## 4 Solution of Requirements and Inspection Methods
### Active Defense Mechanism Enhances Broadband Network Resilience
Additionally, log containment can record security events, attack attempts, and potential vulnerabilities to detect and track potential security risks, safeguarding user networks from attack threats and enhancing network security. The Linux rsyslog is employed to collect log messages from 5G core network base stations. Rsyslog, an enhanced version of syslog, is used to receive, process, and forward log messages from the same host or other hosts. Messages are sent to local or remote log files, files, or other types of storage devices, with its primary format[48; 53] shown in Table 5.  
Figure 34: The log forwarding process. Information is gathered from different dimensions to enhance data reliability and traceability. For example, in the auth log, suspicious account logins are detected, and in the daemon log, malicious command operations are observed. (3). Log Forwarding  
Well-contained logs are forwarded, with the purpose of uniformly formatting the collected log data and then transmitting it to a centralized log system or storage location. This facilitates centralized management, analysis, and processing, making log data more accessible and searchable. Simultaneously, it achieves the comprehensive monitoring and management of the entire network. The log forwarding process, as depicted in Figure 35, involves treating rsyslog logs as input, parsing their format into structured data through a parser, filtering targeted data, modifying, and adding, using a cache for buffering during file processing, and providing a unified and persistent mechanism for data storage. Routing identifies data labels and content matches to determine where this data should be output. Finally, logs are output to a database, network service, or local storage repository. \begin{table}
\begin{tabular}{c c} \hline
**Facility** & **Description** \\ \hline kernel messages (kern) & Most of the messages generated by the system core involve hardware \\  & detection and core function activation. \\ \hline user-level messages (user) & Information generated at the user level, such as the user uses the logger \\  & command to record the function of the login file \\ \hline mail system (mail) & Email sending and receiving \\ \hline system daemons (daemons) & System daemon or service related, such as system-related information \\ \hline security/authorization messages (auth) & Login authorization related, such as login, ssh, and su \\ \hline messages generated internally by syslog (syslog) & Information generated by syslog related protocols; information \\  & generated by the rsyslogs program itself \\ \hline LINE printer subsystem (lpr) & Print related \\ \hline network news subsystem (news) & Newsgroup server related \\ \hline UUCP subsystem (uucp) & Unix to Unix Copy Protocol, used in the early days to exchange \\  & program data between Unix systems \\ \hline clock daemon (cron) & Routine work schedule \\ \hline security/authorization messages (authoriv) & Similar to auth, but records more private account information, \\  & including the operation of the pam module \\ \hline FTP daemon (ftp) & FTP communication protocol related \\ \hline \end{tabular}
\end{table} 
Table 6: Rsyslog log collection source table. \begin{table}
\begin{tabular}{c c c} \hline
**Name** & **Type** & **Description** \\ \hline Tag & str & Event log \\ \hline Priority & int & Priority: Facility \(\times\) 8 + Severity \\ \hline Time & date & Incident time \\ \hline Host & str & The source host that sends syslog messages \\ \hline Ident & str & Identify the device or application that generated the message \\ \hline Pid & int & Process name: often used to analyze the continuity of the log \\  & generation process but does not guarantee reliability \\ \hline message & str & The complete content of the event \\ \hline \end{tabular}
\end{table} 
Table 5: Primary format of rsyslog. For logs in the asynchronous satellite network, there may be thousands of log information records per second. When dealing with a large amount of data, it can lead to system overload.