CN116882379B - Log template processing method and device based on DPI - Google Patents
Log template processing method and device based on DPI Download PDFInfo
- Publication number
- CN116882379B CN116882379B CN202310749725.XA CN202310749725A CN116882379B CN 116882379 B CN116882379 B CN 116882379B CN 202310749725 A CN202310749725 A CN 202310749725A CN 116882379 B CN116882379 B CN 116882379B
- Authority
- CN
- China
- Prior art keywords
- log
- template
- output
- filtering
- field
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000003672 processing method Methods 0.000 title abstract description 5
- 238000001914 filtration Methods 0.000 claims abstract description 74
- 238000000034 method Methods 0.000 claims abstract description 22
- 238000012216 screening Methods 0.000 claims abstract description 10
- 238000012545 processing Methods 0.000 claims description 33
- 238000004590 computer program Methods 0.000 claims description 12
- 238000004458 analytical method Methods 0.000 claims description 11
- 230000032683 aging Effects 0.000 claims 2
- 238000011161 development Methods 0.000 abstract description 2
- 230000006870 function Effects 0.000 description 18
- 238000010586 diagram Methods 0.000 description 7
- 238000004891 communication Methods 0.000 description 4
- 230000003287 optical effect Effects 0.000 description 3
- 238000012423 maintenance Methods 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 241000700605 Viruses Species 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000015572 biosynthetic process Effects 0.000 description 1
- 230000000739 chaotic effect Effects 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 238000005206 flow analysis Methods 0.000 description 1
- ZXQYGBMAQZUVMI-GCMPRSNUSA-N gamma-cyhalothrin Chemical compound CC1(C)[C@@H](\C=C(/Cl)C(F)(F)F)[C@H]1C(=O)O[C@H](C#N)C1=CC=CC(OC=2C=CC=CC=2)=C1 ZXQYGBMAQZUVMI-GCMPRSNUSA-N 0.000 description 1
- 238000007689 inspection Methods 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000007493 shaping process Methods 0.000 description 1
- 238000003786 synthesis reaction Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F40/00—Handling natural language data
- G06F40/10—Text processing
- G06F40/166—Editing, e.g. inserting or deleting
- G06F40/186—Templates
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/18—File system types
- G06F16/1805—Append-only file systems, e.g. using logs or journals to store data
- G06F16/1815—Journaling file systems
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Audiology, Speech & Language Pathology (AREA)
- Computational Linguistics (AREA)
- General Health & Medical Sciences (AREA)
- Health & Medical Sciences (AREA)
- Artificial Intelligence (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention relates to a log template processing method and device based on DPI, wherein the method comprises the following steps: acquiring a plurality of preset log output fields and a plurality of preset log filtering rules; determining one or more log templates based on each service requirement of the machine room link and a corresponding log output format thereof; screening or filtering the message data of the machine room link based on the matching of each log template with the corresponding output field and the filtering rule; and storing the filtered or filtered message data as one or more log records. The invention defines the log template through the fields and the filtering rules, realizes customization and diversification of the log template, improves the development efficiency, is convenient to maintain and saves human resources.
Description
Technical Field
The invention belongs to the technical field of communication networks, and particularly relates to a log template processing method and device based on DPI.
Background
The DPI (DEEP PACKET Inspection) device can carry out filtering control on the detected flow according to a predefined strategy by detecting and analyzing the flow and the message content at the key points of the network, and can complete the functions of service fine identification, service flow direction analysis, service flow ratio statistics, service ratio shaping, application layer denial of service attack, virus and Trojan filtration, P2P abuse control and the like of the link. The unified DPI refers to a set of DPI equipment which collects and identifies the flow on the link and distributes the flow or analysis statistical data required by other systems to each third party application system server. Various traffic management related application systems in the network. The DPI equipment is responsible for data acquisition, flow analysis statistics and log synthesis, and the application server mainly completes further analysis processing of the data, reasonably organizes and stores the data and presents the data. The unified DPI integrates DPI devices of multiple third party application systems, providing DPI capabilities to the multiple systems through DPI multiplexing.
And deploying DPI equipment on the machine room link, identifying the passing message, and then generating a log ticket according to the service requirement. Because the current log ticket demands are diversified, the DPI equipment needs to output logs with different formats, fields and other specifications, so that the whole log file template becomes chaotic and difficult to maintain, and the problem of inconvenient investigation during use affects the practicability of the log file.
Disclosure of Invention
In order to solve the problems of template diversification and difficult maintenance of a computer room link DPI, the first aspect of the invention provides a method for processing a log template based on the DPI, which comprises the following steps: acquiring a plurality of preset log output fields and a plurality of preset log filtering rules; determining one or more log templates based on each service requirement of the machine room link and a corresponding log output format thereof; screening or filtering the message data of the machine room link based on the matching of each log template with the corresponding output field and the filtering rule; and storing the filtered or filtered message data as one or more log records.
In some embodiments of the present invention, the determining one or more log templates based on each service requirement of the machine room link and the corresponding log output format thereof includes: one or more log templates are defined according to each service requirement of the machine room link and the corresponding log output format, wherein each log template comprises a field separator, a field combination, a log filtering rule, a timeout time and a log template name.
In some embodiments of the present invention, the filtering or filtering the message data of the machine room link based on the matching of each log template with the corresponding output field and the filtering rule includes: and matching each log template with the corresponding output field and the filtering rule, and loading the log template into different variables of the template object.
Further, the loading each log template into different variables of the template object by matching the corresponding output field and the filtering rule includes: converting the output field name in each log template into data of a corresponding type, and storing the data into output variables of the log templates; the filter rule field names in each log template are converted into corresponding types of data and stored into filter rule variables of the log templates.
In some embodiments of the present invention, storing the filtered or filtered message data as one or more log records includes: and splicing the filtered or filtered message data according to a specified sequence and format based on a preset log output format, and storing the message data as one or more log records.
In the above embodiment, further comprising: and responding to the analysis request of the log and the target log template, and analyzing the log record.
In a second aspect of the present invention, there is provided a log template processing apparatus based on DPI, including: the acquisition module is used for acquiring a plurality of preset log output fields and a plurality of preset log filtering rules; the determining module is used for determining one or more log templates based on each service requirement of the machine room link and the corresponding log output format of the service requirement; the storage module is used for screening or filtering the message data of the machine room link based on the output field and the filtering rule matched and corresponding to each log template; and storing the filtered or filtered message data as one or more log records.
Further, the device also comprises an analysis module, wherein the analysis module is used for: and responding to the analysis request of the log and the target log template, and analyzing the log record.
In a third aspect of the present invention, there is provided an electronic apparatus comprising: one or more processors; and a storage device for storing one or more programs, which when executed by the one or more processors, cause the one or more processors to implement the method for processing a log template based on DPI provided in the first aspect of the present invention.
In a fourth aspect of the present invention, a computer readable medium is provided, on which a computer program is stored, wherein the computer program, when being executed by a processor, implements the method for processing a log template based on DPI according to the first aspect of the present invention.
The beneficial effects of the invention are as follows:
The invention relates to a log template processing method and device based on DPI, wherein the method comprises the following steps: acquiring a plurality of preset log output fields and a plurality of preset log filtering rules; determining one or more log templates based on each service requirement of the machine room link and a corresponding log output format thereof; screening or filtering the message data of the machine room link based on the matching of each log template with the corresponding output field and the filtering rule; and storing the filtered or filtered message data as one or more log records. Therefore, the invention initializes the log template through the log field and the filtering rule, realizes the free combination of the log field and the filtering rule attribute, generates various different log templates, and outputs the needed log through the log filtering rule, so that the log output is more diversified, thereby meeting different business requirements. The development efficiency is improved, the maintenance is convenient, and the manpower resources are saved.
Drawings
FIG. 1 is a basic flow diagram of a method of DPI-based log template processing in some embodiments of the invention;
FIG. 2 is a flow chart of a method of processing a log template based on DPI according to some embodiments of the present invention;
FIG. 3 is a schematic diagram of a processing apparatus for DPI-based log templates in some embodiments of the invention;
fig. 4 is a schematic structural diagram of an electronic device according to some embodiments of the present invention.
Detailed Description
The principles and features of the present invention are described below with reference to the drawings, the examples are illustrated for the purpose of illustrating the invention and are not to be construed as limiting the scope of the invention.
Referring to fig. 1 and 2, in a first aspect of the present invention, there is provided a method for processing a log template based on DPI, including: s100, acquiring a plurality of preset log output fields and a plurality of preset log filtering rules; s200, determining one or more log templates based on each service requirement of a machine room link and a corresponding log output format of the service requirement; s300, screening or filtering message data of a machine room link based on the fact that each log template is matched with a corresponding output field and a filtering rule; and storing the filtered or filtered message data as one or more log records.
In step S100 of some embodiments of the present invention, a preset plurality of log output fields and a preset plurality of log filtering rules are acquired. Specifically, the log output field is first registered, and the log filtering rule. Log output field: content output to the log file; log filtering rules: generating a rule of the log file, registering an output field and a rule field in a HASH table, wherein key is a field name, and value is a processing function { "name": function }.
In step S200 of some embodiments of the present invention, the determining one or more log templates based on each service requirement of the machine room link and the corresponding log output format thereof includes: one or more log templates are defined according to each service requirement of the machine room link and the corresponding log output format, wherein each log template comprises a field separator, a field combination, a log filtering rule, a timeout time and a log template name.
Specifically, according to the service requirement and the log output format, a log template is defined, including a log output field, a log filtering rule, a field separator, a maximum number of lines of a log, a timeout time, a maximum number of bytes of a log file and the like. The log template includes: log field delimiters, combinations of log output fields, log filter rules, timeout times (maximum number of lines of log, timeout time, maximum number of bytes of log file), log template names (the template content is viewed by the program runtime according to the template name), etc.
In step S300 of some embodiments of the present invention, the filtering or filtering the message data of the machine room link based on the matching of each log template with the corresponding output field and the filtering rule includes: s301, matching each log template with a corresponding output field and a filtering rule, and loading the output field and the filtering rule into different variables of a template object.
In the log output process or code implementation, according to a defined log template, output fields and filtering rule fields in the log are separated and stored in different variables respectively. The output field set in the log template, the filter rule field is loaded into different variables of the template object.
Further, the loading each log template into different variables of the template object by matching the corresponding output field and the filtering rule includes: s3011, converting the output field name in each log template into data of a corresponding type, and storing the data into output variables of the log templates;
Specifically, for the log output field, the log output field is converted into a corresponding character string form according to the well-defined output field of the log template, and the character string form is stored in an output variable of the log template. [ convert the output field names in the log template into corresponding processing functions and arrange them in field order.
S3012, converting the field names of the filtering rules in each log template into corresponding types of data, and storing the data into filtering rule variables of the log templates.
Specifically, for the log filtering rule field, according to the defined filtering rule field, the filtering rule field is converted into a corresponding character string form, and the character string form is stored in a filtering rule variable of the log template. [ convert rule field names in log template to corresponding processing functions.
In some embodiments of the present invention, storing the filtered or filtered message data as one or more log records includes: s302, based on a preset log output format, the filtered or filtered message data are spliced according to a specified sequence and format and stored as one or more log records.
Specifically, according to the log output format, all the fields are spliced according to the designated sequence and format and output to a log file or other storage medium. When the output stream is overtime, firstly, outputting the log of the type when judging according to the rule fields in the log template into corresponding processing functions, if the output is needed, outputting the most value of the processing functions in the template calling output field set, and splicing the most value into a completed diary record according to the separator.
In the above embodiment, further comprising: s400, responding to the analysis request of the log and the target log template, and analyzing the log record.
Specifically, the log template is parsed, the output fields and their corresponding locations are determined, for each log data:
a. Analyzing the log data to obtain the value of the corresponding field;
b. The field value is corresponding to the output position to form a complete log;
c. storing the complete log into a cache;
d. Checking whether the cache reaches an output threshold, if so, outputting logs in all caches, and emptying the caches;
e. checking whether the time is out, if so, outputting the logs in all caches, and emptying the caches.
It should be noted that, at the end of the program, all the remaining logs are output, where the cache may be a tuple or a linked list for storing the processed logs. The output threshold may be a fixed value, such as 1000 logs, or may be dynamically adjusted according to the running state of the program, such as reducing the output threshold when the CPU load is too high, to ensure system performance. The timeout may be a fixed value, for example 5 seconds, or may be dynamically adjusted according to the actual situation. The complete log record is stored in the memory, and when the log record in the memory reaches a threshold value (the number of logs, the size of the logs and the overtime time), the data in the memory is written into the file.
Referring to fig. 2, in one embodiment of the present invention, a method for processing a log template based on DPI includes the steps of:
(1) First register the log output field, log filter rules. Log output field: content output to the log file; log filtering rules: generating a rule of the log file, registering an output field and a rule field in a HASH table, wherein key is a field name, and value is a processing function { "name": function };
(2) According to the service requirement and the log output format, a log template is defined, which comprises a log output field, a log filtering rule, a field separator, a maximum number of lines of a log, a timeout time, a maximum number of bytes of a log file and the like. The log template includes: log field separators, combinations of log output fields, log filter rules, timeout time (maximum number of lines of log, timeout time, maximum number of bytes of log file), log template name (the template content is viewed according to the template name when the program is running), etc.;
(3) In the log output code, according to the defined log template, the output field and the filtering rule field in the log are separated and respectively stored in different variables. Loading the output field set in the log template and the filtering rule field into different variables of the template object;
(4) And for the log output field, converting the log output field into a corresponding character string form according to the well-defined output field of the log template, and storing the character string form into output variables of the log template. Converting the output field names in the log template into corresponding processing functions and arranging the corresponding processing functions according to the field sequence ];
(5) And for the log filtering rule field, converting the log filtering rule field into a corresponding character string form according to the defined filtering rule field, and storing the character string form into filtering rule variables of a log template. Converting rule field names in the log template into corresponding processing functions;
(6) And finally, according to the log output format, all the fields are spliced according to the designated sequence and format and are output to a log file or other storage media. When the stream is overtime, firstly outputting the type of log according to the judgment of the rule fields in the log template into corresponding processing functions, if the type of log is required to be output, calling the template to output the processing functions in the output field set to output the most value, and splicing the template into a completed diary record according to the separator;
(7) Analyzing the log template, determining an output field and a corresponding position thereof, and for each log data:
a. Analyzing the log data to obtain the value of the corresponding field;
b. The field value is corresponding to the output position to form a complete log;
c. storing the complete log into a cache;
d. Checking whether the cache reaches an output threshold, if so, outputting logs in all caches, and emptying the caches;
e. Checking whether overtime exists, if so, outputting logs in all caches, and emptying the caches;
f. And then jumps to step a to continue processing the next log data.
(8) At the end of the program, all remaining logs are output, wherein the cache may be a tuple or a linked list for storing logs that have been processed. The output threshold may be a fixed value, such as 1000 logs, or may be dynamically adjusted according to the running state of the program, such as reducing the output threshold when the CPU load is too high, to ensure system performance. The timeout may be a fixed value, for example 5 seconds, or may be dynamically adjusted according to the actual situation. The complete log records are stored in the memory, and when the log records in the memory reach a threshold value (the number of logs, the size of the logs, and the overtime time), the data in the memory are written into the file.
Example 2
Referring to fig. 3, in a second aspect of the present invention, there is provided a log template processing apparatus 1 based on DPI, comprising: an obtaining module 11, configured to obtain a preset plurality of log output fields and a preset plurality of log filtering rules; a determining module 12, configured to determine one or more log templates based on each service requirement of the machine room link and a corresponding log output format thereof; the storage module 13 is used for screening or filtering the message data of the machine room link based on the output field and the filtering rule matched and corresponding to each log template; and storing the filtered or filtered message data as one or more log records.
Further, the device further comprises a parsing module 14, and the parsing module 14 is configured to: and responding to the analysis request of the log and the target log template, and analyzing the log record.
Example 3
Referring to fig. 4, a third aspect of the present invention provides an electronic device, including: one or more processors; and a storage means for storing one or more programs which, when executed by the one or more processors, cause the one or more processors to implement the method for handling a log template based on DPI according to the first aspect of the invention.
The electronic device 500 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 501 that may perform various appropriate actions and processes in accordance with programs stored in a Read Only Memory (ROM) 502 or loaded from a storage 508 into a Random Access Memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic apparatus 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.
The following devices may be connected to the I/O interface 505 in general: input devices 506 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; an output device 507 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 508 including, for example, a hard disk; and communication means 509. The communication means 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. While fig. 4 shows an electronic device 500 having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead. Each block shown in fig. 4 may represent one device or a plurality of devices as needed.
In particular, according to embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from a network via the communication means 509, or from the storage means 508, or from the ROM 502. The above-described functions defined in the methods of the embodiments of the present disclosure are performed when the computer program is executed by the processing device 501. It should be noted that the computer readable medium described in the embodiments of the present disclosure may be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In an embodiment of the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. Whereas in embodiments of the present disclosure, the computer-readable signal medium may comprise a data signal propagated in baseband or as part of a carrier wave, with computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.
The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device. The computer readable medium carries one or more computer programs which, when executed by the electronic device, cause the electronic device to:
Computer program code for carrying out operations of embodiments of the present disclosure may be written in one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++, python and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).
The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The foregoing description of the preferred embodiments of the invention is not intended to limit the invention to the precise form disclosed, and any such modifications, equivalents, and alternatives falling within the spirit and scope of the invention are intended to be included within the scope of the invention.
Claims (6)
1. A method for processing a log template based on DPI, comprising:
Acquiring a plurality of preset log output fields and a plurality of preset log filtering rules;
Based on each service requirement of the machine room link and the corresponding log output format, one or more log templates are determined: defining one or more log templates according to each service requirement of a machine room link and a corresponding log output format, wherein each log template comprises a field separator, a field combination, a log filtering rule, a timeout time and a log template name; the filtering rule comprises a ticket rule;
Based on the matching of each log template with the corresponding output field and the filtering rule, screening or filtering the message data of the machine room link: the method comprises the steps of carrying out flow aging on message data of a machine room link, screening or filtering the aged message data, and storing the message data as one or more log records, wherein each log template is matched with a corresponding output field and a filtering rule and is loaded into different variables of a template object, and the step of loading each log template into the different variables of the template object comprises the steps of converting the name of the output field in each log template into data of a corresponding type and storing the data into the output variables of the log template; converting the field name of the filtering rule in each log template into data of a corresponding type, and storing the data into the filtering rule variable of the log template; and splicing the filtered or filtered message data according to a specified sequence and format based on a preset log output format, and storing the message data as one or more log records.
2. The method of processing a DPI-based log template according to claim 1, further comprising: and responding to the analysis request of the log and the target log template, and analyzing the log record.
3. A log template processing apparatus based on DPI, comprising:
The acquisition module is used for acquiring a plurality of preset log output fields and a plurality of preset log filtering rules;
The determining module is used for determining one or more log templates based on each service requirement of the machine room link and the corresponding log output format of the service requirement: defining one or more log templates according to each service requirement of a machine room link and a corresponding log output format, wherein each log template comprises a field separator, a field combination, a log filtering rule, a timeout time and a log template name; the filtering rule comprises a ticket rule;
the storage module is used for screening or filtering the message data of the machine room link based on the output field and the filtering rule matched and corresponding to each log template: the method comprises the steps of carrying out flow aging on message data of a machine room link, screening or filtering the aged message data, and storing the message data as one or more log records, wherein each log template is matched with a corresponding output field and a filtering rule and is loaded into different variables of a template object, and the step of loading each log template into the different variables of the template object comprises the steps of converting the name of the output field in each log template into data of a corresponding type and storing the data into the output variables of the log template; converting the field name of the filtering rule in each log template into data of a corresponding type, and storing the data into the filtering rule variable of the log template; and splicing the filtered or filtered message data according to a specified sequence and format based on a preset log output format, and storing the message data as one or more log records.
4. The apparatus for processing a DPI-based log template according to claim 3, further comprising a parsing module configured to: and responding to the analysis request of the log and the target log template, and analyzing the log record.
5. An electronic device, comprising: one or more processors; storage means for storing one or more programs which when executed by the one or more processors cause the one or more processors to implement the method of DPI based log template processing according to any one of claims 1 to 2.
6. A computer readable medium having stored thereon a computer program, wherein the computer program when executed by a processor implements the method of DPI based log template processing according to any of claims 1 to 2.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310749725.XA CN116882379B (en) | 2023-06-21 | 2023-06-21 | Log template processing method and device based on DPI |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310749725.XA CN116882379B (en) | 2023-06-21 | 2023-06-21 | Log template processing method and device based on DPI |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN116882379A CN116882379A (en) | 2023-10-13 |
| CN116882379B true CN116882379B (en) | 2024-05-28 |
Family
ID=88268975
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310749725.XA Active CN116882379B (en) | 2023-06-21 | 2023-06-21 | Log template processing method and device based on DPI |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116882379B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102779087A (en) * | 2011-05-06 | 2012-11-14 | Sap股份公司 | Systems and methods for business process logging |
| CN114281657A (en) * | 2020-09-28 | 2022-04-05 | 华为技术有限公司 | System log collection method and device |
| CN114780361A (en) * | 2022-04-01 | 2022-07-22 | 中国工商银行股份有限公司 | Log generation method, device, computer system and readable storage medium |
-
2023
- 2023-06-21 CN CN202310749725.XA patent/CN116882379B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102779087A (en) * | 2011-05-06 | 2012-11-14 | Sap股份公司 | Systems and methods for business process logging |
| CN114281657A (en) * | 2020-09-28 | 2022-04-05 | 华为技术有限公司 | System log collection method and device |
| CN114780361A (en) * | 2022-04-01 | 2022-07-22 | 中国工商银行股份有限公司 | Log generation method, device, computer system and readable storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116882379A (en) | 2023-10-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111581291B (en) | Data processing method, device, electronic equipment and readable medium | |
| CN110928934A (en) | Data processing method and device for business analysis | |
| CN110719215A (en) | Flow information acquisition method and device of virtual network | |
| CN110908967A (en) | Method, device, equipment and computer readable medium for storing log | |
| CN117156012A (en) | Exception request data processing method, device, equipment and computer readable medium | |
| CN114125015A (en) | Data acquisition method and system | |
| CN116882379B (en) | Log template processing method and device based on DPI | |
| CN114285774B (en) | Flow recording method and device, electronic equipment and storage medium | |
| CN114648012A (en) | Bill processing method and device, electronic equipment and computer readable medium | |
| CN113760698A (en) | Method and device for converting test case file data | |
| CN114968621B (en) | Data communication method, device, equipment, storage medium and system | |
| CN115309612B (en) | Method and device for monitoring data | |
| CN117041387A (en) | Method and device for analyzing message, electronic equipment and computer readable medium | |
| CN111930704B (en) | Service alarm equipment control method, device, equipment and computer readable medium | |
| CN112988528B (en) | Log processing method, device and container group | |
| CN112579553B (en) | Method and apparatus for recording information | |
| CN111258852B (en) | Abnormal data monitoring method, device, electronic equipment and storage medium | |
| CN113420170B (en) | Multithreading storage method, device, equipment and medium for big data image | |
| CN109639686B (en) | Distributed webpage filtering method and device, electronic equipment and storage medium | |
| CN116910108A (en) | Method, device, equipment and computer readable storage medium for processing end-side data | |
| CN116932339A (en) | Service log processing method, device, electronic equipment and computer readable medium | |
| CN113688181A (en) | Data processing method and device, electronic equipment and computer readable medium | |
| CN117873609A (en) | Data processing method and device, storage medium and electronic equipment | |
| CN113407613A (en) | File analysis method and device, electronic equipment and computer readable medium | |
| CN114374745A (en) | Protocol format processing method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |