WO2016177047A1

WO2016177047A1 - Log display method and device

Info

Publication number: WO2016177047A1
Application number: PCT/CN2016/075217
Authority: WO
Inventors: 黄媛媛; 汪德彬; 李庆; 罗波
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-08-06
Filing date: 2016-03-01
Publication date: 2016-11-10
Also published as: CN106445943A; CN106445943B

Abstract

A log display method and device. The log display method comprises: hierarchically and statistically analyzing obtained logs to obtain a statistical result (S101); adding the statistical result to a sunburst chart (S102); and displaying the statistical result by utilizing the sunburst chart (S103). The method provides a more intuitive way to present log-related data and a convenient operation mode for audit analysis by hierarchically and statistically analyzing the obtained logs to obtain a statistical result and adding the statistical result to a sunburst chart so as to utilize the sunburst chart to display the statistical result.

Description

Method and device for displaying log

Technical field

This document relates to the field of log management technology, and in particular to a method and device for displaying logs.

Background technique

At present, the log management system in the government, enterprise, and network management fields has the following problems:

(1) Most log management systems do not have statistical functions, and generally use tables to present log query results;

(2) For a small number of log management systems that support statistical functions, the statistical results are only displayed by the numbers in the table. The results are not intuitive. Users need to carefully check the data to be able to perceive the statistical results. Moreover, the statistics only have logs. The quantity information, the periodic trend of the log is not seen, and it is inconvenient for the log audit analysis;

(3) The statistics function and the query function are separated. After viewing the statistics data on the statistics interface, if you want to view the log records corresponding to the statistics, you need to return to the query interface, set the corresponding query conditions to query the logs, and the operation steps are many. And cumbersome;

(4) The statistical results of the related art log management system are flat and have no hierarchical relationship. If it is necessary to analyze whether a user's operation has an abnormality, it is necessary to analyze the user first, and then analyze all operations performed by the user, and the analysis efficiency is low. .

Summary of the invention

The object of the present invention is to provide a log display method and device, which can provide more intuitive log data and more convenient operation mode for audit analysis.

In order to achieve the above objectives, the following technical solutions are adopted:

A method of displaying logs, including:

Perform hierarchical statistics on the obtained logs to obtain a statistical result;

Adding the statistical result to a rising sun chart;

The statistical results are displayed using the sunburst map.

Optionally, the statistical result obtained by hierarchically collecting the obtained logs is organized according to a json string, wherein each json object represents a log type, and statistics of the lowest log type of the log are obtained. Is the number of logs counted by day.

Optionally, the sunburst map is a multi-layer hollow pie chart based on D3 technology, the level of which corresponds to the level of the log, and the sector area in each layer corresponds to the log type;

The step of adding the statistical result to a sunburst chart includes: dividing, according to the statistical result, a hierarchy of the sunburst map, a number of sector regions in each layer, and a size of each sector region; After the division is completed, the statistical results are respectively added to the corresponding sector regions.

Optionally, the step of displaying the statistical result by using the sunburst map comprises:

After a sector area is selected, the number of logs of the log type corresponding to the sector area is obtained;

Calculating the ratio of the number of logs to the total number of logs, and obtaining a proportional result;

A log type corresponding to the sector area and the scale result are displayed.

After a sector area is selected, the number of logs of the log type corresponding to the sector area is obtained every day;

And generating, according to the number of logs of the log type corresponding to the sector area, the number of logs of the log type corresponding to the sector area of each day;

The histogram is displayed.

After a sector area is selected, a query condition is generated, where the query condition is a log type corresponding to the sector area;

Displays all logs related to the query criteria.

After selecting a sector area, the sector area and the sector area of the upper layer are treated as highlights, and other sector areas are faded; and/or

The hierarchical path information of the sector area is displayed, and the hierarchical path information is a log type corresponding to the sector area and an upper layer log type thereof.

Optionally, the log is an operation log, a security log, or a system log.

A log display device includes a statistics module, an add module, and a display module, wherein

The statistic module is configured to: perform hierarchical statistics on the obtained logs to obtain a statistical result;

The adding module is configured to: add the statistical result to a sunburst chart;

The display module is configured to: display the statistical result by using the sunday map.

The adding module includes a dividing submodule and an adding submodule, wherein:

The dividing sub-module is configured to: according to the statistical result, divide a hierarchy of the sunburst map, a number of sector regions in each layer, and a size of each sector region;

The adding submodule is configured to: after the dividing submodule is divided, add the statistical result to the corresponding sector area.

Optionally, the display module includes a first acquisition module, a calculation module, and a first display module, where

The first obtaining module is configured to: after selecting a sector area, obtain a log quantity of a log type corresponding to the sector area;

The calculating module is configured to: calculate a ratio of the number of logs to a total number of logs, to obtain a proportional result;

The first display module is configured to display a log type corresponding to the sector area and the proportional result.

Optionally, the display module includes a second acquisition module, a first generation module, and a second display module, where

The second obtaining module is configured to: after selecting a sector area, obtain a log quantity of a log type corresponding to the sector area every day;

The first generating module is configured to: generate a histogram according to the number of logs of the daily log type corresponding to the sector area, wherein the histogram is used to represent each day and the sector The number of logs of the log type corresponding to the zone;

The second display module is configured to display the histogram.

Optionally, the display module includes a second generation module and a third display module, where

The second generation module is configured to: after selecting a sector area, generate a query condition, where the query condition is a log type corresponding to the sector area;

The third display module is configured to display all logs related to the query condition.

Optionally, the display module includes a processing module and a fourth display module, where

The processing module is configured to: after selecting a sector area, process the sector area and the sector area of the upper layer to be highlighted, and other sector areas to be faded; and/or

The fourth display module is configured to: display hierarchical path information of the sector area, where the hierarchical path information is a log type corresponding to the sector area and an upper layer log type.

Optionally, the log is an operation log, a security log, or a system log.

Through the above technical solutions of the present invention, the beneficial effects of the present invention are:

The method and device for displaying the log of the technical solution of the present invention obtains a statistical result by hierarchically collecting the obtained log, and adds the statistical result to a sunburst chart to use the sunburst chart to compare the statistics. The results are displayed, which can provide more intuitive log data and more convenient operation mode for audit analysis. At the same time, the statistical results are more intuitive, not only reflecting the log level and log trend, but also obtaining corresponding query results. More sexual.

BRIEF abstract

FIG. 1 is a flow chart showing a method for displaying a log according to an embodiment of the present invention.

FIG. 2 is a schematic structural diagram of a log display apparatus according to an embodiment of the present invention.

Figure 3 is a diagram showing the results of an operation log of a specific embodiment of the present invention.

Figure 4 is a diagram showing a sunburst of a specific embodiment of the present invention.

Preferred embodiment of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The specific embodiments will be described in detail below with reference to the accompanying drawings.

As shown in FIG. 1 , an embodiment of the present invention provides a method for displaying a log, which is used in a log management system, and includes:

S101: Perform hierarchical statistics on the obtained logs to obtain a statistical result.

S102: Add the statistical result to a sunburst chart;

S103: Display the statistical result by using the sunburst chart.

The method for displaying the log in the embodiment of the present invention obtains a statistical result by hierarchically collecting the obtained log, and adds the statistical result to a sunburst chart to perform the statistical result by using the sunday chart. Demonstration can provide more intuitive log-related data and more convenient operation for audit analysis.

In actual applications, the logs to be managed are generally operation logs, security logs, or system logs. Specifically, when the log is an operation log, the step of performing hierarchical statistics on the obtained log includes: performing statistics on the acquired logs according to three levels: level, operation, and command code; when the log is secure In the case of the log, the step of performing hierarchical statistics on the obtained logs includes: performing statistics on the acquired logs according to the user and the log name; and when the logs are system logs, the obtained logs are classified. The step of layer statistics includes: counting the acquired logs according to the level, the log source, and the log name. However, the present invention is not limited thereto, and an appropriate selection can be made according to requirements.

In a specific embodiment of the present invention, the statistical result obtained by hierarchically counting logs is organized according to a json string, wherein each json object represents a log type, and statistics of the lowest log type of the log The result is not the total number of logs, but the number of logs counted by day, based on time conditions.

In the following, an operation log is taken as an example to introduce the specific form of the statistical result. The operation log is counted according to three levels: level, operation, and command code. The time condition is the operation log of the last 7 days, and the statistical result of the lowest log type is an array of length 7.

Specifically, the obtained statistical results are organized in the form of json strings, as shown in Table 1:

Table 1

According to Table 1 above, it can be known that:

The first layer log type of the statistical result of the operation log includes level 4 and level 3;

At level 4, the second layer of log types includes polling management and modifying topology objects; under polling management, the third (lowest) log type includes an operation polling task interface, and the operation polling task interface The statistical result is an array of length [5, 10, 30, 13, 5, 9, 6]; at the same time, under the modified topology object, the third layer log type includes modifying the topology node and modifying the topology link, and its statistics The results are [1,1,3,3,5,7,6] and [15,10,3,1,5,9,6];

In level 3, the second layer of log types includes role management. Under role management, the third layer of log types includes new roles and modified roles. The statistics are [5,6,3,1,6,15,3 respectively. ] and [10,1,0,13,5,6,0].

In a specific embodiment of the present invention, the sunburst map is a multi-layer hollow pie chart based on the D3 technology, the level of which corresponds to the level of the log, and the sector area in each layer corresponds to the log type for effective display. statistical results. The D3 technology is a JavaScript library based on data manipulation documents that makes the display of data more vivid by using HTML, SVG and CSS technologies.

Based on the above-mentioned sunburst chart, the steps of adding the statistical result to a sunburst chart include:

According to the statistical result, the hierarchy of the sunburst chart, the number of sector regions in each layer, and the size of each sector region are divided;

After the division is completed, the statistical results are respectively added to the corresponding sector regions.

In order to fully display the statistical result, in the specific embodiment of the present invention, each sector area may be set to a certain extent. When a sector area is selected, statistical results related to the log type corresponding to the sector area may be displayed. For example, the number of logs of the log type corresponding to the sector area accounts for the ratio of the total number of logs, the daily change of the number of logs of the log type corresponding to the sector area, and the like.

The certain setting is, for example, adding a mouse hover event to each sector, and when the mouse is stuck in a sector, the sector is selected, that is, a trigger event.

Based on the above content, the step of displaying the statistical result by using the sunburst map includes:

A log type corresponding to the sector area and the scale result are displayed.

The log type corresponding to the sector area and the proportional result are, for example, displayed in a hollow position of the sunburst map for the user to know.

Specifically, the step of displaying the statistical result by using the sunburst map may further include:

The histogram is displayed.

In this way, through the histogram, it is possible to know the daily change and trend of the log number of the log type corresponding to the sector area. The histogram is displayed, for example, on the right side of the sunburst chart, which is convenient for the user to observe.

Displays all logs related to the query criteria.

In this way, the statistics function and the query function are associated, and all related logs can be queried in the statistics interface to avoid returning to the query interface. The query result is displayed, for example, below the sunburst chart, so that the user can know the result of the query.

In this way, by highlighting and desalination processing, as shown in FIG. 4, it can achieve a striking effect and is convenient for the user to know. The hierarchical path information of the sector area is displayed, for example, by breadcrumbs below the sunburst map, and the ratio information of the log type of the log type corresponding to the sector area and the total number of logs may be displayed on the breadcrumbs. position.

Referring to Figure 3, there is shown a graph showing the results of an operation log of a specific embodiment of the present invention. In the result graph of Fig. 3, in addition to the sunburst map on the left side, the result of the log type "query user and department" log count as the total number of logs is displayed in the hollow position of the sunburst chart, in the sunburst chart On the right side, the histogram shows the daily change of the log type of the query type "Query User and Department" in the last 30 days. The query result of the query condition is "Query User and Department" is displayed in the table below the Rising Sun chart. Under the sunburst chart, the hierarchical path information corresponding to "query user and department" is displayed by breadcrumbs. Through the above display content, the statistical results are more intuitive. It not only reflects the level of the log and the trend of the log, but also obtains the corresponding query results, which is more practical.

As shown in FIG. 2, the embodiment of the present invention further provides a log display device, which is used in the log management system, and corresponds to the log display method of FIG.

The statistics module 21 is configured to: perform hierarchical statistics on the obtained logs to obtain a statistical result;

The adding module 22 is configured to: add the statistical result to a sunburst chart;

The display module 23 is configured to: display the statistical result by using the sunday map.

The log display device of the embodiment of the present invention obtains a statistical result by hierarchically collecting the obtained log, and adds the statistical result to a sunburst chart to perform the statistical result by using the sunburst chart. Demonstration can provide more intuitive log-related data and more convenient operation for audit analysis.

In actual applications, the logs to be managed are generally operation logs, security logs, or system logs.

In a specific embodiment of the present invention, the statistical result obtained by hierarchically counting logs is organized according to a json string, wherein each json object represents a log type, and the statistical result of the lowest level type of the log It is not the total number of logs, but the number of logs counted by day based on time conditions.

Specifically, the sunburst map is a multi-layer hollow pie chart based on the D3 technology, the level of which corresponds to the level of the log, and the fan-shaped area in each layer corresponds to a log type; the adding module includes:

Dividing the sub-module, the method is: dividing, according to the statistical result, a hierarchy of the sunburst map, a number of sector regions in each layer, and a size of each sector region;

Add a submodule, and set it to: after the division is completed, add the statistical result to the corresponding sector area.

Based on the above content, the display module includes:

a calculation module, configured to: calculate a ratio of the number of logs to a total number of logs, to obtain a proportional result;

The first display module is configured to: display a log type corresponding to the sector area and the scale result.

Specifically, the display module further includes:

a first generating module, configured to: generate a histogram according to the number of logs of the log type corresponding to the sector corresponding to the daily, the histogram is used to indicate a log type corresponding to the sector area of each day Number of logs;

The second display module is configured to: display the histogram.

Specifically, the display module further includes:

The third display module is configured to: display all logs related to the query condition.

Specifically, the display module further includes:

The processing module is configured to: after selecting a sector area, process the sector area and the sector area of the upper layer to be highlighted, and the other sector areas are desalination; and/or

The embodiment of the invention further discloses a computer program, comprising program instructions, when the program instruction is executed by the terminal, so that the terminal can execute the display method of any of the foregoing logs.

The embodiment of the invention also discloses a carrier carrying the computer program.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve. Thus, the invention is not limited to any specific combination of hardware and software.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When each device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Variations or substitutions are readily conceivable within the scope of the present invention by those skilled in the art and are within the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Industrial applicability

The method and device for displaying the log of the technical solution of the present invention obtains a statistical result by hierarchically collecting the obtained log, and adds the statistical result to a sunburst chart to use the sunburst chart to compare the statistics. The results are displayed, which can provide more intuitive log data and more convenient operation mode for audit analysis. At the same time, the statistical results are more intuitive, not only reflecting the log level and log trend, but also obtaining corresponding query results. It is more sexual, so the invention has strong industrial applicability.

Claims

A method of displaying logs, including:

Perform hierarchical statistics on the obtained logs to obtain a statistical result;

Adding the statistical result to a rising sun chart;

The statistical results are displayed using the sunburst map.
The method for displaying a log according to claim 1, wherein the statistical result obtained by hierarchically collecting the obtained logs is organized according to a json string, wherein each json object represents a log type. The statistical result of the lowest log type of the log is the number of logs counted by day.
The method of displaying a log according to claim 1, wherein

The sunburst map is a multi-layer hollow pie chart based on D3 technology, the level of which corresponds to the level of the log, and the sector area in each layer corresponds to the log type;

The step of adding the statistical result to a sunburst chart includes: dividing, according to the statistical result, a hierarchy of the sunburst map, a number of sector regions in each layer, and a size of each sector region; After the division is completed, the statistical results are respectively added to the corresponding sector regions.
The method for displaying a log according to claim 3, wherein the step of displaying the statistical result by using the sunburst map comprises:

After a sector area is selected, the number of logs of the log type corresponding to the sector area is obtained;

Calculating the ratio of the number of logs to the total number of logs, and obtaining a proportional result;

A log type corresponding to the sector area and the scale result are displayed.
The method for displaying a log according to claim 3, wherein the step of displaying the statistical result by using the sunburst map comprises:

After a sector area is selected, the number of logs of the log type corresponding to the sector area is obtained every day;

And generating, according to the number of logs of the log type corresponding to the sector area, the number of logs of the log type corresponding to the sector area of each day;

The histogram is displayed.
The method for displaying a log according to claim 3, wherein the step of displaying the statistical result by using the sunburst map comprises:

After a sector area is selected, a query condition is generated, where the query condition is a log type corresponding to the sector area;

Displays all logs related to the query criteria.
The method for displaying a log according to claim 3, wherein the step of displaying the statistical result by using the sunburst map comprises:

After selecting a sector area, the sector area and the sector area of the upper layer are treated as highlights, and other sector areas are faded; and/or

The hierarchical path information of the sector area is displayed, and the hierarchical path information is a log type corresponding to the sector area and an upper layer log type thereof.
The method for displaying a log according to claim 1, wherein the log is an operation log, a security log, or a system log.
A log display device includes a statistics module, an add module, and a display module, wherein

The statistic module is configured to: perform hierarchical statistics on the obtained logs to obtain a statistical result;

The adding module is configured to: add the statistical result to a sunburst chart;

The display module is configured to: display the statistical result by using the sunday map.
The log display apparatus according to claim 9, wherein the statistical result obtained by hierarchically collecting the acquired logs is organized according to a json string, wherein each json object represents a log type, The statistical result of the lowest log type of the log is the number of logs counted by day.
The log display device according to claim 9, wherein

The sunburst map is a multi-layer hollow pie chart based on D3 technology, the level of which corresponds to the level of the log, and the sector area in each layer corresponds to the log type;

The adding module includes a dividing submodule and an adding submodule, wherein:

The dividing sub-module is configured to: according to the statistical result, divide a hierarchy of the sunburst map, a number of sector regions in each layer, and a size of each sector region;

The adding submodule is configured to: after the dividing submodule is divided, add the statistical result to the corresponding sector area.
The display device of the log according to claim 11, wherein the display module comprises a first acquisition module, a calculation module and a first display module, wherein

The first obtaining module is configured to: after selecting a sector region, acquire the sector region The number of logs corresponding to the log type;

The calculating module is configured to: calculate a ratio of the number of logs to a total number of logs, to obtain a proportional result;

The first display module is configured to display a log type corresponding to the sector area and the proportional result.
The display device of the log according to claim 11, wherein the display module comprises a second acquisition module, a first generation module and a second display module, wherein

The second obtaining module is configured to: after selecting a sector area, obtain a log quantity of a log type corresponding to the sector area every day;

The first generating module is configured to: generate a histogram according to the number of logs of the daily log type corresponding to the sector area, wherein the histogram is used to represent a log corresponding to the sector area of each day The number of logs of the type;

The second display module is configured to display the histogram.
The display device of the log according to claim 11, wherein the display module comprises a second generation module and a third display module, wherein

The second generation module is configured to: after selecting a sector area, generate a query condition, where the query condition is a log type corresponding to the sector area;

The third display module is configured to display all logs related to the query condition.
The display device of the log according to claim 11, wherein the display module comprises a processing module and a fourth display module, wherein

The processing module is configured to: after selecting a sector area, process the sector area and the sector area of the upper layer to be highlighted, and other sector areas to be faded; and/or

The fourth display module is configured to: display hierarchical path information of the sector area, where the hierarchical path information is a log type corresponding to the sector area and an upper layer log type.
The log display apparatus according to claim 9, wherein the log is an operation log, a security log, or a system log.