In network security situation elements extraction, Jajodia collected network vulnerability information to assess the network vulnerability situation [3]; Ning collected network alerting information to assess the network threat situation [4]. The information collected from one single aspect can't obtain the network security situation accurately, thus obtaining comprehensive information and information's relevance is particularly important. In this paper, we will obtain the comprehensive information and information's relevance by node performance and log files to evaluate the network security situation.