KR20130014841A - Method for automatically completing a search equation of log and system for performging the method - Google Patents

Abstract

Disclosed are a log search type autocomplete method for performing a log search operation by completing a log search expression only by operating a computer mouse, and a system for performing the same. The display control unit displays the log search view on the display screen. The search word existence checker checks whether a search word pre-entered in the search window is present as the target field is double-clicked by the analyst in the log search view. Log search formula completion unit if the search word entered in the search box does not exist, enter the search word in the search box, if the search word entered in the search box is checked, the operator set by the analyst Add after the entered search word and add new double clicked search word to complete the log search expression. The search execution unit executes a search of log data using the completed log search expression and displays the log search results in the log search view. Accordingly, as the target field is double-clicked in the log search view in which the log data is displayed, the search word entered in the corresponding field is entered in the search box or the set operator is added, and then the search word entered in the corresponding field is inputted. By completing the log search expression, it is possible to perform the log search operation by completing the log search expression only by operating the computer mouse.

Description

METHOD FOR AUTOMATICALLY COMPLETING A SEARCH EQUATION OF LOG AND SYSTEM FOR PERFORMGING THE METHOD}

The present invention relates to a log-search type autocomplete method and a system for performing the same. More specifically, the log-search type auto-complete method for performing a log search operation by completing a log search expression only by operating a computer mouse and performing the same. It relates to a system for doing so.

In general, a logfile can be expressed as a record of all operations performed by the server. When a user connects to the server, all subsequent tasks remain in the form of a log file at a predetermined location on the server. That is, the log file contains information about the operations performed by the server. They are not only about specific job requests and successes, but also information about their solutions if they fail.

The log file includes a plurality of log lines. The log line includes information such as date and time, IP information, and status when the log line is generated.

The log file can be analyzed by the security operator or system engineers to be used for identifying the current status of security, signs of hacking, or the cause after the security occurs.

In order to analyze such a log file, a log search operation may be involved. That is, a log search operation such as inquiring a specific access IP of a visitor, a specific access date or time, a specific information, or a specific state may be accompanied. However, for such a log search operation, a log analyst has to enter a desired search expression in a search box by pressing a keyboard and a computer mouse.

Korean Patent Publication No. 2009-0068101 (Invention name: Website real-time accessor list providing system and method) Korean Patent Publication No. 2010-0072515 (Invention name: Remote server log analysis system and method) Korean Patent No. 10-0714235 (Name of the invention: log file loading and analysis method, and apparatus for performing the same)

Accordingly, the technical problem of the present invention is to solve such a conventional problem, and an object of the present invention is to perform a log search operation by completing a log search expression by simply operating a computer mouse for the convenience of log search by a log analyzer. It is to provide a searchable autocomplete method.

In addition, another object of the present invention is to provide a log search type automatic completion system for performing the log search type automatic completion method.

In order to realize the above object of the present invention, a log search type automatic completion method according to an embodiment includes the steps of: (a) displaying a log search view on which log data is displayed; As the target field in the view is double-clicked by a computer mouse by an analyst's operation, checking whether a search word pre-entered in the search window exists, and (c) the search word pre-entered in the search window does not exist. If it is not checked, a step of inputting a search word double-clicked into the search box; and (d) If it is checked that the search word pre-inputted in the search box exists, the operator set by the analyst is inputted. Adding a new double-clicked search word after adding it, (e) checking whether or not to continue inputting the search word after performing step (c) or step (d), and (f) ) In step (e) If it is checked that the input of the search word is to be continued, the method returns to step (b) and (g) if it is unchecked to continue input of the search word in step (f), log search is performed using the completed log search expression. Checking whether or not to execute the log search in step (g), if it is unchecked to execute the log search, and terminating the log search, and if it is checked to execute the log search, executing the log data search based on the completed search expression. And displaying a log search result in the log search view.

In an embodiment of the present invention, the operator may include at least one of Boolean operators, adjacent operators, and truncations.

In one embodiment of the present invention, the logical operator may include any one of AND, OR, XOR and NOT, and the adjacent operator may include any one of ADJ and NEAR.

In one embodiment of the present invention, the truncation symbol is any one of <*> disposed in the middle or rear of a specific keyword, a space disposed in the middle of a specific keyword, and <?> Placed in the middle or rear of a specific keyword. It may include.

In order to realize the above object of the present invention, a log search type automatic completion system according to an embodiment includes a display control unit, a search word existence check unit, a log search type completion unit, and a search execution unit. The display control unit displays a log search view in which log data is displayed on the display screen. The search word existence checker checks whether a search word pre-inputted in the search window is present as the target field is double-clicked by an analyst in the log search view. If it is checked that the search word previously inputted in the search box does not exist, the log search expression completion unit inputs a double-clicked search word into the search window and the search word pre-inputted in the search window exists. If checked, the operator set by the analyst is added after the input search word, and the newly double clicked search word is added to complete the log search expression. The search execution unit displays a log search result in the log search view by executing a search of log data using a completed log search equation as a log search request by an analyst is requested.

In one embodiment of the present invention, the log search formula completion unit may include a search word input module, an operator adding module and a search word adding module. The search word input module may input a double clicked search word into the search window. The operator adding module may add an operator after a search word previously entered in the search box. The search word adding module may add a newly double-clicked search word after the operator added by the operator adding module to the search box.

In one embodiment of the present invention, the log search type automatic completion system may further include a log request unit for requesting the log data to display in the log search view.

In an embodiment of the present invention, the log search type autocomplete system may further include a double-click check unit that checks whether or not a double clock is performed by an analyst's computer mouse operation and provides a check result to the search word existence check unit.

According to the automatic log search method and a system for performing the same, as the target field is double-clicked in the log search view in which the log data is displayed, the search word entered in the corresponding field is entered in the search box or the set operator is added. After the log search expression is completed by inputting the search word written in the corresponding field, the log search operation can be performed by completing the log search expression only by using a computer mouse.

1 is a block diagram illustrating a log search type autocomplete system in a log analysis system according to an embodiment of the present invention.
2 is a flowchart illustrating a log search type autocomplete method in the log analysis system according to the present invention.
3A is an image for explaining an example of a log search view shown to an analyst.
3B is an image for explaining that a search word is input to the search box when the search word previously inputted in the search box does not exist.
3C is an image for explaining that an operator and a search word are input to a search box when a search word previously input is present in the search box.
3D is an image for explaining an example of log lines searched according to a search execution.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will now be described in more detail with reference to the accompanying drawings. The present invention is capable of various modifications and various forms, and specific embodiments are illustrated in the drawings and described in detail in the text. It should be understood, however, that the invention is not intended to be limited to the particular forms disclosed, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In this application, the terms "comprises", "having", and the like are used to specify that a feature, a number, a step, an operation, an element, a part or a combination thereof is described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof.

Also, unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

1 is a block diagram illustrating a log search type autocomplete system in a log analysis system according to an embodiment of the present invention.

Referring to FIG. 1, the log search type autocomplete system 100 includes a log request unit 110, a display control unit 120, a search word existence check unit 130, a log search type completion unit 140, and a search execution unit. 150 and a double-click check unit 160, and automatically perform a log search operation by automatically completing a log search equation in accordance with an analyst's operation, in particular, a mouse 40 operation.

The log request unit 110 requests the latest log data stored in the log file storage unit 50 and provides the log control unit 120 to be displayed on the log search view 62 of the display screen 60.

The display control unit 120 displays a log search view 62 on which the latest log data is displayed on the display screen 60.

The search word existence checker 130 inputs the search field 64 in the search window 64 of the display screen 60 as the target field is double-clicked by the analyst in the log search view 62. Checks for the existence of a search word.

The log search expression completion unit 140 includes a search word input module 142, an operator adding module 144, and a search word adding module 146, and a search word inputted in the search window 64 is present. If it is not checked, a search word is input to the search box 64, and if it is checked that a search word previously input is present in the search window 64, the operator set by the analyst is followed by the input search word. After the addition, add a new double clicked search word to complete the log search expression.

The search word input module 142 inputs a search word in the search window 64.

The operator adding module 144 adds an operator after a search word previously input in the search window 64. In the present embodiment, the operator may include at least one of Boolean operators, adjacent operators, and truncations. Here, the logical operator includes any one of AND, OR, XOR and NOT, the adjacent operator includes any one of ADJ and NEAR, and the logical operator and the adjacent operator may be set by an analyst. The truncation symbol includes any one of <*> disposed in the middle or rear of a specific keyword, a space disposed in the middle of a specific keyword, and a <?> Placed in the middle or rear of a specific keyword, and the truncation symbol is analyzed by an analyst. It can be set by. For example, if a <*> truncation symbol is used after a particular keyword, all syllables can be searched for. For example, if a search formula is described as <Peninsula *>, words such as <Semiconductor>, <Semiconductor>, <Semiconductor Depths>, and the like can be searched. Meanwhile, if a symbol <?> Is used after a specific keyword, log data including a word corresponding to a size of <?> May be searched. For example, if a search expression is described as &quot; nothing ??? &quot;, words can be searched, such as &quot; no operation &quot;, &quot; no adjustment &quot;, &quot; unconditional &quot;. When &quot; MP? &Quot; is described as a search expression, words such as <MP3>, <MP4>, <MPA>, <MPS>, and the like can be searched.

In the present exemplary embodiment, the operator is added after the search word input through the operator adding module 144. However, the operator may not only use the operator but also specify a specific word set by the analyst, for example, <*>, space, and other special words. You can also add letters or words.

The search word adding module 146 adds a newly double-clicked search word after the operator added by the operator adding module 144 to the search window 64.

As the log search request by the analyst is requested, the search execution unit 150 executes the search of the log data using the completed log search formula and displays the log search result in the log search view 62.

The double-click check unit 160 checks whether or not the user double-clocked by the operation of the mouse 40 to provide a check result to the search word existence check unit 130.

An example of a log search type autocompletion program for implementing a log search type autocompletion system according to an embodiment of the present invention is shown as pseudo code.

2 is a flowchart illustrating a log search type autocomplete method in the log analysis system according to the present invention. 3A is an image for explaining an example of a log search view shown to an analyst. 3B is an image for explaining that a search word is input to the search box when the search word previously inputted in the search box does not exist. 3C is an image for explaining that an operator and a search word are input to a search box when a search word previously input is present in the search box. 3D is an image for explaining an example of log lines searched according to a search execution.

2, the latest log is requested (step S100).

Then, as shown in Fig. 3A, a log search view is displayed (step S102). Referring to FIG. 3A, the log search view displays information such as date, host name, user ID, client address, process name, command, etc. of log data in line units.

Then, it is checked whether or not the target field is double clicked in the log search view (step S104).

In step S104, if it is unchecked by double-clicking the target field in the log search view, it is fed back to step S102. When it is checked by double-clicking the target field in the log search view, it is checked whether or not the search word entered in the search window exists. (Step S106).

If it is checked in step S106 that the search word previously entered in the search window does not exist, the search word is entered in the search window (step S108). For example, when a search word is input to the search box, it is displayed as shown in FIG. 3B. Referring to FIG. 3B, in order to retrieve log data including <192.168.20.185> which is a client address of log data, the analyst double-clicks a field corresponding to the client address column of the eleventh line. According to the analyst's double-click, as shown in FIG. 3B, the search word <192.168.20.185> is automatically entered in the search box.

If it is checked in step S106 that the search word previously entered in the search box exists, an operator is added after the previously entered search word and a new double-clicked search word is added (step S110). For example, as the operator is added and the search word is double clicked, it is displayed, as shown in FIG. 3C. Referring to FIG. 3C, in order to retrieve log data including the client address <192.168.20.185> of the log data and <sshd> of the process name of the log data simultaneously, the analyst analyzes a field corresponding to the process name column of the 11th line. Double click. In accordance with the analyst's double-click, as shown in FIG. 3C, the search word <sshd> is automatically entered in the search box. At this time, an operator <AND> is automatically added after the search word <192.168.20.185> which is a client address of log data, and then a search word <sshd> which is a process name of log data is written. This operator <AND> can be preset by the analyst. If the log search autocomplete program is set up so that the analyst does not search using the <AND> operator, but uses the <OR> operator, the <OR> operator is automatically placed between the first and second search words. Is written. Meanwhile, not only an operator but also a specific word set by an analyst, for example, <*>, a space, and other special characters or words may be automatically entered. In this embodiment, a space is placed between the word and the word to perform the operator function of <OR>. Specific words described in this embodiment are commonly used in the search field, and thus detailed descriptions thereof will be omitted.

Then, it is checked whether to continue inputting a search word (step S112).

If it is checked in step S112 that input of the search word is to be continued, the flow returns to step S104.

If it is unchecked that input of a search word is to be continued in step S112, it is checked whether log search is to be executed (step S114). The log search can be executed by clicking the button &quot; search &quot; located on the right side of the search box as shown in FIG. 3C.

In step S114, if it is unchecked to execute the log search, the log search ends (step S116). If it is checked that the log search is to be executed, the log search is executed (step S118), and the process feeds back to step S102. For example, as the log search is executed, it is displayed as shown in FIG. 3D. Referring to FIG. 3D, log data (or log lines) including the search word <192.168.20.185> and the search word <sshd> at the same time are displayed.

Although described above with reference to the embodiments, those skilled in the art can be variously modified and changed within the scope of the invention without departing from the spirit and scope of the invention described in the claims below. I can understand.

As described above, according to the present invention, as the target field is double-clicked in the log search view in which the log data is displayed, the search word entered in the corresponding field is inputted to the search box or the set operator is added and then written in the corresponding field. By completing the log search expression by inputting the search word, it is possible to perform the log search operation by completing the log search expression only by operating a computer mouse.

100: log search automatic completion system 110: log request unit
120: display control unit 130: search word existence check unit
140: log search formula completion unit 142: search word input module
144: operator addition module 146: search word addition module
150: search execution unit 160: double click check unit
40: Mouse 50: Log File Storage
60: display screen 62: log search view
64: search box

Claims (8)

(a) displaying a log search view on which log data is displayed on a display screen;
(b) checking whether a search word pre-entered in the search window is present as the target field in the log search view is double-clicked by a computer mouse by an analyst;
(c) if it is checked that a search word previously inputted in the search window does not exist, inputting a double-clicked search word into the search window;
(d) if it is checked that the search word inputted in the search box is present, adding an operator set by the analyst after the search word inputted in advance, and then adding a new double-clicked search word;
(e) checking whether to continue inputting a search word after performing step (c) or step (d);
(f) if it is checked in step (e) that the input of the search word is to be continued, feeding back to step (b);
(g) if unchecked to continue inputting the search word in step (f), checking whether to perform a log search using the completed log search formula; And
(h) If it is unchecked to execute the log search in step (g), the log search is terminated. If it is checked that the log search is to be executed, the log search is performed by searching the log data based on the completed search expression. Log search automatic completion method comprising the step of displaying in the view. The method of claim 1, wherein the operator is at least one of Boolean operators, adjacent operators, and truncations. The method of claim 2, wherein the logical operator includes any one of AND, OR, XOR, and NOT, and the adjacent operator includes one of ADJ and NEAR. The terminal of claim 2, wherein the truncation symbol includes any one of <*> disposed in the middle or rear of a specific keyword, a space disposed in the middle of a specific keyword, and <?> Disposed in the middle or rear of a specific keyword. Log search autocomplete method characterized in that. A display control unit which displays a log search view on which log data is displayed on a display screen;
A search word presence checker which checks whether a search word pre-entered in the search window is present as the target field is double-clicked by a computer mouse in the log search view;
If it is checked that the search word pre-input in the search box does not exist, the search word which is double-clicked is input into the search window, and if it is checked that the search word pre-input in the search box exists, A log search expression completion unit for adding an operator after the input search word and adding a new double clicked search word to complete a log search expression; And
Log search type automatic completion system including a search execution unit for displaying the log search results in the log search view by executing a log data search using the completed log search formula as requested by the analyst. The method of claim 5, wherein the log search formula completion unit,
A search word input module for inputting a double-clicked search word into the search box;
An operator adding module for adding an operator after a search word previously entered in the search box; And
And a search word adding module for adding a new double-clicked search word after the operator added by the operator adding module to the search box. 6. The log search type autocomplete system according to claim 5, further comprising a log request unit for requesting the log data and displaying the log data in the log search view. 6. The log search type automatic completion system according to claim 5, further comprising a double-click check unit which checks whether or not a double clock is operated by a computer mouse operation and provides a check result to the search word existence check unit.

Images