KR102189125B1 - System and method for collecting log - Google Patents

Abstract

In the present invention, logs generated in a large amount are defined as actions and processed in a standardized form, and the continuity of actions is defined as a rule to detect abnormal access, suitable for artificial intelligence learning, and capable of processing at high speed. It is an object of the present invention to provide an action-based rule processing apparatus and a processing method thereof.
In order to achieve the above object, the log collection system according to the present invention is a log collection system that responds to requests from a plurality of users, and is created to respond to a result of executing an application for the request. ), and a hooked servlet that stores information on the user's request in the thread, and when requesting a job to the database, information on the request stored using the thread and the job requested to the database It includes a hooked database interface that stores information together.

Description

Log collection system and its collection method {SYSTEM AND METHOD FOR COLLECTING LOG}

The present invention relates to a log collection system and a method for collecting the same, and more particularly, to a log collection system capable of modulating a loaded class without modifying a source code or replacing a file, and a method of collecting the same.

A general web server is a server that processes static data such as images and HTML files. On the other hand, WAS (Web Application Server) is a server that combines a web server (static data processing) and a web container (dynamic data processing) and processes dynamic data (jsp, asp, Servlet, php, etc.) as well as static data. It is connected with a DB (database) to exchange data or perform data manipulation with a program.

That is, the initial web server processed only static data, but as the web server was gradually used, a dynamic function of inputting and searching data in the web server was required. WAS, which meets these needs, provides a program execution environment and a DB connection function, manages multiple transactions, and executes business logic that processes tasks.

By the way, the Http Access log output from WAS and the DB log output from DB are created by one user action. For example, when a user clicks the login button, both the log accessing the Http Access login page (Http Access log) and the login comparison log (DB log) created in the user table of the DB are generated by one user action. do.

However, there was a problem that the Http Access log and the DB log could not be checked all at once due to the form of logs that are left respectively. In other words, there was a problem of not knowing what Http Access log is paired with the DB log.

In order to solve this problem, it is necessary to directly modify the source code in the application (site) of Was, but this has a problem in that the source code must be directly modified in each of the numerous pages of the application.

In addition, modification of the source code of such an application cannot be entrusted to a third party for security reasons, and there is a problem that the manager who operates this application cannot consume manpower and cost to modify the source code.

Accordingly, the present invention has been proposed to meet the above requirements, and its purpose is to modify the source code of the application or replace the file by modifying the byte code in the binary state before the class loader sends the binary of the class. It is to provide a log collection system and a method of collecting the log that can tamper with the class loaded without doing so.

In order to achieve the above object, the log collection system according to the present invention is a log collection system that responds to requests from a plurality of users, and is created to respond to a result of executing an application for the request. ), and a hooked servlet that stores information on the user's request in the thread, and when requesting a job to the database, information on the request stored using the thread and the job requested to the database It includes a hooked database interface that stores information together.

In addition, in the log collection system according to the present invention, the thread has each TLS (Thread Local Storage) for the user's request, and the hooked servlet stores information about the request in the TLS.

In addition, in the log collection system according to the present invention, the hooked database interface accesses the TLS of the corresponding thread, fetches information on the request, and stores the requested information in the database together.

Meanwhile, in order to achieve the above object, the log collection method according to the present invention is a log collection method that responds to a request of a plurality of users, and requests from a plurality of users are respectively sent to a WAS (Web Application Server). The first step (S10) of transmitting, the second step (S20) of executing the hooked servlet corresponding to the request by creating a thread by the WASS, and the hooked servlet to the thread in response to the user's request A third step (S30) of storing information about the hooked servlet, and a fourth step (S40) of requesting a job from the database through a hooked database interface if necessary according to the request while the application of the hooked servlet is operating, and the And a fifth step (S50) of storing the information on the request stored using the thread in the hooked database interface and information on the job requested in the database.

In addition, in the log collection method according to the present invention, the thread has each TLS (Thread Local Storage) for each request of the user, and the hooked servlet stores information about the request in the TLS.

In addition, in the log collection method according to the present invention, the hooked database interface accesses the TLS of the corresponding thread, fetches information on the request, and stores the requested information in the database together.

According to the present invention, before the class loader sends the binary of the class, it is possible to modify the source code of the application by modifying the byte code in the binary state or modulate the loaded class without replacing the file.

1 is a system configuration diagram showing the overall configuration of a log collection system according to the present invention.
2 is a diagram showing the structure of a class loader in the log collection system according to the present invention.
3 is a view showing a processing state of a class loader in the log collection system according to the present invention.
4 is a view showing a processing state of the log collection system according to the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the related drawings.

1 is a system configuration diagram showing the overall configuration of a log collection system according to the present invention.

Referring to FIG. 1, the log collection system 1000 according to the present invention is a log collection system 1000 that responds to requests from a plurality of users 10. The log collection system 1000 includes a thread (Thread: 110), a hooked servlet (122), and a WASS (Web Application Server: 100) having a hooked database interface (Hooked Database Interface: 130), Includes database 200.

In general, the thread 110 is an execution path that exists inside a process when a computer program is executed, that is, a series of execution codes, and is in charge of actual work. When creating a process, one main thread is created to handle most of the work, and when the main thread is terminated, the process is also terminated. Multitasking is an environment in which multiple processes are executed simultaneously in one operating system, and multithreading is when multiple threads are simultaneously executed in one process. In the present invention, such a thread is created to respond to a result of executing the application 121 to the request of the plurality of users 10. These threads 110 communicate with the washers 100 within the washers 100. In addition, in the thread 110, a plurality of threads 110 are formed according to a plurality of users 10, respectively. That is, when the number of users 10 is 100, 100 threads 110 are generated, one for each of 100 users 10.

The hooked servlet 122 serves to store information on the request of the user 10 in the thread 110. When the user 10 requests resource information (for example, page information, login information, application information, etc.) to the wash 100, the general servlet 120 stores the information on the request in the thread 110 do. In addition, database information stored in the database 200 is called when necessary. At this time, it is not known which access log of the general servlet is matched, that is, which user 10 requests, and to solve this problem, the application 121 is modified. Through the application 121, the access log and the database log must be matched to generate one application log. However, in the log collection system 1000 according to the present invention, the thread 110 has each TLS (Thread Local Storage) for the user 10 request, and the hooked servlet 122 is the TLS of the thread 110 To store information on the request of the user 10. Here, TLS is an independent space each thread 10 has.

In addition, when the hooked servlet 122 requests a job to the database 200, the hooked database interface 130 includes information on the request of the user 10 stored using the thread 110 and the database 200. ) And stores the information on the task requested in the thread 110 together. That is, the hooked servlet 122 stores information on the request of the user 10 in the TLS generated by the thread 122, and when the information of the database 200 is required, the hooked database interface 130 is hooked. The requested information is stored in the database 200 by accessing the TLS of the thread 110 corresponding to the user 10 making the request to the servlet 122, calling information on the request of the user 10, and storing the requested information in the database 200. Accordingly, information on the request of the user 10 stored by the hooked servlet 122 in TLS of one thread 110 generated by one user 10 among the plurality of users 10, and Since the information requested by the hooked database interface 130 is stored together with the database 200, the contents of the access log and the contents of the database log are not matched by modifying the application in the general wash 100, but through hooking. When the module actually operates, the hooked servlet 122 and the hooked database interface 130 are detected and recorded. That is, by using the thread 110 as a key value in the TLS of the thread 110, the request information of the user 10 is stored, and then the thread 110 information is stored in the hooked database interface 130. In TLS, the request information of the user 10 is called and logged together with the query information of the database.

This TLS is an independent space each thread 110 has, and when the user 10 makes a request to the wash 100, one thread 110 must be allocated and operated, so that the hooked in the initial hooking process The servlet 122 stores the request information in TLS. After that, when a log target method (function) such as HttpAccess or database interface access is called, it is mapped with the request information stored in TLS and recorded as a log.

2 is a diagram showing the structure of a class loader in the log collection system according to the present invention.

Referring to FIG. 2, in the log collection system 1000 according to the present invention, it is possible to modulate a class loaded without modifying the application 121 or replacing a file. The basic class loader structure is a structure for class loading by passing the binary (3), which is a byte array of a jar file or a single class file (1), to the JVM (Java Virtual Machine: 4). Here, the class loader is as follows. In Java, a program is composed of a file called a class, and the module that reads these classes is called a class loader, and the class loader is basically installed in the JVM.

In the present invention, the class loader 2 of the hooking module performing hooking is performed by modifying the byte code (role like an assembly) in the binary 3 state just before giving the binary to the JVM 4, the actual application 121 The loaded class can be altered without modifying the source code of the file or replacing the file.

3 is a diagram showing a processing state of a class loader in the log collection system according to the present invention.

In the basic booting process of the general Was (100), the class loader of the JVM (4) loads and executes the Jar File responsible for the initial execution of the Was (100), and the Jar File of the Was (100) is the core class and the 100)'s custom class loader is loaded. After that, the custom class loader loads applications (eg, sites, etc.) and plug-ins (JDBC, Graphic Library), and the WAS 100 operates. That is, in the basic booting process of the Was (100), the class loader of the JVM (4) loads and executes the first execution Jar File (1) of the Was (100), and the Jar File (1) of the Was (100) is The core class and the custom class loader of the WAS 100 are loaded (7). After that, the custom class loader loads 9 applications (sites) and plug-ins (JDBC, Graphic Library), and the WAS 100 operates.

However, as shown in FIG. 3, in the log collection system 1000 according to the present invention, the washer 100 is executed using a hooking module without direct modification. The class loader 5 has a mechanism using a parent class loader. That is, the lower class loader uses the upper class loader. Based on this, the Was 100 is executed through the class loader of the hooking module so that the base class loader of the Was 100 becomes the class loader 5 of the hooking module, and the Was 100 is a custom class loader used internally. (7) Operates as a hooking class loader through byte code patching. Accordingly, applications and plug-ins (JDBC, Graphic Library: 9) loaded by the WAS 100 can be modified in the middle of the runtime (in the middle of execution).

4 is a diagram showing a processing state of the log collection system according to the present invention.

The log collection method according to the present invention is performed by a total of five steps.

As a log collection method for performing a response to a request of a plurality of users 10, in a first step (S10), each request of the plurality of users 10 is transmitted through a plurality of threads 110, To each pass. That is, since the request of one user 10 is transmitted to the washout 100 through one thread 110, for example, in order for each request of the 100 users 10 to be transferred to the washout 100, 100 Three threads 110 are created. At this time, the thread 110 has each TLS (Thread Local Storage) for each request of the user 10.

In the second step (S20), the washer 100 creates the thread 110 to execute the hooked servlet 122 corresponding to the request of the user 10.

In addition, in the third step (S30), information on the request of the user 10 is stored in the TLS of the thread 110 by the hooked servlet 122. That is, the hooked servlet 122 stores information about the request in TLS.

In the fourth step (S40), the application 121 of the hooked servlet 122 requests a job from the database 200 through the hooked database interface 130 when necessary according to a request during operation.

In the fifth step (S50), information on the request of the user 10 and the information on the job requested to the database 200 are stored together with the information on the request of the user 10 stored using TLS of the thread 110 in the hooked database interface 130. That is, the hooked database interface 130 accesses the TLS of the corresponding thread 110, calls the information on the request, and stores the requested information in the database together.

This TLS is an independent space each thread 110 has, and when the user 10 makes a request to the wash 100, one thread 110 must be allocated and operated, so that the hooked in the initial hooking process The servlet 122 stores the request information in TLS. After that, when a log target method (function) such as HttpAccess or database interface access is called, it is mapped with the request information stored in TLS and recorded as a log.

That is, the log collection system 1000 according to the present invention utilizes the TLS of the thread 110 and stores it in the TLS structure in a (Key: Thread, Value: Request) structure. Accordingly, an access log for the request of the user 10 is generated. Thereafter, TLS is searched using the thread information of the user 10 as a key value, and a database log is transmitted to the logging interface, as in the request information of the user 10.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains will be able to make various modifications and variations without departing from the essential characteristics of the present invention. Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain the technical idea, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

10: user
100: was
110: thread
120: servlet
121: application
122: hooked servlet
130: hooked database interface
200: database
1000: log collection system

Claims (6)

As a log collection system that responds to requests from multiple users,
A thread created to respond to the result of executing the application for the request, and
A hooked servlet that stores information on the user's request in the thread,
When requesting a job to a database, it includes a hooked database interface that stores information on the request stored using the thread and information on the job requested in the database together,
Execute WAS through the class loader of the hooked servlet to make the base class loader of the Was the class loader of the hooked servlet,
A log collection system that enables the custom class loader used in the WAS to operate as a hooking class loader through byte code patching. The method of claim 1,
The thread has each TLS (Thread Local Storage) for the user's request,
The hooked servlet is a log collection system that stores information on the request in the TLS. The method of claim 2,
The hooked database interface accesses the TLS of a corresponding thread, calls information on the request, and stores the requested information in the database together. As a log collection method that responds to requests from multiple users,
A first step (S10) of transmitting a request of a plurality of users to WAS (Web Application Server), respectively,
A second step (S20) of executing the hooked servlet corresponding to the request by creating a thread by the WASS;
A third step (S30) of storing information on the user's request in the thread by the hooked servlet,
A fourth step (S40) of requesting an operation from the database through the hooked database interface when the application of the hooked servlet is required according to the request during operation;
A fifth step (S50) of storing together information on the request stored using the thread in the hooked database interface and information on the operation requested in the database,
Execute the was through the class loader of the hooked servlet to make the base class loader of the was a class loader of the hooked servlet,
A log collection method in which the custom class loader used in WAS operates as a hooking class loader through byte code patching. The method of claim 4,
The thread has a respective TLS (Thread Local Storage) for each request of the user,
The hooked servlet logs collection method for storing information on the request in the TLS. The method of claim 5,
The hooked database interface accesses the TLS of the corresponding thread, calls information on the request, and stores the requested information in the database together.

Images