Log management system and operation method thereof

Abstract

The invention provides a log management system and an operation method thereof. The log management system comprises a data source layer, a data platform layer and a scene application layer. The data acquisition layer is used for acquiring data of the data source layer; the analysis and processing layer is used for processing the data acquired by the data acquisition layer through a queue, enablingthe processed data to enter the data platform layer in real time to be filtered and cleaned, performing real-time rule analysis processing on heterogeneous data sources of different formats through an analysis engine, and then loading the processed data into the storage and analysis layer to be stored and analyzed; after being analyzed by the algorithm engine, the data is called by the scene application layer in real time; the scene application layer is used for carrying out real-time detection on suspicious indexes in combination with in-line requirements, quickly responding to abnormal events and problems, tracing the source and establishing an operation and maintenance knowledge base; a security situation awareness scene is established in combination with various network security equipment events and rules in rows, various security events and potential threats are perceived in real time, and timely response and processing, advanced prediction and risk avoidance capability are achieved.

Description

technical field [0001] The invention relates to the technical field of system platform monitoring, in particular to a log management system and an operation method thereof. Background technique [0002] At present, when the system platform is monitored, the monitoring platform is connected with the system platform for data, and then the data is analyzed to achieve the purpose of monitoring. However, when the monitoring platform is connected with multiple system platforms, the monitoring platform The data docking can only be completed after obtaining the authority of each system platform, and when monitoring the data, a large amount of data processing is required to monitor multiple system platforms, and the processing efficiency is very low. Contents of the invention [0003] The aim of the present invention is to solve at least one of said technical drawbacks. [0004] For this reason, the purpose of the present invention is to propose a log management system and its ope...

AI Technical Summary

Problems solved by technology

[0002] At present, when the system platform is monitored, the monitoring platform is connected with the system platform for data, and then the data is analyzed to achieve the purpose of monitoring. However, when the monitoring platform is connected with multiple system platforms, the monitoring platform It is necessary to obtain the authority of each system platform before the data docking can be completed, and when monitoring the data, a large amount of data processing is required to monitor multiple system platforms, and the processing efficiency is very low

Images