All of the log audit system is not necessarily audit.

This article only briefly talks about personal feelings about the log audit system.

There are many log audit products on the market, such as Sifudi, HP Arcsight, Splunk, an Heng Mingyu, Guodu Societe Generale, Qiming Tiankey and so on. These products are generally for security services, but recently I took a look at Netcom's online behavior audit system, which is very enlightening. Personally, I think the log audit system should be more useful or useful, and it also has certain conditions:

1. General log audit products have log standardization function, so it should be used to analyze all kinds of data (including some business data).

2. Log audit systems generally have large-scale hierarchical and hierarchical deployment models, so they should be able to support massive data collection and basic analysis capabilities.

However, at present, such products are only used in the general security field, that is, they are specially used to "find fault", so the value provided to customers is relatively limited, and their features can not be fully utilized, so some users say, "it's good to run naked originally. Why do you have to wear a vest?" But I think this kind of product can be used in big data's analysis (that is, it can be used as a general platform for big data's analysis), and further can be used to analyze the value of customer business data, the prerequisite is:

1. Provide more flexible field definitions for parsing and displaying data formats

2. Provide more powerful data retrieval function.

3. Provide more powerful customer report support function.

4. Provide more statistical models (such as normal, F-distribution, Student distribution, chi-square distribution, etc.) to support users' analysis and prediction of historical data and trend data.

5. Provide more diversified data mining functions (such as association analysis, clustering mining, neural network mining, decision tree mining) to fully support customers' arbitrary data mining.

This can greatly expand the application field of such products and the value of the products themselves.