High-performance log collection and analysis device

Abstract

The invention relates to a high-performance log collection and analysis device, and belongs to the field of data processing. The device comprises a log collection module, a log analysis module, a data storage module, a communication interaction module, a power management module and a system monitoring module, and all the modules work cooperatively through a high-speed bus. The device disclosed by the invention can realize high-performance log collection and analysis of efficient collection, real-time analysis, safe storage and stable wired transmission of multi-scene logs, can be widely applied to scenes which have strict limitation on wireless communication and have requirements on hardware localization compatibility, and provides hardware-level support for stable operation and risk early warning of various systems.

Description

Technical Field

[0001] This invention belongs to the field of data processing, specifically relating to a high-performance log collection and analysis device. Background Technology

[0002] With the deepening of digital transformation, the number of terminals such as servers, IoT sensors, and industrial control equipment is growing exponentially. These terminals generate massive amounts of log data during operation. This log data contains key information such as equipment operating parameters, fault information, user operation records, and network interaction data, which are the core basis for system operation and maintenance, fault location, and security auditing.

[0003] Current mainstream log processing solutions suffer from the following technical shortcomings: First, in the log acquisition stage, the common hardware interface types are limited, making it difficult to adapt to special terminals in industrial scenarios such as RS485 bus devices and long-distance fiber optic transmission equipment. Furthermore, the single-channel acquisition mode lacks concurrency capabilities, easily leading to data loss or delays. Second, in the log analysis stage, some solutions rely on imported CPUs, posing compatibility and security risks in special and critical industry scenarios. Moreover, the limited computing power of general-purpose CPUs results in low efficiency when relying on software for data processing, failing to meet real-time fault warning requirements. Third, in the data storage stage, traditional storage media are commonly used, lacking redundancy protection and easily leading to the loss of critical data. Fourth, in the data transmission stage, some solutions overly rely on wireless communication methods such as WiFi and 5G. In industrial scenarios with strict requirements for communication stability and security, wireless signals are easily interfered with, leading to transmission interruptions, and there is a risk of eavesdropping and tampering, failing to meet the needs of these scenarios. In addition, existing solutions have poor hardware architecture scalability, low module coordination, and limited overall processing performance.

[0004] Therefore, developing a log collection and analysis system hardware with rich interfaces, high-efficiency computing based on domestically compatible CPUs, reliable storage, stable wired transmission, and high scalability has become an urgent problem to be solved in special scenarios such as industry. Summary of the Invention

[0005] (a) Technical problems to be solved The technical problem to be solved by this invention is how to provide a high-performance log collection and analysis device to solve the problems of poor hardware architecture scalability, low coordination between modules, and limited overall processing performance in existing solutions.

[0006] (II) Technical Solution To address the aforementioned technical problems, this invention proposes a high-performance log collection and analysis device, which includes: a log collection module, a log analysis module, a data storage module, a communication interaction module, a power management module, and a system monitoring module. Each module works collaboratively via a high-speed bus. The log collection module adopts a multi-channel parallel acquisition architecture, integrating five interface types: RS232, RS485, Gigabit Ethernet, USB 3.0, and SFP + fiber optic. It also has a built-in channel priority scheduling unit and PCIe 4.0 expansion interface, supporting 32-channel parallel acquisition. The log analysis module adopts a heterogeneous computing architecture of "Hygon 3350 CPU + GPU + FPGA". The Hygon 3350 CPU is responsible for overall scheduling and complex logic processing, the GPU is used for parallel acceleration of anomaly detection algorithms, and the FPGA is used for hardware acceleration of preprocessing and correlation analysis. The data storage module adopts a hierarchical storage architecture of DDR5 high-speed cache and NVMe SSD RAID array, supports RAID 5 / 6 redundancy configuration and national cryptographic SM4 encryption, and reserves SAS-4 expansion interface; The communication module adopts a fully wired transmission design, integrating 4 Gigabit Ethernet, 2 10 Gigabit Ethernet and 1 PROFINET / Modbus-TCP industrial bus, and has a built-in hardware encryption unit and electrical isolation unit that support the national cryptographic SM4 algorithm. The power management module supports dual power redundant input. It is designed with a dedicated POL power supply module for Hygon 3350 CPU, supports dynamic voltage regulation, and is equipped with overcurrent, overvoltage, and short circuit protection and real-time monitoring units to ensure stable power supply to the system. The system monitoring module is used to monitor the operating status of each module in real time, with a focus on adapting to the status monitoring requirements of the Hygon 3350 CPU to ensure stable system operation.

[0007] (III) Beneficial Effects This invention proposes a high-performance log collection and analysis device. This device can achieve high-performance log collection and analysis with efficient collection, real-time analysis, secure storage and stable wired transmission in multiple scenarios. It can be widely used in scenarios with strict restrictions on wireless communication and requirements for hardware compatibility with domestic production (such as industrial control systems, server clusters and financial data centers), providing hardware-level support for the stable operation and risk warning of various systems. Detailed Implementation

[0008] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to examples.

[0009] This invention relates to the field of data processing hardware technology. Specifically, it relates to a high-performance log collection and analysis system hardware capable of efficient collection, real-time analysis, secure storage, and stable wired transmission of logs across multiple scenarios. It can be widely used in scenarios with strict restrictions on wireless communication and a need for domestic hardware compatibility (such as industrial control systems, server clusters, and financial data centers), providing hardware-level support for the stable operation and risk warning of various systems.

[0010] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a high-performance log collection and analysis device. Through modular design, a heterogeneous computing architecture based on the Hygon 3350 CPU, and hardware-level functional optimization, it achieves efficient processing of log data throughout the entire process. The system hardware mainly includes: a log collection module, a log analysis module, a data storage module, a communication interaction module, a power management module, and a system monitoring module. These modules work collaboratively via a high-speed bus. The log collection module adopts a multi-channel parallel acquisition architecture, integrating five interface types: RS232, RS485, Gigabit Ethernet, USB 3.0, and SFP + fiber optic. It also has a built-in channel priority scheduling unit and PCIe 4.0 expansion interface, supporting 32-channel parallel acquisition with a high-priority channel transmission delay of ≤1ms.

[0011] The log analysis module adopts a heterogeneous computing architecture of "Hygon 3350 CPU + GPU + FPGA". The Hygon 3350 CPU is responsible for overall scheduling and complex logic processing, the GPU accelerates the anomaly detection algorithm in parallel, and the FPGA accelerates the preprocessing and correlation analysis in hardware. The analysis efficiency is 30-100 times higher than that of traditional software implementation, and meets the requirements of domestic compatibility.

[0012] The data storage module adopts a tiered storage architecture of DDR5 high-speed cache and NVMe SSD RAID array, supports RAID 5 / 6 redundancy configuration and national cryptographic SM4 encryption, with data storage reliability ≥99.999%, and reserves a SAS-4 expansion interface, with a maximum storage capacity expandable to 32TB (expandable to 48TB).

[0013] The communication module adopts a fully wired transmission design, integrating 4 Gigabit Ethernet, 2 10 Gigabit Ethernet and 1 PROFINET / Modbus-TCP industrial bus. It has a built-in hardware encryption unit and electrical isolation unit that support the national cryptographic SM4 algorithm, reducing bandwidth utilization by ≥70%, and providing encrypted protection and strong anti-interference capabilities during data transmission.

[0014] The power management module supports dual power supply (AC 90V-264V / DC 12V) redundant input. A dedicated POL power supply module is designed for the Hygon 3350 CPU, which supports dynamic voltage regulation and is equipped with overcurrent, overvoltage, and short circuit protection and real-time monitoring units to ensure stable power supply to the system.

[0015] The system monitoring module is used to monitor the operating status of each module in real time, with a focus on adapting to the status monitoring requirements of the Hygon 3350 CPU to ensure stable system operation.

[0016] Example 1: (a) Log collection module The log collection module, serving as the core of data input, adopts a multi-channel parallel acquisition architecture, featuring diverse interfaces and high-concurrency acquisition capabilities. The specific design is as follows: 1. Multi-type interface unit: Integrates 8 independent acquisition interfaces, covering five interface types: RS232, RS485, Gigabit Ethernet, USB 3.0, and SFP+ fiber optic. The RS232 / RS485 interface uses the MAX3232 / MAX485 level conversion chip, supporting baud rates of 1200bps-115200bps adaptively, adapting to industrial control equipment and traditional serial port devices; the Gigabit Ethernet interface uses an Intel I225-LM controller, supports the IEEE 802.3az energy-saving standard, and has a built-in CRC check circuit to ensure data transmission integrity; the USB 3.0 interface uses a VL817 hub chip, with a transmission rate of up to 5Gbps, allowing direct connection to USB storage devices to read offline logs; the SFP+ fiber optic interface uses a Broadcom BCM57810S transceiver, supporting a transmission rate of 10Gbps and a maximum transmission distance of 10km, meeting the needs of long-distance log acquisition (such as cross-plant equipment monitoring).

[0017] 2. Channel Priority Scheduling Unit: The NXP LPC55S69 microcontroller, based on the ARM Cortex-M33 core and operating at 150MHz, is used as the scheduling core and supports hardware encryption. This unit can set collection priorities based on the importance of the terminal device (e.g., core server, ordinary sensor) and log type (e.g., fault log, regular operation log). High-priority channels (e.g., core server fault logs) use dedicated bandwidth with a data transmission latency of ≤1ms. Low-priority data is temporarily stored in a 256MB DDR3 cache (Micron MT41K256M16TW-107) to prevent critical data from being blocked.

[0018] 3. Expansion Interface Unit: Reserves 2 PCIe 4.0 x4 expansion slots to support the connection of expansion acquisition cards. Each expansion card can add 8 acquisition channels. Data interaction between the expansion card and the main module is realized through the Broadcom BCM5396 PCIe Switch chip. Up to 4 expansion cards can be cascaded to achieve 32-channel parallel acquisition, which meets the needs of large-scale terminal deployment scenarios.

[0019] (ii) Log Analysis Module The log analysis module adopts a heterogeneous computing architecture of "Hygon 3350 CPU + GPU + FPGA". It achieves efficient overall scheduling based on a domestically produced compatible CPU, and with the hardware acceleration of GPU and FPGA, it significantly improves processing efficiency. The specific design is as follows: 1. CPU Coordination Unit: Utilizing the Hygon Dhyana 3350 processor, based on the x86 architecture, this 8-core, 16-thread unit features a base frequency of 3.0GHz and a maximum turbo frequency of 3.8GHz. It supports AMD-V virtualization technology and hardware-level security encryption (compliant with the national SM4 standard), ensuring both high computing performance and meeting the hardware compatibility requirements of specialized and critical industries. This unit is responsible for system resource scheduling, complex logic processing (such as log association rule parsing), and peripheral management. It connects to four 32GB DDR4 ECC memory modules (Samsung M393A4K40CB2-CTD) via a DDR4-3200 memory controller, providing a total memory capacity of 128GB and a memory bandwidth of ≥51.2GB / s. Supporting ECC error checking ensures error-free data processing. Simultaneously, the CPU integrates a PCIe 4.0 controller, providing 16 PCIe 4.0 lanes for direct connection to the GPU, FPGA, and storage modules, reducing data transmission link losses and improving overall collaborative efficiency.

[0020] 2. GPU Parallel Computing Unit: Utilizing an NVIDIA A10 GPU based on the Ampere architecture, this unit features 2560 CUDA cores, 24GB of GDDR6 memory, and a memory bandwidth of 600GB / s. It connects directly to the Hygon 3350 CPU via a PCIe 4.0 x16 interface. This unit is hardware-optimized for anomaly detection algorithms (such as Isolation Forest and LSTM neural networks). A custom computing kernel is developed using the CUDA SDK to parallelize the algorithms. Combined with the efficient task scheduling of the Hygon 3350 CPU, the analysis efficiency is 30-50 times higher than traditional single-threaded CPU processing, enabling real-time identification of fault characteristics and security risks in logs.

[0021] 3. FPGA Hardware Acceleration Unit: Utilizing a Xilinx Alveo U200 FPGA acceleration card, comprising 195K logic units and 2880 DSP slices, it connects to the Hygon 3350 CPU via a PCIe 4.0 x16 interface. This unit accelerates log preprocessing (such as format standardization and redundant data removal) and correlation analysis (such as matching device failure chain reactions). It features a built-in custom instruction set, supports parsing JSON / XML / CSV and custom format logs, achieves redundant data removal latency ≤100ns, and correlation rule matching speed ≥1 million records / second, more than 100 times faster than software implementation. Simultaneously, the Hygon 3350 CPU can achieve low-latency data interaction with the FPGA through a dedicated driver, ensuring that preprocessed data quickly enters the analysis process.

[0022] (III) Data storage module The data storage module adopts a tiered storage architecture, balancing data read / write speed with storage reliability. The specific design is as follows: 1. High-speed cache unit: Configured with four 64GB DDR5-5600 memory modules (Hynix HMCG88MEBQM-UH), total capacity 256GB, memory timing CL40, operating voltage 1.1V, supports On-Die ECC verification, and connects to the analysis module through the Hygon 3350 CPU's built-in memory controller. It is used to store real-time log data to be analyzed and intermediate results during the analysis process, with a data read / write speed ≥89.6GB / s, avoiding data waiting during the analysis process.

[0023] 2. Persistent Storage Unit: A RAID array consisting of four 4TB NVMe SSDs (Samsung 990 Pro) is used. Each SSD has sequential read and write speeds of 7450MB / s and 6900MB / s respectively, supporting TCG Opal 2.0 hardware encryption and the national standard SM4 encryption algorithm, adapting to special scenario requirements. RAID 5 / 6 configuration is achieved through an LSI MegaRAID 9500-8i RAID card (supporting drivers compatible with Hygon 3350 CPUs). RAID 5 mode allows for the failure of one SSD, while RAID 6 mode allows for the simultaneous failure of two SSDs, with data storage reliability ≥99.999%. Additionally, two SAS-4 interfaces (12Gbps) are reserved, supporting connection to SAS expansion cards, with a maximum expansion capacity of 32TB to meet the needs of massive long-term log storage.

[0024] (iv) Communication and Interaction Module The communication interaction module is based on a fully wired transmission design, featuring high stability, high security, and flexible scalability, and is suitable for scenarios without wireless communication. The specific design is as follows: 1. Multi-rate wired communication unit: 1.1 Gigabit Ethernet Sub-unit: Integrates 4 Intel I350-T2 Gigabit Ethernet controllers, each supporting IEEE 802.3ad link aggregation and IEEE 802.1Q VLAN segmentation. It connects to the local area network via an RJ45 interface (integrated network transformer HR911105A), with a single-channel transmission rate of up to 1000Mbps. It supports QoS flow control, allowing log data, management data, and alarm data to be allocated to different VLANs for isolated data transmission and to avoid mutual interference. The controller driver has been adapted for compatibility with the Hygon 3350 CPU, ensuring stable communication links.

[0025] 1.2 10 Gigabit Ethernet Sub-unit: Integrates two Broadcom BCM57810S 10 Gigabit Ethernet controllers, connecting to single-mode / multimode fiber via SFP+ optical module interfaces, supporting a transmission rate of 10Gbps and a maximum transmission distance of 40km (single-mode fiber), suitable for cross-regional, long-distance data transmission scenarios (such as log data exchange between the main plant and branch plants); also completes driver adaptation with Hygon 3350 CPU to ensure high-bandwidth transmission stability.

[0026] 1.3 Industrial Bus Sub-unit: Integrates one PROFINET bus interface and one Modbus-TCP bus interface, using Siemens DP / PN couplers and Schneider Modbus gateway chips. It supports common bus protocols in industrial control systems and can directly communicate with industrial PLCs and DCS systems to obtain equipment operation logs without the need for additional protocol conversion equipment. The bus controller connects to the Hygon 3350 CPU via a PCIe 3.0 interface to ensure efficient protocol parsing and data transmission.

[0027] 2. Hardware encryption and data isolation unit: 2.1 Encryption Subunit: Integrates an Atmel AT88SC0104CA encryption chip (supporting the national standard SM4 algorithm), connected to the main controller of the communication module via the SPI bus. Before log data transmission, the encryption chip performs hardware-level encryption, generating an encrypted data packet containing ciphertext, key ID, and checksum. The receiving end decrypts the data using an encryption chip of the same model, ensuring that the data is not stolen or tampered with during transmission. It also supports periodic key updates (the update cycle can be remotely configured via the system monitoring module) to further enhance security.

[0028] 2.2 Data Isolation Subunit: A dual-port isolation chip (TI ISO7740) is used to achieve electrical isolation between the communication module and other modules. The isolation voltage reaches 2500Vrms, which effectively suppresses electromagnetic interference and common-mode noise in the industrial field and prevents external interference from affecting the operation of the core module of the system through the communication line.

[0029] 3. Local Interaction and Edge Adaptation Unit: 3.1 Local Operation Subunit: Equipped with one RS232 debugging interface and one HDMI display interface, it supports connecting to a debugging terminal for local configuration, or connecting a monitor and keyboard and mouse to directly view the log processing progress, analysis results and system running status on the device, adapting to offline scenarios without network connection.

[0030] 3.2 Edge Processing Subunit: Configured with a TI AM3359 embedded processor (ARM Cortex-A8 core), connected to 512MB DDR3 memory and 4GB eMMC flash memory, running the Buildroot lightweight Linux system (with completed collaborative communication adaptation with the Hygon 3350 CPU). This unit can perform preliminary analysis of log data locally (such as simple anomaly filtering and data compression), and only upload key anomaly information (such as severe fault warnings) to the upper-level management platform via wired communication, reducing backbone network bandwidth utilization by ≥70%, adapting to edge computing scenarios.

[0031] (v) Power Management Module The power management module provides stable and reliable power supply support for the system. The power supply scheme is optimized based on the power consumption characteristics of the Hygon 3350 CPU, and the specific design is as follows: 1. Multi-input power distribution unit: A Mean Well RSP-1500-48 switching power supply is used as the main power supply, with an input voltage of 90V-264V AC and an output of 48V DC, providing 1500W of power to meet the system's full-load operation requirements (the Hygon 3350 CPU consumes approximately 65W at full load, and the total power consumption with GPU, FPGA, and other modules is ≤300W). A 12V DC input interface is also reserved, which is converted to 48V via a TI TPS54620 DC-DC converter, achieving dual power supply redundancy. The input terminals are equipped with a Schaffner FN 328-6-06 EMI filter and a Phoenix Contact VAL-MS 230 / 10 surge protector to suppress grid interference and surge impacts.

[0032] 2. Modular Power Conversion Unit: Customized conversion solutions are adopted to meet the power supply requirements of different modules. In the core analysis module, the Hygon 3350 CPU is powered by a dedicated POL power module (TI TPS51200), with an output voltage of 1.05V (adapted to the CPU core voltage requirements) and supports dynamic voltage regulation (DVS), which can automatically adjust the voltage according to the CPU load to reduce power consumption; the GPU is powered by two Artesyn AIF-150-12 DC-DC converters (48V to 12V, 12.5A current); the log collection, communication and other modules are powered by Mean Well IRM-60-12 converters (48V to 12V, 5A current), and low-voltage devices (such as microcontrollers) are converted to 5V / 3.3V power by TI TPS7A4700 LDO.

[0033] 3. Protection and Monitoring Unit: Each power output is equipped with overcurrent (TI TPS2491), overvoltage (TI TPS3808), and short-circuit protection circuits, which automatically cut off the power supply when the output is abnormal; the ADI ADM1278 monitoring chip is used to collect voltage, current, power, and temperature parameters of each channel via I2C bus (with a focus on monitoring the power supply voltage and current of the Hygon 3350 CPU), with a sampling accuracy of ≤1%. The data is uploaded to the system monitoring module in real time, so that users can keep track of the power supply status.

[0034] (vi) System monitoring module The system monitoring module monitors the operating status of each module in real time, with a focus on adapting to the status monitoring requirements of the Hygon 3350 CPU to ensure stable system operation. The specific design is as follows: 1. Hardware Status Monitoring Unit: Connects to the Nuvoton NCT6798D monitoring chip via I2C bus to collect the temperature (sampling range -40℃ to 125℃, accuracy ±1℃), voltage, and fan speed of the Hygon 3350 CPU, GPU, and FPGA (the Hygon 3350 CPU temperature threshold is set to ≤85℃). Simultaneously, it monitors the SSD health status of the storage module and the network link status of the communication module (such as gigabit Ethernet link speed and bit error rate). When the parameters exceed the preset threshold, an alarm is triggered.

[0035] 2. Fault Early Warning and Handling Unit: In conjunction with the core analysis module, it receives hardware status data and log analysis results. When a hardware fault (such as SSD damage or Ethernet link interruption) or log anomaly (such as frequent device errors) is detected, it sends alarm information (local audible and visual alarms, email / SMS gateway notifications within the local area network) to maintenance personnel through the communication module. At the same time, it automatically performs emergency handling (such as switching redundant power supplies, enabling backup Ethernet links, and enabling backup SSDs) to reduce the impact of the fault.

[0036] 3. Local and Remote Management Unit: Supports on-site management via local HDMI interface connection to a monitor, or remote access via a web interface within the local area network. Users can view system operating parameters (such as Hygon 3350 CPU load, memory usage, storage utilization, and communication link status), log processing progress, and analysis results in real time. They can also remotely update the firmware of each module (adapted to the firmware update protocol of Hygon 3350 CPU), configure collection priorities and analysis rules, without on-site operation, thus improving operation and maintenance efficiency.

[0037] To more clearly illustrate the implementation process of this invention, the following describes in detail the specific implementation steps of the system hardware, using a log processing scenario of an industrial control system as an example: (a) Hardware deployment 1. Terminal Connection: Connect the 12 core PLC controllers (PROFINET interface), 8 servers (Gigabit Ethernet interface), and 3 remote monitoring devices (SFP + fiber optic interface) in the industrial control system to the corresponding interfaces of the log collection module. Set the core PLC fault logs to the highest priority, the server operation logs to the medium priority, and the remote monitoring device data logs to the low priority using the module's local configuration tool (connected to the RS232 debugging interface).

[0038] 2. Module Assembly: The log collection module, log analysis module, data storage module, communication interaction module, power management module, and system monitoring module are assembled through standardized backplane slots. The modules are connected to each other via a PCIe 4.0 x16 bus (the Hygon 3350 CPU is directly connected to the GPU, FPGA, and storage module via a PCIe 4.0 channel). The power management module is connected to the 220V AC power supply and 12V DC backup power supply in the industrial site. The four Gigabit Ethernet interfaces of the communication module are connected to the local special LAN switch, the operation and maintenance management terminal, and the alarm gateway, respectively. The two 10 Gigabit Ethernet interfaces are connected to the main plant management platform and the off-site backup center via single-mode fiber.

[0039] 3. Parameter Configuration: Configure log analysis rules (e.g., "PLC temperature > 85℃ and output current > 110% of rated value → fault warning"), storage policies (RAID 6 mode, log retention period of 2 years, regular automatic backup to an off-site backup center, and data encryption using the national cryptographic SM4 algorithm) and communication parameters (Gigabit Ethernet VLAN division: log data VLAN ID 10, management data VLAN ID 20, alarm data VLAN ID 30; 10 Gigabit Ethernet transmission rate locked at 10Gbps full duplex) through the local HDMI interface of the system monitoring module. At the same time, configure the dynamic voltage regulation parameters of the Hygon 3350 CPU, setting it to automatically reduce the frequency to 2.0GHz when the load is below 30% to reduce system power consumption.

[0040] (II) Log Processing Flow 1. Data Acquisition: The log collection module synchronously collects log data from each terminal through a multi-channel interface. The main controller (LPC55S69) schedules data according to priority. The core PLC fault log is directly transmitted to the Hygon 3350 CPU of the log analysis module through the PCIe 4.0 bus. The logs of the server and remote monitoring devices are temporarily stored in the local DDR3 cache and sent after the high-priority data transmission is completed. The concurrent acquisition capability reaches 150,000 records / second with no data loss.

[0041] 2. Data Preprocessing: The Hygon 3350 CPU distributes the collected raw log data to the FPGA acceleration unit. The FPGA automatically identifies the PLC's PROFINET protocol logs, the server's JSON logs, and the monitoring device's CSV logs, converting them into a unified JSON format. At the same time, it removes duplicate logs (such as normal data repeatedly reported by the monitoring device), extracts fields such as timestamps, device IDs, and key parameters, with a preprocessing delay of ≤200ns. The preprocessed data is then transmitted back to the Hygon 3350 CPU via the PCIe 4.0 bus.

[0042] 3. Analysis and Calculation: The Hygon 3350 CPU distributes the preprocessed data to the GPU and its own computing core: The GPU runs the LSTM neural network algorithm in parallel computing to detect abnormal features in the logs in real time (such as PLC voltage drop, abnormal server process exit), with an analysis latency of ≤5ms; The Hygon 3350 CPU itself is responsible for parsing complex association rules, and works with the FPGA acceleration unit to complete the matching of the chain fault relationship of "PLC voltage drop → motor overload → production line shutdown", with a matching speed of 1.2 million records / second; The collaboration of the three ensures that the analysis results are generated quickly.

[0043] 4. Data Storage and Transmission: Analysis results (including anomaly level, fault location, and handling suggestions) and raw log data are transmitted from the Hygon 3350 CPU to the data storage module. The analysis results are temporarily stored in the DDR5 high-speed cache, and the raw logs are stored in the NVMe SSD array (encrypted using the national cryptographic SM4 algorithm). The communication module sends critical fault warnings (such as production line shutdowns) to the alarm gateway via Gigabit Ethernet VLAN 30, triggering local audible and visual alarms and email notifications to maintenance personnel. At the same time, the raw logs and analysis results are synchronized to the off-site backup center via 10 Gigabit Ethernet. Regular analysis results are uploaded to the main plant management platform in batches every 2 hours, reducing bandwidth usage by 75%.

[0044] 5. Status Monitoring and Early Warning: The system monitoring module collects real-time data on the Hygon 3350 CPU temperature (stable at 65℃-75℃), load (average load ≤60%), SSD health status (no bad blocks), and communication link status (Gigabit Ethernet bit error rate <10). - ¹² (10 Gigabit Ethernet link stability): When the Ethernet link of a server's log collection channel fluctuates, the Hygon 3350 CPU immediately dispatches a backup link and sends alarm information to the maintenance terminal to ensure uninterrupted collection and transmission.

[0045] (III) Expansion and Maintenance When six new PLC controllers are added to the industrial control system, an expansion acquisition card (adding eight PROFINET interfaces) is connected through the PCIe 4.0 x4 expansion slot of the log collection module. The Hygon 3350 CPU automatically identifies the expansion device and allocates resources, configuring the new PLC logs as medium priority. No other hardware replacement is required. After expansion, the acquisition channels reach 16, meeting the needs of the new terminals. After 12 months of system operation, the FPGA firmware, GPU driver, and Hygon 3350 CPU microcode are remotely updated via the LAN Web interface to improve the accuracy of anomaly detection. At the same time, historical logs are migrated in batches to the newly added SAS expansion storage (total capacity reaches 48TB after expansion) via 10 Gigabit Ethernet. The entire process does not require downtime and does not affect industrial production or data security.

[0046] Key technical points of this invention: 1. Multi-channel parallel acquisition and priority scheduling technology: By integrating five interfaces, namely RS232, RS485, Gigabit Ethernet, USB3.0, and SFP + fiber optic, and a channel priority scheduling unit, it achieves multi-scenario terminal adaptation and priority processing of critical logs, solving the problems of single hardware interface and weak concurrent acquisition capability of traditional hardware. The acquisition latency is ≤1ms and the concurrent capability is ≥100,000 records / second.

[0047] 2. "Hygon 3350 CPU+GPU+FPGA" Heterogeneous Computing Acceleration Technology: Based on the domestic compatibility and efficient scheduling capabilities of the Hygon 3350 CPU, combined with the parallel computing of the GPU and the hardware-level acceleration of the FPGA, it achieves efficient processing of log preprocessing, anomaly detection and correlation analysis, balancing security and performance. The analysis efficiency is 30-100 times higher than that of traditional software solutions, meeting the needs of real-time analysis and special scenarios.

[0048] 3. Tiered storage and RAID redundancy technology: It adopts a tiered architecture of DDR5 high-speed cache and NVMe SSD RAID array, supports RAID 5 / 6 redundancy configuration and national cryptographic SM4 encryption, data storage reliability ≥99.999%, and supports dynamic capacity expansion to 32TB (expandable to 48TB), solving the problems of slow speed, easy loss and insufficient security of traditional storage.

[0049] 4. Fully wired high-reliability communication technology: Integrates Gigabit Ethernet (4 channels), 10 Gigabit Ethernet (2 channels) and industrial bus (PROFINET / Modbus-TCP), with hardware encryption (supporting national cryptographic algorithms) and electrical isolation design to achieve stable and secure data transmission, adapt to scenarios without wireless communication, solve the problems of traditional wireless communication being susceptible to interference and having poor security, and reduce bandwidth utilization by ≥70%.

[0050] 5. Power supply and monitoring technology adapted to Hygon 3350 CPU: The power management scheme is optimized for the power consumption and voltage requirements of Hygon 3350 CPU, and the precise hardware status monitoring ensures stable operation of the CPU; the combination of dual power input, multiple protection circuits and real-time status monitoring results in a system mean time between failures (MTBF) of ≥100,000 hours, solving the problems of low reliability and difficulty in early warning of failures in traditional power supplies.

[0051] Beneficial effects: This invention provides a high-performance log collection and analysis device. This device can achieve high-performance log collection and analysis with efficient collection, real-time analysis, secure storage and stable wired transmission in multiple scenarios. It can be widely used in scenarios with strict restrictions on wireless communication and requirements for hardware compatibility with domestic production (such as industrial control systems, server clusters and financial data centers), providing hardware-level support for the stable operation and risk warning of various systems.

[0052] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A high-performance log collection and analysis device, characterized in that, The device includes: a log collection module, a log analysis module, a data storage module, a communication interaction module, a power management module, and a system monitoring module. All modules work together via a high-speed bus. The log collection module adopts a multi-channel parallel acquisition architecture, integrating five interface types: RS232, RS485, Gigabit Ethernet, USB3.0, and SFP + fiber optic. It also has a built-in channel priority scheduling unit and PCIe 4.0 expansion interface, supporting 32-channel parallel acquisition. The log analysis module adopts a heterogeneous computing architecture of "Hygon 3350 CPU + GPU + FPGA". The Hygon 3350 CPU is responsible for overall scheduling and complex logic processing, the GPU is used for parallel acceleration of anomaly detection algorithms, and the FPGA is used for hardware acceleration of preprocessing and correlation analysis. The data storage module adopts a hierarchical storage architecture of DDR5 high-speed cache and NVMe SSD RAID array, supports RAID 5 / 6 redundancy configuration and national cryptographic SM4 encryption, and reserves SAS-4 expansion interface; The communication module adopts a fully wired transmission design, integrating 4 Gigabit Ethernet, 2 10 Gigabit Ethernet and 1 PROFINET / Modbus-TCP industrial bus, and has a built-in hardware encryption unit and electrical isolation unit that support the national cryptographic SM4 algorithm. The power management module supports dual power redundant input. It is designed with a dedicated POL power supply module for Hygon 3350 CPU, supports dynamic voltage regulation, and is equipped with overcurrent, overvoltage, and short circuit protection and real-time monitoring units to ensure stable power supply to the system. The system monitoring module is used to monitor the operating status of each module in real time, with a focus on adapting to the status monitoring requirements of the Hygon 3350 CPU to ensure stable system operation.

2. The high-performance log collection and analysis device as described in claim 1, characterized in that, The log collection module integrates eight independent acquisition interfaces, covering five interface types: RS232, RS485, Gigabit Ethernet, USB 3.0, and SFP+ fiber optic. The RS232 / RS485 interfaces utilize the MAX3232 / MAX485 level conversion chip, supporting baud rates of 1200bps-115200bps adaptively, suitable for industrial control equipment and traditional serial devices. The Gigabit Ethernet interface uses an Intel I225-LM controller, supports the IEEE 802.3az energy-saving standard, and has a built-in CRC check circuit to ensure data transmission integrity. The USB 3.0 interface uses a VL817 hub chip, achieving a transmission rate of up to 5Gbps, allowing direct connection to USB storage devices to read offline logs. The SFP+ fiber optic interface uses a Broadcom BCM57810S transceiver, supporting a transmission rate of 10Gbps.

3. The high-performance log collection and analysis device as described in claim 2, characterized in that, The log collection module uses an NXP LPC55S69 microcontroller as the scheduling core, based on an ARM Cortex-M33 core with a working frequency of 150MHz. It supports hardware encryption and sets collection priorities according to the importance of terminal devices and log types. High-priority channels use dedicated bandwidth design, while low-priority data is temporarily stored in a 256MB DDR3 cache to avoid blocking critical data. Two PCIe 4.0 x4 expansion slots are reserved to support the connection of expansion acquisition cards. Each expansion card can add 8 acquisition channels. Data interaction between the expansion card and the main module is realized through a Broadcom BCM5396 PCIe Switch chip. A maximum of 4 expansion cards can be cascaded to achieve 32-channel parallel acquisition.

4. The high-performance log collection and analysis device as described in claim 1, characterized in that, The log analysis module uses a Hygon 3350 processor, which is responsible for system resource scheduling, complex logic processing and peripheral management. It connects to four 32GB DDR4 ECC memory modules through a DDR4-3200 memory controller. At the same time, the CPU integrates a PCIe 4.0 controller, providing 16 PCIe 4.0 lanes, which directly connect to the GPU, FPGA and storage module. The NVIDIA A10 GPU is selected and directly connected to the Hygon 3350 CPU via the PCIe 4.0x16 interface; the anomaly detection algorithm is optimized at the hardware level, a custom computing kernel is developed using the CUDA SDK, the algorithm is parallelized, and combined with the efficient task scheduling of the Hygon 3350 CPU, fault characteristics and security risks in the logs are identified in real time. The Xilinx Alveo U200 FPGA acceleration card is used and connected to the Hygon 3350 CPU via a PCIe 4.0 x16 interface to accelerate log preprocessing and correlation analysis. It has a built-in custom instruction set and supports the parsing of JSON / XML / CSV and custom format logs. At the same time, the Hygon 3350 CPU achieves low-latency data interaction with the FPGA through a dedicated driver, ensuring that the preprocessed data quickly enters the analysis process.

5. The high-performance log collection and analysis device as described in claim 1, characterized in that, The data storage module is equipped with four 64GB DDR5-5600 memory modules, which are connected to the log analysis module through the built-in memory controller of the Hygon 3350 CPU. They are used to store the real-time log data to be analyzed and the intermediate results during the analysis process. It uses four 4TB NVMe SSDs to form a RAID array, and implements RAID 5 / 6 configuration through an LSI MegaRAID 9500-8i RAID card. RAID 5 mode allows for the failure of one SSD, and RAID 6 mode allows for the simultaneous failure of two SSDs. At the same time, it reserves two SAS-4 interfaces to support the connection of SAS expansion cards, which can be expanded to a maximum storage capacity of 32TB.

6. The high-performance log collection and analysis device as described in claim 1, characterized in that, The communication interaction module includes a multi-rate wired communication unit comprising: Gigabit Ethernet Sub-unit: Integrates 4 Intel I350-T2 Gigabit Ethernet controllers, each supporting IEEE 802.3ad link aggregation and IEEE 802.1Q VLAN segmentation, and connects to the local area network via RJ45 interface; 10 Gigabit Ethernet Subunit: Integrates two Broadcom BCM57810S 10 Gigabit Ethernet controllers, connecting to single-mode / multimode fiber via SFP+ optical module interfaces; Industrial bus sub-unit: integrates one PROFINET bus interface and one Modbus-TCP bus interface, adopts DP / PN coupler and Modbus gateway chip, and the bus controller is connected to Hygon 3350 CPU through PCIe 3.0 interface to ensure high efficiency of protocol parsing and data transmission.

7. The high-performance log collection and analysis device as described in claim 1, characterized in that, The communication interaction module includes a hardware encryption and data isolation unit comprising: Encryption Subunit: Integrates an Atmel AT88SC0104CA encryption chip, which is connected to the main controller of the communication module via the SPI bus. Before log data is transmitted, the encryption chip performs hardware-level encryption to generate an encrypted data packet containing ciphertext, key ID, and checksum. The receiving end decrypts the data using an encryption chip of the same model, ensuring that the data is not stolen or tampered with during transmission. Data isolation subunit: A dual-port isolation chip is used to achieve electrical isolation between the communication module and other modules, with an isolation voltage of up to 2500Vrms, suppressing electromagnetic interference and common-mode noise in industrial environments, and preventing external interference from affecting the operation of the core system modules through the communication lines.

8. The high-performance log collection and analysis device as described in claim 1, characterized in that, The communication interaction module includes a local interaction and edge adaptation unit: Local operation subunit: Equipped with one RS232 debugging interface and one HDMI display interface, it supports connecting to a debugging terminal for local configuration, or connecting to a monitor and keyboard and mouse to directly view log processing progress, analysis results and system running status on the device, adapting to offline scenarios without network connection; Edge processing subunit: Configured with a TI AM3359 embedded processor, connected to 512MB DDR3 memory and 4GB eMMC flash memory, running the Buildroot lightweight Linux system; performs preliminary analysis of log data locally, and only uploads key anomaly information to the upper-level management platform via wired communication.

9. The high-performance log collection and analysis device as described in claim 1, characterized in that, The power management module includes: Multi-input power distribution unit: Utilizing a Mean Well RSP-1500-48 switching power supply as the main power source, with an input voltage of 90V-264V AC and an output of 48V DC, delivering 1500W of power to meet the system's full-load operation requirements; a 12V DC input interface is also reserved, which is converted to 48V via a TI TPS54620 DC-DC converter, achieving dual power supply redundancy; the input terminals are equipped with a Schaffner FN 328-6-06 EMI filter and a Phoenix Contact VAL-MS 230 / 10 surge protector to suppress grid interference and surge impacts; Modular power conversion unit: Customized conversion solutions are adopted to meet the power supply requirements of different modules; in the core analysis module, the Hygon 3350 CPU is powered by a dedicated POL power module with an output voltage of 1.05V, supporting dynamic voltage adjustment and automatically adjusting the voltage according to the CPU load; the GPU is powered by two Artesyn AIF-150-12 DC-DC converters; the log collection module and communication interaction module are powered by Mean Well IRM-60-12 converters, and low-voltage devices are converted to 5V / 3.3V power supply by TITPS7A4700 LDO; Protection and monitoring unit: Each power output is equipped with overcurrent, overvoltage and short circuit protection circuits, which automatically cut off the power supply when the output is abnormal; the ADI ADM1278 monitoring chip is used to collect voltage, current, power and temperature parameters of each channel through the I2C bus.

10. The high-performance log collection and analysis device as described in claim 1, characterized in that, The system monitoring module includes: Hardware status monitoring unit: Connects to the Nuvoton NCT6798D monitoring chip via I2C bus to collect the temperature, voltage and fan speed of the Hygon 3350 CPU, GPU and FPGA. At the same time, it monitors the health status of the SSD in the storage module and the network link status of the communication module. When the parameters exceed the preset threshold, an alarm is triggered. Fault warning and handling unit: In conjunction with the log analysis module, it receives hardware status data and log analysis results. When a hardware fault or log anomaly is detected, it sends alarm information to maintenance personnel through the communication module and automatically performs emergency handling. Local and remote management unit: Supports on-site management via connecting a monitor through the local HDMI interface, or remote access via a web interface within the local area network. Users can view system operating parameters, log processing progress and analysis results in real time, and remotely update firmware for each module, configure collection priorities and analysis rules.