Log Analysis System Feedback Resend Mechanism
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing log analysis systems face inefficiencies in narrowing down and analyzing large volumes of logs to identify specific quality processes, such as unauthorized communications, leading to poor monitoring efficiency in network communications.
Innovation Solution
A log analysis system that includes a processor device which stops sending detection logs if they cannot be confirmed as received after a predefined number of attempts, and adds information to identify whether the logs have been resent and how many times they have been transmitted, allowing for targeted analysis and improved efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the system continuously sends detection logs to downstream processing blocks without confirmation, then log delivery is maximized, but processing efficiency decreases due to redundant analysis of undelivered logs
Solution Approach 1:
The system implements a feedback mechanism where downstream processing blocks send notifications back to upstream blocks confirming receipt of detection logs. The upstream block uses this feedback to determine whether to resend logs, thereby avoiding continuous redundant transmission and improving processing efficiency.
Solution Approach 2:
The system performs preliminary confirmation actions by checking whether detection logs have been successfully delivered to downstream processing blocks before continuing to send new logs. This preliminary verification prevents unnecessary reprocessing of undelivered logs.
2Ease of manufacture
If the system sends detection logs without tracking transmission attempts, then log transmission is simplified, but unnecessary reanalysis occurs when logs are lost
Solution Approach 1:
The system uses feedback notifications from downstream processing blocks to track whether logs have been received. This feedback mechanism enables the upstream block to identify lost logs and resend them only when necessary, maintaining transmission simplicity while improving analysis efficiency.
3Reliability
If the system analyzes all received logs without filtering, then complete data processing is achieved, but processing time increases for confirmed duplicate logs
Solution Approach 1:
The system extracts and separates confirmed duplicate logs from the processing stream by using feedback information to identify which logs have already been successfully delivered. These confirmed duplicates are taken out of the reanalysis queue, allowing the system to maintain processing completeness while eliminating redundant time-consuming analysis.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
A log analysis system for analyze a detection log detected in a monitoring target system includes an acquisition device for detecting detection target processes performed in the monitoring target system, and acquiring a detection log of the detection target processes; and a processor device for processing the detection log acquired by the acquirer. The processor device includes a plurality of processing blocks that perform processing on the detection log sequentially. The processor device performs processing while sending the detection log in order from a most-upstream processing block to downstream processing blocks. A most-downstream processing block of the processor device notifies the most-upstream processing block of the processor device that the detection log has been received. For a detection log being processed that cannot be confirmed to have arrived at the most-downstream processing block in a notification received from the most-downstream processing block of the processor device, the most-upstream processing block of the processor device resends the detection log to a downstream processing block.