System audit log collection and analysis method and device

Abstract

The invention discloses a system audit log collection and analysis method and device, and relates to the technical field of log collection and analysis, and the method comprises the steps: defining each module in a system and a behavior executed by each module; when a user clicks a menu on an interface to trigger a corresponding event, the triggered event is intercepted, an object attribute related to operation is obtained, and the obtained attribute information is notified to a related service component for further processing and recording; after receiving the attribute information of the operation object, the service component loads an audit log component; the auditing log component processes the menu information, arranges the menu information into a preset rule format and writes the menu information into a log file; collecting a log file in real time, processing and cleaning to form structured data, and writing the structured data into a data warehouse; and performing association analysis on the structured data of the data warehouse, and visually displaying an analysis result. The method is used for collecting, storing, querying and analyzing the log data of the application system in real time.

Description

Technical Field

[0001] The present invention relates to the technical field of log collection and analysis, and in particular to a method and device for collecting and analyzing system audit logs. Background Art

[0002] With the rapid development of cloud computing technology and the in-depth promotion of government informationization, the security, reliability and compliance of government cloud, as an important infrastructure to support government services and improve governance efficiency, have attracted much attention. Government cloud audit log technology has emerged to record operations and events in the government cloud environment, ensure information security, and provide a basis for compliance audits. Audit logs record all operations and events in the government cloud environment, including key information such as user login, resource configuration, and data access. These logs are of great significance for ensuring the safe and stable operation of the government cloud, monitoring abnormal behavior, tracing the source of security incidents, and meeting compliance requirements.

[0003] With the expansion of the scale of government cloud and the diversification of services, the generation, storage and analysis of audit logs face huge challenges. Since there are many modules in the business system of government cloud, to generate audit logs, each module must call the log method module to write data to the table, resulting in bloated code and difficult maintenance; at the same time, due to the frequent and large-scale operations of users, many logs are generated every day, and the large amount of data in traditional database tables can no longer meet their business scenarios; for developers, business development often does not need to care about log writing, which is a function that is not related to the business. Summary of the invention

[0004] In view of the needs and shortcomings of current technological development, the present invention provides a method and device for collecting and analyzing system audit logs to efficiently and reliably perform real-time collection, storage, query and analysis of large-scale application system log data.

[0005] In the first aspect, the present invention provides a method for collecting and analyzing system audit logs. The technical solution adopted to solve the above technical problems is as follows:

[0006] A method for collecting and analyzing system audit logs comprises the following steps:

[0007] S1. Define the modules in the system and the behaviors performed by each module;

[0008] S2. When the user clicks a menu on the interface to trigger a corresponding event, the triggered event is intercepted, object attributes related to the operation are obtained, and the obtained attribute information is notified to the relevant business components for further processing and recording;

[0009] S3. After receiving the attribute information of the operation object, the business component loads the audit log component; the audit log component processes the menu information, and then organizes the processed information into a preset rule format and writes it into a log file;

[0010] S4, collect log files in real time, process and clean them to form structured data and write them into the data warehouse;

[0011] S5. Use data analysis tools and techniques to conduct correlation analysis on the structured data in the data warehouse and intuitively display the analysis results.

[0012] Optionally, the modules involved refer to relatively independent functional units or components in the system, and the modules work together to realize the overall function of the system; when defining the modules in the system, first divide the system into multiple functional modules according to business logic, or divide the system into multiple component modules according to technical implementation, and then clarify the functions and responsibilities of each module;

[0013] Behavior refers to the operations or activities that occur within a module or between modules. When defining the behavior performed by each module, first identify the pre-specified behaviors in each module, then describe each behavior in detail, including the triggering conditions, execution process, expected results, and possible abnormal situations of the behavior, and finally evaluate the risk of each behavior.

[0014] Optionally, the step S2 involved specifically includes:

[0015] S2.1. Define interception logic: Use the idea of ​​Spring AOP to write a section according to actual business needs. The section contains three types of notifications: pre-, post- and surround, which are used to handle the interception and collection logic when the user clicks the menu event;

[0016] S2.2. Create a custom annotation: define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted;

[0017] S2.3. Apply annotations to controller methods: In the Spring MVC architecture, find the controller method that handles menu click events and add the @OperateAuditLogAction annotation to the method;

[0018] S2.4. Configure the aspect: Configure the aspect in the Spring configuration file to make it effective, and ensure that the aspect can recognize and process methods annotated with @OperateAuditLogAction;

[0019] S2.5. Implement aspect logic: Implement specific interception logic in the aspect, including obtaining object attributes related to the operation, and notifying the obtained attribute information to related business components for further processing and recording; the execution order will be different depending on the notification type set.

[0020] Further optionally, the audit log component involved processes the menu information, and then organizes the processed information into a preset rule format and writes it into a log file. This process includes:

[0021] S3.1. Define aspects and pointcuts: Using the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods need to be intercepted;

[0022] S3.2. Define an around notification: In the aspect class, use the @Around annotation to define an around notification method, which will be processed before and after the target method is executed, thereby processing the menu information;

[0023] S3.3. Obtain request parameters: In the surround notification method, obtain relevant information of the request through method parameters, and process the obtained relevant information;

[0024] S3.4, global storage value write log: use MDC global storage to process related information;

[0025] S3.5. Configure the Logback framework: Use the logback.xml configuration file to specify the log output path and set the variable template, so that the processed information is recorded in the specified log file according to the preset rules;

[0026] S3.6, message segmentation: Use the "@|@" symbol to segment the log message and pass the obtained relevant information to facilitate the subsequent log collection, processing and cleaning;

[0027] S3.7. Output to the specified path: Through the configuration of Logback, the processed log information is output to the specified file path.

[0028] Optionally, executing step S5, performing association analysis on the structured data in the data warehouse means discovering potential problems, anomalies or trends by mining the associations and patterns between the data, and then using the echart plug-in to render the analyzed data and make a report to display to the client.

[0029] In a second aspect, the present invention provides a system audit log collection and analysis device, and the technical solution adopted to solve the above technical problems is as follows:

[0030] A collection and analysis device for system audit logs, comprising:

[0031] The system definition module is used to define the modules in the system and the behaviors performed by each module;

[0032] The event interception and processing module is used to monitor the menu click events of the user on the interface, and first intercept the menu click event when it occurs, then obtain the object attributes related to the operation, and notify the relevant business components of the acquired attribute information for further processing and recording;

[0033] A receiving and loading module is used to receive attribute information of the operation object using the business component and load the audit log component;

[0034] The audit log processing module is used to process the received information using the audit log component, and then organize the processed information into a preset rule format and write it into a log file;

[0035] The log data processing module is used to collect log files in real time, process and clean them, and then write them into the data warehouse into structured data.

[0036] The data analysis and display module is used to use data analysis tools and techniques to perform correlation analysis on the structured data in the data warehouse and intuitively display the analysis results.

[0037] Optionally, the system definition module involved defines each module in the system and the behavior performed by each module, wherein a module refers to a relatively independent functional unit or component in the system, and each module works together to realize the overall function of the system, and a behavior refers to an operation or activity occurring within or between modules;

[0038] When defining the modules in the system, the system is first divided into multiple functional modules according to business logic, or divided into multiple component modules according to technical implementation, and then the functions and responsibilities of each module are clarified;

[0039] When the system definition module defines the behavior performed by each module, it first identifies the pre-specified behavior in each module, then describes each behavior in detail, including the triggering conditions, execution process, expected results and possible abnormal situations of the behavior, and finally evaluates the risk of each behavior.

[0040] Optionally, the event interception and processing modules involved include:

[0041] Define the interception unit, use the idea of ​​Spring AOP, and write a section according to actual business needs. The section contains three types of notifications: pre-, post-, and surround, which are used to handle the interception and collection logic when the user clicks the menu event;

[0042] Define an annotation unit to define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted;

[0043] The annotation application unit is used to find the controller method that handles the menu click event in the Spring MVC architecture and add the @OperateAuditLogAction annotation to the method;

[0044] Configure the aspect unit, which is used to configure the aspect in the Spring configuration file to make it effective and ensure that the aspect can recognize and process methods annotated with @OperateAuditLogAction;

[0045] The aspect implementation unit is used to implement specific interception logic in the aspect, including obtaining object attributes related to the operation and notifying the obtained attribute information to related business components for further processing and recording; the execution order will be different depending on the set notification type.

[0046] Further optionally, the audit log processing module involved processes the received information using the audit log component, and then organizes the processed information into a preset rule format and writes it into a log file. This process includes:

[0047] Using the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods need to be intercepted;

[0048] In the aspect class, use the @Around annotation to define an around notification method, which will be processed before and after the target method is executed, thereby processing the menu information;

[0049] In the surround notification method, obtain the relevant information of the request through the method parameters and process the obtained relevant information;

[0050] Use MDC to globally store the processed related information;

[0051] Use the logback.xml configuration file to specify the log output path and set the variable template, so that the processed information is recorded in the specified log file according to the preset rules;

[0052] Use the "@|@" symbol to split the log message and pass the acquired relevant information to facilitate subsequent log collection, processing, and cleaning;

[0053] Through the configuration of Logback, the processed log information is output to the specified file path.

[0054] Optionally, the data analysis and display module performs correlation analysis on the structured data in the data warehouse, which means discovering potential problems, anomalies or trends by mining the correlation relationships and patterns between the data. Subsequently, the echart plug-in is used to render the analyzed data and make a report to display to the client.

[0055] Compared with the prior art, the method and device for collecting and analyzing system audit logs of the present invention have the following beneficial effects:

[0056] The present invention can efficiently and reliably perform real-time collection, storage, query and analysis of large-scale application system log data, and solve the tracing problem during user operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Attached Figure 1 is a flow chart of a method according to Embodiment 1 of the present invention;

[0058] Attached Figure 2 This is a module connection block diagram of the second embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the technical solution, the technical problem solved and the technical effect of the present invention more clearly understood, the technical solution of the present invention is clearly and completely described below in conjunction with specific embodiments.

[0060] Embodiment 1:

[0061] Combined with Figure 1 This embodiment proposes a method for collecting and analyzing system audit logs, which includes the following steps:

[0062] S1. Define the modules in the system and the behaviors performed by each module.

[0063] Modules refer to relatively independent functional units or components in the system. Each module works together to realize the overall function of the system. When defining each module in the system, first divide the system into multiple functional modules according to business logic, or divide the system into multiple component modules according to technical implementation, and then clarify the functions and responsibilities of each module.

[0064] Behavior refers to the operations or activities that occur within a module or between modules. When defining the behavior performed by each module, first identify the pre-specified behaviors in each module, then describe each behavior in detail, including the triggering conditions, execution process, expected results, and possible abnormal situations of the behavior, and finally evaluate the risk of each behavior.

[0065] S2. When the user clicks a menu on the interface to trigger a corresponding event, the triggered event is intercepted, the object attributes related to the operation are obtained, and the obtained attribute information is notified to the relevant business components for further processing and recording. This process specifically includes:

[0066] S2.1. Define interception logic: Use the idea of ​​Spring AOP (aspect-oriented programming) to write an aspect according to actual business needs. The aspect contains three types of notifications: pre-, post- and surround, which are used to handle the interception and collection logic when the user clicks the menu event;

[0067] S2.2. Create a custom annotation: define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted;

[0068] S2.3. Apply annotations to controller methods: In the Spring MVC architecture, find the controller method that handles menu click events and add the @OperateAuditLogAction annotation to the method;

[0069] S2.4. Configure the aspect: In the Spring configuration file (such as applicationContext.xml or using a Java configuration class), configure the aspect to make it effective, ensuring that the aspect can recognize and process methods annotated with @OperateAuditLogAction;

[0070] S2.5. Implement aspect logic: Implement specific interception logic in the aspect, including obtaining object attributes related to the operation, and notifying the obtained attribute information to related business components for further processing and recording; the execution order will be different depending on the notification type set.

[0071] S3. After receiving the attribute information of the operation object, the business component loads the audit log component. The audit log component processes the menu information, and then organizes the processed information into a preset rule format and writes it into a log file. This process includes:

[0072] S3.1. Define aspects and pointcuts: Using the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods need to be intercepted;

[0073] S3.2. Define an around notification: In the aspect class, use the @Around annotation to define an around notification method, which will be processed before and after the target method is executed, thereby processing the menu information;

[0074] S3.3. Obtain request parameters: In the surround notification method, obtain relevant information of the request through method parameters, and process the obtained relevant information;

[0075] S3.4. Global storage value writing log: Use MDC (Mapped Diagnostic Context) to globally store the processed related information;

[0076] S3.5. Configure the Logback framework: Use the logback.xml configuration file to specify the log output path and set the variable template, so that the processed information is recorded in the specified log file according to the preset rules;

[0077] S3.6, message segmentation: Use the "@|@" symbol to segment the log message and pass the obtained relevant information to facilitate the subsequent log collection, processing and cleaning;

[0078] S3.7. Output to the specified path: Through the configuration of Logback, the processed log information is output to the specified file path.

[0079] S4. Collect log files in real time, process and clean them to form structured data and write them into the data warehouse.

[0080] When executing this step, the filebeat log collection component is used to collect logs and output them to logstash, which processes and cleans them to form structured data and writes them into the data warehouse. Processing refers to parsing, extracting, and converting the data in the log file to a structured data format, and cleaning refers to removing noise, duplication, and invalid data from the log data to improve the accuracy and availability of the data.

[0081] It should be added that filebeat is a mature log collector that collects data into the data warehouse through rule configuration.

[0082] S5. Use data analysis tools and techniques to conduct correlation analysis on the structured data in the data warehouse and intuitively display the analysis results.

[0083] Correlation analysis of structured data in a data warehouse refers to discovering potential problems, anomalies, or trends by mining the associations and patterns between data. Subsequently, the echart plug-in is used to render the analyzed data and present it to the client as a report.

[0084] Embodiment 2:

[0085] Combined with Figure 2 This embodiment provides a collection and analysis device for system audit logs, which includes:

[0086] The system definition module is used to define the modules in the system and the behaviors performed by each module;

[0087] The event interception and processing module is used to monitor the menu click events of the user on the interface, and first intercept the menu click event when it occurs, then obtain the object attributes related to the operation, and notify the relevant business components of the acquired attribute information for further processing and recording;

[0088] A receiving and loading module is used to receive attribute information of the operation object using the business component and load the audit log component;

[0089] The audit log processing module is used to process the received information using the audit log component, and then organize the processed information into a preset rule format and write it into a log file;

[0090] The log data processing module is used to collect log files in real time, process and clean them, and then write them into the data warehouse into structured data.

[0091] The data analysis and display module is used to use data analysis tools and techniques to perform correlation analysis on the structured data in the data warehouse and intuitively display the analysis results.

[0092] In this embodiment, the system definition module involved defines each module in the system and the behavior performed by each module, wherein a module refers to a relatively independent functional unit or component in the system, and each module works together to realize the overall function of the system, and a behavior refers to an operation or activity that occurs within a module or between modules. When the system definition module defines each module in the system, it first divides the system into multiple functional modules according to business logic, or divides the system into multiple component modules according to technical implementation, and then clarifies the functions and responsibilities of each module. When the system definition module defines the behavior performed by each module, it first identifies the pre-specified behavior in each module, and then describes each behavior in detail, including the triggering conditions, execution process, expected results, and possible abnormal situations of the behavior, and finally evaluates the risk of each behavior.

[0093] In this embodiment, the event interception and processing modules involved include:

[0094] Define an interception unit and use the idea of ​​Spring AOP (aspect-oriented programming) to write an aspect according to actual business needs. The aspect contains three types of notifications: pre-, post- and surround, which are used to handle the interception and collection logic when the user clicks the menu event;

[0095] Define an annotation unit to define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted;

[0096] The annotation application unit is used to find the controller method that handles the menu click event in the Spring MVC architecture and add the @OperateAuditLogAction annotation to the method;

[0097] Configuration aspect unit is used to configure the aspect in the Spring configuration file (such as applicationContext.xml or using Java configuration class) to make it effective and ensure that the aspect can identify and process methods annotated with @OperateAuditLogAction;

[0098] The aspect implementation unit is used to implement specific interception logic in the aspect, including obtaining object attributes related to the operation and notifying the obtained attribute information to related business components for further processing and recording; the execution order will be different depending on the set notification type.

[0099] In this embodiment, the audit log processing module uses the audit log component to process the received information, and then organizes the processed information into a preset rule format and writes it into a log file. This process includes:

[0100] Using the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods need to be intercepted;

[0101] In the aspect class, use the @Around annotation to define an around notification method, which will be processed before and after the target method is executed, thereby processing the menu information;

[0102] In the surround notification method, obtain the relevant information of the request through the method parameters and process the obtained relevant information;

[0103] Use MDC (Mapped Diagnostic Context) to globally store the processed related information;

[0104] Use the logback.xml configuration file to specify the log output path and set the variable template, so that the processed information is recorded in the specified log file according to the preset rules;

[0105] Use the "@|@" symbol to split the log message and pass the acquired relevant information to facilitate subsequent log collection, processing, and cleaning;

[0106] Through the configuration of Logback, the processed log information is output to the specified file path.

[0107] In this embodiment, the data analysis and display module involved performs correlation analysis on the structured data in the data warehouse, which means discovering potential problems, anomalies or trends by mining the correlation relationships and patterns between the data. Subsequently, the echart plug-in is used to render the analyzed data and make a report to display to the client.

[0108] In summary, the method and device for collecting and analyzing system audit logs of the present invention can efficiently and reliably perform real-time collection, storage, query and analysis of large-scale application system log data.

[0109] The above specific examples are used to explain the principles and implementation methods of the present invention in detail. These examples are only used to help understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, any improvements and modifications made by technicians in this technical field without departing from the principles of the present invention should fall within the scope of patent protection of the present invention.

Claims

1. A method for collecting and analyzing system audit logs, characterized in that: The steps include: S1. Define the modules in the system and the behaviors performed by each module; S2. When the user clicks a menu on the interface to trigger a corresponding event, the triggered event is intercepted, object attributes related to the operation are obtained, and the obtained attribute information is notified to the relevant business components for further processing and recording; S3. After receiving the attribute information of the operation object, the business component loads the audit log component; the audit log component processes the menu information, and then organizes the processed information into a preset rule format and writes it into a log file; S4, collect log files in real time, process and clean them to form structured data and write them into the data warehouse; S5. Use data analysis tools and techniques to conduct correlation analysis on the structured data in the data warehouse and intuitively display the analysis results.

2. According to the method for collecting and analyzing system audit logs according to claim 1, it is characterized in that: Modules refer to relatively independent functional units or components in the system. Each module works together to realize the overall function of the system. When defining each module in the system, first divide the system into multiple functional modules according to business logic, or divide the system into multiple component modules according to technical implementation, and then clarify the functions and responsibilities of each module. Behavior refers to the operations or activities that occur within a module or between modules. When defining the behavior performed by each module, first identify the pre-specified behaviors in each module, then describe each behavior in detail, including the triggering conditions, execution process, expected results, and possible abnormal situations of the behavior, and finally evaluate the risk of each behavior.

3. The method for collecting and analyzing system audit logs according to claim 1 is characterized in that: The step S2 specifically includes: S2.

1. Define interception logic: Use the idea of ​​Spring AOP to write a section according to actual business needs. The section contains three types of notifications: pre-, post- and surround, which are used to handle the interception and collection logic when the user clicks the menu event; S2.

2. Create a custom annotation: define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted; S2.

3. Apply annotations to controller methods: In the Spring MVC architecture, find the controller method that handles menu click events and add the @OperateAuditLogAction annotation to the method; S2.

4. Configure the aspect: In the Spring configuration file, configure the aspect to make it effective, and ensure that the aspect can recognize and process methods annotated with @OperateAuditLogAction; S2.

5. Implement aspect logic: Implement specific interception logic in the aspect, including obtaining object attributes related to the operation, and notifying the obtained attribute information to related business components for further processing and recording; the execution order will be different depending on the notification type set.

4. A method for collecting and analyzing system audit logs according to claim 3, characterized in that: The audit log component processes the menu information, then organizes the processed information into a preset rule format and writes it into the log file. This process includes: S3.

1. Define aspects and pointcuts: Using the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods need to be intercepted; S3.

2. Define an around notification: In the aspect class, use the @Around annotation to define an around notification method, which will be processed before and after the target method is executed, thereby processing the menu information; S3.

3. Obtain request parameters: In the surround notification method, obtain relevant information of the request through method parameters, and process the obtained relevant information; S3.4, global storage value write log: use MDC global storage to process related information; S3.

5. Configure the Logback framework: Use the logback.xml configuration file to specify the log output path and set the variable template, so that the processed information is recorded in the specified log file according to the preset rules; S3.6, message segmentation: Use the "@|@" symbol to segment the log message and pass the acquired relevant information to facilitate the subsequent log collection, processing and cleaning; S3.

7. Output to the specified path: Through the configuration of Logback, the processed log information is output to the specified file path.

5. The method for collecting and analyzing system audit logs according to claim 1 is characterized in that: Execute step S5 to perform association analysis on the structured data in the data warehouse, which means to discover potential problems, anomalies or trends by mining the associations and patterns between the data. Then, the echart plug-in is used to render the analyzed data and make a report to display to the client.

6. A system audit log collection and analysis device, characterized in that: It includes: The system definition module is used to define the modules in the system and the behaviors performed by each module; The event interception and processing module is used to monitor the menu click events of the user on the interface, and first intercept the menu click event when it occurs, then obtain the object attributes related to the operation, and notify the relevant business components of the acquired attribute information for further processing and recording; A receiving and loading module is used to receive attribute information of the operation object using the business component and load the audit log component; The audit log processing module is used to process the received information using the audit log component, and then organize the processed information into a preset rule format and write it into a log file; The log data processing module is used to collect log files in real time, process and clean them, and then write them into the data warehouse into structured data. The data analysis and display module is used to use data analysis tools and techniques to perform correlation analysis on the structured data in the data warehouse and intuitively display the analysis results.

7. The system audit log collection and analysis device according to claim 6, characterized in that: The system definition module defines each module in the system and the behavior performed by each module, wherein a module refers to a relatively independent functional unit or component in the system, and each module works together to realize the overall function of the system, and a behavior refers to an operation or activity occurring within a module or between modules; When the system definition module defines each module in the system, the system is first divided into multiple functional modules according to business logic, or the system is divided into multiple component modules according to technical implementation, and then the functions and responsibilities of each module are clarified; When the system definition module defines the behavior performed by each module, it first identifies the pre-specified behavior in each module, then describes each behavior in detail, including the triggering conditions, execution process, expected results and possible abnormal situations of the behavior, and finally evaluates the risk of each behavior.

8. The system audit log collection and analysis device according to claim 6, characterized in that: The event interception and processing module includes: Define the interception unit, use the idea of ​​Spring AOP, and write a section according to actual business needs. The section contains three types of notifications: pre-, post-, and surround, which are used to handle the interception and collection logic when the user clicks the menu event; Define an annotation unit to define an annotation named @OperateAuditLogAction, which is used to mark the method that needs to be intercepted; The annotation application unit is used to find the controller method that handles the menu click event in the Spring MVC architecture and add the @OperateAuditLogAction annotation to the method; Configure the aspect unit, which is used to configure the aspect in the Spring configuration file to make it effective and ensure that the aspect can recognize and process methods annotated with @OperateAuditLogAction; The aspect implementation unit is used to implement specific interception logic in the aspect, including obtaining object attributes related to the operation and notifying the obtained attribute information to related business components for further processing and recording; the execution order will be different depending on the set notification type.

9. The system audit log collection and analysis device according to claim 8, characterized in that: The audit log processing module processes the received information using the audit log component, and then organizes the processed information into a preset rule format and writes it into a log file. This process includes: Using the features of Spring AOP, define an aspect and a pointcut, where: the aspect class is annotated with @Aspect; the pointcut method is annotated with @Pointcut to specify which methods need to be intercepted; In the aspect class, use the @Around annotation to define an around notification method, which will be processed before and after the target method is executed, thereby processing the menu information; In the surround notification method, obtain the relevant information of the request through the method parameters and process the obtained relevant information; Use MDC to globally store the processed related information; Use the logback.xml configuration file to specify the log output path and set the variable template, so that the processed information is recorded in the specified log file according to the preset rules; Use the "@|@" symbol to split the log message and pass the relevant information to facilitate subsequent log collection, processing and cleaning; Through the configuration of Logback, the processed log information is output to the specified file path.

10. The system audit log collection and analysis device according to claim 6, characterized in that: The data analysis and display module performs association analysis on the structured data in the data warehouse, which means discovering potential problems, anomalies or trends by mining the associations and patterns between the data. Subsequently, the echart plug-in is used to render the analyzed data and make a report to display to the client.

Images