Analysis of Logs by Using Logstash

Sanjappa, Sushma; Ahmed, Muzameel

doi:10.1007/978-981-10-3156-4_61

Cited by 11 publications

(2 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Logstash [7] is another open-source and reliable tool to parse, unify, and interpret syslog entries. Logstash provides a text filtering engine which can search for the text patterns in live streams of syslog entries and replace them with predefined strings [8]. In addition to the off-line tools, such as Syslog-ng and Logstash, there is a growing number of on-line tools, e.g., Loggy [9], Logsign [10], and Scalyr [11], that offer a comprehensive package of syslog analysis services.…”

Section: Related Workmentioning

confidence: 99%

Anonymization of System Logs for Preserving Privacy and Reducing Storage

Ghiasvand

Ciorba²

2018

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

System logs constitute valuable information for analysis and diagnosis of system behavior. The size of parallel computing systems and the number of their components steadily increase. The volume of generated logs by the system is in proportion to this increase. Hence, long-term collection and storage of system logs is challenging. The analysis of system logs requires advanced text processing techniques. For very large volumes of logs, the analysis is highly time-consuming and requires a high level of expertise. For many parallel computing centers, outsourcing the analysis of system logs to third parties is the only affordable option. The existence of sensitive data within system log entries obstructs, however, the transmission of system logs to third parties. Moreover, the analytical tools for processing system logs and the solutions provided by such tools are highly system specific. Achieving a more general solution is only possible through the access and analysis system of logs of multiple computing systems. The privacy concerns impede, however, the sharing of system logs across institutions as well as in the public domain. This work proposes a new method for the anonymization of the information within system logs that employs de-identification and encoding to provide sharable system logs, with the highest possible data quality and of reduced size. The results presented in this work indicate that apart from eliminating the sensitive data within system logs and converting them into shareable data, the proposed anonymization method provides 25% performance improvement in post-processing of the anonymized system logs, and more than 50% reduction in their required storage space.

show abstract

Section: Related Workmentioning

confidence: 99%

Anonymization of System Logs for Preserving Privacy and Reducing Storage

Ghiasvand

Ciorba²

2018

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

show abstract

“…They stand as the fundamental technology in contemporary network security, serving as the initial defense against external network attacks and threats [2]. The key functionality of this proposed system is its ability to handle, collect , and analyze huge volumes of different kinds of log data [3]. The rapid expansion of internet usage presents a challenge in effectively managing bandwidth and securing the campus network environment.…”

Section: Introductionmentioning

confidence: 99%

Data Mining-Driven Framework for Effective Firewall Log Management

Gouda,

khafagy,

Badry

2024

Labyrinth: Fayoum Journal of Science and Interdisciplinary Stud

View full text Add to dashboard Cite

devices face challenges, particularly in addressing performance issues due to evolving security threats. This paper presents a framework utilizing data mining techniques, specifically the Apriori and FPgrowth algorithms, to analyze extensive firewall logs. The proposed system extracts Juniper firewall logs from Security Information and Event Management (SIEM), deploying data mining algorithms to identify and address performance issues. The process involves discovering patterns, grouping item sets, and identifying related events within the telecom network's firewall logs. The study yields recommendations for managing firewall events, both individually and in critical event contexts, enabling network security administrators to automatically detect and review firewall performance problems. The FPgrowth algorithm identifies frequent itemsets, highlighting closely related events occurring together. The proposed data miningdriven framework demonstrates strong predictive power (R = 0.948, R Square = 0.898) and significant explanatory capability, evidenced by a high F-statistic (509.589, p < 0.0001) and impactful coefficients, particularly for the "actual frequency" variable. This framework enhances the efficiency of firewall log management, providing valuable insights for network security administrators.

show abstract

Modelling Auto-scalable Big Data Enabled Log Analytic Framework

Deshpande

Rao

2022

Computer Networks and Inventive Communication Technologies

View full text Add to dashboard Cite

Analysis of Logs by Using Logstash

Cited by 11 publications

References 1 publication

Anonymization of System Logs for Preserving Privacy and Reducing Storage

Anonymization of System Logs for Preserving Privacy and Reducing Storage

Data Mining-Driven Framework for Effective Firewall Log Management

Modelling Auto-scalable Big Data Enabled Log Analytic Framework

Contact Info

Product

Resources

About