Analytics and deduplication for air-gapped log analysis

Abstract

A system and method for deduplicating analyzing system logs is disclosed. The method includes capturing, by an image acquisition component, an image of at least one log entry, converting, by an image processing component, text in the image of the at least one log entry to machine-encoded text, and scanning, by a log scanning component, the machine-encoded text for the at least one redundant copy of the at least one log entry. The method also includes removing, by the log scanning component, the at least one redundant copy of the at least one log entry, determining, by a log analysis component, if the at least one log entry is significant, flagging the at least one log entry if the log entry is significant, and alerting a user if the log entry is flagged.

1 . A method for deduplicating and analyzing system logs, comprising:
 capturing an image of at least one log entry;   converting text in the image of the at least one log entry to machine-encoded text;   scanning the machine-encoded text for at least one redundant copy of the at least one log entry;   removing the at least one redundant copy of the at least one log entry;   determining if the at least one log entry is significant;   flagging the at least one log entry if the at least one log entry is significant; and   alerting a user if the at least one log entry is flagged.   
     
     
         2 . The method of  claim 1 , wherein the determining determines that the at least one log entry is significant if a number of the at least one redundant copy of the at least one log entry is greater than a threshold number of redundant copies of log entries in a designated time span. 
     
     
         3 . The method of  claim 1 , wherein the determining determines that the at least one log entry is significant if the at least one log entry reports a system error. 
     
     
         4 . The method of  claim 1 , wherein the image of the at least one log entry is a video. 
     
     
         5 . The method of  claim 1 , wherein the image of the at least one log entry is a still image. 
     
     
         6 . The method of  claim 1 , further comprising encrypting the image of the at least one log entry. 
     
     
         7 . The method of  claim 1 , further comprising encrypting the machine-encoded text of the at least one log entry. 
     
     
         8 . A system comprising:
 at least one processing component;   at least one memory component;   at least one image acquisition component configured to capture an image of at least one log entry;   at least one image processing component configured to convert text in the image of the at least one log entry to machine-encoded text;   at least one log scanning component configured to scan the machine-encoded text for at least one redundant copy of the at least one log entry, and further configured to remove the at least one redundant copy of the at least one log entry; and   at least one log analysis component configured to determine if the at least one log entry is significant, and further configured to alert a user if the at least one log entry is flagged.   
     
     
         9 . The system of  claim 8 , wherein the log analysis component determines that the at least one log entry is significant if a number of the at least one redundant copy of the at least one log entry is greater than a threshold number of redundant copies of log entries in a designated time span. 
     
     
         10 . The system of  claim 8 , wherein the log analysis component determines that the at least one log entry is significant if the at least one log entry reports a system error. 
     
     
         11 . The system of  claim 8 , wherein the image acquisition component, the image processing component, the log scanning component, and the log analysis component are in a log processing device. 
     
     
         12 . The system of  claim 8 , wherein the image acquisition component is further configured to encrypt the image of the at least one log entry. 
     
     
         13 . The system of  claim 8 , wherein the image processing component is further configured to encrypt the machine-encoded text of the at least one log entry. 
     
     
         14 . The system of  claim 8 , further comprising a camera. 
     
     
         15 . The system of  claim 8 , wherein the image acquisition component is in an image acquisition device. 
     
     
         16 . A computer program product for deduplicating and analyzing system logs, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the device to perform a method comprising:
 capturing an image of at least one log entry;   converting text in the image of the at least one log entry to machine-encoded text;   scanning the machine-encoded text for at least one redundant copy of the at least one log entry;   removing the at least one redundant copy of the at least one log entry;   determining if the at least one log entry is significant;   flagging the at least one log entry if the at least one log entry is significant; and   alerting a user to a flagged log entry.   
     
     
         17 . The computer program product of  claim 16 , wherein the determining determines that the at least one log entry is significant if a number of the at least one redundant copy of the at least one log entry is greater than a threshold number of redundant copies of log entries in a designated time span. 
     
     
         18 . The computer program product of  claim 16 , wherein the determining determines that the at least one log entry is significant if the at least one log entry reports a system error. 
     
     
         19 . The computer program product of  claim 16 , further comprising encrypting the image of the at least one log entry. 
     
     
         20 . The computer program product of  claim 16 , further comprising encrypting the machine-encoded text of the at least one log entry.