The Design And Realization Of Log Parsing System

In recent years, with the rapid development of computer technology, information technology and other high-tech advances, the world has entered the information age. Network openness has both increased inter connectivity and degree of sharing and made network security issues increasingly important. Information security problem is not only related to the country’s economic security, financial security, but also to the country’s national security and cultural security. Relative to the firewall, log parsing technology is a means of network information security in recent years used for further assurance. With the improvement of network security requirements, log parsing technology is more and more mature.Based on elaborating the SOC domestic and international situation and key technologies, this essay provides a systematic analysis on the demand for system log structure parsing. Using Java language, applying XML technology and using MYSQL database, this essay designs and realizes the system of log parsing functions, including log collection, log aggregation, log filtering, log recognition, log formatting, log transmission and other processes. On the problem of limitation of types of log identification and apportionment, this essay, using the XML structure formatted parsing script, makes the script and the program itself separable, higher expansion ability and more simple and clear structure, which makes it easy to increase the analytic log type. System test results show the correctness of the design, stable operation of the program, meet the actual demand. But for some rare type of device logs this system may not support, which requires further modification on the corresponding log parsing script.By normalizing massive log information, this system can generate alarm events to facilitate system administrators understand and make timely coping strategies, provide faster, better, more accurate solution to security incidents, improve system security, and enhance the network security management of enterprises.