CN112800006B

CN112800006B - Log storage method and device for network equipment

Info

Publication number: CN112800006B
Application number: CN202110109244.3A
Authority: CN
Inventors: 余忠益
Original assignee: Hangzhou DPTech Technologies Co Ltd
Current assignee: Hangzhou DPTech Technologies Co Ltd
Priority date: 2021-01-27
Filing date: 2021-01-27
Publication date: 2023-05-26
Anticipated expiration: 2041-01-27
Also published as: CN112800006A

Abstract

The present disclosure relates to a log storage method, apparatus, electronic device, and computer-readable medium for a network device. The method comprises the following steps: acquiring a log generated by network equipment; calculating to obtain a hash value of a field in the log; matching the hash value with the file name of the index file existing in the network equipment; when the matching is successful, writing the fields into a log file according to a preset first rule; and when the matching is unsuccessful, writing the fields into the log file according to a preset second rule. The log storage method, the log storage device, the electronic equipment and the computer readable medium for the network equipment can greatly reduce the occupied amount of the storage space on the network equipment under the condition that the log storage information is complete and effective.

Description

Log storage method and device for network equipment

Technical Field

The present disclosure relates to the field of computer information processing, and in particular, to a log storage method, apparatus, electronic device, and computer readable medium for a network device.

Background

In general, the network device needs to store some logs. These logs may help users diagnose network problems. One common log format is: time field 1 field 2 field 3. Among these, the fields may be strings or numbers with practical significance such as IP, MAC, log content, etc. In a network device, a log of the above format may be stored in persistent storage in the form of a file or database. However, due to cost constraints, some network devices have relatively small persistent memory capacities, typically 8MB, 16MB, 32MB, etc. Because network device firmware also occupies a portion of the space, the space that is actually reserved for log storage is more intense.

The existing technical scheme mainly realizes log storage by writing files or databases. Logically, each log is arranged in turn to form the following structure: the first log |second log | … …', and when the log needs to be checked, each log is read. Because of the large number of logs that may be generated in an actual network environment, the network device may only store a certain number of log entries. When the maximum number of storable logs is exceeded, the system deletes some of the logs that are earliest in time, making room for storing the newly generated log. In the prior art, the number of the logs which can be stored is small due to the limitation of the storage space, and long-time log backtracking cannot be performed. Thus, there is a need for a new log storage method, apparatus, electronic device and computer readable medium for network devices.

The above information disclosed in the background section is only for enhancement of understanding of the background of the disclosure and therefore it may include information that does not form the prior art that is already known to a person of ordinary skill in the art.

Disclosure of Invention

In view of the above, the present disclosure provides a log storage method, apparatus, electronic device and computer readable medium for a network device, which can greatly reduce the occupation amount of storage space on the network device when the log storage information is complete and effective.

Other features and advantages of the present disclosure will be apparent from the following detailed description, or may be learned in part by the practice of the disclosure.

According to an aspect of the present disclosure, a log storage method for a network device is provided, the method including: acquiring a log generated by network equipment; calculating to obtain a hash value of a field in the log; matching the hash value with the file name of the index file existing in the network equipment; when the matching is successful, writing the fields into a log file according to a preset first rule; and when the matching is unsuccessful, writing the fields into the log file according to a preset second rule.

In an exemplary embodiment of the present disclosure, calculating a hash value of a field in the log includes: and calculating a hash value of a field in the log based on a first secure hash algorithm.

In an exemplary embodiment of the present disclosure, before matching the hash value with a file name of an index file existing in the network device, the method further includes: and generating the index file according to the hash value of the field of the history log.

In one exemplary embodiment of the present disclosure, writing the field into the log file according to a pre-first rule includes: acquiring the index file successfully matched; acquiring a field number; the field and the field number are stored in the log file.

In an exemplary embodiment of the present disclosure, obtaining the index file that the matching is successful includes: opening the index file; decompressing the index file; and dividing the file content in the index file according to the separator.

In one exemplary embodiment of the present disclosure, obtaining a field number includes: extracting the field number when the field is successfully matched with the existing field in the index file; and generating file content and the field number when the field is not successfully matched with the existing field in the index file.

In an exemplary embodiment of the present disclosure, further comprising: and when the field is not successfully matched with the existing field in the index file, compressing and updating the content, the separator and the field number in the field into the index file.

In an exemplary embodiment of the present disclosure, generating the file content and the field number includes: extracting the current maximum field number; and taking the next sequence number of the maximum field number as the field number.

In an exemplary embodiment of the present disclosure, writing the field into the log file according to the pre-second rule includes: creating an index file; writing the hash value of the field and the initial field number into the index file; the hash value of the field and the initial field number are stored in the log file.

In an exemplary embodiment of the present disclosure, further comprising: extracting the log file; the file path is automatically referred to according to the hash value of the field; acquiring an index file based on the index file path; and acquiring and displaying the field value based on the index file.

According to an aspect of the present disclosure, there is provided a log storage apparatus for a network device, the apparatus comprising: the log module is used for acquiring logs generated by the network equipment; the hash value module is used for calculating and obtaining a hash value of a field in the log; the matching module is used for matching the hash value with the file name of the index file existing in the network equipment; the first rule module is used for writing the fields into the log file according to a preset first rule when the matching is successful; and the second rule module is used for writing the fields into the log file according to a preset second rule when the matching is unsuccessful.

According to an aspect of the present disclosure, there is provided an electronic device including: one or more processors; a storage means for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the methods as described above.

According to an aspect of the present disclosure, a computer-readable medium is presented, on which a computer program is stored, which program, when being executed by a processor, implements a method as described above.

According to the log storage method, the log storage device, the electronic equipment and the computer readable medium for the network equipment, the log generated by the network equipment is obtained; calculating to obtain a hash value of a field in the log; matching the hash value with the file name of the index file existing in the network equipment; when the matching is successful, writing the fields into a log file according to a preset first rule; when the matching is unsuccessful, the fields are written into the log file according to a preset second rule, so that the occupied amount of the storage space on the network equipment can be greatly reduced under the condition that the log storage information is complete and effective.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings. The drawings described below are merely examples of the present disclosure and other drawings may be obtained from these drawings without inventive effort for a person of ordinary skill in the art.

Fig. 1 is a system block diagram illustrating a log storage method and apparatus for a network device according to an exemplary embodiment.

Fig. 2 is a flow chart illustrating a log storage method for a network device according to an example embodiment.

Fig. 3 is a flowchart illustrating a log storage method for a network device according to another exemplary embodiment.

Fig. 4 is a flowchart illustrating a log storage method for a network device according to another exemplary embodiment.

Fig. 5 is a flowchart illustrating a log storage method for a network device according to another exemplary embodiment.

Fig. 6 is a block diagram illustrating a log storage for a network device according to an example embodiment.

Fig. 7 is a block diagram of an electronic device, according to an example embodiment.

Fig. 8 is a block diagram of a computer-readable medium shown according to an example embodiment.

Detailed Description

Example embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments can be embodied in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the example embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and thus a repetitive description thereof will be omitted.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the disclosed aspects may be practiced without one or more of the specific details, or with other methods, components, devices, steps, etc. In other instances, well-known methods, devices, implementations, or operations are not shown or described in detail to avoid obscuring aspects of the disclosure.

The block diagrams depicted in the figures are merely functional entities and do not necessarily correspond to physically separate entities. That is, the functional entities may be implemented in software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices.

The flow diagrams depicted in the figures are exemplary only, and do not necessarily include all of the elements and operations/steps, nor must they be performed in the order described. For example, some operations/steps may be decomposed, and some operations/steps may be combined or partially combined, so that the order of actual execution may be changed according to actual situations.

It will be understood that, although the terms first, second, third, etc. may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one element from another element. Accordingly, a first component discussed below could be termed a second component without departing from the teachings of the concepts of the present disclosure. As used herein, the term "and/or" includes any one of the associated listed items and all combinations of one or more.

Those skilled in the art will appreciate that the drawings are schematic representations of example embodiments and that the modules or flows in the drawings are not necessarily required to practice the present disclosure, and therefore, should not be taken to limit the scope of the present disclosure.

The technical abbreviations to which the present disclosure relates are explained as follows:

SHA-1: which may be referred to as a first secure hash algorithm or secure hash algorithm-1, is a cryptographic hash function designed by the national security agency and issued by the National Institute of Standards and Technology (NIST) as federal data processing standard (FIPS). SHA-1 may generate a 160-bit (20 byte) hash value called a message digest, typically in the form of 40 hexadecimal numbers.

Linux: the system is a free-to-use and freely-spread Unix-like operating system, and is a multi-user, multi-task and multi-CPU-supporting operating system based on POSIX and Unix. It can run major Unix tools, applications, and networking protocols. It supports 32-bit and 64-bit hardware. Linux inherits the design idea of Unix with a network as a core, and is a multi-user network operation system with stable performance.

zlib; zlib is a library of functions that provides for data compression.

The inventors of the present application, after carefully analyzing the daily log generated by the network device, found that: during a certain period of time, the device generates a log of many field repetitions. For example, "2020-2-11 08:00|1.2.3.4|access network", "2020-2-11:08:01|1.2.3.4|disconnect network", "2020-2-11:08:02|1.2.3.4|access network", "2020-2-11:08:03|1.2.3.4|disconnect network". Obviously, the IP fields in such 4 logs are all duplicated. However, the prior art solution records 4 logs, including 4 identical IPs, 2 identical "access networks" and 2 identical "disconnection networks". Thus, the log generated by the network device may have duplicate fields, occupy space, and are not economical.

In view of the above analysis and the technical bottlenecks in the prior art, the disclosure provides a log storage method and apparatus for a network device, which can solve the problem of storing duplicate fields in multiple logs.

Fig. 1 is a system block diagram illustrating a log storage method, apparatus for a network device according to an exemplary embodiment.

As shown in fig. 1, the system architecture 10 may include

terminal devices

101, 102, 103, a network 104, and a network device 105. The network 104 is the medium used to provide communication links between the

terminal devices

101, 102, 103 and the network device 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

A user may interact with the network device 105 via the network 104 using the

terminal devices

101, 102, 103 to receive or send messages or the like. Various communication client applications, such as shopping class applications, web browser applications, search class applications, instant messaging tools, mailbox clients, social platform software, etc., may be installed on the

terminal devices

101, 102, 103.

The

terminal devices

101, 102, 103 may be a variety of electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop and desktop computers, and the like.

The network device 105 may monitor the network data of the

terminal devices

101, 102, 103 and generate log information. The network device 105 may, for example, obtain a log; network device 105 may, for example, calculate a hash value of a field in the log; network device 105 may, for example, match the hash value with a file name of an index file already in the network device; the network device 105 may write the fields into the log file according to a pre-first rule, for example, when the matching is successful; the network device 105 may write the fields in the log file according to a pre-second rule, for example, when the matching is unsuccessful.

It should be noted that, the log storage method for a network device provided by the embodiments of the present disclosure may be executed by the network device 105, and accordingly, the log storage apparatus for the network device may be disposed in the network device 105.

Fig. 2 is a flow chart illustrating a log storage method for a network device according to an example embodiment. The log storing method 20 for a network device includes at least steps S202 to S210.

As shown in fig. 2, in S202, a log generated by the network device is acquired. Network devices and components are physical entities connected into a network. The network device may include: hubs, switches, bridges, routers, gateways, network Interface Cards (NICs), wireless Access Points (WAPs), printers and modems, fiber optic transceivers, fiber optic cables, and the like. The log system is a very important functional component in the network device. Problems can be quickly understood and diagnosed by looking at the logs of switches, routers, and other network devices.

In S204, a hash value of a field in the log is calculated. Comprising the following steps: and calculating a hash value of a field in the log based on a first secure hash algorithm. The first secure hash algorithm may be SHA-1. The hash value is 40 hexadecimal numbers after calculation.

In S206, the hash value and the file name of the index file existing in the network device are matched.

Before the hash value is matched with the file name of the index file existing in the network device, the method further comprises the following steps: and generating the index file according to the hash value of the field of the history log.

In S208, when the matching is successful, the fields are written into the log file according to a pre-first rule. The index file which is successfully matched can be obtained; acquiring a field number; the field and the field number are stored in the log file.

The details will be described in the corresponding embodiment of fig. 3.

In S210, when the matching is unsuccessful, the field is written into the log file according to a pre-second rule. An index file may be created, for example; writing the hash value of the field and the initial field number into the index file; the hash value of the field and the initial field number are stored in the log file.

The details will be described in the corresponding embodiment of fig. 4.

According to the log storage method for the network equipment, the log generated by the network equipment is obtained; calculating to obtain a hash value of a field in the log; matching the hash value with the file name of the index file existing in the network equipment; when the matching is successful, writing the fields into a log file according to a preset first rule; when the matching is unsuccessful, the fields are written into the log file according to a preset second rule, so that the occupied amount of the storage space on the network equipment can be greatly reduced under the condition that the log storage information is complete and effective.

In the log storage method for network equipment of the present disclosure, a field stored in a log file is "SHA-1 value-id" of a field value; saving the field value by an additional index file; the fields are spliced and compressed according to the form of field 1 plus separator plus field 2 and then stored in an index file; the first 2 hexadecimal of the field SHA-1 value is taken as the directory name; the remaining 38 hexadecimal of the field SHA-1 value is taken as the file name; directory name + file name make up the index file path; the log stored by the setting mode can greatly save the storage space,

it should be clearly understood that this disclosure describes how to make and use particular examples, but the principles of this disclosure are not limited to any details of these examples. Rather, these principles can be applied to many other embodiments based on the teachings of the present disclosure.

In one embodiment, the step of reading the log stored by way of the present disclosure may comprise: extracting the log file; the file path is automatically referred to according to the hash value of the field; acquiring an index file based on the index file path; and acquiring and displaying the field value based on the index file.

In this disclosure, the meaning of id is the number of the storage field in the index file. Because SHA-1 is a hash function, the hash function has a small probability of "collision" probability. In other words, there is a possibility that SHA-1 (field 1) =sha-2 (field 2). Then field 1 and field 2 may be hashed to the same index file. For this case, when the log file is read, it can be read by the following method to avoid the problem of hash collision.

1) The field recorded in the log file is "SHA1 (field) value-id", and the number of the field in the index file is indicated by the id.

2) The plurality of fields are spliced in a format of "field 1, separator, field 2, separator, field 3, … …".

3) And then compressing the spliced fields by using zlib, and finally storing the compressed fields into an index file.

4) id is the number where the field is located after splicing, for example, id of field 1 is 1, id of field 2 is 2, and so on.

And when the log of the network equipment is checked later, opening a field of the log file reading log. Since the fields were previously filled with SHA-1 value-ids, the first 2 hexadecimal and the remaining 38 hexadecimal are first extracted from the SHA-1 value to form the index file path. The index file is then looked up in the file system. After the index file is found, the index file is opened, and the content of the index file is decompressed by using zlib. Extracting the decompressed field content according to the separator, and acquiring a corresponding field value according to the id value. And finally, displaying the field value.

Fig. 3 is a flowchart illustrating a log storage method for a network device according to another exemplary embodiment. The flow 30 shown in fig. 3 is a detailed description of "write the fields into the log file according to the pre-first rule" in S208 in the flow shown in fig. 2.

As shown in fig. 3, in S302, the index file that is successfully matched is obtained. The index file may be opened, for example; decompressing the index file; and dividing the file content in the index file according to the separator.

In S304, a field number is acquired. The field number may be extracted, for example, when the field matches an existing field in the index file successfully; and generating file content and the field number when the field is not successfully matched with the existing field in the index file.

Wherein generating the file content and the field number includes: extracting the current maximum field number; and taking the next sequence number of the maximum field number as the field number.

In one embodiment, the method further comprises compressing and updating the content and separator in the field and the field number into the index file when the field and the existing field in the index file are not successfully matched.

In S306, the field and the field number are stored in the log file. If the field value is already found in the index file (and the id is obtained at the same time), the SHA-1 value-id of the field is written into the log file (assuming the log file is saved in/tmp/log/2020-2-10. Log, here the file path is exemplified by the Linux operating system).

Fig. 4 is a flowchart illustrating a log storage method for a network device according to another exemplary embodiment. The flow 40 shown in fig. 4 is a detailed description of "write the fields into the log file according to the pre-second rule" in S210 in the flow shown in fig. 2.

As shown in fig. 4, in S402, an index file is created. If the field value does not find the same matching information in the index file, the index file is created. The file name of the index file may be: "/tmp/index/6d/da9b434e3d40bd18ee92181a0652cbd f56 fba.

In S404, the hash value of the field, the initial field number, is written to the index file.

In S406, the hash value of the field and the initial field number are stored in the log file. The file path here is exemplified by the Linux operating system, which can write the "SHA-1 value-1" of the field into the log file/tmp/log/2020-2-10. Log.

Fig. 5 is a flowchart illustrating a log storage method for a network device according to another exemplary embodiment. The flow 50 shown in fig. 5 is a detailed description of the overall process of the present application.

As shown in fig. 5, in S501, the network device generates a log.

In S502, the SHA-1 value of the log field is calculated. First, the SHA-1 value of the field, namely 40 hexadecimal numbers, is calculated, and if the field value is "1.2.3.4", SHA-1 (1.2.3.4) = "6dda9b434e3d40bd18ee92181a0652cbd8f56fba".

In S503, whether an index file corresponding to the SHA-1 value exists or not.

In S504, the index file is opened and decompressed; the file content is partitioned according to the delimiters.

In S505, it is found whether a field exists.

In S506, id=the found number.

In S507, an index file is created.

In S508, the field value, id=1, is compressed, and the index file is written.

In S509, id=current maximum number+1.

In S510, a new file is generated.

In S511, the field SHA-1 value and id are written to the log file. If the field value is already found in the index file (while the id is obtained), the SHA-1 value-id of the field is written to the log file. If the field value is not found in the index file, the "SHA-1 value-1" of the field is written to the log file. At the same time, an index file is created in the file system of the device. Such as: "/tmp/index/6d/da9b434e3d40bd18ee92181a0652cbd f56 fba. It is worth mentioning that here the directory name 6d is the first two hexadecimal of SHA-1 (1.2.3.4), while the file name da9b434e3d40bd18ee92181a0652cbd f56fba is the remaining 38 hexadecimal of SHA-1 (1.2.3.4). Finally, after field values 1.2.3.4 are compressed using the zlib tool, they are stored in the da9b434e3d40bd18ee92181a0652cbd f56fba index file.

In the method of the present disclosure, only one field value is reserved, and only "SHA-1 value-id" is recorded in the log. If the field length is long (for example, more than 100 characters), the method can effectively reduce the occupied storage space. In addition, the zlib compressed field value is adopted, so that the space occupation is further reduced.

Index file example:

file path:

/tmp/index/6d/da9b434e3d40bd18ee92181a0652cbd8f56fba

file content:

+++++++++++

field value (id=1)

+++++++++++

File path:

/tmp/index/eb/3cf4c0f840058d986d19a9fa2a9ed48589c81e

file content:

++++++++++++++++++++++++++

field value (id=1) separator field value (id=2)

++++++++++++++++++++++++++

Log file example:

file path: TMP/log/2020-2-10.Log

File content:

+++++++++++++++++++++++++++++++++++++++++++++

time 6dda b434e3d40bd18ee92181a0652cbd8f56fba-1|

+++++++++++++++++++++++++++++++++++++++++++++

Time |eb3cf4c0f840058d986d19a9fa2a9ed48589c81e-1|

+++++++++++++++++++++++++++++++++++++++++++++

Time |eb3cf4c0f840058d986d19a9fa2a9ed48589c81e-2|

+++++++++++++++++++++++++++++++++++++++++++++

As can be seen from the above file examples, the log file stores SHA-1 value-id. Meanwhile, the index file individually stores the compressed field values

It should be noted that the method can also be implemented by creating a plurality of database tables and referring to the primary keys of table 2 and table 3 by using the fields of table 1. For example, table 1 refers to "id key |refer to table 2 key|refer to table 3 key"; table 2 is "id primary key |field 1"; table 3"id primary key |field 1". That is, the log is stored as "1|2|3" in table 1, "2|1.2.3.4" in table 2, and "3|access network" in table 3. Tables 2 and 3 correspond to the function of the index file. However, this solution requires that the network device support a database, while the small-capacity network device has limited performance and is not necessarily capable of supporting a database. While file systems are generally supported. There is a limitation in this alternative.

Those skilled in the art will appreciate that all or part of the steps implementing the above described embodiments are implemented as a computer program executed by a CPU. The above-described functions defined by the above-described methods provided by the present disclosure are performed when the computer program is executed by a CPU. The program may be stored in a computer readable storage medium, which may be a read-only memory, a magnetic disk or an optical disk, etc.

Furthermore, it should be noted that the above-described figures are merely illustrative of the processes involved in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It will be readily appreciated that the processes shown in the above figures do not indicate or limit the temporal order of these processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, for example, among a plurality of modules.

The following are device embodiments of the present disclosure that may be used to perform method embodiments of the present disclosure. For details not disclosed in the embodiments of the apparatus of the present disclosure, please refer to the embodiments of the method of the present disclosure.

Fig. 6 is a block diagram illustrating a log storage apparatus for a network device according to another exemplary embodiment. As shown in fig. 6, the log storage means 60 for a network device includes: a log module 602, a hash value module 604, a matching module 606, a first rule module 608, and a second rule module 610.

The log module 602 is configured to obtain a log generated by a network device;

the hash value module 604 is configured to calculate a hash value of a field in the log;

the matching module 606 is configured to match the hash value with a file name of an index file existing in the network device;

the first rule module 608 is configured to write the field into the log file according to a pre-first rule when the matching is successful;

the second rule module 610 is configured to write the field into the log file according to a predetermined second rule when the matching is unsuccessful.

According to the log storage device for the network equipment, the log generated by the network equipment is acquired; calculating to obtain a hash value of a field in the log; matching the hash value with the file name of the index file existing in the network equipment; when the matching is successful, writing the fields into a log file according to a preset first rule; when the matching is unsuccessful, the fields are written into the log file according to a preset second rule, so that the occupied amount of the storage space on the network equipment can be greatly reduced under the condition that the log storage information is complete and effective.

An electronic device 700 according to such an embodiment of the present disclosure is described below with reference to fig. 7. The electronic device 700 shown in fig. 7 is merely an example and should not be construed to limit the functionality and scope of use of embodiments of the present disclosure in any way.

As shown in fig. 7, the electronic device 700 is embodied in the form of a general purpose computing device. Components of electronic device 700 may include, but are not limited to: at least one processing unit 710, at least one memory unit 720, a bus 730 connecting the different system components (including the memory unit 720 and the processing unit 710), a display unit 740, and the like.

Wherein the storage unit stores program code that is executable by the processing unit 710 such that the processing unit 710 performs steps described in the present specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 710 may perform the steps as shown in fig. 2, 3, 4, 5.

The memory unit 720 may include readable media in the form of volatile memory units, such as Random Access Memory (RAM) 7201 and/or cache memory 7202, and may further include Read Only Memory (ROM) 7203.

The storage unit 720 may also include a program/utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment.

Bus 730 may be a bus representing one or more of several types of bus structures including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

The electronic device 700 may also communicate with one or more external devices 700' (e.g., keyboard, pointing device, bluetooth device, etc.), devices that enable a user to interact with the electronic device 700, and/or any devices (e.g., routers, modems, etc.) with which the electronic device 700 can communicate with one or more other computing devices. Such communication may occur through an input/output (I/O) interface 750. Also, electronic device 700 may communicate with one or more networks such as a Local Area Network (LAN), a Wide Area Network (WAN) and/or a public network, such as the Internet, through network adapter 760. Network adapter 760 may communicate with other modules of electronic device 700 via bus 730. It should be appreciated that although not shown, other hardware and/or software modules may be used in connection with electronic device 700, including, but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data backup storage systems, and the like.

From the above description of embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or may be implemented in software in combination with the necessary hardware. Thus, as shown in fig. 8, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, and includes several instructions to cause a computing device (may be a personal computer, a server, or a network device, etc.) to perform the above-described method according to the embodiments of the present disclosure.

The software product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium would include the following: an electrical connection having one or more wires, a portable disk, a hard disk, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

The computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, with readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A readable storage medium may also be any readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out operations of the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).

The computer-readable medium carries one or more programs, which when executed by one of the devices, cause the computer-readable medium to perform the functions of: acquiring a log generated by network equipment; calculating to obtain a hash value of a field in the log; matching the hash value with the file name of the index file existing in the network equipment; when the matching is successful, writing the fields into a log file according to a preset first rule; and when the matching is unsuccessful, writing the fields into the log file according to a preset second rule.

Those skilled in the art will appreciate that the modules may be distributed throughout several devices as described in the embodiments, and that corresponding variations may be implemented in one or more devices that are unique to the embodiments. The modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.

From the above description of embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or in combination with the necessary hardware. Thus, the technical solutions according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, and include several instructions to cause a computing device (may be a personal computer, a server, a mobile terminal, or a network device, etc.) to perform the method according to the embodiments of the present disclosure.

Exemplary embodiments of the present disclosure are specifically illustrated and described above. It is to be understood that this disclosure is not limited to the particular arrangements, instrumentalities and methods of implementation described herein; on the contrary, the disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A log storage method for a network device, comprising:

acquiring a log generated by network equipment;

calculating to obtain a hash value of a field in the log;

matching the hash value with the file name of the index file existing in the network equipment;

when matching is successful, acquiring the index file which is successfully matched, when matching is successful between a field and an existing field in the index file, extracting a field number, when not matching is successful between the field and the existing field in the index file, generating file content and the field number, storing the field and the field number in a log file, and when not matching is successful between the field and the existing field in the index file, compressing and updating the content and separator in the field and the field number into the index file;

when the matching is unsuccessful, an index file is created, the hash value of the field, an initial field number are written into the index file, and the hash value of the field and the initial field number are stored in the log file.

2. The method of claim 1, wherein calculating a hash value of a field in the log comprises:

and calculating a hash value of a field in the log based on a first secure hash algorithm.

3. The method of claim 1, wherein prior to matching the hash value with a filename of an index file existing in the network device, further comprising:

and generating the index file according to the hash value of the field of the history log.

4. The method of claim 1, wherein obtaining the index file for which the matching was successful comprises:

opening the index file;

decompressing the index file;

and dividing the file content in the index file according to the separator.

5. The method of claim 1, wherein generating file content and the field number comprises:

extracting the current maximum field number;

and taking the next sequence number of the maximum field number as the field number.

6. The method as recited in claim 1, further comprising:

extracting the log file;

making an index file path according to the hash value of the field;

acquiring an index file based on the index file path;

and acquiring and displaying the field value based on the index file.

7. A log storage apparatus for a network device, comprising:

the log module is used for acquiring logs generated by the network equipment;

the hash value module is used for calculating and obtaining a hash value of a field in the log;

the matching module is used for matching the hash value with the file name of the index file existing in the network equipment;

the first rule module is used for acquiring the index file with successful matching when the matching is successful, extracting a field number when the matching of a field and an existing field in the index file is successful, generating file content and the field number when the matching of the field and the existing field in the index file is unsuccessful, storing the field and the field number in a log file, and compressing and updating the content and separator in the field and the field number in the index file when the matching of the field and the existing field in the index file is unsuccessful;

and the second rule module is used for creating an index file when the matching is unsuccessful, writing the hash value of the field and the initial field number into the index file, and storing the hash value of the field and the initial field number in the log file.