<p class="shortdesc">本文介绍如何将日志存储在数据库中，并利用lucene索引进行条件搜索。</p> <section class="section prereq" id="byLucene__prereq_pdg_4zb_tsb"><div class="tasklabel"><h2 class="doc-tairway">前提条件</h2></div> <p class="p">您已创建安全日志审计实例。</p> </section> <section><div class="tasklabel"><h2 class="doc-tairway">操作步骤</h2></div><ol class="ol steps"><li class="li step stepexpand"> <span class="ph cmd">登录<a class="xref" href="https://www.ocftcloud.com/console/log-audit" target="_blank" rel="external noopener">安全日志审计SLA控制台</a>，进入<span class="keyword wintitle">实例列表</span>页面。</span> </li><li class="li step stepexpand"> <span class="ph cmd">单击目标实例<span class="ph uicontrol"> 操作</span>列的<span class="ph uicontrol">管理</span>，进入安全日志审计控制台。</span> <div class="itemgroup info"> <img class="image" id="byLucene__d22e53" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112057-1ecc508f988a.png" width="830"> </div> </li><li class="li step stepexpand"> <span class="ph cmd">在页面上边栏选择<span class="ph uicontrol">系统</span>，在左侧菜单栏选择<span class="ph menucascade"><span class="ph uicontrol">系统配置</span><abbr> > </abbr><span class="ph uicontrol">高级配置</span></span>，进入<span class="ph uicontrol">高级配置</span>页面。</span> </li><li class="li step stepexpand"> <span class="ph cmd">在弹出的对话框中输入动态密码，单击<span class="ph uicontrol">确定</span>。</span> </li><li class="li step stepexpand"> <span class="ph cmd">选择<span class="ph uicontrol">日志存储</span>页签，单击<span class="ph menucascade"><span class="ph uicontrol">新增</span><abbr> > </abbr><span class="ph uicontrol">Lucene入库</span></span>，根据以下信息，配置Lucene入库策略，配置完成后单击<span class="ph uicontrol">保存</span>。</span> <div class="itemgroup info"> <div class="p"> <img class="image" id="byLucene__image_kkc_x4t_4sb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112057-15820e30903b.png" width="400"> </div> <table class="table" id="byLucene__table_pyz_cgf_4sb"><caption></caption><colgroup><col><col></colgroup><thead class="thead"> <tr class="row"> <th class="entry colsep-1 rowsep-1" id="byLucene__table_pyz_cgf_4sb__entry__1"> <p class="p"> 配置项 </p> </th> <th class="entry colsep-1 rowsep-1" id="byLucene__table_pyz_cgf_4sb__entry__2"> <p class="p"> 说明 </p> </th> </tr> </thead><tbody class="tbody"> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 线程数 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> Lucene入库的线程数，默认为7。 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 是否开启批量 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 是否开启批量存储日志功能。 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 批量数 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 批量存储日志的条数，默认2000。 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 是否启动缓存 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 是否启动缓存。 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 缓存数 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 缓存数，默认20000 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 索引目录 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 索引目录 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 索引最大内存数 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 索引最大内存数，默认512。 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 合并因子 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 默认为10 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 索引目录结构 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 索引目录结构，默认MMapDirectory </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 最大文档数 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 最大文档数 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 检索粒度 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 检索粒度 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 单次检索允许的最大文档 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 单次检索允许的最大文档，默认10000000 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 允许加载的reader数量 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 允许加载的reader数量 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 允许加载X天的索引 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 允许加载X天的索引，默认15 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 检索垃圾清理 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 检索垃圾清理 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 检索过reader自动释放内存 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 检索过reader自动释放内存，true or false </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 索引压缩 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 索引压缩 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 合并机制允许的最大文档数 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> 合并机制允许的最大文档数。 </p> </td> </tr> <tr class="row"> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__1 "> <p class="p"> 分词器 </p> </td> <td class="entry colsep-1 rowsep-1" headers="byLucene__table_pyz_cgf_4sb__entry__2 "> <p class="p"> Lucene索引使用的分词器。 </p> </td> </tr> </tbody></table> </div> </li></ol></section>