首页>
外国专利>
To support the computer network security technology to store efficiently log data while supporting queries
To support the computer network security technology to store efficiently log data while supporting queries
展开▼
机译:支持计算机网络安全技术以在支持查询的同时有效地存储日志数据
展开▼
页面导航
摘要
著录项
相似文献
摘要
A logging system includes an event receiver and a storage manager. The receiver receives log data, processes it, and outputs a data “chunk.” The manager receives data chunks and stores them so that they can be queried. The receiver includes buffers that store events and a metadata structure that stores metadata about the contents of the buffers. The metadata includes a unique identifier associated with the receiver, the number of events in the buffers, and, for each “field of interest,” a minimum value and a maximum value that reflect the range of values of that field over all of the events in the buffers. A chunk includes the metadata structure and a compressed version of the contents of the buffers. The metadata structure acts as a search index when querying event data. The logging system can be used in conjunction with a security information/event management (SIEM) system.
展开▼