CAJ | 학술논문

针对传统的单一设备和人工管理方式不能应对日益复杂的网络威胁和挑战，不能及时发现和准确定位网络安全事件，也不能对安全事件可能造成的后果进行准确评估的问题，本文主要讨论如何基于标准Syslog协议，通过对网络设备大量网络日志数据的集中采集，通过SQL代理处理后进行分析，构造一套日志系统，以达到对网络运行状况进行检测的目的。
침대전통적단일설비화인공관리방식불능응대일익복잡적망락위협화도전，불능급시발현화준학정위망락안전사건，야불능대안전사건가능조성적후과진행준학평고적문제，본문주요토론여하기우표준Syslog협의，통과대망락설비대량망락일지수거적집중채집，통과SQL대리처리후진행분석，구조일투일지계통，이체도대망락운행상황진행검측적목적。
The traditional reliance on a single device, or manual management approaches have failed to respond to increasingly complex challenges of network threats and can not find and accurately locate the network security incidents, security incidents can not be an accurate assessment of the consequences. This article focuses on how standards-based syslog protocol, a large number of network devices through the network of a centralized collection of log data, processed by the SQL Agent to analyze, construct a log system to achieve operational status of the network for testing purposes.