基于事件聚集的AAA系统日志分析  

Log Analysis of AAA System based on Event Clustering

作　　者：罗伟[1] 卓琳[2] 孙旭辉 

机构地区：[1]国防科技大学计算机学院 [2]长沙大学 [3]71155部队

出　　处：《计算机安全》2014年第12期17-20,共4页Network & Computer Security

摘　　要：AAA系统涉及的设备类型众多,其日志格式互不相同,即使是同一类设备,其日志格式也会因软件版本、网络层次和故障类型等因素而各不相同,从而导致通过分析日志数据分析系统故障非常复杂。首先提出了一种日志模板自动提取机制(ATE,Auto Template Extraction),用于将各类日志数据格式化。然后设计了一种基于故障事件对格式化日志数据进行聚集的方法(EBCo LD,Event Based Cluster of Log Data),用于分析各类故障事件(数据库宕机等)与日志数据的关系,进而获取与某一事件相关的日志集合,用于故障检测、定位和分析。最后依据从某电信运营商获取的真实AAA系统日志数据,通过仿真实验验证了ATE机制和EBCo LD方法的有效性。AAA systems are constituted by kinds of devices which generate log files with different structures of software version, net layer and fault type, even the same type of devices will generate different log files locating based on log files. An auto template extraction method log files, we design an event based clustering of log data met Because of the differences which leads to hard fault . And based on formative tween fault event And log ng and analyzing. Lastly, data is detected. The log items which are related to one fault event are assembled to fault detecting,locating and analyzing. Lastly,the effectiveness of the ATE and EBCoLD is wildated by simulation based on the real log data of one ISP.

关 键 词：AAA系统 日志分析 模板提取 事件聚集 

分 类 号：TP274.2[自动化与计算机技术—检测技术与自动化装置]