Log collecting and processing device and equipment

Abstract

The utility model discloses a log collecting and processing device and equipment. The log collecting and processing device comprises a communication module, a random access memory, a read-only memory and at least two processors arranged in parallel, the processor comprises a main processor and at least one auxiliary processor for providing elastic computing power, and the processor is connected with the communication module, the random access memory and the read-only memory; the processor is connected with a disk of to-be-detected target equipment through an interface; the log acquisition and processing device accesses target equipment of logs to be acquired, shares a disk with the target equipment, and is provided with a processor and a memory which are independent of the target equipment, so that real-time, efficient and convenient log acquisition and analysis are ensured, service requirements of the target equipment are not influenced, parallel service requirements and detection are realized, dependence on intermediate equipment is not needed, and the efficiency of log acquisition and analysis is improved. The method is high in adaptability and flexibility, meanwhile, privacy protection is facilitated, in addition, the mode that multiple CPUs are connected in parallel is adopted, and elastic computing capacity can be provided for log detection.

Description

Technical Field

[0001] The utility model relates to the technical field of data collection and storage, and in particular to a log collection and processing device and equipment. Background Art

[0002] With the continuous development and evolution of Internet technology, related businesses are increasing, and the amount of data generated by various businesses is gradually huge and diverse. According to research, in order to solve the problems of large amount of data storage, low efficiency, and data heterogeneity, many businesses currently introduce distributed system infrastructure (Hadoop) to manage big data. As one of the widely used architectures for IoT devices, Hadoop implements a distributed file system (HDFS) based on this architecture. HDFS is widely used on general-purpose hardware and can provide high-throughput data access, which is suitable for the application of large-scale data sets. When the distributed file system processes data in parallel, a large number of log files will be generated. Log files have become important data for maintaining large systems, used to record the status of the system during operation and various emergencies. By checking and analyzing these logs, staff can find anomalies and diagnose the root cause, but due to the large scale of the system, the large amount of log data, and the strong privacy of the logs, it is very difficult to manually check the logs. Therefore, anomaly detection of logs is an issue that needs urgent attention.

[0003] At present, the existing research methods for log detection are mainly divided into the following three categories:

[0004] (1) Manual log detection method: For a long time, the scale and data volume of Internet business were not as large as they are now, and the corresponding number of logs was relatively small. In addition, before the introduction of the distributed file system architecture, the demand for logs was often for fault tracing, that is, when a device or program was interrupted or abnormal, the small range of log information corresponding to the time was checked to find the error log entries for fault cause analysis. Therefore, due to the above two reasons, manual log detection can still cope with it. However, with the advancement of the development of various Internet businesses and the growth of business, as well as the application of big data and various distributed architectures, the number and scale of logs have exploded. In particular, with the deepening of technology, the types of logs have become more and more complex, and log analysis is no longer a simple fault tracing, but often real-time log analysis to predict and diagnose problems. This results in manual log detection being unable to effectively respond to existing development needs.

[0005] (2) Automated log detection method implemented by software: Since manual log detection has inevitable disadvantages, the development of automated log detection methods has been promoted. Nowadays, automated log detection methods are mainly carried out through machine learning methods. That is, deep neural network classifiers are used to complete log anomaly detection tasks, which requires a large amount of labeled data to train the model. This requires that the physical device that carries the automated detection program has a certain amount of redundant computing power and memory for additional log analysis. However, due to the operating costs, computing power and specification requirements of business equipment, many devices cannot bear the additional detection load. Therefore, due to the above reasons, it is not reliable to use programs to perform automated detection in the physical device where the log is located. In addition, since the log records important operating data of the entire physical device, this log detection mode cannot be guaranteed.

[0006] (3) Separate log detection method: This detection method implements log detection by running inspection software on a physical device independent of the carrier device. This method often requires an intermediate device to collect data and transfer it to the detection device. However, on the one hand, this method cannot achieve real-time log detection. On the other hand, after the detection, it cannot be directly connected to the devices using these entities, which increases the detection cost and time. And because this type of inspection equipment focuses on the inspection itself, the design of this type of inspection equipment often relies on terminal devices (such as mobile phones, computers, etc.), and it is impossible to achieve modularization of the detection equipment and the integration between the inspection equipment and the physical carrier.

[0007] Therefore, there is no effective log detection device to achieve fault diagnosis. The current log detection direction has the following main defects:

[0008] (1) The manual log detection method is inefficient and cannot guarantee accuracy, and cannot meet the current large-scale log detection needs;

[0009] (2) Existing log inspection methods consume a large amount of computing resources on physical carriers and cannot effectively balance their own business needs and detection parallelism;

[0010] (3) Existing detection often relies on intermediate devices to copy log data and on existing terminal devices, such as mobile phones and computers;

[0011] (4) The existing detection methods do not have good adaptability and flexibility, cannot achieve real-time detection and analysis of logs, and cannot detect faults in time through log analysis;

[0012] (5) Existing detection methods do not consider privacy protection during the log detection process and cannot effectively protect the information of physical devices. Utility Model Content

[0013] The technical problem to be solved by the utility model is to provide a log collection and processing device and equipment to provide hardware support for improving the convenience, efficiency, privacy and flexibility of log collection and analysis.

[0014] In order to solve the above technical problems, the technical solution adopted by the utility model is:

[0015] A log collection and processing device includes a communication module, a random access memory, a read-only memory, and at least two processors arranged in parallel;

[0016] The processor includes a main processor and at least one auxiliary processor providing elastic computing power, and the processor is connected to the communication module, the random access memory and the read-only memory;

[0017] The processor is connected to the disk of the target device to be inspected through an interface.

[0018] Furthermore, the processor is connected to the disk of the target device to be inspected through the interface specifically as follows:

[0019] The processor connects the general input and output pins P2.0, P2.1, P2.2, P2.3, P2.4, P2.5, P2.6 and P2.7 to the address bus of the disk of the target device through the interface;

[0020] Connecting the general input and output pins P0.0, P0.1, P0.2, P0.3, P0.4, P0.5, P0.6 and P0.7 to the data bus of the disk of the target device;

[0021] The P0.0 pin is connected to the 1D pin of the latch, the P0.1 pin is connected to the 2D pin of the latch, the P0.2 pin is connected to the 3D pin of the latch, the P0.3 pin is connected to the 4D pin of the latch, the P0.4 pin is connected to the 5D pin of the latch, the P0.5 pin is connected to the 6D pin of the latch, the P0.6 pin is connected to the 7D pin of the latch, and the P0.7 pin is connected to the 8D pin of the latch;

[0022] The output pin of the latch is connected to the address bus of the disk of the target device.

[0023] Furthermore, it also includes an encryption module and a conversion module;

[0024] The general input and output pins P0.0 to P0.7 of the processor are respectively connected to the input pins D0.0 to D0.7 of the encryption module and the general input and output pins P0.0 to P0.7 of the conversion module;

[0025] The write enable pin of the processor is connected to the write enable pin of the encryption module;

[0026] The general input and output pin P2.7 of the processor is connected to the chip selection pin and the data transmission pin of the encryption module;

[0027] The power ground pin of the processor is connected to the digital ground pin of the encryption module;

[0028] The output pin of the encryption module is connected to the input pin of the conversion module.

[0029] Further, the communication module includes a WiFi module;

[0030] The transmission pin of the processor is connected to the receiving pin of the WiFi module;

[0031] The receiving pin of the processor is connected to the transmitting pin of the WiFi module.

[0032] Further, the communication module includes a Bluetooth module;

[0033] The transmission pin of the processor is connected to the receiving pin of the Bluetooth module;

[0034] The receiving pin of the processor is connected to the transmitting pin of the Bluetooth module.

[0035] Furthermore, an interface module is included, and the interface module is connected to the processor.

[0036] Furthermore, the read-only memory is an electrically erasable programmable read-only memory.

[0037] Furthermore, the parallel connection of the processors is specifically as follows:

[0038] The power ground pins of at least two processors are connected to each other;

[0039] Digital ground pins of at least two processors are connected to each other;

[0040] The transmission pins of at least two processors are connected to each other;

[0041] The receiving pins of at least two processors are connected to each other.

[0042] Further, the processor includes the processor chip and peripheral circuits;

[0043] The peripheral circuit includes a first capacitor, a second capacitor, a third capacitor, a first resistor, a reset switch and a crystal oscillator;

[0044] The external clock input pin of the processor chip is connected to one end of the second capacitor and one end of the crystal oscillator;

[0045] The external clock output pin of the processor chip is connected to one end of the third capacitor and the other end of the crystal oscillator;

[0046] The reset pin of the processor chip is respectively connected to one end of the reset switch, one end of the first resistor and one end of the first capacitor;

[0047] The other end of the first resistor and the voltage pin of the processor chip are both connected to the 3.3V power pin;

[0048] The other ends of the first capacitor, the second capacitor, the third capacitor and the reset switch are all grounded;

[0049] The ground pin of the processor chip is grounded.

[0050] In order to solve the above technical problems, another technical solution adopted by the utility model is:

[0051] A log collection and processing device comprises a central detection device and a plurality of log collection and processing devices for connecting to a target device;

[0052] The log collection and processing device adopts the log collection and processing device described above;

[0053] The central detection device is communicatively connected with the log collection and processing device.

[0054] The beneficial effects of the utility model are: a log collection and processing device and equipment of the utility model, the log collection and processing device is connected to the target device for collecting logs, shares a disk with the target device, and has a processor and memory independent of the target device, ensuring real-time, efficient and convenient log collection and analysis while not affecting the business needs of the target device itself, realizing business needs and detection in parallel, without relying on intermediate devices, with strong adaptability and flexibility, and beneficial to privacy protection. In addition, the use of multiple CPUs in parallel can provide elastic computing power for log detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a structural example diagram of a log collection and processing device according to an embodiment of the utility model;

[0056] Figure 2 This is an example diagram of a processor parallel structure of a log collection and processing device according to an embodiment of the utility model;

[0057] Figure 3This is an example diagram of a processor peripheral circuit of a log collection and processing device according to an embodiment of the utility model;

[0058] Figure 4 This is a circuit connection example diagram of a partial structure of a log collection and processing device according to an embodiment of the utility model;

[0059] Figure 5 This is an example diagram of a connection circuit between a random access memory of a log collection and processing device and a target device disk according to an embodiment of the utility model;

[0060] Figure 6 This is a connection example diagram of a random access memory, an encryption module, and a conversion module of a log collection and processing device according to an embodiment of the utility model;

[0061] Figure 7 This is a structural example diagram of a log collection and processing device according to an embodiment of the utility model;

[0062] Figure 8 It is a partial structural schematic diagram of a central detection device of a log collection and processing device according to an embodiment of the utility model;

[0063] Fig. 9 A partial circuit connection diagram of a central detection device of a log collection and processing device according to an embodiment of the utility model;

[0064] Fig.10 The present invention is a schematic diagram of a one-way data transmission structure of a log collection and processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to explain the technical content, achieved objectives and effects of the present invention in detail, the following is an explanation in conjunction with the implementation modes and the accompanying drawings.

[0066] Please refer to Figures 1 to 6 , a log collection and processing device, comprising a communication module, a random access memory, a read-only memory, and at least two processors arranged in parallel;

[0067] The processor includes a main processor and at least one auxiliary processor providing elastic computing power, and the processor is connected to the communication module, the random access memory and the read-only memory;

[0068] The processor is connected to the disk of the target device to be inspected through an interface.

[0069] From the above description, it can be seen that the beneficial effects of the utility model are: a log collection and processing device of the utility model is connected to the target device for collecting logs, shares a disk with the target device, and has a processor and memory independent of the target device, ensuring real-time, efficient and convenient log collection and analysis while not affecting the business needs of the target device itself, realizing business needs and detection in parallel, without relying on intermediate devices, with strong adaptability and flexibility, and beneficial to privacy protection.

[0070] Furthermore, the processor is connected to the disk of the target device to be inspected through the interface as follows:

[0071] The processor connects the general input and output pins P2.0, P2.1, P2.2, P2.3, P2.4, P2.5, P2.6 and P2.7 to the address bus of the disk of the target device through the interface;

[0072] Connecting the general input and output pins P0.0, P0.1, P0.2, P0.3, P0.4, P0.5, P0.6 and P0.7 to the data bus of the disk of the target device;

[0073] The P0.0 pin is connected to the 1D pin of the latch, the P0.1 pin is connected to the 2D pin of the latch, the P0.2 pin is connected to the 3D pin of the latch, the P0.3 pin is connected to the 4D pin of the latch, the P0.4 pin is connected to the 5D pin of the latch, the P0.5 pin is connected to the 6D pin of the latch, the P0.6 pin is connected to the 7D pin of the latch, and the P0.7 pin is connected to the 8D pin of the latch;

[0074] The output pin of the latch is connected to the address bus of the disk of the target device.

[0075] From the above description, it can be seen that the log collection and processing device is connected to the target device disk by a processor. The above is a specific connection structure, which is convenient for reading data from the disk into the memory for subsequent possible transmission, analysis and other steps.

[0076] Furthermore, it also includes an encryption module and a conversion module;

[0077] The general input and output pins P0.0 to P0.7 of the processor are respectively connected to the input pins D0.0 to D0.7 of the encryption module and the general input and output pins P0.0 to P0.7 of the conversion module;

[0078] The write enable pin of the processor is connected to the write enable pin of the encryption module;

[0079] The general input and output pin P2.7 of the processor is connected to the chip selection pin and the data transmission pin of the encryption module;

[0080] The power ground pin of the processor is connected to the digital ground pin of the encryption module;

[0081] The output pin of the encryption module is connected to the input pin of the conversion module.

[0082] From the above description, it can be seen that considering the possible need for data transmission, the hardware of the encryption module and the conversion module are introduced to encrypt the log information to be transmitted. The model can be selected, for example, the serial port transmission encryption module of Ebyte E34-2G4D11S.

[0083] Further, the communication module includes a WiFi module;

[0084] The transmission pin of the processor is connected to the receiving pin of the WiFi module;

[0085] The receiving pin of the processor is connected to the transmitting pin of the WiFi module.

[0086] From the above description, it can be seen that the introduction of the WiFi module enables the device to have and support the ability of wireless transmission via WiFi.

[0087] Further, the communication module includes a Bluetooth module;

[0088] The transmission pin of the processor is connected to the receiving pin of the Bluetooth module;

[0089] The receiving pin of the processor is connected to the transmitting pin of the Bluetooth module.

[0090] From the above description, it can be seen that the Bluetooth module is introduced to enable the device to have and support the ability to transmit data via Bluetooth.

[0091] Furthermore, the interface module is connected to the processor.

[0092] As can be seen from the above description, it also has an interface module that can connect to other mobile storage devices such as USB flash drives or mobile phones, and supports exporting data through the interface when necessary.

[0093] Furthermore, the read-only memory is an electrically erasable programmable read-only memory.

[0094] From the above description, it can be seen that a read-only memory is designed for storing log analysis programs, which can effectively ensure program security. At the same time, it is specifically an electrically erasable programmable read-only memory, which can provide secure update capabilities when the program algorithm needs to be updated.

[0095] Furthermore, the parallel connection of the processors is specifically as follows:

[0096] The power ground pins of at least two processors are connected to each other;

[0097] Digital ground pins of at least two processors are connected to each other;

[0098] The transmission pins of at least two processors are connected to each other;

[0099] The receiving pins of at least two processors are connected to each other.

[0100] It can be seen from the above description that at least two processors are connected in parallel through the above connection method.

[0101] Further, the processor includes the processor chip and peripheral circuits;

[0102] The peripheral circuit includes a first capacitor, a second capacitor, a third capacitor, a first resistor, a reset switch and a crystal oscillator;

[0103] The external clock input pin of the processor chip is connected to one end of the second capacitor and one end of the crystal oscillator;

[0104] The external clock output pin of the processor chip is connected to one end of the third capacitor and the other end of the crystal oscillator;

[0105] The reset pin of the processor chip is respectively connected to one end of the reset switch, one end of the first resistor and one end of the first capacitor;

[0106] The other end of the first resistor and the voltage pin of the processor chip are both connected to the 3.3V power pin;

[0107] The other ends of the first capacitor, the second capacitor, the third capacitor and the reset switch are all grounded;

[0108] The ground pin of the processor chip is grounded.

[0109] It can be seen from the above description that the external circuit structure of the processor is explained above.

[0110] Please refer to Figure 7 , a log collection and processing device, including a central detection device and a plurality of log collection and processing devices for connecting to a target device;

[0111] The log collection and processing device adopts the log collection and processing device described above;

[0112] The central detection device is communicatively connected with the log collection and processing device.

[0113] From the above description, it can be seen that the beneficial effects of the utility model are: a log collection and processing device of the utility model is connected to the target device for collecting logs, shares a disk with the target device, and has a processor and memory independent of the target device, which ensures that the log collection and analysis is real-time, efficient, and convenient, while not affecting the business needs of the target device itself, and realizes business needs and detection in parallel, without relying on intermediate devices, with strong adaptability and flexibility, and is beneficial to privacy protection. It also connects multiple log collection and processing devices through a central device to facilitate possible centralized analysis needs, or to handle situations where the performance of the log collection and processing device is insufficient. At the same time, since the collection and processing devices do not share an encryption module, log confusion and log leakage can be avoided during encrypted transmission, and log isolation between different devices can be achieved.

[0114] Furthermore, the central detection device includes a disk, a read-only memory, a random access memory, a processor, a load balancer, a communication module for communicating with the log collection and processing device, and an encryption module for encrypting and decrypting communication data;

[0115] The number of the processors is at least two, and at least two of the processors are arranged in parallel;

[0116] The processor, the load balancer and the encryption module are connected in sequence, and the processor is connected to the random access memory, the read-only memory and the disk.

[0117] As can be seen from the above description, the central detection device uses a plurality of processors to run in parallel to process data, and performs load balancing between the processors through a load balancing device to improve device performance.

[0118] Furthermore, the number of the processors is three;

[0119] The load balancer is provided with 6 output ports, which are respectively connected to the ACC1 and ACC2 interfaces of the three processors in a one-to-one correspondence.

[0120] From the above description, it can be seen that the connection with the three processors is achieved through the six output ports of the load balancer.

[0121] The utility model provides a log collection and processing device and equipment, which is suitable for scenarios where log analysis exists, and is particularly suitable for scenarios where abnormal diagnosis and discovery need to be performed by checking and analyzing log data when a distributed system infrastructure (Hadoop) manages big data.

[0122] Please refer to Figures 1 to 6 , Embodiment 1 of the present utility model is:

[0123] A log collection and processing device comprises a communication module, a random access memory, an encryption module, a conversion module, a read-only memory, an interface module and at least two processors arranged in parallel.

[0124] Please refer to Figure 2 In this embodiment, two processors are connected in parallel as an example for explanation. The processors are microprocessors of the STM32F103T806 type based on an ARM chip. The parallel connection of the processors is specifically as follows:

[0125] The power ground pins of at least two processors are connected to each other;

[0126] Digital ground pins of at least two processors are connected to each other;

[0127] The transmission pins of at least two processors are connected to each other;

[0128] The receiving pins of at least two processors are connected to each other.

[0129] Please refer to Figure 3 , in this embodiment, the processor adopts the processor including the processor chip and peripheral circuits;

[0130] The peripheral circuit includes a first capacitor, a second capacitor, a third capacitor, a first resistor, a reset switch and a crystal oscillator;

[0131] The external clock input pin of the processor chip is connected to one end of the second capacitor and one end of the crystal oscillator;

[0132] The external clock output pin of the processor chip is connected to one end of the third capacitor and the other end of the crystal oscillator;

[0133] The reset pin of the processor chip is respectively connected to one end of the reset switch, one end of the first resistor and one end of the first capacitor;

[0134] The other end of the first resistor and the voltage pin of the processor chip are both connected to the 3.3V power pin;

[0135] The other ends of the first capacitor, the second capacitor, the third capacitor and the reset switch are all grounded;

[0136] The ground pin of the processor chip is grounded.

[0137] In this embodiment, considering that the CPU is the computing core of the physical device, whether it is the operation of its own business or the log detection service, it essentially relies on the CPU to provide computing power. However, many current devices are single CPUs. Although multi-core high-performance CPUs have long appeared, considering the needs of the business and cost issues, many physical devices will not use high-performance CPUs, and the CPU computing power often only supports the needs of the business itself. Most log detection services are relatively low in complexity compared to the business. Therefore, for log detection, detection services can often be implemented using low-cost microprocessors. Therefore, in the face of business development, a large number of logs, frequent failures and other reasons, a new type of CPU grouping parallel structure is used in this embodiment: that is, on the basis of keeping the business processor unchanged, two microprocessors are connected in parallel in the existing physical architecture for log detection services and providing elastic computing capabilities.

[0138] This embodiment summarizes that the newly added parallel microprocessor adopts a microprocessor of the STM32F103T806 type based on an ARM chip. Since the utility model focuses on the parallel CPU added for log detection, a microprocessor such as STM32 is adopted, which not only saves costs, but also has high performance efficiency. In addition, in order to realize the mutual isolation and mutual non-influence of log detection and business operation, the parallel microprocessor can be adapted to run an independent system, and at the same time, in order to speed up the speed of log detection, the parallel microprocessor will directly read the storage space of the device itself. Considering that the log detection computing power increases with the peak of business operation, elastic computing power is realized by connecting two microprocessors in parallel. In addition, specifically, the microprocessor is connected to an independent WiFi module, a Bluetooth module, a Type-c interface, a micro scanner, a storage module, and a power supply respectively, as a CPU for log detection, it has efficient data processing and computing power, and is the core of log detection.

[0139] The processor is connected with the communication module, the interface module, the random access memory and the read-only memory.

[0140] Please refer to Figure 4 , the communication module includes a WiFi module and a Bluetooth module;

[0141] The transmission pin of the processor is connected to the receiving pin of the WiFi module;

[0142] The receiving pin of the processor is connected to the transmitting pin of the WiFi module;

[0143] The transmission pin of the processor is connected to the receiving pin of the Bluetooth module;

[0144] The receiving pin of the processor is connected to the transmitting pin of the Bluetooth module.

[0145] Among them, the WiFi module has the ability to open the hotspot and connect to the wireless network; the Bluetooth module has the ability to connect to nearby Bluetooth devices. Specifically, the WiFi module opens the hotspot function to enable the use of physical devices to realize the local area network data transmission function through the hotspot function enabled by the device. The WiFi module connects to the wireless network to enable the device to access the Internet and update the log detection database; the Bluetooth module can realize the data transmission between the device and the external temporary device. The WiFi module uses the ESP8266WiFi module, and the Bluetooth module uses the ECB01H2 Bluetooth module.

[0146] In this embodiment, the interface module uses a USB interface, and the processor is connected to the USB interface.

[0147] In addition, the present embodiment also includes an information input and output module: this part is composed of a Type-c interface and a micro scanner. The Type-c interface is used for writing the log detection program and reading and reading data. Specifically, the log detection program runs in a microprocessor, and the Type-c interface can be connected to a computer or other physical device to realize the writing and updating of the program; the Type-c interface can also be used for reading and reading data, that is, the transmission of log information can be realized through this interface.

[0148] The processor is connected to the disk of the target device to be inspected through an interface.

[0149] Please refer to Figure 5 The processor is connected to the disk of the target device to be inspected through the interface as follows:

[0150] The processor connects the general input and output pins P2.0, P2.1, P2.2, P2.3, P2.4, P2.5, P2.6 and P2.7 to the address bus of the disk of the target device through the interface;

[0151] Connecting the general input and output pins P0.0, P0.1, P0.2, P0.3, P0.4, P0.5, P0.6 and P0.7 to the data bus of the disk of the target device;

[0152] The P0.0 pin is connected to the 1D pin of the latch, the P0.1 pin is connected to the 2D pin of the latch, the P0.2 pin is connected to the 3D pin of the latch, the P0.3 pin is connected to the 4D pin of the latch, the P0.4 pin is connected to the 5D pin of the latch, the P0.5 pin is connected to the 6D pin of the latch, the P0.6 pin is connected to the 7D pin of the latch, and the P0.7 pin is connected to the 8D pin of the latch;

[0153] The output pin of the latch is connected to the address bus of the disk of the target device.

[0154] Referring to the figure, the processor connects the general input and output pins P2.0, P2.1, P2.2, P2.3, P2.4, P2.5, P2.6 and P2.7 to the address bus of the disk of the target device through the interface;

[0155] Connecting the general input and output pins P0.0, P0.1, P0.2, P0.3, P0.4, P0.5, P0.6 and P0.7 to the data bus of the disk of the target device;

[0156] The P0.0 pin is connected to the 1D pin of the latch, the P0.1 pin is connected to the 2D pin of the latch, the P0.2 pin is connected to the 3D pin of the latch, the P0.3 pin is connected to the 4D pin of the latch, the P0.4 pin is connected to the 5D pin of the latch, the P0.5 pin is connected to the 6D pin of the latch, the P0.6 pin is connected to the 7D pin of the latch, and the P0.7 pin is connected to the 8D pin of the latch;

[0157] The output pin of the latch is connected to the address bus of the disk of the target device.

[0158] A latch is a digital circuit element with a holding function, which can keep its output state unchanged after the input signal disappears. In this embodiment, the latch is used to temporarily store the data sent by the ARM processor to ensure that the data will not be reversed during the transmission process.

[0159] In addition, refer to Fig.10 In this embodiment, an optocoupler is also introduced, and a latch and an optocoupler are combined to realize unidirectional transmission of data.

[0160] The optical coupler is a device that uses optical signals for isolated transmission, which can effectively prevent the transmission of electrical noise and interference. In this embodiment, the optical coupler is used to further isolate the ARM processor and the subsequent detection module to ensure the unidirectionality of the data flow. The optical coupler only allows data to flow from the ARM processor to the detection module, preventing any reverse data flow.

[0161] Please refer to Figure 6 , the general input and output pins P0.0 to P0.7 of the processor are respectively connected to the input pins D0.0 to D0.7 of the encryption module and the general input and output pins P0.0 to P0.7 of the conversion module;

[0162] The write enable pin of the processor is connected to the write enable pin of the encryption module;

[0163] The general input and output pin P2.7 of the processor is connected to the chip selection pin and the data transmission pin of the encryption module;

[0164] The power ground pin of the processor is connected to the digital ground pin of the encryption module;

[0165] The output pin of the encryption module is connected to the input pin of the conversion module.

[0166] In this embodiment, the encryption module is used to encrypt the data transmission for log detection. When the CPU computing power of the log collection module is insufficient to support log detection, it needs to be transferred out, or when there are other data transfer requirements, the log information needs to be encrypted for transmission. In this embodiment, the encryption module selects the serial transmission encryption module of the Ebyte E34-2G4D11S signal. At the same time, in order to achieve wireless transmission capability, a conversion module is used. The conversion module uses the Ebyte E103-W04 serial to wireless module to achieve WIFI transmission capability.

[0167] In this embodiment, the storage part is divided into two types of memories, namely random access memory (RAM) and read-only memory (ROM). The random access memory uses the W9825G6KH-6 chip as the main memory of the device, and the log detection module is stored in the RAM. The read-only memory ROM uses an electrically erasable EEPROM chip to provide storage for the entity log detection program. At the same time, due to its erasable characteristics, the detection algorithm can be updated.

[0168] Please refer to Figures 7 to 9 , Embodiment 2 of the present utility model is:

[0169] A log collection and processing device comprises a central detection device and a plurality of log collection and processing devices for connecting to a target device;

[0170] The log collection and processing device adopts the log collection and processing device described above;

[0171] The central detection device is communicatively connected with the log collection and processing device.

[0172] In this embodiment, the central detection equipment is provided with an encryption module corresponding to the log collection and processing device. The encryption modules are grouped into two. To save costs, the encryption module selects the serial port transmission encryption module of the E34-2G4D11S signal of Ebyte.

[0173] The central detection device includes a disk, a read-only memory, a random access memory, a processor, a load balancer, a communication module for communicating with the log collection and processing device, and an encryption module for encrypting and decrypting communication data;

[0174] The number of the processors is at least two, and at least two of the processors are arranged in parallel;

[0175] The processor, the load balancer and the encryption module are connected in sequence, and the processor is connected to the random access memory, the read-only memory and the disk.

[0176] Please refer to Figure 8 , in this embodiment, the number of the processors is three;

[0177] The load balancer is provided with 6 output ports, which are respectively connected to the ACC1 and ACC2 interfaces of the three processors in a one-to-one correspondence.

[0178] Specifically, the load balancer in this embodiment uses a high-speed 8-input digital multiplexer of the 74LS151 model, referred to herein as 74LS151. The processor of the central detection device is an ARM chip processor, referred to herein as ARM1, ARM2 and ARM3.

[0179] Please refer to Fig. 9 In this embodiment, the I0 port of 74LS151 is connected to the ACC1 port of ARM1, and the I1 port is connected to the ACC2 port of ARM1. Similarly, the I2 port is connected to the ACC1 port of ARM2, and the I3 port is connected to the ACC2 port of ARM2. The I4 port is connected to the ACC1 port of ARM3, and the I5 port is connected to the ACC2 port of ARM3.

[0180] In summary, the utility model provides a log collection and processing device and equipment. The log collection and processing device is connected to the target device for collecting logs, shares a disk with the target device, and has a processor and memory independent of the target device, which ensures that the log collection and analysis is real-time, efficient, and convenient, while not affecting the business needs of the target device itself, and realizes business needs and detection in parallel without relying on intermediate devices. It has strong adaptability and flexibility, and is beneficial to privacy protection. It also connects multiple log collection and processing devices through a central device to facilitate possible centralized analysis needs, or to handle situations where the performance of the log collection and processing device is insufficient. At the same time, since the collection and processing devices do not share an encryption module, log confusion and log leakage can be avoided during encrypted transmission, and log isolation between different devices can be achieved.

[0181] The above description is only an embodiment of the present invention, and does not limit the patent scope of the present invention. Any equivalent transformations made using the contents of the specification and drawings of the present invention, or directly or indirectly applied in the relevant technical field, are also included in the patent protection scope of the present invention.

Claims

1. A log collection and processing device, characterized in that: It includes a communication module, a random access memory, a read-only memory and at least two processors arranged in parallel; The processor includes a main processor and at least one auxiliary processor providing elastic computing power, and the processor is connected to the communication module, the random access memory and the read-only memory; The processor is connected to the disk of the target device to be inspected through an interface.

2. A log collection and processing device according to claim 1, characterized in that: The processor is used to connect to the disk of the target device to be inspected through the interface: The processor connects the general input and output pins P2.0, P2.1, P2.2, P2.3, P2.4, P2.5, P2.6 and P2.7 to the address bus of the disk of the target device through the interface; Connecting the general input and output pins P0.0, P0.1, P0.2, P0.3, P0.4, P0.5, P0.6 and P0.7 to the data bus of the disk of the target device; The P0.0 pin is connected to the 1D pin of the latch, the P0.1 pin is connected to the 2D pin of the latch, the P0.2 pin is connected to the 3D pin of the latch, the P0.3 pin is connected to the 4D pin of the latch, the P0.4 pin is connected to the 5D pin of the latch, the P0.5 pin is connected to the 6D pin of the latch, the P0.6 pin is connected to the 7D pin of the latch, and the P0.7 pin is connected to the 8D pin of the latch; The output pin of the latch is connected to the address bus of the disk of the target device.

3. A log collection and processing device according to claim 1, characterized in that: Also includes an encryption module and a conversion module; The general input and output pins P0.0 to P0.7 of the processor are respectively connected to the input pins D0.0 to D0.7 of the encryption module and the general input and output pins P0.0 to P0.7 of the conversion module; The write enable pin of the processor is connected to the write enable pin of the encryption module; The general input and output pin P2.7 of the processor is connected to the chip selection pin and the data transmission pin of the encryption module; The power ground pin of the processor is connected to the digital ground pin of the encryption module; The output pin of the encryption module is connected to the input pin of the conversion module.

4. A log collection and processing device according to claim 1, characterized in that: An interface module is also included, and the interface module is connected to the processor.

5. The log collection and processing device according to claim 1, characterized in that: The read-only memory is an electrically erasable programmable read-only memory.

6. A log collection and processing device according to claim 1, characterized in that: The parallel connection of the processors is specifically as follows: The power ground pins of at least two processors are connected to each other; Digital ground pins of at least two processors are connected to each other; The transmission pins of at least two processors are connected to each other; The receiving pins of at least two processors are connected to each other.

7. A log collection and processing device according to claim 1, characterized in that: The processor includes the processor chip and peripheral circuits; The peripheral circuit includes a first capacitor, a second capacitor, a third capacitor, a first resistor, a reset switch and a crystal oscillator; The external clock input pin of the processor chip is connected to one end of the second capacitor and one end of the crystal oscillator; The external clock output pin of the processor chip is connected to one end of the third capacitor and the other end of the crystal oscillator; The reset pin of the processor chip is respectively connected to one end of the reset switch, one end of the first resistor and one end of the first capacitor; The other end of the first resistor and the voltage pin of the processor chip are both connected to the 3.3V power pin; The other ends of the first capacitor, the second capacitor, the third capacitor and the reset switch are all grounded; The ground pin of the processor chip is grounded.

8. A log collection and processing device, characterized in that: It includes a central detection device and several log collection and processing devices for connecting to the target device; The log collection and processing device adopts a log collection and processing device as described in any one of claims 1 to 7 above; The central detection device is communicatively connected with the log collection and processing device.

9. The log collection and processing device according to claim 8, characterized in that: The central detection device includes a disk, a read-only memory, a random access memory, a processor, a load balancer, a communication module for communicating with the log collection and processing device, and an encryption module for encrypting and decrypting communication data; The number of the processors is at least two, and at least two of the processors are arranged in parallel; The processor, the load balancer and the encryption module are connected in sequence, and the processor is connected to the random access memory, the read-only memory and the disk.

10. The log collection and processing device according to claim 9, characterized in that: The number of the processors is three; The load balancer is provided with 6 output ports, which are respectively connected to the ACC1 and ACC2 interfaces of the three processors in a one-to-one correspondence.

Images