Log cache eviction method, system and router

Abstract

The application belongs to the technical field of network communication, and particularly relates to a log cache elimination method, a system and a router. The method is aimed at the problem that key logs are easily covered by ordinary logs in the first-in-first-out coverage mode of a ring buffer. The basic weight of a log is determined according to the attribute information of the log, and the dynamic weight of the log is corrected according to the network running state information. When the cache space is insufficient, the comprehensive evaluation value is calculated by comprehensively considering the current weight information, the storage time information and the relevance information, and the low-value logs are preferentially eliminated by combining the sorting and rule screening based on the evaluation value, so that the cache utilization efficiency and the key log retention capability are improved, and the reliability of fault troubleshooting and security analysis is enhanced.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, specifically to a log cache eviction method, system, and router, and more particularly to a local log cache eviction scheme for circular buffer log management scenarios that combines log grading, dynamic weight correction, comprehensive evaluation, and rule-based filtering. Background Technology

[0002] Routers continuously generate a large number of system logs, link logs, interface logs, session logs, and security alarm logs during operation. These logs play a crucial role in device operation and maintenance, fault location, performance analysis, and security auditing. Currently, routers supporting system log management are widely used, allowing users to monitor various system events occurring within the router system by viewing the system logs.

[0003] Due to limited local storage space on routers, existing devices typically use a circular buffer to cache logs. The capacity of the router's internal memory for recording system logs is usually only a few kilobytes. When the system log volume exceeds this capacity, the router will clear the stored system logs according to pre-defined rules to free up internal memory cache capacity. For example, in Cisco routers' log caching mechanism, system logs are stored in the router's memory buffer. The buffer capacity is small, and a record is typically only kept for a few minutes. The buffer processes log records in a first-in-first-out (FIFO) queue mode, where the oldest records are refreshed, and some important log records may be overwritten. HPE FlexNetwork routers also use a FIFO mode by default; when the log buffer is full, new logs automatically overwrite the oldest logs. Furthermore, the open-source project libosmocore implements a circular buffer specifically for logging. This implementation is a lossy circular buffer, retaining only a maximum of N of the most recent messages, with older messages being overwritten as new messages arrive.

[0004] However, the traditional first-in-first-out (FIFO) overwriting method described above primarily relies on the order in which logs are written to eliminate them, failing to differentiate the importance of different logs. When critical events such as abnormal device restarts, link jitter, traffic surges, network attacks, or configuration anomalies occur, logs related to these events are usually highly valuable for subsequent troubleshooting and analysis, but they may still be overwritten by a large amount of subsequent ordinary operational logs, leading to the loss of critical logs.

[0005] To address the aforementioned issues, patent application CN106547677A discloses a log processing method and apparatus. This method determines log scores by rating acquired logs and then sends logs based on these scores, preventing important logs from being missed during periods of high throughput. However, this approach focuses on prioritizing log transmission rather than eviction decisions when cache space is insufficient. Its rating is primarily based on the importance of the log sender, neglecting dimensions such as storage time decay and log correlation, and it lacks a mechanism for real-time weight adjustments based on network status. Therefore, when cache space is limited, this approach still cannot effectively protect high-value logs related to critical events.

[0006] Therefore, providing a router local log cache intelligent eviction method that can perform hierarchical evaluation of logs, dynamically adjust retention priorities based on network operating status, and perform differentiated eviction based on log association relationships has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0007] To address the aforementioned shortcomings of existing router local log caching technologies that employ a circular buffer FIFO (First-In, First-Out) eviction mechanism, this invention provides a log cache eviction method, system, and router. This method, system, and router combine log attribute information, network operating status, storage time, and log correlation to comprehensively evaluate the value of cached logs. When cache space is insufficient, low-value logs are prioritized for eviction, thereby increasing the retention probability of critical logs.

[0008] To achieve the above objectives, the present invention provides the following technical solution: Solution 1: This invention provides a log cache eviction method, comprising the following steps: Obtain the base weight of the log to be written, the base weight being determined based on the log's attribute information; The dynamic weights of the logs are adjusted based on network operation status information; When the cache space is insufficient, the comprehensive evaluation value of the log is calculated based on the current weight information, storage time information and correlation information of the log; A set of elimination candidates is generated based on the comprehensive evaluation values; Perform log-based elimination operations based on the elimination candidate set.

[0009] In a preferred embodiment, the log attribute information includes log level and log type; the log level includes a first level, a second level, and a third level, wherein the base weight of the first level log is greater than the base weight of the second level log, and the base weight of the second level log is greater than the base weight of the third level log.

[0010] In a preferred embodiment, the dynamic weight of the logs is adjusted based on network operation status information, including: when a first type of abnormal event is detected, the dynamic weight of the relevant logs is increased to a first preset multiple; when a second type of abnormal event is detected, the dynamic weight of the relevant logs is increased to a second preset multiple; wherein the first preset multiple is greater than the second preset multiple.

[0011] In a preferred embodiment, the comprehensive evaluation value is obtained by weighting the dynamic weight normalized value, the storage time decay value, and the log correlation value; the weight coefficients of the dynamic weight normalized value, the storage time decay value, and the log correlation value are dynamically adjusted according to the cache utilization rate.

[0012] In a preferred embodiment, generating a candidate set for elimination based on the comprehensive evaluation value includes: sorting the logs according to the comprehensive evaluation value, and performing rule-based filtering on the sorted logs to generate the candidate set for elimination; the rule-based filtering includes at least one of the following: excluding first-level logs from the candidate set for elimination; and including second-level logs in the candidate set for elimination when preset conditions are met.

[0013] In a preferred embodiment, the method further includes: when the cache utilization rate exceeds a preset threshold and the number of logs exceeds a preset number, performing optimization processing on the candidate set to be evicted; the optimization processing includes dividing the logs into multiple value groups according to the comprehensive evaluation value, and prioritizing the selection of logs from the low-value groups.

[0014] Solution 2: This invention provides a log cache eviction system, comprising: The acquisition module is used to acquire the basic weight of the log, which is determined based on the log's attribute information; The correction module is used to correct the dynamic weight of the logs based on network operation status information; The evaluation module is used to calculate a comprehensive evaluation value of the log based on its current weight information, storage time information, and correlation information when the cache space is insufficient. The screening module is used to generate a set of elimination candidates based on the comprehensive evaluation value; The elimination module is used to perform log elimination operations based on the elimination candidate set; The cache management module is used to manage the circular buffer and determine whether the cache space is sufficient.

[0015] In a preferred embodiment, the log attribute information includes log level and log type; the log level includes a first level, a second level, and a third level, wherein the base weight of the first level log is greater than the base weight of the second level log, and the base weight of the second level log is greater than the base weight of the third level log.

[0016] In a preferred embodiment, the correction module corrects the dynamic weight of the logs based on network operation status information, including: when a first type of abnormal event is detected, increasing the dynamic weight of the logs associated with the abnormal event to a first preset multiple; when a second type of abnormal event is detected, increasing the dynamic weight of the logs associated with the abnormal event to a second preset multiple; wherein the first preset multiple is greater than the second preset multiple.

[0017] In a preferred embodiment, when the evaluation module calculates the comprehensive evaluation value, the comprehensive evaluation value is obtained by weighting the dynamic weight normalized value, the storage time decay value, and the log correlation value; the weight coefficients of the dynamic weight normalized value, the storage time decay value, and the log correlation value are dynamically adjusted according to the cache utilization rate.

[0018] In a preferred embodiment, the filtering module generates a candidate set for elimination based on the comprehensive evaluation value, including: sorting the logs according to the comprehensive evaluation value, and performing rule-based filtering on the sorted logs to generate the candidate set for elimination; the rule-based filtering includes at least one of the following: excluding the first-level logs from the candidate set for elimination; and including the second-level logs in the candidate set for elimination when they meet preset conditions.

[0019] Solution 3: This invention provides a router, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is run on the processor, the processor performs the following steps: Obtain the base weight of the log to be written, the base weight being determined based on the log's attribute information; The dynamic weights of the logs are adjusted based on network operation status information; When the cache space is insufficient, the comprehensive evaluation value of the log is calculated based on the current weight information, storage time information and correlation information of the log; A set of elimination candidates is generated based on the comprehensive evaluation values; Perform log-based elimination operations based on the elimination candidate set.

[0020] In a preferred embodiment, the log attribute information includes log level and log type; the log level includes a first level, a second level, and a third level, wherein the base weight of the first level log is greater than the base weight of the second level log, and the base weight of the second level log is greater than the base weight of the third level log.

[0021] In a preferred embodiment, the processor adjusts the dynamic weight of the logs based on network operating status information, including: when a first type of abnormal event is detected, increasing the dynamic weight of the logs associated with the abnormal event to a first preset multiple; when a second type of abnormal event is detected, increasing the dynamic weight of the logs associated with the abnormal event to a second preset multiple; wherein the first preset multiple is greater than the second preset multiple.

[0022] In a preferred embodiment, the comprehensive evaluation value is obtained by weighting the dynamic weight normalized value, the storage time decay value, and the log correlation value; the weight coefficients of the dynamic weight normalized value, the storage time decay value, and the log correlation value are dynamically adjusted according to the cache utilization rate.

[0023] In a preferred embodiment, the processor generates a candidate set for elimination based on the comprehensive evaluation value, including: sorting the logs according to the comprehensive evaluation value and performing rule-based filtering on the sorted logs to generate the candidate set for elimination; the rule-based filtering includes at least one of the following: excluding the first-level logs from the candidate set for elimination; and including the second-level logs in the candidate set for elimination when a preset condition is met.

[0024] In a preferred embodiment, the processor further performs the following steps: when the cache utilization rate exceeds a preset threshold and the number of logs exceeds a preset number, optimization processing is performed on the candidate set to be evicted; the optimization processing includes dividing the logs into multiple value groups according to the comprehensive evaluation value, and prioritizing the selection of logs from the low-value groups.

[0025] Compared with the prior art, the present invention has the following advantages: First, this invention constructs a two-layer weight system that combines basic weights and dynamic weights. The basic weights are statically set based on the log attribute information, while the dynamic weights are corrected in real time based on the network operation status. The combination of the two not only ensures the basic framework of log classification, but also realizes dynamic protection of logs related to critical events.

[0026] Second, this invention introduces a multi-dimensional comprehensive evaluation mechanism, which calculates a comprehensive evaluation value by combining three dimensions: current weight information, storage time information, and correlation information. Furthermore, the weight coefficients of each dimension are adaptively adjusted according to the cache usage rate, thereby realizing dynamic optimization of the eviction strategy.

[0027] Third, this invention designs a two-level screening mechanism. First, a preliminary candidate set is generated through rule-based screening, and then a second screening is performed through optimization processing to ensure the accuracy of elimination decisions and the effective protection of critical logs.

[0028] Fourth, this invention applies the method to routers, establishing a linkage guarantee mechanism between intelligent replacement and first-in-first-out degradation. When there is insufficient space released by intelligent replacement, automatic degradation is performed using the first-in-first-out method to complete the write, ensuring the reliability and availability of the router under extreme conditions. Attached Figure Description

[0029] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0030] Figure 1 This is an overall flowchart of the log cache eviction method of the present invention.

[0031] Figure 2 This is a flowchart illustrating the comprehensive evaluation value calculation, sorting, rule-based screening, and candidate set optimization of the present invention.

[0032] Figure 3 This is a structural block diagram of a log cache eviction system provided in an embodiment of the present invention. Detailed Implementation

[0033] To make the technical means, technical features, objectives and effects of this invention easier to understand, the invention will be further described below with reference to specific illustrations.

[0034] To overcome the problems faced by existing technologies, the log caching eviction scheme proposed in this invention first constructs a two-layer weight system combining basic weights and dynamic weights. The basic weights are statically set based on the log's attribute information, namely its level and type, reflecting the inherent importance of the log; the dynamic weights are adjusted in real time based on network operating status and abnormal events, reflecting the timeliness and importance of the log. The combination of these two systems ensures both the basic framework of log hierarchy and dynamic protection of logs related to critical events.

[0035] Building upon this foundation, a multi-dimensional comprehensive evaluation mechanism is introduced. Unlike traditional solutions that rely solely on a single dimension such as time or level for eviction decisions, this invention calculates a comprehensive evaluation value by integrating three dimensions: current weight information, storage time information, and correlation information. Furthermore, the weight coefficients of each dimension are adaptively adjusted according to cache utilization, thereby achieving dynamic optimization of the eviction strategy.

[0036] A two-tiered screening mechanism is further constructed. First, a preliminary candidate set is generated through rule-based screening, and then a second screening is conducted through optimization processing to ensure the accuracy of elimination decisions and the effective protection of critical logs.

[0037] Furthermore, a linkage mechanism between intelligent replacement and first-in-first-out (FIFO) degradation should be established. When there is insufficient space freed up by intelligent replacement, automatic degradation will be completed using a FIFO approach to ensure the reliability and availability of the router under extreme conditions.

[0038] Based on the organic combination of the above-mentioned technical means, this invention can significantly improve the retention rate of critical logs under cache pressure; realize the adaptive adjustment of the eviction policy to the network operation status; maintain the integrity of the critical event chain through correlation protection; and maximize the overall retention value of logs when cache resources are limited.

[0039] See Figure 1 The diagram shown is an example of the overall process of the log cache eviction method provided by this invention.

[0040] Based on the diagram, this log cache eviction method is mainly implemented by steps S101-S110 in sequence. The specific execution plan and process are as follows: This log cache eviction method first executes step S101 after a new log is generated by the router. This step determines the log's basic weight based on its attribute information, including log level and log type. Step S101 establishes an initial importance metric for each log entry, reflecting its inherent value.

[0041] Then, step S102 is executed to adjust the dynamic weight of the logs based on network operating status information. In this method, step S102 enables the importance measurement of logs to reflect real-time changes in network operating status, ensuring that logs related to critical events receive higher retention priority.

[0042] Step S103 determines whether the current cache space is sufficient. If the cache space is sufficient, proceed to step S104 to directly write the log to the circular buffer; if the cache space is insufficient, proceed to step S105 to start the intelligent eviction process.

[0043] Step S105 performs a comprehensive evaluation calculation on the cached logs. In this method, step S105 comprehensively quantifies the retention value of each log from three dimensions: dynamic weight, storage time, and relevance.

[0044] Step S106 sorts the logs according to the comprehensive evaluation value and generates a preliminary candidate set for elimination by combining rule-based filtering. In this method, step S106 combines the comprehensive evaluation value with business rules to ensure that core logs are not mistakenly eliminated.

[0045] Step S107 involves optimizing the initial eviction candidate set when the cache utilization rate exceeds a preset threshold and the number of logs reaches a preset scale, generating the final eviction candidate set. In this method, step S107 further refines the eviction candidate set through secondary screening to ensure the accuracy of the eviction decision.

[0046] Step S108 performs an elimination operation based on the final candidate set to release cache space.

[0047] Step S109 determines whether there is enough free space. If there is enough, proceed to step S104 to write a new log; if there is still insufficient free space, proceed to step S110 to degrade and use a first-in-first-out overwrite method to complete the write.

[0048] Based on an understanding of the overall function and logical coordination of the above steps, the following section provides a more detailed explanation of the specific implementation plan for each step from a technical implementation perspective.

[0049] As an example of an implementable form, step S101 of this log cache eviction method can be implemented through the following specific scheme when obtaining the basic weight: To achieve hierarchical log management, a basic weight is assigned based on the log level and log type when a log is generated. Log levels are divided into three categories: Level 1 (core logs), Level 2 (important logs), and Level 3 (normal logs). Log types include security logs, configuration change logs, session exception logs, performance alarm logs, system logs, and forwarding logs.

[0050] As an example, the following grading rules can be adopted: When a log belongs to the core log category and its type is security or configuration change, the basic weight is set to the highest level; if its type is other categories, the basic weight is set to the second highest level; when a log belongs to the important log category and its type is session exception or performance alarm, the basic weight is set to the medium level; the basic weight of other important logs is set to the second medium level; and the basic weight of ordinary logs is uniformly set to the lowest level. The specific values ​​of each level can be flexibly configured according to the actual application scenario. For example, they can be set to integer values ​​such as 10, 9, 6, 5, and 2 to reflect the weight differences between each level.

[0051] In the log data structure, in addition to the basic weight, dynamic weights are also initialized synchronously to the basic weight value, and the log generation timestamp and event end time are recorded as initial values. This initialization process ensures that subsequent dynamic adjustments and comprehensive evaluations have a unified initial benchmark.

[0052] As an example of an implementable form, when performing dynamic weight adjustment in step S102 of this log cache eviction method, it can be implemented through the following specific scheme: After obtaining the basic log weights, the system adjusts the dynamic log weights based on network operation status information and abnormal event detection results. The dynamic weights reflect the actual importance of the logs at the current moment, and their values ​​vary within a preset range, such as 1 to 20.

[0053] When a first type of abnormal event, namely a major abnormal event, including device crash, large-scale attack or critical configuration abnormality, is detected, the dynamic weight of the log associated with the event in terms of time window, IP identifier, port identifier or log category will be increased to a first preset multiple, for example, it can be increased to 200% of the base weight; When a second type of abnormal event, namely a general abnormal event, is detected, including short-term traffic fluctuations, single session abnormalities, or port alarms, the relevant log dynamic weight will be increased to a second preset multiple, for example, up to 150% of the base weight.

[0054] Unlike the binary model in existing technologies that restores weights immediately after an event ends, this invention does not restore weights immediately after an event ends. Instead, the dynamic weights are restored to their base weights only after the event has ended and a preset observation time has elapsed. This "delayed recovery" mechanism, by setting a preset observation time (e.g., 1800 seconds), ensures that associated logs generated during the "aftermath" of the event are also effectively protected, avoiding the problem of associated logs being mistakenly discarded when the event has just ended but the network is still converging.

[0055] The dynamic weight correction mechanism employed in this invention enables logs related to an abnormal event to receive a temporary high retention priority when such an event occurs, thereby preventing them from being overwritten by a large number of subsequent ordinary logs. After the event ends, the weight is gradually restored, preventing excessive caching space from being occupied due to persistently high weights.

[0056] As an example of an implementable form, step S103 of this log cache eviction method, when determining the sufficiency of cache space, can be implemented through the following specific scheme: After the logs are configured with basic weights and dynamic weight adjustments, a buffer space sufficiency check is performed before writing the logs to the circular buffer. The purpose of this check is to determine whether the available storage space in the current circular buffer is sufficient to accommodate the log data to be written, so as to avoid write operations failing due to insufficient space or valid logs being indiscriminately overwritten.

[0057] As an example, a log cache management mechanism based on a circular buffer can be adopted, which achieves efficient management of contiguous address space through a base address pointer, a tail pointer, a write pointer, and a valid log start pointer. Unlike existing technologies that use "reserved space" or additional counters to resolve pointer overlap ambiguity, this invention addresses the ambiguity of the circular buffer when the write pointer and start pointer coincide by introducing a valid log status determination to distinguish between cache empty and cache full states. This determination mechanism does not rely on reserved space (avoiding storage space waste) nor on additional atomic counters (avoiding race conditions in multi-core environments). It accurately determines the status by directly parsing the existence of valid logs in the buffer, thereby ensuring the reliability of log writing, and is particularly suitable for router embedded environments with extremely limited storage resources.

[0058] If the available space is greater than or equal to the length of the log to be written, the cache space is determined to be sufficient, and the write operation in step S104 is executed; if the available space is less than the length of the log to be written, the cache space is determined to be insufficient, and the intelligent eviction process in step S105 is triggered. During the determination process, the system also calculates the cache utilization rate U, U = (total cache space - available space) / total cache space. This cache utilization rate serves as the input parameter for the dynamic adjustment of the weight coefficient in the subsequent step S105.

[0059] As an example of an implementable form, S104 of this log cache eviction method can be implemented through the following specific scheme when writing logs to the circular buffer: When step S103 determines that the cache space is sufficient, the system performs a log write operation, writing the log content in the log data structure to the storage location pointed to by the current write pointer of the circular buffer.

[0060] As an example, a log caching management mechanism based on a circular buffer can be adopted, which constructs a variable-length log storage model through a base address pointer (base_ptr), a tail pointer (tail_ptr), a write pointer (write_ptr), and a start pointer (start_ptr).

[0061] Unlike existing technologies that rely on segmented writing or external consumption confirmation to reclaim space, the writing strategy of this invention has dual optimizations: On the one hand, it dynamically selects continuous writing or segmented writing strategies based on the remaining contiguous space between the write pointer and the tail pointer to handle log data that crosses the physical boundary of the buffer—segmented writing is only used when there is insufficient remaining contiguous space, avoiding unnecessary splitting operations and memory copy overhead. Actual tests show that it can significantly reduce the number of memory copies and significantly improve the write throughput. On the other hand, during the writing process, when the write pointer catches up with the start pointer due to wrapping or continuous writing, the log size is accumulated one by one by parsing the length information of the existing log header in the buffer, and the new start pointer position is determined based on the address difference between the write pointer and the start pointer, thereby realizing dynamic reclamation and overwrite protection of effective log space. This mechanism differs from the simple direct overwriting of old logs in existing technologies. It ensures that the circular buffer can maintain the integrity of log entries and the continuity of storage space during tail-overwriting without relying on external consumer confirmation, avoiding the problem of the circular buffer "hardening" or data corruption due to the lack of external consumers.

[0062] As an example of an implementable form, step S105 in this log cache eviction method can trigger the intelligent eviction process and the calculation of the comprehensive evaluation value through the following scheme.

[0063] When step S103 determines that the cache space is insufficient, the intelligent eviction process is initiated. The mechanism of this intelligent eviction process is configured to meet the writing requirements of new logs by releasing the space occupied by the least valuable logs in the cache without losing core logs.

[0064] Combination Figure 2 This step performs a comprehensive evaluation of all valid logs in the current cache. The comprehensive evaluation value is a weighted composite based on the following three dimensions: Sub-step S105a: Calculation of dynamic weight normalization value. Map the current dynamic weight of the log to the interval [0,1]. Set the current dynamic weight of the log to dw, and the maximum dynamic weight to MAX_DW. Then, the dynamic weight normalization value W = (dw-1) / (MAX_DW-1), where W represents the dynamic weight normalization value, dw represents the current dynamic weight of the log, and MAX_DW represents the preset maximum dynamic weight value. Based on this value setting, the dynamic weight is effectively converted into a dimensionless relative value, which is convenient for weighted fusion with other dimensions. The specific value of MAX_DW can be set according to the actual application scenario, for example, it can be set to 20.

[0065] Sub-step S105b: Calculation of storage time decay value. The longer a log is retained in the buffer, the lower its priority retention value becomes. Here, an exponential decay function is used to model the storage time: Let the log generation time be ts, the current time be now, and the log age be age = now - ts, where age represents the length of time the log has been stored, ts represents the timestamp of the log generation, and now represents the current system time. Then, the storage time decay value T = exp(-age / t0), where T represents the storage time decay value, t0 represents the preset time decay constant, and exp() represents an exponential function with the natural constant e as the base. When age exceeds a preset duration, T takes a lower limit value.

[0066] Unlike existing exponential decay models that reduce the value of old logs to zero, this invention specifically establishes a lower limit protection mechanism for decay: when the age exceeds a preset duration, T takes a lower limit value. For example, t0 can be set to 3600 seconds, and when age ≥ 7200 seconds, T takes a value of 0.1. This lower limit setting ensures that even logs with long storage times (such as security audit logs and historical configuration change logs) retain a certain basic retention value and will not be indefinitely depreciated to zero and indiscriminately eliminated. This is especially important for network devices that need to meet security compliance retention requirements.

[0067] As a supplementary explanation, the construction of the exponential decay function is based on the premise that newly generated logs typically have high reference value, which gradually decreases over time, but will not completely reach zero, because some historical logs may still have long-term reference value, such as security audit logs. The specific values ​​of the above parameters can be flexibly configured according to the actual application scenario.

[0068] Sub-step S105c: Calculate the log correlation value. Log correlation is used to reflect the strength of the association between logs and critical events and other high-value logs.

[0069] Unlike existing technologies that rely on simple tag matching or keyword co-occurrence for coarse-grained association, this invention comprehensively considers factors such as time proximity, IP consistency, port consistency, and event tag similarity to construct a refined quantitative evaluation model for router log scenarios. Specifically, a four-dimensional feature vector is constructed for each log entry, and cosine similarity is used to calculate the similarity between the log entry and high-dynamic-weight logs in the cache. The maximum value is taken as the correlation value R of the log entry. High-dynamic-weight logs can be defined, for example, as logs with a dynamic weight not lower than a preset threshold (e.g., 8). By calculating the cosine similarity of the four-dimensional feature vector (IP + port + time + event tag) and combining it with the "maximum value" strategy, it is ensured that ordinary logs strongly associated with any high-value log (such as logs generated within the same IP, port, or time window) can be accurately identified and protected, thereby effectively maintaining the integrity of the critical event chain.

[0070] The technical effect of this correlation value is that ordinary logs that are strongly correlated with core or important logs, such as those generated from the same IP address, the same port, or within the same time window, may belong to the same critical event chain. Retaining these correlated logs helps maintain the integrity of the event chain and provides complete contextual information for subsequent troubleshooting.

[0071] Sub-step S105d: Synthesis of comprehensive evaluation value. The three values ​​above are weighted and summed as follows: S = α·W + β·T + γ·R, where S represents the comprehensive evaluation value, α represents the weight coefficient of the dynamic weight normalization value, β represents the weight coefficient of the storage time decay value, and γ represents the weight coefficient of the log correlation value. The weight coefficients α, β, and γ are dynamically adjusted based on the cache utilization rate U: when the cache utilization rate is higher than a higher threshold, the weight coefficient of the dynamic weight normalization value is increased to prioritize retaining logs related to critical events; when the cache utilization rate is lower than a lower threshold, the weight coefficient of the storage time decay value is increased to prioritize cleaning up ordinary logs whose timeliness has expired.

[0072] Unlike existing technologies that use fixed coefficients or simple binary switching, this invention employs a three-tier quantization configuration to achieve nonlinear adaptive eviction policies to cache pressure: For example, when U ≥ 0.9, α = 0.6, β = 0.2, γ = 0.2; when 0.7 ≤ U < 0.9, α = 0.4, β = 0.3, γ = 0.3; and when U < 0.7, α = 0.3, β = 0.4, γ = 0.3. These three configurations form a complete strategy spectrum: significantly increasing the dynamic weight coefficient when cache pressure is extremely high, reflecting a "prioritize critical" approach; and increasing the time decay coefficient when cache pressure is low, reflecting a "clear old" approach, reserving space for potentially high-value logs in the future.

[0073] The technical effect of this dynamic weight adjustment mechanism is that when the cache pressure is high, logs with high dynamic weights, i.e. logs related to the current critical events, are retained first; when the cache pressure is low, the weight of the time decay factor is appropriately increased, and ordinary logs that have expired are cleaned up first, reserving space for high-value logs that may be generated in the future.

[0074] As an example of an implementable form, step S106 in this log cache eviction method, during sorting and rule-based filtering, can be implemented through the following steps: When the cache space is insufficient, the configuration is set to calculate the comprehensive evaluation value of each log in the buffer and sort them from low to high. The lower the value, the higher the priority to enter the elimination candidate range.

[0075] Specifically, continue to combine Figure 2 It can be configured to filter the comprehensively sorted logs based on the following principles to generate a preliminary candidate set for elimination: Rule 1: Level 1 Log Exemption. Core logs, i.e., logs with a base weight higher than a preset high threshold, are generally not prioritized for elimination and are retained directly. This rule ensures that high-value logs related to fatal device errors, network attacks, and critical configuration changes are absolutely protected. This preset high threshold can be set, for example, to a base weight of no less than 9.

[0076] Rule 2: Second-Level Log Condition Determination. Unlike the existing "one-size-fits-all" approach of either protecting all or discarding all intermediate-level logs, this rule only includes important logs in the discard candidate set if they meet any of the following preset conditions: Condition a: The overall evaluation value is lower than a preset threshold, for example, the overall evaluation value threshold can be set to 0.3; Condition b: The storage time exceeds the preset duration and the correlation value is lower than the preset threshold. For example, the storage time threshold can be set to 3600 seconds and the correlation value threshold can be set to 0.2. Condition c: The associated event ends after a preset time and there are no subsequent associated logs. For example, the event end observation time can be set to 1800 seconds.

[0077] These three conditions are used to make a refined judgment from three dimensions: comprehensive value, time and relevance combination, and event life cycle, achieving a fine balance between protecting important logs and releasing cache space.

[0078] Rule 3: Level 3 logs are included by default and retained based on their correlation with other logs. Regular logs are included in the eviction candidate set by default, but when they have a strong correlation with core or important logs, they are temporarily retained to avoid disrupting the integrity of the critical event chain. For example, a correlation value of at least 0.7 can be set to indicate a strong correlation.

[0079] Rule 4: Critical Interval Observation. For logs with comprehensive evaluation values ​​falling within the critical interval, set an observation flag and re-evaluate them in subsequent elimination rounds to avoid false eliminations due to errors in a single evaluation. For example, the critical interval can be set to 0.3 to 0.5.

[0080] As an example of an implementable form, step S107 in this log cache eviction method can be implemented during candidate set optimization through the following steps: When the cache space utilization rate exceeds a preset high threshold and the number of logs exceeds a preset number, candidate set optimization is performed on the initial eviction candidate set. For example, the cache utilization rate threshold can be set to 90%, and the log number threshold can be set to 1000.

[0081] Specifically, continue to combine Figure 2 The candidate set optimization here can be achieved through the following sub-steps: Sub-step S107a: Grouping. Divide the logs in the initial candidate set into multiple value groups based on their overall evaluation value. For example, they can be divided into three groups: low-value group, medium-value group, and high-value group.

[0082] Sub-step S107b: Low-value priority filtering. Prioritize filtering logs stored for more than a preset duration from the low-value group. For example, the preset duration can be set to 1800 seconds.

[0083] Sub-step S107c: Secondary verification. Unlike existing single-round screening schemes that execute elimination immediately after generating a candidate set, this invention adds a safety net after the initial screening: a secondary verification of the correlation of the selected logs is performed. This verifies that there is no strong correlation between the selected logs and the core and important logs currently in the cache before determining the final elimination candidate set. This "secondary verification" step prevents the erroneous elimination of edge logs that are strongly correlated with critical events due to errors in grouping or initial screening. Under high-pressure scenarios with a cache utilization rate exceeding 90% and more than 1000 logs, this three-level screening mechanism reduces the false elimination rate from approximately 15% in a single round of screening to below 2%, significantly improving the accuracy of elimination decisions.

[0084] Based on this candidate set optimization mechanism, this solution can further narrow down the eviction scope through grouping and secondary verification when the cache pressure is extremely high and the number of logs is huge, ensuring the accuracy of eviction decisions and avoiding the mistaken eviction of marginal logs related to critical events.

[0085] As an example of an implementable form, step S108 in this log cache eviction method can be implemented through the following steps during eviction: The system performs log eviction based on the final candidate set, releasing cache space. The eviction execution module iterates through the log indices in the final candidate set, calls the release interface of the circular buffer management unit, marks the memory space occupied by the corresponding log as reusable, and updates the start pointer. If the released log is at the beginning of the buffer, the start pointer moves forward to the beginning of the next valid log entry. The system accumulates the number of bytes released and returns the total number of bytes released.

[0086] As an example of an implementable form, step S109 in this log cache eviction method, when determining whether to release space, can be implemented through the following steps: Determine if the total amount released in step S108 is sufficient to accommodate the new log to be written. If the total amount released is greater than or equal to the length of the log to be written, it is determined that the released space is sufficient, and step S104 is executed to write the new log to the circular buffer. If the total amount released is less than the length of the log to be written, it is determined that the released space is still insufficient, and step S110 is executed for degradation processing.

[0087] As an example of an implementable form, step S110 of this log cache eviction method differs from existing technologies where intelligent eviction (based on semantics) and FIFO (based on time) are two independent and unrelated strategies. It innovatively establishes a linkage guarantee mechanism between "priority strategy and degradation strategy," specifically implemented through the following steps: When the smart eviction returns zero bytes freed or the space is still insufficient after freeing, the system is configured to enter FIFO (First-In, First-Out) overwrite mode. In this mode, the system starts from the current start pointer `start_ptr` and releases logs one by one in FIFO order. Each time a log is released, the system checks if the cumulative released amount meets the length requirement for writing logs. If it does, the release stops and the write operation is performed. If the released amount is still insufficient after traversing the entire buffer, all logs are released, and both the start pointer and write pointer are reset to the base address `base_ptr`.

[0088] In degraded write mode, the system wraps the write pointer back to the start address of the buffer and adjusts the start pointer according to the circular buffer rules. If the log to be written crosses the end of the buffer, the log is split into two segments and written to the end and beginning of the buffer respectively to avoid out-of-bounds writes.

[0089] The present invention implements intelligent eviction as a priority strategy based on this linkage mechanism to maximize the protection of high-value logs; and first-in-first-out as a degradation strategy to ensure the reliability and availability of the system under extreme conditions and avoid the loss of new logs due to eviction failure.

[0090] The log cache eviction method proposed in this invention can be configured into a corresponding software program to form a log cache eviction system. This system runs on the control plane of the router device, relying on the router's central processing unit and random access memory resources, and resides on the router's operating system kernel as a daemon process.

[0091] like Figure 3 As shown, the system of the present invention includes an acquisition module 10, a correction module 20, a cache management module 30, an evaluation module 40, a filtering module 50, and an elimination module 60. The modules exchange data through inter-process communication or shared memory, and work collaboratively with existing functional modules of the router, such as the system log service, interface management module, routing protocol stack, and security protection module.

[0092] The acquisition module 10 in the system, as a downstream processing unit of the router system log service, is configured to receive raw log messages from various subsystems of the router, obtain basic weights based on log level and log type, initialize the log data structure, and pass the logs to the cache management module. This module can establish an initial importance metric for each log and aggregate the scattered log streams into a unified cache management system.

[0093] The correction module 20 is configured to monitor the router's network operating status and abnormal events in real time. Based on the severity of the event and the correlation between the log and the event, it dynamically corrects the weights of relevant logs in the cache. This module enables the importance measurement of logs to reflect real-time changes in the router's operating status, ensuring that logs related to critical events receive temporary protection.

[0094] The cache management module 30 is configured to manage the circular buffer allocated in the router's memory, maintain the base address pointer, tail pointer, write pointer, and start pointer, monitor cache utilization, perform cache space sufficiency checks and log writing operations, and trigger an intelligent eviction process when cache space is insufficient. This module coordinates the linkage between log writing and eviction, ensuring the efficiency and reliability of cache operations.

[0095] The evaluation module 40 is configured to calculate a comprehensive evaluation value for all valid logs in the cache when cache space is insufficient. This includes the calculation and weighted synthesis of dynamic weight normalized values, storage time decay values, and log correlation values. Based on this module, the retention value of each log can be comprehensively quantified from multiple dimensions, providing a quantitative basis for eviction decisions.

[0096] The filtering module 50 is configured to sort logs based on comprehensive evaluation values, perform rule-based filtering to generate an initial candidate set for elimination, and optimize the candidate set to generate a final candidate set for elimination when conditions are met. This module uses a two-level filtering mechanism to determine the set of logs that should be eliminated most, ensuring the integrity of core logs and critical event chains.

[0097] The eviction module 60 is configured to perform log eviction and release cache space based on the final candidate set. When the space released by intelligent eviction is insufficient, it will degrade to a first-in-first-out (FIFO) approach to release the remaining space. This module is capable of executing eviction decisions and ensuring the successful writing of new logs.

[0098] Based on an understanding of the overall functions and logical relationships of the modules in the above system, the following section provides a detailed explanation of the specific structural schemes of each component from a technical implementation perspective.

[0099] In its specific implementation, the acquisition module 10 in this system includes a log parsing unit 11 and a weight initialization unit 12.

[0100] The log parsing unit 11 is registered as the router's system log receiver. It receives raw log messages from the log output interfaces of each subsystem of the router and extracts log level, log type, generation timestamp, source IP address, source port, and interface index metadata.

[0101] The weight initialization unit 12 determines the basic weights according to the pre-configured hierarchical rule table. As an example, the following hierarchical rules can be adopted: When the log level is kernel level or critical level, and the log type is security or configuration change, the basic weight is set to a relatively high value, such as 10; when the log level is kernel level or critical level, and the log type is other categories, the basic weight is set to a relatively high value, such as 9; when the log level is error level or warning level, and the log type is session exception or performance alarm, the basic weight is set to a medium value, such as 6; when the log level is error level or warning level, and the log type is other categories, the basic weight is set to a medium value, such as 5; when the log level is information level or debug level, the basic weight is uniformly set to a relatively low value, such as 2.

[0102] Furthermore, the weight initialization unit 12 writes the basic weight into the log data structure, initializes the dynamic weight to be equal to the basic weight, records the generated timestamp, constructs the complete log data structure, and then passes the data structure to the cache management module 30 through a shared memory queue.

[0103] In its specific implementation, the correction module 20 in this system includes an event detection unit 21 and a weight adjustment unit 22.

[0104] The event detection unit 21 is configured to obtain real-time status data from the router's state management component via polling. The state management component maintains the router's system operating status table, including the link status, interface speed, error count, and packet loss rate of each interface; routing protocol neighbor status; security events including distributed denial-of-service attack detection, unauthorized access attempts, and abnormal traffic; system resources including CPU utilization exceeding thresholds and insufficient memory; and configuration changes including runtime configuration modifications and commits. When the event detection unit 21 identifies an abnormal event, it determines the event type and occurrence time and sends the event information to the weight adjustment unit 22.

[0105] The weight adjustment unit 22 is configured to traverse the log index table maintained by the cache management module 30 based on event information, filter out logs associated with the event in terms of time window, IP identifier, port identifier, interface index, or log category, and increase their dynamic weights according to the severity of the event: first-type abnormal events are increased to a higher multiple, such as 200% of the base weight; second-type abnormal events are increased to a lower multiple, such as 150% of the base weight. The weight adjustment unit 22 also records the event end time. Unlike the prior art scheme that restores the weight immediately after the event ends, the weight adjustment unit 22 only restores the dynamic weight of the relevant logs to the base weight after a preset observation time (e.g., 1800 seconds) has elapsed since the event ended.

[0106] In its specific implementation, the cache management module 30 in this system includes a circular buffer management unit 31 and a space monitoring unit 32.

[0107] The ring buffer management unit 31 is configured to allocate a contiguous address space in the router's memory as a ring buffer. This unit maintains four pointers: a base address pointer (base_ptr) pointing to the start address of the buffer, a tail pointer (tail_ptr) pointing to the physical end of the buffer, a write pointer (write_ptr) pointing to the next location to be written, and a start pointer (start_ptr) pointing to the start position of the current valid log.

[0108] The space monitoring unit 32 is configured to calculate the current cache utilization and available space in real time. The available space is calculated as follows: when `write_ptr` is less than or equal to `start_ptr`, if the cache is empty, the available space is the total cache space; if the cache is full, the available space is zero. When `write_ptr` is greater than `start_ptr`, the available space = (tail_ptr - write_ptr) + (start_ptr - base_ptr). Unlike existing technologies, the space monitoring unit 32 addresses the ambiguity when the write pointer and start pointer coincide by distinguishing between empty and full cache states through valid log status determination. When the available space is less than the length of the log to be written, the space monitoring unit 32 triggers an intelligent eviction process.

[0109] Furthermore, when the circular buffer management unit 31 performs log writing, it determines whether the log to be written crosses the end of the buffer. If it does, it dynamically selects between continuous writing and segmented writing strategies based on the remaining contiguous space between the write pointer and the tail pointer. Specifically, if the remaining contiguous space is sufficient to accommodate the entire log, continuous writing (single memory copy) is used; otherwise, segmented writing (splitting the log into tail and head segments and writing them separately) is used. During the writing process, when the write pointer `write_ptr` catches up with the start pointer `start_ptr`, the circular buffer management unit 31 accumulates the log size line by line by parsing the length information of the existing log header in the buffer, and determines the new start pointer position based on the address difference between the write pointer and the start pointer, thereby achieving dynamic reclamation of effective log space without relying on external consumption confirmation.

[0110] In its specific implementation, the evaluation module 40 in this system includes a weight normalization unit 41, a time decay calculation unit 42, a correlation calculation unit 43, and a score synthesis unit 44.

[0111] The weight normalization unit 41 is configured to read the current dynamic weight dw from the log data structure and map it to the [0,1] interval: W=(dw-1) / (MAX_DW-1), where MAX_DW represents the maximum dynamic weight value, which can be set to 20 for example.

[0112] The time decay calculation unit 42 is configured to read the generated timestamp ts from the log data structure, obtain the current system time now, calculate the log age age = now - ts, and then calculate the storage time decay value: when age is less than a preset duration, T = exp(-age / t0), where t0 is the preset time decay constant; unlike the existing exponential decay model that sets the value of old logs to zero, in this unit, when age reaches or exceeds the preset duration, T takes a lower limit value; for example, t0 can be set to 3600 seconds, and when age ≥ 7200 seconds, T = 0.1.

[0113] The correlation calculation unit 43 is configured to construct a four-dimensional feature vector (time proximity, IP consistency, port consistency, event tag similarity) for each log, traverse the high dynamic weight logs in the cache, calculate the cosine similarity between the current log and each reference log, and take the maximum similarity as the correlation value R of the log.

[0114] The score synthesis unit 44 is configured to obtain the current cache utilization rate U from the cache management module 30 and determine the weight coefficients based on the U value: when U≥0.9, α=0.6, β=0.2, γ=0.2; when 0.7≤U<0.9, α=0.4, β=0.3, γ=0.3; when U<0.7, α=0.3, β=0.4, γ=0.3; and finally calculate the comprehensive evaluation value S=α·W+β·T+γ·R.

[0115] In its specific implementation, the filtering module 50 in this system includes a sorting unit 51, a rule filtering unit 52, and a candidate set optimization unit 53.

[0116] The sorting unit 51 is configured to sort all valid logs in ascending order based on the comprehensive evaluation value S.

[0117] The rule filtering unit 52 is configured to sequentially apply core log exemption, important log condition judgment, default inclusion and related retention of ordinary logs, and critical interval observation rules to generate a preliminary elimination candidate set. Among them, important logs are included in the elimination candidate set only when one of the following conditions is met: the comprehensive evaluation value is lower than the first preset threshold; the storage time exceeds the second preset threshold and the correlation value is lower than the third preset threshold; the related event ends more than the fourth preset threshold and there are no subsequent related logs.

[0118] The candidate set optimization unit 53 is configured to start when the cache utilization rate U is not lower than a preset high threshold such as 0.9 and the total number of valid logs is not lower than a preset number such as 1000. The initial candidate set is divided into low value group, medium value group and high value group according to the S value. Logs with a storage time exceeding a preset duration such as 1800 seconds are selected from the low value group first. The selected logs are subjected to a secondary correlation verification. After confirming that there is no strong correlation between them and the core logs and important logs in the current cache, the final elimination candidate set is generated.

[0119] In its specific implementation, the elimination module 60 in this system includes an intelligent elimination unit 61 and a downgrade elimination unit 62.

[0120] The intelligent elimination unit 61 is configured to release the memory space occupied by the corresponding log according to the final candidate set, update the start pointer and return the number of bytes released.

[0121] The degradation and eviction unit 62 is configured to activate when the number of bytes released by intelligent eviction is less than the required number of bytes. That is, when the intelligent eviction space is insufficient, it automatically degrades, releasing log entries one by one in a first-in-first-out order, starting from the current starting pointer. After each release, it checks whether the cumulative release amount meets the requirement, until it does or the buffer is empty. After completing the operation, the degradation and eviction unit 62 updates the starting pointer and write pointer, and records the degradation and eviction event log.

[0122] When the log cache eviction system based on the above scheme operates in the control plane of the router device, as the router operates normally and generates new logs, the acquisition module 10 continuously receives log messages from various subsystems, completes basic weight acquisition and data structure initialization, and pushes the log data structure to the cache management module 30. The space monitoring unit 32 of the cache management module 30 checks the current available space in each write cycle. If there is sufficient available space, the circular buffer management unit 31 writes the log data sequentially into the buffer. If the write position crosses the end of the buffer, it is automatically split into two segments and written to the end and beginning respectively, and the write pointer is updated. If there is insufficient available space, intelligent eviction is performed. In the first step, the event detection unit 21 of the correction module 20 reads the latest status data of the router status management component. If it finds that there are currently unresolved abnormal events or events that have just recovered are still within the observation period, the weight adjustment unit 22 performs dynamic weight correction on the associated logs in the cache.

[0123] The second step is for the evaluation module 40 to obtain a list of pointers to all valid logs from the cache management module 30, calculate W, T, R and the final S value for each log, and write the S value back to the log data structure.

[0124] In the third step, the sorting unit 51 of the filtering module 50 sorts the logs in ascending order of S, the rule filtering unit 52 generates a preliminary candidate set, and if the optimization triggering conditions are met, the candidate set optimization unit 53 further filters and generates the final candidate set.

[0125] In the fourth step, the intelligent eviction unit 61 of the eviction module 60 releases memory space based on the final candidate set. The cache management module 30 recalculates the available space; if the new log length is met, writing is performed; otherwise, the downgrade eviction unit 62 initiates a first-in-first-out overwrite to continue releasing space.

[0126] Fifth, the new log is written to the buffer, the write pointer is updated, and the entire process ends.

[0127] The following specific application examples further illustrate the application and implementation process of the solution provided by this invention.

[0128] This example uses an enterprise-level router operating in a real network environment. This router is configured with a 128MB log ring buffer and generates approximately 500,000 log entries per day. The device is deployed at the enterprise network egress point, handling network address translation, firewall functions, and route forwarding.

[0129] Example Scenario 1: Log eviction during normal operation Under normal operating conditions, cache utilization remains at a low level, around 60%. At this time, the evaluation module 40 uses a weighting coefficient configuration of α=0.3, β=0.4, and γ=0.3, with the time decay factor having a relatively high weight of 40% in the comprehensive evaluation. When cache space is insufficient, the system prioritizes evicting ordinary logs with storage times exceeding 2 hours and low dynamic weights, such as regular network address translation session establishment logs and normal interface status logs. Core logs, such as device startup logs and configuration save logs, are not included in the evictory candidate set due to core exemption rules and are always retained in the cache. This configuration ensures that during normal operation, the cache primarily retains recent logs with high timeliness and critical logs with long-term value.

[0130] Example Scenario 2: Dynamic Protection When Abnormal Events Occur At 15:30:00 on a certain day, the router detected an abnormal restart of the WAN interface, which was identified as a Type I anomaly. The correction module 20 immediately recognized this event as a major anomaly and increased the dynamic weight of all logs related to this interface within 5 minutes before and after the event—including interface status change logs, PPP negotiation logs, and routing protocol neighbor relationship change logs—to 200% of their base weight. For example, a log entry with an interface down whose base weight was originally 5 was dynamically increased to 10.

[0131] Subsequently, at 15:35:00, the cache space reached a high threshold, such as 90%, triggering intelligent eviction. Evaluation module 40 detected a cache utilization rate U≥0.9 and adopted a high dynamic weight configuration of α=0.6, β=0.2, and γ=0.2. Logs related to the interface restart event were elevated to a higher level due to their dynamic weight, resulting in a significantly higher overall evaluation value than other ordinary logs. They were ranked lower and not included in the eviction candidate set. Meanwhile, other unrelated ordinary logs generated during the same time period, such as normal traffic logs from other interfaces, had lower overall evaluation values ​​due to the lack of increased dynamic weight and were prioritized for eviction. Ultimately, the complete log chain related to the interface restart event was preserved, providing complete contextual information for subsequent root cause analysis.

[0132] Example Scenario 3: Weight Restoration After the Event Ends The interface restart event resumed at 15:30:45, and the event end time was recorded. By 16:00:45, the preset observation time (e.g., 1800 seconds) had been exceeded, and the correction module 20 gradually restored the dynamic weights of the relevant logs to their base weights. If intelligent eviction is triggered again at this point, these logs will participate in the comprehensive evaluation according to their base weights and will no longer enjoy special protection. This avoids the problem of excessive cache space being occupied due to persistently high weights.

[0133] Example Scenario 4: Association Protection During the interface restart period from 15:30:00 to 15:30:45, the logs related to this interface include: interface down logs, which are core logs with a high basic weight (e.g., 10); PPP negotiation failure logs, which are important logs with a medium basic weight (e.g., 6); and a large number of ordinary connection timeout logs with the same IP address as this interface, which are ordinary logs with a low basic weight (e.g., 2).

[0134] The correlation calculation unit 43 of the evaluation module 40 constructs a feature vector for each log entry. For ordinary connection timeout logs, their IP identifiers are consistent with those of interface down logs and PPP negotiation failure logs, and the calculated correlation value R is not lower than a preset threshold (e.g., 0.7). The filtering module 50 identifies this strong correlation during rule-based filtering and temporarily retains these ordinary connection timeout logs, excluding them from the elimination candidate set. Ultimately, the complete event chain from interface down to PPP negotiation failure to connection timeout is preserved, providing troubleshooters with a complete log view from root cause to impact.

[0135] Example Scenario 5: Intelligent Elimination and First-In-First-Out Degradation Linkage Suppose that at a certain moment, a security alert log to be written is 2048 bytes long, while the current available space in the circular buffer is only 512 bytes. The cache management module 30 triggers the intelligent eviction process, and the eviction module 60 releases 1200 bytes of space based on the final candidate set, making the available space 1712 bytes, which is still insufficient to accommodate the 2048 bytes of new log.

[0136] At this point, the downgrade / removal unit 62 of the removal module 60 automatically initiates a first-in-first-out (FIFO) overwrite mode, releasing logs one by one from the head of the buffer until the available space reaches 2048 bytes or more. The new logs are successfully written to the circular buffer. This linkage mechanism ensures that newly generated security alert logs are not lost due to removal failures under extreme cache pressure.

[0137] Example Scenario 6: Overall System Technical Effectiveness Evaluation After deployment and testing in a real network environment, the following results were obtained after adopting the solution of this invention: the retention rate of critical logs, namely core logs and important logs, under cache pressure increased from about 35% under the traditional first-in-first-out solution to over 92%; the complete retention rate of logs related to abnormal events, i.e., the completeness of the event chain, increased from less than 20% to over 85%; the utilization efficiency of cache space, measured by the comprehensive value of retained logs, increased by about 60%; the average time for troubleshooting was reduced from 45 minutes to less than 15 minutes; and the write success rate of the system under worst-case conditions, i.e., no loss of new logs, remained above 99.9%.

[0138] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A log cache eviction method, characterized in that, Includes the following steps: Obtain the base weight of the log to be written, the base weight being determined based on the log's attribute information; The dynamic weights of the logs are adjusted based on network operation status information; When the cache space is insufficient, the comprehensive evaluation value of the log is calculated based on the current weight information, storage time information and correlation information of the log; A set of elimination candidates is generated based on the comprehensive evaluation values; Perform log-based elimination operations based on the elimination candidate set.

2. The log cache eviction method according to claim 1, characterized in that, The log attribute information includes log level and log type; the log level includes first level, second level and third level, the base weight of the first level log is greater than the base weight of the second level log, and the base weight of the second level log is greater than the base weight of the third level log.

3. The log cache eviction method according to claim 1, characterized in that, The dynamic weights of the logs are adjusted based on network operation status information, including: When a first-type abnormal event is detected, the dynamic weight of the relevant logs is increased to a first preset multiple; When a second type of abnormal event is detected, the dynamic weight of the relevant logs will be increased to a second preset multiple. Wherein, the first preset multiple is greater than the second preset multiple.

4. The log cache eviction method according to claim 1, characterized in that, The comprehensive evaluation value is obtained by weighting the dynamic weight normalized value, the storage time decay value, and the log correlation value; the weight coefficients of the dynamic weight normalized value, the storage time decay value, and the log correlation value are dynamically adjusted according to the cache utilization rate.

5. The log cache eviction method according to claim 1, characterized in that, The process of generating a candidate set for elimination based on the comprehensive evaluation value includes: sorting the logs according to the comprehensive evaluation value and performing rule-based filtering on the sorted logs to generate the candidate set for elimination; the rule-based filtering includes at least one of the following: excluding first-level logs from the candidate set for elimination; and including second-level logs in the candidate set for elimination when they meet preset conditions.

6. The log cache eviction method according to claim 1, characterized in that, Also includes: When the cache utilization rate exceeds a preset threshold and the number of logs exceeds a preset number, optimization processing is performed on the candidate set of evictions. The optimization process includes dividing the logs into multiple value groups based on the comprehensive evaluation value, and prioritizing the filtering of logs from the low-value groups.

7. A log cache eviction system, characterized in that, include: The acquisition module is used to acquire the basic weight of the log, which is determined based on the log's attribute information; The correction module is used to correct the dynamic weight of the logs based on network operation status information; The evaluation module is used to calculate a comprehensive evaluation value of the log based on its current weight information, storage time information, and correlation information when the cache space is insufficient. The filtering module is used to generate a set of elimination candidates based on the comprehensive evaluation value; The elimination module is used to perform log elimination operations based on the elimination candidate set; The cache management module is used to manage the circular buffer and determine whether the cache space is sufficient.

8. The log cache eviction system according to claim 7, characterized in that, The log attribute information includes log level and log type; the log level includes first level, second level and third level, the base weight of the first level log is greater than the base weight of the second level log, and the base weight of the second level log is greater than the base weight of the third level log.

9. The log cache eviction system according to claim 7, characterized in that, The correction module corrects the dynamic weight of the logs based on network operation status information, including: when a first type of abnormal event is detected, increasing the dynamic weight of the logs associated with the abnormal event to a first preset multiple; when a second type of abnormal event is detected, increasing the dynamic weight of the logs associated with the abnormal event to a second preset multiple; wherein the first preset multiple is greater than the second preset multiple.

10. The log cache eviction system according to claim 7, characterized in that, When the evaluation module calculates the comprehensive evaluation value, the comprehensive evaluation value is obtained by weighting the dynamic weight normalized value, the storage time decay value, and the log correlation value; the weight coefficients of the dynamic weight normalized value, the storage time decay value, and the log correlation value are dynamically adjusted according to the cache utilization rate.

11. The log cache eviction system according to claim 7, characterized in that, The filtering module generates a candidate set for elimination based on the comprehensive evaluation value, including: sorting the logs according to the comprehensive evaluation value, and performing rule-based filtering on the sorted logs to generate the candidate set for elimination; the rule-based filtering includes at least one of the following: excluding the first-level logs from the candidate set for elimination; and including the second-level logs in the candidate set for elimination when they meet preset conditions.

12. A router, characterized in that, It includes a processor and a memory, the memory storing a computer program that, when executed on the processor, causes the processor to perform the steps of the log cache eviction method as described in any one of claims 1-6.

Images