] The execution logic of "and" or "or" can be set between multiple rule conditions; when the execution logic between two rule conditions is "and", the two rule conditions need to be met at the same time; when the execution logic between two rule conditions is "or", at least one of the two rule conditions must be met.

[0117] In one implementation, the operation rules include: a first operation rule, a second operation rule and a third operation rule, the first operation rule is used to determine whether the event indicates a bypass login, the second operation rule is used to determine whether the event indicates an unauthorized operation, and the third operation rule is used to determine whether the event indicates an operation time violation; step (2) includes: step (2.1), the details of which are as follows:

[0118] Step (2.1): The third server analyzes the syslog log according to the first operation rule, the second operation rule and the third operation rule to obtain a first analysis result, a second analysis result and a third analysis result.

[0119] Specifically, the illegal operations including bypass login, unauthorized operation and operation time violation should all have corresponding operation rules; among them, the first operation rule is used to determine whether the event indicates bypass login, the second operation rule is used to determine whether the event indicates unauthorized operation, and the third operation rule is used to determine whether the event indicates operation time violation; in actual application, the operation rules corresponding to different illegal operations are also set to be turned on / off;

[0120] For example, the first operation rule and the second operation rule may be set to on, and the third operation rule may be set to off. When the third server 140 analyzes the aggregated syslog log, only the first operation rule and the second operation rule are applied to obtain the analysis result.

[0121] In one implementation, the first operation rule includes: a value range of the host name, a value range of the user account; the second operation rule includes: a value range of the device type, a value range of the device manufacturer, a value range of the user account, and a value range of the user operation authority; the third operation rule includes: a value range of the device manufacturer, a value range of the user operation command, and a value range of the timestamp generated by the log; step (2.1) includes: steps (2.1.1) to (2.1.3), the details of which are as follows:

[0122] Step (2.1.1): If the current host name is not within the range of host name values, and / or the current user account is not within the range of user account values, the first analysis result is "bypass login".

[0123] Specifically, step (2.1.1) is a specific execution step for analyzing the syslog log according to the first operation rule; an example is now given for step (2.1.1), and the details are as follows:

[0124] The first operation rule includes two rule conditions, one rule condition includes the value range of the host name N4, and the other rule condition includes the user account N9 ′’ two rule conditions are "and" execution, that is, two value ranges need to be satisfied at the same time; in actual execution, the above value ranges have been preset in the third server 140.

[0125] For example, the bypass login operation rules are set as follows:

[0126] 1) If the current host name n4 is in the preset first host name set and the current user account n ′ 9 ’ is in the preset user account set, the corresponding analysis result will be "normal login";

[0127] 2) If the current host name n4 is in the preset second host name set and the current user account n ′ 9 ’ It is in the preset user account set, and the corresponding analysis result will be "Emergency Bypass Login";

[0128] 3) If the current host name n4 is not in the preset first host name set and the preset second host name set, and / or the current user account n′ 9 ’ If the account is not in the preset user account set, the corresponding analysis result will be "bypass login";

[0129] If the analysis result is "bypass login", the third server 140 issues an alarm;

[0130] The type of the preset first host name set is "conventional source", and the type of the preset second host name set is "emergency source".

[0131] Step (2.1.2): If any of the values ​​of the current device type, the current device manufacturer, the current user account, and the current user operation authority is not within the corresponding value range, the second analysis result is "illegal login".

[0132] Specifically, step (2.1.2) is a specific execution step for analyzing the syslog log according to the second operation rule; now an example is given for step (2.1.2), and the details are as follows:

[0133] The second operation rule includes: a rule condition, which includes the value range of the device type M1, the value range of the device manufacturer M2, the user account n9 ′’ The value range of the user operation authority M3; in actual execution, the above value range has been preset in the third server 140; when the third server 140 extracts the current host name n4 and message content n9 of the current aggregated syslog log, it determines the current device type m1, the current device manufacturer m2, and the current user account n9 according to the preset association relationship. ′ ′ ’ , current user operation permissions m3.

[0134] For example, the operation rules for unauthorized operation are set as follows:

[0135] 1) If the current device type is m1, the current device manufacturer is m2, and the current user account is n ′ 9 ’ , the current user operation permissions m3 are all within the value range, and the corresponding analysis result will be "compliant login";

[0136] 2) If the current device type is m1, the current device manufacturer is m2, and the current user account is n ′ 9 ’ , If any value in the current user operation permission m3 is out of the value range, the corresponding analysis result will be "illegal login";

[0137] If the analysis result is "illegal login", the third server 140 issues an alarm;

[0138] Step (2.1.3): If any of the values ​​of the current user operation command, the current device manufacturer, and the current timestamp is not within the corresponding value range, the third analysis result is "operation time violation".

[0139] Specifically, step (2.1.3) is a specific execution step for analyzing the syslog log according to the third operation rule; an example is now given for step (2.1.3), and the details are as follows: The third operation rule includes: two rule conditions, one rule condition includes the value range of the equipment manufacturer M2 and the value range of the user operation command N″9, and the other rule condition includes the value range of the timestamp N3 generated by the log; the two rule conditions are executed in an “and” manner, that is, the two value ranges need to be satisfied at the same time; in actual execution, the above value ranges have been preset in the third server 140; when the third server 140 extracts the message content n9 of the current aggregated syslog log, the current user operation command n″9 is determined according to the message content n9, and the current equipment manufacturer m2 is determined according to the preset association relationship;

[0140] For example, the third operation rule is now set as follows:

[0141] 1) If the current user operation command n″9, the current equipment manufacturer m2, and the current timestamp n3 are all within the value range, the corresponding analysis result will be "operation time compliance";

[0142] 2) If any of the values ​​of the current user operation command n″9, the current device manufacturer m2, and the current timestamp n3 is out of the value range, the corresponding analysis result will be "operation time violation";

[0143] If the analysis result is "operation time violation", the third server 140 issues an alarm. In one implementation, S400 includes: step (3), the details of which are as follows:

[0144] Step (3): If the third server determines that the first analysis result is a bypass login, determines that the second analysis result is an unauthorized operation, or determines that the third analysis result is an operation time violation, the third server issues an alarm.

[0145] Specifically, in actual execution, the event may be determined to be an illegal operation based on the first analysis result, the second analysis result or the third analysis result, or it may be determined not to be an illegal operation based on the first analysis result, the second analysis result or the third analysis result.

[0146] In one implementation, the method further includes: Steps (4) to (6), the details of which are as follows:

[0147] Step (4): The aggregated syslog log and corresponding log information are stored through a third server.

[0148] Specifically, after the third server 140 completes the analysis of the aggregated syslog log, it locally stores the aggregated syslog log and the corresponding log information for query.

[0149] Step (5): receiving a log query request through a third server;

[0150] The log query request includes a target value of the attribute data.

[0151] Specifically, Figure 4 As shown, Figure 4 This is an example diagram of a log management interface provided in an embodiment of the present application, wherein the log management interface includes: an input area and a display area; the input area is located at the top and is used to input query conditions, and the display area is located at the bottom and is used to display query results; wherein each input area corresponds to an attribute data, for example, the input area for "device name" corresponds to the host name N4, and the input area for "device type" corresponds to the device type M1.

[0152] In actual execution, the user enters the target value in the input area, and the third server 140 generates a log query request accordingly. For details, see Figure 4 The destination value "Router" is shown in .

[0153] Step (6): The third server selects log information whose corresponding attribute data value meets the target value from the stored log information according to the target value.

[0154] Specifically, when the user operates Figure 4 After clicking the "Query" control in the log management interface, the third server 140 queries according to the log query request to obtain log information whose corresponding attribute data value meets the target value. For details, see Figure 4 The log information is displayed in the display area.

[0155] Second, the present application proposes a syslog log analysis device, which is applied to a target server, the target server establishes a connection with a syslog server, and the syslog server establishes a connection with a syslog client, such as Figure 5 As shown, Figure 5 A schematic diagram of the structure of a syslog log analysis device provided in an embodiment of the present application, the device includes: a server docking module 610, a log analysis module 620 and an alarm module 630;

[0156] The server docking module 610 is used to receive the syslog log forwarded by the syslog server;

[0157] Among them, syslog logs are generated based on events on the syslog client;

[0158] The log analysis module 620 is used to analyze the syslog log according to the operation rules to obtain the analysis result;

[0159] The alarm module 630 is used to generate an alarm if the analysis result indicates that the event is an illegal operation; wherein the illegal operation includes: bypassing login, unauthorized operation and operation time violation.

[0160] In one implementation, the target server includes: a first server, a second server and a third server, the first server establishes a connection with the syslog server; the server docking module is set in the first server and the second server;

[0161] The server-side docking module in the first server is used to receive syslog logs sent by multiple syslog servers and aggregate the received syslog logs to obtain aggregated syslog logs; and is also used to send the aggregated syslog logs to the second server;

[0162] The server-side docking module in the second server is further used to store the received aggregated syslog log in a message sequence;

[0163] In response to the second server receiving a log sending request sent by the third server, the server docking module in the second server is also used to send a converged syslog log in the message sequence to the third server; the third server is used to analyze the syslog log according to the operation rules to obtain an analysis result.

[0164] In one implementation, the log analysis module 620 is disposed in the third server; the log analysis module 620 is further used to parse and process the aggregated syslog log to obtain log information;

[0165] The log information includes: a plurality of attribute data corresponding to the plurality of attribute fields one by one;

[0166] The log analysis module 620 is further used to analyze the log information according to the operation rules to obtain the analysis results; wherein the operation rules include: a plurality of rule conditions, and the rule conditions indicate the value range of the attribute data.

[0167] In one implementation, the operation rule includes: a first operation rule, a second operation rule and a third operation rule, the first operation rule is used to determine whether the event indicates a bypass login, the second operation rule is used to determine whether the event indicates an unauthorized operation, and the third operation rule is used to determine whether the event indicates an operation time violation;

[0168] The log analysis module 620 in the third server is further used to analyze the syslog log according to the first operation rule, the second operation rule and the third operation rule to obtain the first analysis result, the second analysis result and the third analysis result.

[0169] In one implementation, the first operation rule includes: a value range of a host name, a value range of a user account;

[0170] The log analysis module 620 in the third server is further configured to: if the current host name is not within the host name value range, and / or the current user account is not within the user account value range, the first analysis result is "bypass login";

[0171] And, the second operation rule includes: a value range of device type, a value range of device manufacturer, a value range of user account, and a value range of user operation authority;

[0172] The log analysis module 620 in the third server is also used to determine that if any one of the values ​​of the current device type, the current device manufacturer, the current user account, and the current user operation authority is not within the corresponding value range, the second analysis result is "illegal login";

[0173] And, the third operation rule includes: a value range of the device manufacturer, a value range of the user operation command, and a value range of the timestamp of log generation;

[0174] The log analysis module 620 in the third server is also used to, if any one of the values ​​in the current user operation command, the current equipment manufacturer, and the current timestamp is not in the corresponding value range, then the third analysis result is "operation time violation".

[0175] In one implementation, the alarm module 630 is disposed in the third server;

[0176] The alarm module 630 in the third server is also used to issue an alarm if the first analysis result is determined to be a bypass login, the second analysis result is determined to be an unauthorized operation, or the third analysis result is determined to be an operation time violation.

[0177] In one implementation, the device further includes: a data module; the data module is arranged in the third server;

[0178] The data module in the third server is used to store the aggregated syslog log and the corresponding log information;

[0179] The data module is also used to receive log query requests;

[0180] Wherein, the log query request includes a target value of the attribute data;

[0181] The data module is also used to filter out the log information whose corresponding attribute data meets the target value and the corresponding aggregated syslog log from the stored log information according to the target value.

[0182] Third, the present application provides an electronic device, which includes a processor and a memory, wherein the memory is used to store software programs, and the processor runs or executes the software programs stored in the memory so that the electronic device implements the syslog log analysis method shown in S100 to S400.

[0183] Fourthly, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program codes executed by a processor, wherein the program codes include the code for implementing the syslog log analysis method shown in S100 to S400.

[0184] Fifth, the present application provides a computer program product, including program code, and when a computer runs the computer program product, the computer executes the syslog log analysis method shown in S100 to S400.

[0185] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0186] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0187] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0188] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM) random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0189] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0190] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A syslog log analysis method, characterized in that: The method is applied to a target server, the target server establishes a connection with a syslog server, and the syslog server establishes a connection with a syslog client, and the method includes: Receive the syslog log forwarded by the syslog server; Wherein, the syslog log is generated based on the event in the syslog client; Analyze the syslog log according to the operation rules to obtain an analysis result; If the analysis result indicates that the event is an illegal operation, an alarm is issued; Among them, the illegal operations include: bypassing login, unauthorized operation and illegal operation time.

2. The method according to claim 1, characterized in that The target server includes: a first server, a second server and a third server, the first server establishes a connection with the syslog server; the receiving of the syslog log forwarded by the syslog server includes: The first server receives syslog logs sent by the plurality of syslog servers and aggregates the received syslog logs to obtain an aggregated syslog log; The first server sends the aggregated syslog log to the second server; After receiving the syslog log forwarded by the syslog server, the method further includes: The second server stores the received aggregated syslog log in a message sequence; In response to the second server receiving the log sending request sent by the third server, the second server sends one of the aggregated syslog logs in the message sequence to the third server; the third server is used to analyze the aggregated syslog log according to the operation rules to obtain an analysis result.

3. The method according to claim 1 or 2, characterized in that: The analyzing the syslog log according to the operation rule to obtain the analysis result includes: Parsing the syslog log to obtain log information; The log information includes: a plurality of attribute data corresponding to a plurality of attribute fields in a one-to-one correspondence; Analyze the log information according to the operation rules to obtain an analysis result; The operation rule includes: at least one rule condition, and the rule condition indicates the value range of the attribute data.

4. The method according to claim 3, characterized in that The operation rules include: a first operation rule, a second operation rule and a third operation rule, wherein the first operation rule is used to determine whether the event indicates the bypass login, the second operation rule is used to determine whether the event indicates the unauthorized operation, and the third operation rule is used to determine whether the event indicates an operation time violation; the analysis result obtained by analyzing the syslog log according to the operation rules includes: The third server analyzes the syslog log according to the first operation rule, the second operation rule and the third operation rule to obtain a first analysis result, a second analysis result and a third analysis result.

5. The method according to claim 4, characterized in that The first operation rule includes: a value range of a host name and a value range of a user account; If the current host name is not within the host name value range, and / or the current user account is not within the user account value range, the first analysis result is "bypass login"; The second operation rule includes: a value range of device type, a value range of device manufacturer, a value range of user account, and a value range of user operation authority; If any of the values ​​of the current device type, current device manufacturer, current user account, and current user operation authority is not within the corresponding value range, the second analysis result is "illegal login"; The third operation rule includes: the value range of the equipment manufacturer, the value range of the user operation command, and the value range of the timestamp of log generation; If any of the values ​​in the current user operation command, the current device manufacturer, and the current timestamp is not in the corresponding value range, the third analysis result is "operation time violation".

6. The method according to claim 5, characterized in that If the analysis result indicates that the event is an illegal operation, issuing an alarm includes: If the third server determines that the first analysis result is a bypass login, or determines that the second analysis result is an unauthorized operation, or determines that the third analysis result is an operation time violation, the third server issues an alarm.

7. The method according to claim 3, characterized in that The method further comprises: Storing the syslog log and the corresponding log information; Receive log query requests; Wherein, the log query request includes the target value of the attribute data; According to the target value, the log information whose corresponding attribute data meets the target value and the corresponding syslog log are screened out from the stored log information.

8. A syslog log analysis device, characterized in that: The device is applied to a target server, the target server establishes a connection with a syslog server, the syslog server establishes a connection with a syslog client, and the device includes: a server docking module, a log analysis module and an alarm module; The server docking module is used to receive the syslog log forwarded by the syslog server; Wherein, the syslog log is generated based on the event in the syslog client; The log analysis module is used to analyze the syslog log according to the operation rules to obtain the analysis result; The alarm module is used to issue an alarm if the analysis result indicates that the event is an illegal operation; wherein the illegal operation includes: bypassing login, unauthorized operation and operation time violation.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, the memory is used to store a software program, and the processor runs or executes the software program stored in the memory so that the electronic device implements the syslog log analysis method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes executed by a processor, wherein the program codes include code for implementing the syslog log analysis method according to any one of claims 1 to 7.

Images