System and method for storing raw log data

• US 20050114708A1
• Filed: 07/23/2004
• Published: 05/26/2005
• Est. Priority Date: 11/26/2003
• Status: Active Grant

• Current Assignee: Cloud Software Group
• Original Assignee: Loglogic (Cloud Software Group)
• Inventors: DeStefano, Jason Michael, Jenson, Ralph D.
• Granted Patent: US 7,599,939 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 41/044 comprising hierarchical management structures
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A system and method is disclosed for collecting, storing and reporting raw log data from log-producing devices such as firewalls and routers. The log-producing devices may be both local and remote—i.e., linked to a raw log server via a LAN and/or a WAN. A log data analyzer at a remote location gathers log data from devices at that remote location into time-defined sets and then sends those sets over a WAN (which may be the Internet) to a raw log server using a first protocol. Local log-producing devices may send their log data to the log data analyzer via a LAN using a second protocol. The log data analyzer forwards the raw log data local devices to an appropriate log data analyzer for parsing, summarizing and storage in one or more databases. The raw log server combines local and remote sets of raw log data for a given time period and stores them in a storage area of raw log data. A central management station is used to query the various databases in the system and to merge database reports into a single report for display.

Claims

1. A data processing system comprising:

a first local area network;

a first log-producing device connected to the first local area network;

a raw log server connected to the first local area network and in data communication with the first log-producing device over the first local area network;

a first log data analyzer connected to the first local area network and in data communication with the raw log server over the first local area network;

a second local area network in data communication with the first local area network;

a second log-producing device connected to the second local area network; and

,

a second log data analyzer connected to the second local area network and in data communication with the second log-producing device over the second local area network and in data communication with the raw log server via the first and second local area networks.

2. A data processing system as recited in claim 1 wherein the first log-producing device is a firewall.

3. A data processing system as recited in claim 1 wherein the first log-producing device is a device selected from the group consisting of routers, firewalls, file servers, VPN servers, e-mail servers and gateways.

4. A data processing system as recited in claim 1 further comprising a management station connected to the first local area network and in data communication with the raw log server and the first and second log data analyzers.

5. A data processing system as recited in claim 1 wherein the second log data analyzer is at a location remote from the raw log server.

6. A data processing system as recited in claim 1 further comprising scalable data storage connected to the raw log server for storing raw log data.

7. A data processing system as recited in claim 6 wherein the scalable data storage is selected from the group consisting of Network Attached Storage, Storage Area Networks and WORM Storage.

8. A method for processing log data comprising:

generating raw log data in a first log-producing device connected to a first local area network;

storing raw log data in a raw log server connected to the first local area network and in data communication with the first log-producing device over the first local area network;

sending the raw log data generated by the first log-producing device to a first log data analyzer connected to the first local area network and in data communication with the raw log server over the first local area network;

generating log data in a second log-producing device connected to a second local area network; and

,

sending the log data generated by the second log-producing device from a second log data analyzer connected to the second local area network and in data communication with the second log-producing device over the second local area network and in data communication with the raw log server via the first and second local area networks to the raw log server.

9. A data processing method as recited in claim 8 wherein the first log-producing device is a firewall.

10. A data processing method as recited in claim 8 wherein the first log-producing device is a router.

11. A data processing method as recited in claim 8 further comprising sending a database query from a management station connected to the first local area network to the raw log server.

12. A data processing method as recited in claim 8 further comprising sending a database query from a management station connected to the first local area network to the first log data analyzer.

13. A data processing method as recited in claim 8 further comprising sending a database query from a management station connected to the first local area network and in data communication with the second local area network to the second log data analyzer.

14. A data processing method as recited in claim 8 wherein the second log data analyzer is at a location remote from the raw log server.