The computer protection mechanism has to be monitored after been built. The
operation process of monitoring system was auditing. Log file is an important part of
security system, which is the history record of computer system running status. As the
developing of the Internet, online behavior tracking has become more and more
critical. Traditional log auditing system, with standardized function, can be deployed
in single server and can meet the common requirement of enterprise application,
which get server access summary by cataloging and collecting file content of web log
files. However, most auditing tools, not very flexible and adaptable, can simply
process “standardized (typical log format)”log files, hard to achieve general
management of associated information among different log files. Furthermore,
traditional tools, adopting file-system techniques, the processing speed and
performance rapidly decrease when the auditing files increase to certain amount.
More importantly, this kind of auditing system, with isolated sub systems, can not
audit integrated behaviors of multiple services in a certain scope.