METHOD OF PROCESSING LOG FILES IN AN INFORMATION SYSTEM, AND LOG FILE PROCESSING SYSTEM

• US 20110191394A1
• Filed: 01/29/2010
• Published: 08/04/2011
• Est. Priority Date: 01/29/2010
• Status: Abandoned Application

• Current Assignee: NetGuardians SA
• Original Assignee: NetGuardians SA
• Inventors: Maio, Raffael, WINTEREGG, Joel
• Application Number:
  US12/696,130
• Publication Number:
  US 20110191394A1
• Time in Patent Office: Days
• US Class Current: 707/822
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs

Abstract

A system and method of processing log files in an information system having a plurality of log file sources, by collecting log files from the log file sources at a log file acquisition unit and storing the log files in a log file storage unit. On an on demand basis, a portion of stored log files is selected and the selected log files are processed in order to obtain a normalized log file data. The system also relates to the corresponding log file processing system for an information system.

Claims

1. A method of processing log files in an information system having a plurality of log file sources, comprising:

collecting log files from said log file sources at a log file acquisition unit;

storing said log files in a log file storage unit;

on an on demand basis, selecting a portion of stored log files;

processing said selected log files in order to obtain normalized log file data.

2. The method of claim 1, further comprising:

referring to at least one log file dictionary, for interpretation of selected log files.

3. The method of claim 1, further comprising:

analyzing the normalized log file data on order to provide on demand forensics.

4. The method of claim 1, further comprising:

before processing of selected log files, updating log file dictionaries.

5. A method of processing log files in an information system having a plurality of log file sources, comprising:

collecting log files from said log file sources at a log file acquisition unit;

storing said log files in a log file storage unit;

receiving from a log file selection unit a selection of stored log files to be processed;

processing said selected log files in order to obtain normalized log file data.

6. The method of claim 5, further comprising:

referring to at least one log file dictionary, for interpretation of selected log files.

7. The method of claim 5, further comprising:

analyzing the normalized log file data on order to provide on demand forensics.

8. The method of claim 5, further comprising:

before processing of selected log files, updating log file dictionaries.

9. A log file processing system for an information system, comprising:

a log file acquisition unit, for acquisition of log files from a plurality of log sources connectable to said system;

a log file storage unit, for storing log files received from log sources;

a log file selection unit, for identification of log files to be processed among the stored log files;

a log file processing unit, comprising a normalization engine, for normalization of log files in a given format;

log file interpretation dictionary, accessible from said processing unit and providing a database of interpretation codes for the normalization engine;

wherein said normalization engine is adapted for on-demand processing of selected log files.

10. The log file processing system of claim 9, wherein said log file storage unit is adapted for continuing the storage of the log files selected for processing.

11. The log file processing system of claim 9, wherein the normalized log file data are analyzable in order to provide on demand forensics.

12. The log file processing system of claim 9, further comprising a forensic module for analysis of the normalized log files.

13. A log file processing system for an information system, comprising:

a log file acquisition unit, for acquisition of log files from a plurality of log sources connectable to said system;

a log file storage unit, for storing log files received from log sources;

a log file selection unit, for identification of log files to be processed among the stored log files;

a log file processing unit, comprising a normalization engine, for normalization of log files in a given format;

log file interpretation dictionary, accessible from said processing unit and providing a database of interpretation codes for the normalization engine;

wherein said log file selection unit is adapted for on-demand selection of log files to be normalized.

14. The log file processing system of claim 13, further comprising a forensic module for analysis of the normalized log files.