Automatic operation and maintenance method and system for OA system based on multi-script collaboration

Abstract

The invention discloses an automatic operation and maintenance method and system for an OA system based on multi-script collaboration, and the method and system achieve the full-life-cycle management from the initial deployment of a server cluster to the later continuous operation and maintenance through designing a series of automatic scripts which are decoupled in function and work cooperatively. According to the invention, an efficient, stable and safe automatic operation and maintenance system is constructed by modules such as an initialization script module, a service installation script module, an automatic backup script module, a service monitoring script module, a log cutting script module, a security defense script module, an artificial security defense script module, a backup data server and a central server; according to the method, the labor cost of OA system operation and maintenance is remarkably reduced, the system deployment efficiency, the service availability and the security protection capability are improved, the method is especially good at coping with common network threats such as CC attacks and vulnerability scanning, and detailed traceability evidence can be provided for network attack and defense drilling.

Description

Technical Field

[0001] This invention belongs to the field of computer operation and maintenance technology, specifically relating to an automated operation and maintenance method and system for an OA system based on multi-script collaboration. Background Technology

[0002] As enterprises become increasingly information-driven, OA (Office Automation) systems have become a core support platform for daily operations. To ensure high availability and performance, they are typically deployed in clusters of multiple servers. However, traditional server operation and maintenance methods have significant drawbacks: First, manually initializing dozens or even hundreds of servers and configuring the kernel, firewall, and services is cumbersome, inefficient, and prone to errors. Second, routine maintenance tasks, such as service status monitoring, log management, data backup, and security protection, heavily rely on manual intervention, resulting in slow response times and difficulty in timely detection and handling of service failures or network attacks, potentially leading to business interruptions or data leaks.

[0003] While some existing automated operation and maintenance tools can solve some problems, they are often complex to configure and lack flexibility, especially in dealing with sudden security incidents and conducting granular log analysis. There is a lack of deeply integrated solutions specifically for OA system scenarios. For example, how to automatically defend against CC attacks and how to quickly and accurately identify and trace attack behaviors from massive amounts of logs remain challenges in the industry. Summary of the Invention

[0004] To address the problems of existing technologies, this invention provides an efficient, stable, and secure automated operation and maintenance method and system for OA systems based on multi-script collaboration. This application not only effectively reduces the manpower cost of OA system operation and maintenance and improves system deployment efficiency, service availability, and security protection capabilities, but also excels at dealing with common network threats such as CC attacks and vulnerability scanning, and can provide detailed traceability evidence for network attack and defense drills.

[0005] The technical solution of the present invention is as follows:

[0006] An automated operation and maintenance method for an OA system based on multi-script collaboration includes the following steps:

[0007] S1. OA System Initialization Configuration: The initialization script module automatically initializes and configures all servers within the OA system.

[0008] S2, OA system service deployment and configuration: Through the service installation script module, the services required by the OA system are automatically installed and configured on the initialized server, including Nginx as a web server and load balancer, PHP with specific version and security extensions configured, MySQL with security initialization and creation of dedicated databases and users, Redis with configured authentication passwords and memory policies, and unified opening of relevant firewall ports and setting of unified log storage directory.

[0009] S3, Encrypted Incremental Backup and Off-site Disaster Recovery: Through the automatic backup script module, important business data files generated locally on the server are periodically packaged, encrypted, and automatically uploaded to a dedicated backup data server.

[0010] S4. Service Health Monitoring and Fault Self-Healing: The service monitoring script module periodically checks the availability and business health of the core services of the OA system. When a service anomaly is detected, the service monitoring script module automatically triggers a predefined restart sequence for fault isolation and recovery. If the restart fails or fails multiple times consecutively within a specified time, the service monitoring script module will escalate the alarm level and send an alarm notification containing detailed error codes, server identifiers, and timestamps to the operations and maintenance personnel through the Webhook channel to achieve rapid response.

[0011] S5. Log Rotation and Processing: The log rotation script module rotates, compresses, and archives the running logs of each service on the server according to a preset time strategy, and cleans up expired log files according to the storage strategy.

[0012] S6. Real-time proactive security defense: Through the security defense script module, service access logs are monitored in real time to detect and process abnormal data and behaviors, and proactively defend and protect the OA system.

[0013] S7. In-depth inspection and attack tracing: Through the manual security defense script module, the system error log is deeply analyzed to identify attack patterns, track attacker IPs and behavior sequences, generate attack tracing reports, and block the attack source IPs in real time.

[0014] To further illustrate the present invention, the initialization configuration in step S1 includes kernel parameter tuning, basic firewall policy deployment, enhanced SSH security configuration, system time zone synchronization, configuration of essential software package repositories, setting of unified hostname naming rules, and generating a detailed initialization compliance report to ensure environment consistency.

[0015] To further explain the present invention, step S3 specifically involves: using an automatic backup script module, employing a strategy combining full backup and incremental backup, periodically packaging key data on the server, including business databases, application configuration files, and uploaded file directories; encrypting the packaged data using a strong encryption algorithm, and then automatically transmitting it to a designated, isolated backup data server via a secure network channel; the automatic backup script module inherently possesses backup integrity verification and retransmission mechanisms, and retains multiple versions of backup copies to support data traceability.

[0016] To further explain the present invention, step S5 specifically involves: using a log cutting script module, which combines cutting tools with custom strategies, the running logs of various services on the server are cut according to preset strategies, including preset time or file size thresholds. The cut logs are immediately compressed to save storage space and archived according to date and service type. Simultaneously, the log cutting script module automatically cleans up expired log files according to data retention strategies and can trigger log analysis tasks before cleaning to extract key indicators. This solves the problem of log files growing indefinitely, making them easy to view and saving disk space.

[0017] To further illustrate the present invention, in step S6, the defensive protection includes:

[0018] S61, IP Access Frequency Exceeds Limit and Enables Dynamic Defense Against Attacks: Employs a high-performance log parsing engine to parse Web service logs in real time, configures a fixed time window as the period, and slides to count the number of access requests for each source IP; when the count exceeds the first threshold dynamically adjusted based on historical baselines, it is determined that the IP frequency has exceeded the limit, and the system firewall command is automatically invoked to block the IP for a configurable period of time.

[0019] S62. Connection Count Anomaly Detection and Defense: By encapsulating system commands or directly parsing the / proc / net / tcp file, the current network connection status from each IP address to the local service port is efficiently counted; when the number of connections for a certain IP exceeds the second threshold set according to server performance and normal business model, the connection count is determined to be excessive, and it is regarded as a source of resource exhaustion attack and is also included in the firewall blacklist.

[0020] S63. Malicious Scanning Behavior Identification and Defense: Based on a predefined rule base, the system performs pattern matching on request paths, tool fingerprints, and attack payloads in logs to identify malicious scanning behaviors and block the corresponding IPs.

[0021] S64. Dynamic Blacklist Management: For IPs that are determined to have exceeded the frequency or connection limits, the security defense script module automatically calls the firewall management command to immediately add them to the blacklist; the blocking time adopts a progressive penalty mechanism; at the same time, the security defense script module sets up a blacklist queue, regularly scans and cleans up blacklist records that have exceeded the automatic unblocking time, releases resources and avoids false blocking for a long time.

[0022] Further explanation of the present invention: Step S7 specifically involves: activating the manual security defense script module during specific security periods or routine in-depth inspections. This script module simulates the thinking of a security analyst, performing multi-dimensional correlation analysis on system error logs and application logs, and using pattern recognition and sequence analysis algorithms to identify attack patterns. Through session tracking technology, it reconstructs the complete operation chain of the attacker within a single or multiple sessions, and automatically generates a detailed source tracing report containing the attack timeline, the technical points used, the affected assets, and evidence logs. This provides visualized evidence chain support for security decisions and emergency response, and simultaneously feeds back to the proactive defense module in real time to block the attack source IP.

[0023] The manual security defense script module performs multi-dimensional correlation and sequence analysis on the timestamps, IP addresses, session IDs, request payloads, and error response codes of attack attempts in the error log. It can reconstruct the attacker's complete operation path and behavior graph within the system in the form of graphical or structured data. The graph accurately marks the attack's starting point, lateral movement path, privilege escalation attempts, and data access behaviors, providing an intuitive and reliable visual chain of evidence for the security report generated afterward. It can also feed the attack fingerprint back to the rule base of the proactive defense module, enabling the self-evolution of defense capabilities.

[0024] Further description of the present invention: the operation and maintenance system includes an initialization script module, a service installation script module, an automatic backup script module, a service monitoring script module, a log rotation script module, a security defense script module, a manual security defense script module, a backup data server, and a central server; wherein:

[0025] The initialization script module is used to execute the initialization script on the target server to establish a secure and standard operating environment;

[0026] The service installation script module is used to execute the service installation script to achieve standardization of middleware and applications;

[0027] The automatic backup script module is used to execute the automatic backup script to ensure the reliability and recoverability of the data;

[0028] The service monitoring script module is used to execute the service monitoring script to achieve 24 / 7 service status awareness and automated fault recovery.

[0029] The log rotation script module is used to execute the log rotation script to achieve standardized log storage and space management.

[0030] The security defense script module is used to execute the security defense script and provide real-time threat protection at the network layer and application layer.

[0031] The manual security defense script module is used to execute the manual security defense script, providing in-depth security incident analysis and investigation capabilities;

[0032] The central server, as the brain of the system, is used to coordinate and control the execution order, cycle and strategy of the above modules, and has the functions of task orchestration, dependency management, execution status tracking, unified configuration management and visualization dashboard.

[0033] The backup data server is used to back up data files.

[0034] All script modules are implemented using declarative configuration management tools or highly reliable Shell / Python scripts. These script modules are centrally stored in a version control system and are remotely invoked, distributed, and executed by a central scheduler on a master server via the SSH protocol. The central server can distribute tasks to multiple target servers in parallel and collect execution results feedback, forming a centralized management and distributed execution operation and maintenance system to ensure consistency and efficiency of operations.

[0035] The beneficial effects of this invention are:

[0036] This invention automates the entire process from server initialization to online operation and maintenance, greatly improving efficiency and reducing human error; through service monitoring and automatic recovery mechanisms, it enhances the availability and stability of the OA system; the built-in dynamic security defense mechanism can effectively resist common network attacks, especially application layer attacks, and has powerful attack tracing capabilities, improving the overall security level; by using scripts to solidify operation and maintenance operations, it ensures the configuration consistency of all servers in the cluster. Attached Figure Description

[0037] Figure 1 This is a flowchart of the method;

[0038] Figure 2 This is a block diagram of the system structure of the present invention. Detailed Implementation

[0039] The present invention will be further described below with reference to specific embodiments.

[0040] Example:

[0041] An automated operation and maintenance method for an OA system based on multi-script collaboration includes the following steps:

[0042] S1. OA System Initialization Configuration: The initialization script module automatically initializes and configures all servers within the OA system.

[0043] S2, OA system service deployment and configuration: Through the service installation script module, the services required by the OA system are automatically installed and configured on the initialized server, including Nginx as a web server and load balancer, PHP with specific version and security extensions configured, MySQL with security initialization and creation of dedicated databases and users, Redis with configured authentication passwords and memory policies, and unified opening of relevant firewall ports and setting of unified log storage directory.

[0044] S3, Encrypted Incremental Backup and Off-site Disaster Recovery: Through the automatic backup script module, important business data files generated locally on the server are periodically packaged, encrypted, and automatically uploaded to a dedicated backup data server.

[0045] S4. Service Health Monitoring and Fault Self-Healing: The service monitoring script module periodically checks the availability and business health of the core services of the OA system. When a service anomaly is detected, the service monitoring script module automatically triggers a predefined restart sequence for fault isolation and recovery. If the restart fails or fails multiple times consecutively within a specified time, the service monitoring script module will escalate the alarm level and send an alarm notification containing detailed error codes, server identifiers, and timestamps to the operations and maintenance personnel through Webhook channels, including integrated SMS gateways, email interfaces, DingTalk, or WeChat Work, to achieve rapid response.

[0046] The service monitoring script module is executed periodically by Cron, for example, once per minute; you can check whether services such as nginx, php-fpm, mysql, and redis are running by using the systemctl is-active or ps command; if a service is found to be stopped, execute systemctl restart [service name]; if multiple restarts (e.g., 3 times) fail, call the SMS gateway API, etc., to send alarm information to the operation and maintenance personnel;

[0047] S5. Log Rotation and Processing: The log rotation script module rotates, compresses, and archives the running logs of each service on the server according to a preset time strategy, and cleans up expired log files according to the storage strategy.

[0048] S6. Real-time proactive security defense: Through the security defense script module, service access logs are monitored in real time to detect and process abnormal data and behaviors, and proactively defend and protect the OA system.

[0049] S7. In-depth inspection and attack tracing: Through the manual security defense script module, the system error log is deeply analyzed to identify attack patterns, track attacker IPs and behavior sequences, generate attack tracing reports, and block the attack source IPs in real time.

[0050] The initialization configuration in step S1 includes kernel parameter tuning, deployment of basic firewall policies such as iptables or firewalld, enhanced SSH security configuration, system time zone synchronization, configuration of essential package repositories, setting of unified hostname naming rules, and generating a detailed initialization compliance report to ensure environment consistency; the enhanced SSH security configuration includes disabling password authentication, using key pair login, and changing the default port.

[0051] The kernel parameter tuning includes modifying ` / etc / sysctl.conf` to adjust TCP / IP stack parameters, such as increasing the maximum number of connections and speeding up TCP connection recycling. The firewall policy deployment includes installing and starting iptables or firewalld, which by default rejects all inbound traffic and only opens necessary ports such as SSH (the modified port), 80, and 443. The key pair login deployment involves deploying a pre-generated SSH public key to the server's `authorized_keys` file, disabling password login, and improving security. The port modification specifically involves editing the ` / etc / ssh / sshd_config` file and changing the default port 22 to a non-standard port.

[0052] Step S3 specifically involves: using an automatic backup script module, employing a strategy combining full backup and incremental backup, periodically packaging key data on the server, including business databases, application configuration files, and uploaded file directories; encrypting the packaged data using a strong encryption algorithm (such as AES-256), and then automatically transmitting it to a designated, isolated backup data server via a secure network channel (such as SFTP or RSYNC over SSH); the automatic backup script module inherently possesses backup integrity verification and retransmission mechanisms, and retains multiple versions of backup copies to support data traceability.

[0053] Step S5 specifically involves using a log cutting script module. This module, combined with cutting tools and custom strategies, cuts the runtime logs (access logs, error logs, slow query logs, etc.) of various services on the server according to preset strategies, including preset time or file size thresholds. The cut logs are immediately compressed to save storage space and archived according to date and service type. Simultaneously, the log cutting script module automatically cleans up expired log files based on data retention policies and can trigger log analysis tasks before cleanup to extract key indicators. This addresses the problem of infinitely growing log files, making them easier to view while saving disk space.

[0054] The log rotation script module can be configured using the logrotate tool or implemented manually. For Nginx and PHP-FPM's access.log and error.log, it can be set to rotate daily; for business application logs, it can be rotated weekly or monthly. Rotated logs are automatically compressed, and you can choose to retain a recent period or a specified number of files, while older files are automatically deleted. The system can use asynchronous programming models such as Python asyncio, Golang Goroutine, or Node.js Event Loop to handle high-concurrency log streams, avoiding blocking the main thread when analyzing large amounts of logs. After reading, logs are placed in an in-memory queue (such as Redis Streams or RabbitMQ) for concurrent consumption by multiple worker processes, greatly improving processing efficiency.

[0055] In step S6, the defense protection includes:

[0056] S61. Enable dynamic defense against IP access frequency exceeding limits: Employ a high-performance log parsing engine (such as Awk or a specific program written in Go) to parse Web service logs in real time, configure a fixed time window as the period, and slide to count the number of access requests for each source IP; when the count exceeds the first threshold dynamically adjusted based on the historical baseline, it is determined that the IP frequency exceeds the limit, and the system firewall (such as iptables or firewalld) command is automatically invoked to block the IP for a configurable period of time;

[0057] S62. Connection Count Anomaly Detection and Defense: By encapsulating system commands or directly parsing the / proc / net / tcp file, the current network connection status (especially ESTABLISHED, SYN_RECV, etc.) of each IP address to the local service port is efficiently counted. When the number of connections of an IP exceeds the second threshold set according to server performance and normal business model, the connection count is determined to be excessive, and it is regarded as a source of resource exhaustion attack and is also included in the firewall blacklist.

[0058] S63. Malicious Scanning Behavior Identification and Defense: Based on a predefined rule base, the system performs pattern matching on request paths (common vulnerability scanning paths such as / admin / , / phpmyadmin / , etc.) and tool fingerprints and attack payloads in the logs to identify malicious scanning behaviors and block the corresponding IPs.

[0059] S64. Dynamic Blacklist Management: For IPs determined to have exceeded frequency or connection limits, the security defense script module automatically calls firewall management commands (such as iptables -I INPUT -s <malicious IP> -j DROP) to immediately add them to the blacklist; the blocking time adopts a progressive penalty mechanism; at the same time, the security defense script module sets up a blacklist queue, regularly scans and cleans up blacklist records that have exceeded the automatic unblocking time, releases resources and avoids false blocking for a long time.

[0060] The security defense script module introduces a sliding window counter and token bucket algorithm instead of a simple fixed threshold. Using a high-performance key-value database such as Redis or Memcached, a counter containing a timestamp queue is stored with the IP address as the key. The script no longer checks the "sum within 1 minute," but rather the "request frequency within the last 10 seconds." Simultaneously, combined with the token bucket algorithm, a token generation rate is assigned to each IP address. Once a sudden surge in traffic exhausts all tokens, the IP is either rate-limited or blocked. This effectively distinguishes between short-lived high-concurrency requests from normal users and continuous flood attacks from CC attacks. A behavioral baseline is established for each IP address. If an IP has a long history of low-frequency access and then suddenly experiences a traffic spike, a high-priority alert is triggered. For known API gateway or search engine IP addresses, the baseline threshold can be dynamically adjusted higher to reduce false positives.

[0061] The connection anomaly detection not only checks the total number of ESTABLISHED connections, but also uses the extended functions of the ss or netstat commands to analyze the target ports of the connections; it employs very strict restrictions to effectively defend against brute-force attacks; and it links high-connection-count IPs with the CC attack detection module. If an IP triggers both a CC alert and a high-connection-count alert simultaneously, the blocking weight and blocking time are doubled.

[0062] The malicious scanning and identification method utilizes efficient Regex pattern matching to match known vulnerability scanning paths, tool fingerprints (such as the default User-Agent of sqlmap and nmap), and attack payloads. The rule base supports hot reloading and can be updated without restarting the script. A simple abnormal request classification model is pre-trained using Python's scikit-learn library, with features including:

[0063] URL path entropy: Randomly generated directory names or file names have high entropy values;

[0064] Request order: Sensitive files such as login.php, admin.php, and config.php are accessed sequentially within a very short period of time;

[0065] Failure rate: A large number of 404 / 500 status code requests within a short period of time;

[0066] Linked Threat Intelligence: The script can call publicly available threat intelligence APIs to check whether the accessing IP is a known malicious IP.

[0067] The blacklist ban time is not fixed and can be dynamically calculated based on the severity of the attack and historical records. A "progressive penalty" mechanism is adopted: the first violation results in a 10-minute ban, the second in 1 hour, the third in 24 hours, and so on. If an IP makes a new attack attempt while in the blacklist queue, the ban time will be reset and increased.

[0068] Step S7 specifically involves: Activating the manual security defense script module during specific security periods or routine in-depth inspections. This script module simulates the thinking of a security analyst, performing multi-dimensional correlation analysis on system error logs, including PHP error logs, Nginx 4xx / 5xx logs, and application logs. It utilizes pattern recognition and sequence analysis algorithms to identify attack patterns, including SQL injection, path traversal, and brute-force attacks. Through session tracing technology, it reconstructs the complete operation chain of the attacker within a single or multiple sessions, including from probing and attack to backdoor implantation, and automatically generates a detailed source tracing report containing the attack timeline, the technical points used, affected assets, and evidence logs. This provides visualized evidence chain support for security decisions and emergency response, while simultaneously feeding back to the proactive defense module in real time to block the attack source IP.

[0069] The manual security defense script module performs multi-dimensional correlation and sequence analysis on the timestamps, IP addresses, session IDs, request payloads, and error response codes of attack attempts in the error log. It can reconstruct the attacker's complete operation path and behavior graph within the system in the form of graphical or structured data. The graph accurately marks the attack's starting point, lateral movement path, privilege escalation attempts, and data access behaviors, providing an intuitive and reliable visual chain of evidence for the security report generated afterward. It can also feed the attack fingerprint back to the rule base of the proactive defense module, enabling the self-evolution of defense capabilities.

[0070] The newly added manual security defense script module features an automatic trust whitelist and a self-healing function for false positives, enabling it to learn and correct itself. By analyzing historical logs, it automatically adds trusted IPs such as those from search engines, monitoring systems, and API partners to the whitelist, ensuring they are never blocked. By providing an API interface, when a legitimate user is mistakenly blocked, they can submit an appeal through a specific page. The system records the appeal and automatically unblocks the IP, while simultaneously lowering the IP's threat score, reducing the probability of future false positives.

[0071] The visualization can be achieved through a web dashboard or integrated with a standard monitoring system; defensive actions (such as blocking / unblocking IPs) and statistical information are output in a structured format (JSON), which is convenient for Filebeat to collect and send to ELK (Elasticsearch, Logstash, Kibana) or Grafana for visualization; the dashboard displays real-time attack maps, top attack IPs, frequency of defense rule triggers, etc., making the security status clear at a glance.

[0072] The manual security defense script module can also be manually executed by operations and maintenance personnel during security incidents or attack and defense drills. By analyzing error logs (such as Nginx 404 and 500 error logs, and application SQL injection error logs) over a period of time (such as the time of the attack), suspicious IPs are extracted through pattern recognition, and all operation traces of the IPs in the entire system (which URLs were accessed, what parameters were submitted, etc.) are tracked to form a complete attack chain analysis report, providing solid evidence for writing security reports, and all identified attack source IPs are blocked with one click.

[0073] The operation and maintenance system includes an initialization script module, a service installation script module, an automatic backup script module, a service monitoring script module, a log rotation script module, a security defense script module, a manual security defense script module, a backup data server, and a central server; wherein:

[0074] The initialization script module is used to execute the initialization script on the target server to establish a secure and standard operating environment;

[0075] The service installation script module is used to execute the service installation script to achieve standardization of middleware and applications;

[0076] The automatic backup script module is used to execute the automatic backup script to ensure the reliability and recoverability of the data;

[0077] The service monitoring script module is used to execute the service monitoring script to achieve 24 / 7 service status awareness and automated fault recovery.

[0078] The log rotation script module is used to execute the log rotation script to achieve standardized log storage and space management.

[0079] The security defense script module is used to execute the security defense script and provide real-time threat protection at the network layer and application layer.

[0080] The manual security defense script module is used to execute the manual security defense script, providing in-depth security incident analysis and investigation capabilities;

[0081] The central server, as the brain of the system, is used to coordinate and control the execution order, cycle and strategy of the above modules, and has the functions of task orchestration, dependency management, execution status tracking, unified configuration management and visualization dashboard.

[0082] The backup data server is used to back up data files.

[0083] All script modules are implemented using declarative configuration management tools or highly reliable Shell / Python scripts. These script modules are centrally stored in a version control system and are remotely invoked, distributed, and executed by a central scheduler on a master server via the SSH protocol. The central server can distribute tasks to multiple target servers in parallel and collect execution results feedback, forming a centralized management and distributed execution operation and maintenance system to ensure consistency and efficiency of operations.

Claims

1. An automated operation and maintenance method for an OA system based on multi-script collaboration, characterized in that: Includes the following steps: S1. OA System Initialization Configuration: The initialization script module automatically initializes and configures all servers within the OA system. S2, OA system service deployment and configuration: Through the service installation script module, the services required by the OA system are automatically installed and configured on the initialized server, including Nginx as a web server and load balancer, PHP with specific version and security extensions configured, MySQL with security initialization and creation of dedicated databases and users, Redis with configured authentication passwords and memory policies, and unified opening of relevant firewall ports and setting of unified log storage directory. S3, Encrypted Incremental Backup and Off-site Disaster Recovery: Through the automatic backup script module, important business data files generated locally on the server are periodically packaged, encrypted, and automatically uploaded to a dedicated backup data server. S4. Service Health Monitoring and Fault Self-Healing: The service monitoring script module periodically checks the availability and business health of the core services of the OA system. When a service anomaly is detected, the service monitoring script module automatically triggers a predefined restart sequence for fault isolation and recovery. If the restart fails or fails multiple times consecutively within the specified time, the service monitoring script module will escalate the alarm level and send an alarm notification containing detailed error codes, server identifiers, and timestamps to the operations and maintenance personnel through the Webhook channel to achieve rapid response; S5. Log Rotation and Processing: The log rotation script module rotates, compresses, and archives the running logs of each service on the server according to a preset time strategy, and cleans up expired log files according to the storage strategy. S6. Real-time proactive security defense: Through the security defense script module, service access logs are monitored in real time to detect and process abnormal data and behaviors, and proactively defend and protect the OA system. S7. In-depth inspection and attack tracing: Through the manual security defense script module, the system error log is deeply analyzed to identify attack patterns, track attacker IPs and behavior sequences, generate attack tracing reports, and block the attack source IPs in real time.

2. The automated operation and maintenance method for an OA system based on multi-script collaboration according to claim 1, characterized in that: The initialization configuration in step S1 includes kernel parameter tuning, basic firewall policy deployment, enhanced SSH security configuration, system time zone synchronization, configuration of essential software package repositories, setting of unified hostname naming rules, and generating a detailed initialization compliance report to ensure environment consistency.

3. The automated operation and maintenance method for an OA system based on multi-script collaboration as described in claim 1, characterized in that: Step S3 specifically involves: using an automatic backup script module, employing a strategy that combines full backup and incremental backup, periodically packaging key data on the server, including business databases, application configuration files, and uploaded file directories; encrypting the packaged data using a strong encryption algorithm, and then automatically transmitting it to a designated, isolated backup data server through a secure network channel; the automatic backup script module itself has backup integrity verification and retransmission mechanisms, and retains multiple versions of backup copies to support data traceability.

4. The automated operation and maintenance method for an OA system based on multi-script collaboration as described in claim 1, characterized in that: Step S5 specifically involves: using the log cutting script module to cut the running logs of each service on the server according to a preset strategy; immediately compressing the cut logs to save storage space and archiving them according to date and service type; at the same time, the log cutting script module automatically cleans up expired log files according to the data retention strategy, and can trigger a log analysis task to extract key indicators before cleaning.

5. The automated operation and maintenance method for an OA system based on multi-script collaboration according to claim 1, characterized in that: In step S6, the defense protection includes: S61, IP Access Frequency Exceeds Limit and Enables Dynamic Defense Against Attacks: Employs a high-performance log parsing engine to parse Web service logs in real time, configures a fixed time window as the period, and slides to count the number of access requests for each source IP; when the count exceeds the first threshold dynamically adjusted based on historical baselines, it is determined that the IP frequency has exceeded the limit, and the system firewall command is automatically invoked to block the IP for a configurable period of time. S62. Connection Count Anomaly Detection and Defense: By encapsulating system commands or directly parsing the / proc / net / tcp file, the current network connection status from each IP address to the local service port is efficiently counted; when the number of connections for a certain IP exceeds the second threshold set according to server performance and normal business model, the connection count is determined to be excessive, and it is regarded as a source of resource exhaustion attack and is also included in the firewall blacklist. S63. Malicious Scanning Behavior Identification and Defense: Based on a predefined rule base, the system performs pattern matching on request paths, tool fingerprints, and attack payloads in logs to identify malicious scanning behaviors and block the corresponding IPs. S64. Dynamic Blacklist Management: For IPs that are determined to have exceeded the frequency or connection limits, the security defense script module automatically calls the firewall management command to immediately add them to the blacklist; the blocking time adopts a progressive penalty mechanism; at the same time, the security defense script module sets up a blacklist queue, regularly scans and cleans up blacklist records that have exceeded the automatic unblocking time, releases resources and avoids false blocking for a long time.

6. The automated operation and maintenance method for an OA system based on multi-script collaboration according to claim 1, characterized in that: Step S7 specifically involves: activating the manual security defense script module during specific security periods or routine in-depth inspections. This script module simulates the thinking of a security analyst, performing multi-dimensional correlation analysis on system error logs and application logs, and using pattern recognition and sequence analysis algorithms to identify attack patterns. Through session tracing technology, it reconstructs the complete operation chain of the attacker in a single or multiple sessions, and automatically generates a detailed source tracing report containing the attack timeline, the technical points used, the affected assets, and evidence logs. This provides visualized evidence chain support for security decisions and emergency response, and simultaneously feeds back to the proactive defense module in real time to block the attack source IP.

7. An automated operation and maintenance system for an OA system based on multi-script collaboration, characterized in that: The operation and maintenance system includes an initialization script module, a service installation script module, an automatic backup script module, a service monitoring script module, a log rotation script module, a security defense script module, a manual security defense script module, a backup data server, and a central server; wherein: The initialization script module is used to execute the initialization script on the target server to establish a secure and standard operating environment; The service installation script module is used to execute the service installation script to achieve standardization of middleware and applications; The automatic backup script module is used to execute the automatic backup script to ensure the reliability and recoverability of the data; The service monitoring script module is used to execute the service monitoring script to achieve 24 / 7 service status awareness and automated fault recovery. The log rotation script module is used to execute the log rotation script to achieve standardized log storage and space management. The security defense script module is used to execute the security defense script and provide real-time threat protection at the network layer and application layer. The manual security defense script module is used to execute the manual security defense script, providing in-depth security incident analysis and investigation capabilities; The central server, as the brain of the system, is used to coordinate and control the execution order, cycle and strategy of the above modules, and has the functions of task orchestration, dependency management, execution status tracking, unified configuration management and visualization dashboard. The backup data server is used to back up data files.

Images