Log generation method and device, equipment and storage medium

Abstract

The invention provides a log generation method and device, equipment and a storage medium. Comprising the steps of screening out log data meeting a rule template from original log data according to the preset rule template; formatting the log data meeting the rule template to obtain standard log data; generating random log data based on the standard log data and a preset parameter range; and generating a complete log file based on the random log data and the standard log data. The invention aims to provide a system for constructing complete log transmission based on an existing log format, standardized, structured and multi-scene logs can be quickly generated, automatic log data construction is realized, the workload of manual writing and log code adjustment is reduced, and remarkable efficiency improvement is brought to a software development process.

Description

Technical Field

[0001] The present application relates to the technical field of log processing, and in particular to a log generation method, apparatus, device and storage medium. Background Art

[0002] In modern software engineering practice, the generation and processing of log data is crucial for system monitoring, fault diagnosis, and performance optimization. As a means of recording system operating status and user behavior, logs can help developers and operation and maintenance teams track problems, analyze anomalies, and optimize system performance. However, the generation and management of log data often involves complex logic and format requirements, and currently developers are often required to manually write and adjust log code. This not only consumes a lot of developers' time, but also increases the maintenance cost of the system. Summary of the invention

[0003] The embodiments of the present application provide a log generation method, apparatus, device and storage medium to at least solve the technical problem in the related art that it is difficult to quickly generate standardized and structured logs.

[0004] According to one aspect of an embodiment of the present application, a log generation method is provided, including:

[0005] According to a preset rule template, the log data satisfying the rule template is filtered out from the original log data;

[0006] Formatting the log data satisfying the rule template to obtain standard log data;

[0007] Generate random log data based on the standard log data and a preset parameter range;

[0008] A complete log file is generated based on the random log data and the standard log data.

[0009] In one embodiment, before filtering out log data satisfying the rule template from the original log data according to the preset rule template, the method further includes:

[0010] Perform statistical analysis on raw log data to identify multiple behavioral patterns;

[0011] Extracting key fields from the original log data;

[0012] The rule template is generated according to the identified behavior pattern and key fields.

[0013] In one embodiment, it further includes:

[0014] The rule template library is displayed in a user interface, and the user interface provides one or more operation interfaces for editing, saving, deleting, and adding the rule templates in the rule template library.

[0015] In one implementation, formatting the log data satisfying the rule template to obtain standard log data includes:

[0016] Using a log parsing tool to parse the log data that meets the rule template and extract key fields;

[0017] According to the preset formatting model, a format conversion operation is performed on the extracted key fields to obtain the standard log data.

[0018] In one implementation, generating random log data based on the standard log data and a set parameter range includes:

[0019] Generate a log template including variable placeholders based on the log template corresponding to the standard log data;

[0020] Generate random data according to a preset parameter range, wherein the parameter range includes a random number range, a character set, and a data option;

[0021] The random data is filled into the log template including the variable placeholder to obtain the random log data.

[0022] In one implementation, after generating a complete log file based on the random log data and the standard log data, the method further includes:

[0023] Receive a source device IP address and at least one destination device IP address configured by a user;

[0024] According to the source device IP address, the complete log file is simulated and sent from the source device to the destination device corresponding to the at least one destination device IP address.

[0025] In one embodiment, before simulating sending the complete log file from the source device to the destination device corresponding to the at least one destination device IP address, the method further includes:

[0026] Receive the number of transmissions and the transmission interval information configured by the user;

[0027] A scheduled task is generated based on the sending number and the sending interval information, and the complete log file is cyclically sent based on the scheduled task.

[0028] According to another aspect of an embodiment of the present application, a log generating device is provided, including:

[0029] A rule association analysis module is used to filter out log data that meets the rule template from the original log data according to the preset rule template;

[0030] A formatting module, used for formatting the log data satisfying the rule template to obtain standard log data;

[0031] A random module, used to generate random log data based on the standard log data and a preset parameter range;

[0032] A generating module is used to generate a complete log file based on the random log data and the standard log data.

[0033] According to another aspect of the embodiments of the present application, there is further provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the log generation method through the computer program.

[0034] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned log generation method when running.

[0035] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0036] This application uses a preset rule template to efficiently filter out logs that meet specific conditions from a large amount of log data. This process greatly improves the pertinence and efficiency of log processing. The filtered log data is formatted so that the log information is converted into a unified standard format, which is not only convenient for storage and query, but also makes the log data more compatible between different systems and platforms. Standardized log data helps to extract useful information quickly and accurately, which is crucial for key operations such as system monitoring, security auditing, and troubleshooting. In addition, this application can also generate random log data based on standard log data and a set parameter range, realize the expansion of log data, construct logs in more scenarios, and analyze the device status based on the generated log data.

[0037] Through the solution of this application, standardized, structured and multi-scenario logs can be quickly generated, and the construction of automated log data can be realized, which brings significant efficiency improvements to the software development process. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0039] Figure 1 is a flow chart of a log generation method according to an embodiment of the present application;

[0040] Figure 2 is a schematic diagram of a system function interface according to an embodiment of the present application;

[0041] Figure 3 It is a schematic diagram of a log generation and sending method according to an embodiment of the present application;

[0042] Figure 4 is a schematic diagram of another system function interface according to an embodiment of the present application;

[0043] Figure 5 is a schematic diagram of another log generation and sending method according to an embodiment of the present application;

[0044] Figure 6 is a schematic diagram of another system function interface according to an embodiment of the present application;

[0045] Figure 7 is a schematic diagram of another log generation and sending method according to an embodiment of the present application;

[0046] Figure 8 is a schematic diagram of another system function interface according to an embodiment of the present application;

[0047] Fig. 9 is a schematic diagram of another log generation and sending method according to an embodiment of the present application;

[0048] Fig.10 It is a schematic diagram of a log generation and sending method according to an embodiment of the present application;

[0049] Fig.11 is a schematic diagram of a log generating device according to an embodiment of the present application;

[0050] Fig.12 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0052] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0053] The method provided in the embodiment of the present application can quickly generate standardized, structured and multi-scenario logs, and realize the rapid and stable construction of target logs. Based on the generated logs, the device status is analyzed, and developers and operation and maintenance personnel can more easily track system behavior, identify anomalies, perform troubleshooting and performance optimization.

[0054] The following is combined with Figure 1 The log generation method of the embodiment of the present application is described in detail. Figure 1 As shown, the method mainly includes the following steps:

[0055] S101 selects log data satisfying the rule template from the original log data according to the preset rule template.

[0056] After obtaining the collected raw log data, you can filter it based on the preset rule template to obtain the log data that meets the rule template. The rule template is the rule template selected by the user in the rule template library in the system interface. For example, the rule template is "security log type, the source IP is the same, but the destination IP is different". You can filter out the log data that meets the rule.

[0057] In one implementation, the rule template library is displayed in a user interface, and the user interface provides one or more operation interfaces for editing, saving, deleting, and adding rule templates in the rule template library.

[0058] According to the method of the present application, after selecting a rule template, a brief description of the rule is displayed on the system interface. It supports modifying the rule template after selecting the rule, and can also save the modified rule template in the rule template library. It also supports users to delete or add rule templates in the rule template library, and can manually edit and add new rule templates.

[0059] In an optional implementation, it also includes automatically generating a rule template.

[0060] Before calling the preset rule template, it also includes: performing statistical analysis on the original log data to identify multiple behavior patterns; extracting key fields in the original log data; and generating a rule template based on the identified behavior patterns and key fields.

[0061] Specifically, a large amount of log data is collected, which should cover different log types and events.

[0062] Analyze the collected logs and identify the behavior patterns and key fields. The key fields include timestamp, source IP, destination IP, source port, destination port, etc.

[0063] In one embodiment, log analysis tools, such as log statistical analysis services, can be used to perform statistical analysis on the collected log data to identify multiple behavior patterns. For example, a Log Cluster algorithm can be used to cluster logs to identify similar log entries and behavior patterns. For example, a behavior pattern in which a source IP frequently sends data to different destination IPs can be identified.

[0064] Based on the identified patterns and key fields, rule templates are automatically defined based on conditional statements. For example, if a source IP is found to frequently send data to different destinations, a rule template can be created to describe this behavior pattern. A rule template can be defined as a series of conditional statements, such as "same source IP, different destination IP, fixed source port".

[0065] like Figure 6 As shown in the figure, the user interface supports rule association analysis according to the built-in rule template library to filter out log data that meets the rules. The system interface supports modifying the rule template after selecting the rule. After selecting the rule, the rule description is displayed.

[0066] like Figure 7 As shown, first, select the rules, obtain the logs that meet the rules based on the selected rules, and then configure the log source IP, collector IP, source IP, destination IP, reporting port, number of sends, sending interval, and log time, and implement log sending and console display execution based on the configuration data.

[0067] According to this step, logs that meet specific conditions can be efficiently screened out from a large amount of log data, which greatly improves the pertinence and efficiency of log processing. Through the application of rule templates, the system can automatically identify and extract key information, reducing the need for manual intervention and reducing errors and omissions caused by human factors.

[0068] Before executing step S101, log data is collected. In one embodiment, first, the log collection target is determined, and the log collection is for monitoring system performance, security audit, troubleshooting or business analysis. Different targets will determine what types of log data need to be collected.

[0069] Based on the collection target, determine the device type for which logs need to be collected. This application supports multiple device types, such as logs of threat detection probes, firewalls, servers, and other devices. Then collect log data of the corresponding devices. At the same time, identify the type of logs generated by each device, such as system logs, application logs, security logs, audit logs, traffic logs, etc.

[0070] The method provided by the embodiment of the present application also includes receiving user-defined log data input, and when encountering a log that does not support the structure, the user can manually input it. It also includes collecting the log content input by the user, and the user can put the log into the favorites for backup.

[0071] Specifically, Figure 2 As shown in the system interface, it includes a custom sending function, which allows manual input of logs, and a collection function, which allows log collection functions, such as collection of traffic logs and audit logs. It also supports functions such as log source IP configuration, collector IP configuration, reporting port configuration, number of sending configuration, and interval time configuration.

[0072] like Figure 3 As shown in the figure, after the log is imported, you can configure the log source IP, collector IP, reporting port, number of times to send, and interval time. You can also click My Favorites to save the log collection. Logs are sent based on the configuration information, and the execution supports continuous output of system logs for display, which is convenient for observing the execution status.

[0073] S102 formats the log data that meets the rule template to obtain standard log data.

[0074] In one implementation, the log data satisfying the rule template is formatted to obtain standard log data, including: using a log parsing tool to parse the log data satisfying the target rule and extract key fields.

[0075] In one embodiment, the log type is identified, such as security log, audit log, traffic log, and after the log type is identified, the parsing tool extracts key fields according to the log type, which may include timestamp, log level, message, source IP, destination IP, user ID, etc. The parsing tool applies a series of preset rules to perform the extraction, which may be based on regular expressions, keyword matching, or other logic.

[0076] According to the preset formatting model, the format conversion operation is performed on the extracted key fields to obtain standard log data.

[0077] In one embodiment, as needed, the formatting function is encapsulated into a formatting model that specifies how the log data should be displayed, including which fields are required, and their order and format. The parsed fields are mapped to the corresponding positions in the formatting model. This may involve renaming fields, converting data types (such as converting timestamps from one format to another), etc. Finally, standard log data is generated according to the formatting model. The data now has a unified format for easy storage, query, and analysis.

[0078] like Figure 4 As shown in the figure, the system supports logs of various types of devices, such as threat detection probes, firewalls, and terminal security logs. It also supports formatted output. You can configure the log source IP, collector IP, source IP, destination IP, reporting port, number of transmissions, and transmission interval in the system interface, and you can also modify the log time.

[0079] like Figure 5 As shown in the figure, you can configure the log source IP, collector IP, source IP, destination IP, reporting port, number of transmissions, transmission interval, and log time in the system interface. Log collection and transmission are realized based on the configured data.

[0080] Furthermore, you can select a device type, select a log type, and send and display the execution status based on the selected corresponding log type data.

[0081] S103 generates random log data based on the standard log data and a preset parameter range.

[0082] First, based on the log template corresponding to the standard log data, a log template containing variable placeholders is generated.

[0083] Based on step S101 and step S102, standard log data that meets the target rules and is formatted can be obtained. One of the standard log data is selected as a template, and the value to be randomly generated in the log template is replaced with a variable placeholder (key) to generate a log template containing the variable placeholder.

[0084] Furthermore, random data is generated according to a preset parameter range, and the parameter range includes a random number range, a character set, and a data option.

[0085] Receive the parameter range preset by the user. For example, if you need to generate random numbers, you can pre-set a number range so that the system can generate random numbers according to the set number range. For example, enter the number range in the format of "0,100".

[0086] You can also get a specified number of characters, for example, enter a character range in the format of "abcdefghijk,5". You can also get a random string, and enter multiple groups of data in the format of "tcp / udp / wcm".

[0087] Furthermore, random data is filled into the log template to obtain random log data.

[0088] Specifically, multiple log data can be constructed, and the input of increasing numbers is supported. For example, if 10 is input, ten logs will be constructed, and the specified number of each log can be increased by 1.

[0089] like Figure 8 As shown, the system interface provides a self-set random function, you can enter a standard log template, and the value that needs to be randomly generated in the log is replaced by (key). You can also configure the random number range, random character range, etc., to randomly generate log data, and support the random generation of multiple logs.

[0090] like Fig. 9 As shown, first, enter the log template, click Save to My Template, and then configure the log source IP, collector IP, source IP, destination IP, and reporting port.

[0091] Further, get random numbers and enter the number range in the format of "0,100". Get a specified number of characters and enter the character range in the format of "abcdefghijk,5". Get random strings and enter multiple groups of data in the format of "tcp / udp / wcm". Execute loop: Get increasing numbers, for example: enter 10, and ten logs will be constructed, and the specified number of each log can be increased by 1.

[0092] Send based on the generated random logs and display the execution status in the console.

[0093] S104 generates a complete log file based on the random log data and the standard log data.

[0094] The generated random log data is taken together with the standard log data as the constructed complete log.

[0095] Understandably, when the device does not generate enough standard log data that meets the rules, multiple log data can be randomly generated based on the standard log data template. By constructing logs in more scenarios, various operation scenarios can be simulated, including normal operations and abnormal situations. This helps to discover potential problems during software development and testing, and improve the robustness and reliability of the system.

[0096] In one embodiment, after the complete log is generated based on random log data and standard log data, it also includes: receiving a source device IP address and at least one destination device IP address configured by a user; and simulating sending the complete log from the source device to a device corresponding to at least one destination device IP address.

[0097] In the implementation mode of the present application, the user can input the sender source device IP address and the receiver destination device IP address in the system interface. At least one set of device IP addresses must be input. It also supports sending multiple IPs at the same time, and multiple destination IP addresses can be input at the same time. It can simulate sending the complete log from the source device to the device corresponding to at least one destination device IP address.

[0098] The implementation of the present application provides a flexible and efficient log simulation sending solution, and its technical effects mainly include:

[0099] (1) Simulate a real network environment: By allowing users to enter the source device IP and destination device IP addresses, the system can simulate the log sending process in a real network environment. This helps to verify the network communication function of the log system during the development and testing phase.

[0100] (2) Flexibility and configurability: Users can enter multiple destination IP addresses, and the system supports sending logs to these addresses at the same time. This design provides a high degree of flexibility, allowing users to configure sending parameters according to different test requirements.

[0101] (3) Test the scalability of the log system: By simulating the sending of logs to multiple devices, the performance and stability of the log system when processing a large number of concurrent log transmissions can be tested to ensure that the system can work normally under high load conditions.

[0102] (4) Reduce testing costs: By simulating the sending of log data without the need to actually deploy multiple physical devices, testing costs can be reduced and the testing cycle can be accelerated.

[0103] (5) Improve the accuracy of log analysis: By simulating the sending of logs, we can ensure that the log data received by the log analysis tool is consistent with the data format and content in the actual production environment, thereby improving the accuracy of log analysis. When a problem occurs, we can simulate the sending of logs to reproduce the problem scenario, helping developers and operation and maintenance personnel to quickly locate and solve the problem.

[0104] In one embodiment, before simulating sending the complete log from the source device to the device corresponding to the IP address of at least one destination device, it also includes: receiving the log time, number of sending, and sending interval information configured by the user. A scheduled task is generated based on the number of sending and the sending interval information, and the complete log is sent cyclically based on the scheduled task.

[0105] In one embodiment of the present application, the log occurrence time can be modified, and the log source IP, collector IP, source IP, destination IP, reporting port, number of transmissions, transmission interval, and log time configuration can be performed in the system interface. Log time modification can be realized, and the number of transmissions and transmission intervals of logs can be configured.

[0106] By presetting the number of sending times and sending intervals, the system can automatically and efficiently perform log sending tasks without human intervention, and flexibly simulate different log generation and sending scenarios. By setting a higher number of sending times and a shorter sending interval, it can simulate log sending under high load conditions and test the system's performance under high pressure.

[0107] In order to facilitate understanding of the method of the embodiment of the present application, Fig.10 Further description. Fig.10 As shown, the method includes:

[0108] One implementation mode of the present application includes a custom sending function, which can receive log data manually transmitted by users, obtain highly customized content, and save the logs to my favorites. It includes a background traffic function, which can realize the selection of specific types of logs and support formatting processing. It includes an association rule function with built-in complex rules to filter log content that meets the rules. The rules can be customized. It includes a self-set random function to provide random combinations within a fixed data range to generate extended random log data. Based on the processing of these functions, a complete log can be constructed. The complete log constructed is sent, and the execution status is displayed on the console.

[0109] According to another aspect of the embodiments of the present application, a log generation device for implementing the above log generation method is also provided. Fig.11 As shown, the device comprises:

[0110] The rule association analysis module 1101 is used to filter out log data that meets the rule template from the original log data according to the preset rule template;

[0111] The formatting module 1102 is used to format the log data that meets the rule template to obtain standard log data;

[0112] The random module 1103 is used to generate random log data based on the standard log data and a preset parameter range;

[0113] The generating module 1104 is used to generate a complete log file based on the random log data and the standard log data.

[0114] It should be noted that the log generation device provided in the above embodiment only uses the division of the above functional modules as an example when executing the log generation method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the log generation device provided in the above embodiment and the log generation method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0115] According to another aspect of the embodiments of the present application, an electronic device corresponding to the log generation method provided in the above embodiments is also provided to execute the above log generation method.

[0116] Please refer to Fig.12 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Fig.12 As shown, the electronic device includes: a processor 1200, a memory 1201, a bus 1202 and a communication interface 1203, and the processor 1200, the communication interface 1203 and the memory 1201 are connected via the bus 1202; the memory 1201 stores a computer program that can be run on the processor 1200, and when the processor 1200 runs the computer program, it executes the log generation method provided in any of the aforementioned embodiments of the present application.

[0117] The memory 1201 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 1203 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0118] The bus 1202 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. Among them, the memory 1201 is used to store programs, and the processor 1200 executes the program after receiving the execution instruction. The log generation method disclosed in any implementation of the above-mentioned embodiment of the present application can be applied to the processor 1200, or implemented by the processor 1200.

[0119] The processor 1200 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 1200. The above processor 1200 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be combined and executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 1201, and the processor 1200 reads the information in the memory 1201 and completes the steps of the above method in combination with its hardware.

[0120] The electronic device provided in the embodiment of the present application and the log generation method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.

[0121] According to another aspect of the embodiments of the present application, a computer-readable storage medium corresponding to the log generation method provided in the aforementioned embodiments is also provided, on which a computer program (i.e., a program product) is stored. When the computer program is run by a processor, it executes the log generation method provided in any of the aforementioned embodiments.

[0122] It should be noted that examples of computer-readable storage media may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0123] The computer-readable storage medium provided in the above-mentioned embodiment of the present application and the log generation method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.

[0124] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] The above embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention patent shall be subject to the attached claims.

Claims

1. A log generation method, characterized in that: include: According to a preset rule template, the log data satisfying the rule template is filtered out from the original log data; Formatting the log data satisfying the rule template to obtain standard log data; Generate random log data based on the standard log data and a preset parameter range; A complete log file is generated based on the random log data and the standard log data.

2. The method according to claim 1, characterized in that Before filtering out log data satisfying the rule template from the original log data according to the preset rule template, the method further includes: Perform statistical analysis on raw log data to identify multiple behavioral patterns; Extracting key fields from the original log data; The rule template is generated according to the identified behavior pattern and key fields.

3. The method according to claim 1 or 2, characterized in that: Also includes: The rule template library is displayed in a user interface, and the user interface provides one or more operation interfaces for editing, saving, deleting, and adding the rule templates in the rule template library.

4. The method according to claim 1, characterized in that The log data satisfying the rule template is formatted to obtain standard log data, including: Using a log parsing tool to parse the log data that meets the rule template and extract key fields; According to the preset formatting model, a format conversion operation is performed on the extracted key fields to obtain the standard log data.

5. The method according to claim 1, characterized in that Based on the standard log data and the set parameter range, random log data is generated, including: Generate a log template including variable placeholders based on the log template corresponding to the standard log data; Generate random data according to a preset parameter range, wherein the parameter range includes a random number range, a character set, and a data option; The random data is filled into the log template including the variable placeholder to obtain the random log data.

6. The method according to claim 1, characterized in that After generating a complete log file based on the random log data and the standard log data, the method further includes: Receive a source device IP address and at least one destination device IP address configured by a user; According to the source device IP address, the complete log file is simulated and sent from the source device to the destination device corresponding to the at least one destination device IP address.

7. The method according to claim 6, characterized in that Before simulating sending the complete log file from the source device to the destination device corresponding to the at least one destination device IP address, the method further includes: Receive the number of transmissions and the transmission interval information configured by the user; A scheduled task is generated based on the sending number and the sending interval information, and the complete log file is cyclically sent based on the scheduled task.

8. A log generating device, characterized in that: include: A rule association analysis module is used to filter out log data that meets the rule template from the original log data according to the preset rule template; A formatting module, used for formatting the log data satisfying the rule template to obtain standard log data; A random module, used to generate random log data based on the standard log data and a preset parameter range; A generating module is used to generate a complete log file based on the random log data and the standard log data.

9. An electronic device, characterized in that: The system comprises a processor and a memory storing program instructions, wherein the processor is configured to execute the log generating method according to any one of claims 1 to 7 when executing the program instructions.

10. A computer-readable medium, characterized in that Computer-readable instructions are stored thereon, and the computer-readable instructions are executed by a processor to implement a log generating method as claimed in any one of claims 1 to 7.

Images