From 1f34cac94eb453cc6f6bf8dd534c177be20906d5 Mon Sep 17 00:00:00 2001 From: zhanghongqing Date: Fri, 6 May 2022 15:28:52 +0800 Subject: [PATCH] 22.04 --- .../TSG-22.04/Galaxy_22.04更新文档.docx | Bin 0 -> 57596 bytes .../TSG-22.04/druid/top_client_ip_log.json | 55 + .../TSG-22.04/druid/top_external_host_log.json | 56 + .../TSG-22.04/druid/top_internal_host_log.json | 55 + .../TSG-22.04/druid/top_server_ip_log.json | 56 + .../TSG-22.04/druid/top_user_log.json | 55 + .../TSG-22.04/druid/top_website_domain_log.json | 56 + .../TSG-22.04/druid/traffic_app_stat_log.json | 63 + .../config/ETL-ACTIVE-DEFENCE-EVENT-COMPLETED | 67 + .../flink/completion/config/ETL-GTPC-RECORD-COMPLETED | 66 + .../config/ETL-INTERIM-SESSION-RECORD-COMPLETED | 66 + .../flink/completion/config/ETL-PROXY-EVENT-COMPLETED | 66 + .../completion/config/ETL-RADIUS-RECORD-COMPLETED | 66 + .../completion/config/ETL-SECURITY-EVENT-COMPLETED | 66 + .../completion/config/ETL-SESSION-RECORD-COMPLETED | 66 + .../config/ETL-SYS-PACKET-CAPTURE-COMPLETED | 66 + .../config/ETL-TRANSACTION-RECORD-COMPLETED | 66 + .../flink/completion/config/ETL-VOIP-RECORD-COMPLETED | 66 + .../TSG-22.04/flink/completion/start.sh | 40 + .../TSG-22.04/flink/kafka-flinksql-top.sql | 415 +++ .../config/LIVE-CHARTS_INTERIM-SESSION-RECORD | 55 + .../livecharts/config/LIVE-CHARTS_SESSION-RECORD | 55 + .../TSG-22.04/flink/livecharts/start.sh | 41 + .../TSG-22.04/flink/radiusOnOff/start.sh | 40 + .../TSG-22.04/flink/voipRelation/start.sh | 39 + .../TSG-22.04/qgw/config/ck-filter.json | 99 + .../TSG-22.04/qgw/config/ck-queries-template.sql | 118 + .../TSG-22.04/qgw/config/druid-filter.json | 21 + .../TSG-22.04/qgw/config/druid-queries-template.sql | 92 + .../TSG-22.04/qgw/config/engine-filter.json | 53 + .../TSG-22.04/qgw/config/engine-queries-template.sql | 120 + .../TSG-22.04/qgw/config/hbase-filter.json | 15 + .../TSG-22.04/qgw/config/hbase-queries-template.sql | 4 + .../TSG-22.04/qgw/config/job_result.json | 42 + .../TSG-22.04/qgw/config/proxy_event_hits_log.json | 133 + .../TSG-22.04/qgw/config/recommendation_app_cip.json | 27 + .../qgw/config/relation_account_framedip.json | 37 + .../TSG-22.04/qgw/config/report_result.json | 32 + .../TSG-22.04/qgw/config/security_event.json | 2373 +++++++++++++++++ .../TSG-22.04/qgw/config/security_event_hits_log.json | 97 + .../TSG-22.04/qgw/config/session_record.json | 2315 ++++++++++++++++ .../TSG-22.04/qgw/config/sys_storage_log.json | 71 + .../TSG-22.04/qgw/config/top_client_ip_log.json | 93 + .../TSG-22.04/qgw/config/top_external_host_log.json | 93 + .../TSG-22.04/qgw/config/top_internal_host_log.json | 93 + .../TSG-22.04/qgw/config/top_server_ip_log.json | 93 + .../TSG-22.04/qgw/config/top_urls_log.json | 30 + .../TSG-22.04/qgw/config/top_user_log.json | 93 + .../TSG-22.04/qgw/config/top_website_domain_log.json | 93 + .../TSG-22.04/qgw/config/traffic_app_stat_log.json | 88 + .../TSG-22.04/qgw/config/traffic_metrics_log.json | 286 ++ .../qgw/config/traffic_protocol_stat_log.json | 132 + .../TSG-22.04/qgw/config/traffic_summary_log.json | 174 ++ .../traffic_top_destination_ip_metrics_log.json | 96 + 54 files changed, 8755 insertions(+) create mode 100644 TSG发布版本更新记录/TSG-22.04/Galaxy_22.04更新文档.docx create mode 100644 TSG发布版本更新记录/TSG-22.04/druid/top_client_ip_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/druid/top_external_host_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/druid/top_internal_host_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/druid/top_server_ip_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/druid/top_user_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/druid/top_website_domain_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/druid/traffic_app_stat_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-ACTIVE-DEFENCE-EVENT-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-GTPC-RECORD-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-INTERIM-SESSION-RECORD-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-PROXY-EVENT-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-RADIUS-RECORD-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SECURITY-EVENT-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SESSION-RECORD-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SYS-PACKET-CAPTURE-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-TRANSACTION-RECORD-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-VOIP-RECORD-COMPLETED create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/completion/start.sh create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/kafka-flinksql-top.sql create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/livecharts/config/LIVE-CHARTS_INTERIM-SESSION-RECORD create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/livecharts/config/LIVE-CHARTS_SESSION-RECORD create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/livecharts/start.sh create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/radiusOnOff/start.sh create mode 100644 TSG发布版本更新记录/TSG-22.04/flink/voipRelation/start.sh create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/ck-filter.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/ck-queries-template.sql create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/druid-filter.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/druid-queries-template.sql create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/engine-filter.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/engine-queries-template.sql create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/hbase-filter.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/hbase-queries-template.sql create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/job_result.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/proxy_event_hits_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/recommendation_app_cip.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/relation_account_framedip.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/report_result.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/security_event.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/security_event_hits_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/session_record.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/sys_storage_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/top_client_ip_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/top_external_host_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/top_internal_host_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/top_server_ip_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/top_urls_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/top_user_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/top_website_domain_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/traffic_app_stat_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/traffic_metrics_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/traffic_protocol_stat_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/traffic_summary_log.json create mode 100644 TSG发布版本更新记录/TSG-22.04/qgw/config/traffic_top_destination_ip_metrics_log.json diff --git a/TSG发布版本更新记录/TSG-22.04/Galaxy_22.04更新文档.docx b/TSG发布版本更新记录/TSG-22.04/Galaxy_22.04更新文档.docx new file mode 100644 index 0000000000000000000000000000000000000000..81ecaf86510ed5a7997c21eaea3d679f6f5dfb64 GIT binary patch literal 57596 zcma&M1CT7;wl&(eZQHhO+qUiAZQI;!+qSvewr%(Be*K;M-+1So_#@uSh>EJH8mn@y zF*DZ~IoDK>1_prw_~!_d+ZXuf{eKV0pARPX#tKgM4$kxnKQNS^FChK}Q?-Yv(*pzm za0CJXK=^ln``jX9wj?nVP_ zU~BDy3Sswi3o~^b|JCkrGh#nz^pVuDAr`qIKw^31q%z+1gewa)@I_fwnF7-NEf||l z{3v)Aqg0S1j?FG{(e&UtC$IQe0~VH*ac`=hvr0++jI^`RxyK=lT4WA(Je;W{lc<9$ z0d*PC7I>)c{^$M|wie~`{o3q(2`@uGDT|f@_+j@jqGPd6kmAigEN=iQrP$W5mkE_r z5)4;hIx8y*=P$WxPKDPP>F@cht=%LTUd)OMeCIreavW4r`(Gws7kaz2g+Neo(y=NU zeW!L!XZmiX(#=+T{xAO1fE&4;UX_#=zpj&k@#&kNZQ44UM=_-Q7kjks zVgEB1+YLNtpz?*Fp?Hv3PNJcNtiB^dTGrpP$$3k z#T>dC=ZS#dTBzmxMjc?9?&Bm((-7WG1dr7=v;rqSPf>!A`Zzn6BLEG>VoBd+oTm6P1LnB;*7-w9tW@bx zcPHb!Rj(as%<;#&7R;e_!?aUUo%p%*)ztBO6_-`Dq~cmQ!p+_MxW~osv}AVdh*m;=R@`@=~pRh`9Pe1w3iHm+~K_!O>?itLs4`y=|$0 zF3#w-oizo8m(N~oxe^;Gaaj4l3fovyZ1MPivPO&;SyScNPj4Y`=K29 zKPY!~cCokphxFovNx4A=1ko3X&!D631M#eunnV>(sc=w<uIfKfKo?d^i`{BWq2!i(WbNG% zcrkdzjyX+z#K|#x{q2r1^{C*Si)^>`_mY*<3f%gcyvw#5keU{Zuu7a$5Sj*znx)_@ zetWwit$ZE5MA)=5Zf>o-F?#F~e0$`7;A*UmUe$s<6@y7cst!2|g3ZEbUy%|}32BTy zhZpW~1MfDc2o#=n)qDNDZdc8a=(0L`)+7(+#9OaN(Jy2MB*qYm19}Yw&Wu{ZZ{0EW zDhK&(&D66xeO`=t^vyIy7i@Bmj(CnJ$w~K$2%4(O;QgBWPn31>GJF93xsdtPKDF{Qp9nT|8|}o&O=dTUXj?a}05dd%#`5z?7aMkw{bu zrkSj$#DYr3@s#jLQyqBe5(|(51HYw=+T+ao6|5)b1aIaYAm%G?F-1TN8_Ht0yJ})8 zOemkv-v2$7tRI0c5-m3|AK*nI(3*P0rPk8Y!{5b*UKn> zm#$v&lJmeM06@b%Q4HB$LB)O4;2@LMZE^~|$qe(WBVAOos)Gg(UP;xf)(LomjI&xq zhJ?tI&+Gl^DNPfD6VkG%n;{{b5+Z6t@`Kct6XA(7qT@$td*N!>%BCk}A=i;+F(y28 z?k`v-YIGuc>?V{bFi{;A0{I#to?=PoEhqejVw(M~ctm>XTggm}17)%XwBuJ7=(6fI zbOpz-lGiXOC_8?>`R|KWN1wxnRkhBJ&U~6A+7aAsHoY#y#z54OX#@b=&Ic#0v=kY7 z&0(#sBd0f`j5PX!sm!gr^}BJx&!!GanEBKF1!FR3HfaKmw9(Q%?(iuMu{58V^CGGx zLr3*hVeg`Eo$)HFpd(OfVnVXLAPK^B`!}Xn(GnOcch7o{-zlB`dsS82X+Tw9e|Nq= zZ~VWCYhovC;|JaC;aUA3T8+iGwM=W)8L$G8g`Tz#G4dw4D#`XHnI#k`2!4NGNu4Z_ z*vR>eqY)kV(s?`=A2J>`bl>Kd?rRM(s=wLJ`o6iSLud*-%MP&HUyfsA`X1f+f(}8c zswyds;P;C1sCxo6eOqv_%5@8t!Ilq0Y5u0*etZ`hQR?eeT_z_)$w@Tr&roXE^}sLS zrL||!M>5DYV2}-AGs}Ss^I*laMy_i=;G!O z2iV4KAO^UBJ4F2D9`*v!*BRsovb$Bz0K^~|sKQhr0S_u2j{}uTz=}d6XhfkA*rZSg zBAIUhsU*~oL=qfGDgnNr0>#&FOk6qQk276d#iV(cx4#3is|mLIE*cds!0O{6s7#O2 zc6?`_Wz9XkZDD5LA}#ApZ`7gMgKQ9ArGBnU75`vBhj#&__u}3>2hMnV89{#AgHgu; z1|$_4sQ%|SgCF905#?((`XA$g(UVgXI6`S6COi{YuEOxAY~J~R2b$#$Q4LO5&={7M zjFEGz{Ou7?(UxME_dg?XGg1wGq((s~`(nu;aYP|lK4nS4$^kn_M+q(2c~=#VkXW@? zFD{>X3vD3N>M_*R(vUTiPBK9j&*W7k-8H97Xca zf+~=L+-8{)PiICxtZnFVm_g552wAem>u!_a?o|eHpp)nU?_3N$!}unjI6U!P=FNXh z=p(g;OBCpdD#KJfXVC*#J(x%>E=x}vH0c3Tu$o9$tHFcTb${>K%CN50e(aQsFJ^ss zsm)2u@Jd@PoH6*p4X#K9p6VChq)_B#NG)wNW`z-L*{S|cgd#z@(oYG>)9eBww_vR5 zi;1H=_lpWDz=8CkC-X|zmqEHz2Ez^dpuW} z%B2EN!}dc(frkpVDH<|&01HbGOav^)F)?pP1Nk$Bf0iU@PNndr%KDZ26k*9Yh)Pb> zadtj?UsZAA8(_aTcv~S7&QkW)T@B(X!C2t0J2)dKJaE6)Q1QaI{&M4vhsdo^g)Df8 z%5~A}aZjlHA0_QUa*IQZPs;&=N7C`UU{|09EGsDiJy8(*?v_XsqA1UtKcZ(%hItP{ zg90aD8H<)`iE4>tc~!)+KcM7<3Tc5q{KiUq^daGAJXLe!o0W6pK0hy<$~nt!DTdGr zWM&ZIa;{Sl;tH6KYxOPOU~dI`bMPFR?dB_!yPCQ2eci&O;Z8B~DEAmSv>U9SALQwP z`F;y~|Gwqi-XnMGi?Z_aL2RjTXTXsMKLrQ%+C}#8vyoI6YtF0DQ(7! zY$S%j`BWbA2s^u*6oTYZH`nZe!cl$%GWQ)I$j&A+QSg>-1Ek#SUgmTTcpOf|Z7_w> zmK)uT7#Bs=rVsOa=~80e%6XUabzpUTS)6Hm0y3)pu@(XR$s8w|!=@TEUDCMlmolEy z_4#}hldG?s+iz5`V4suKxJ~GM|^w>O%a0*z{_X zmHrXQEFApxk<0zaZlj-B0&hkab5jY1B9J;l`xB68ui}gKE!bWjQHE1cI%E<(RHAfE z04}jGV1vmC%OdUN-<-6*2Fz!a2 zJfqlC$F#fZMYi{2Nbi3j39TN)5uZcY()&swYA0+%*po-|p{bSB+Zse^JWV3HcVb9a zJC1WaFY)#o-p>XwrjDEzKjZ)Z{bwMeJx!W4wwCNwRn;hOwm&X@7#S{|VqNf;|<4cw2)mjjbtj9rY(@ zX*{ihntuWx#^$^nR_>~&p#!)5ncDDC4&To#4gZ{crm{d?77<7_iuJ1d?bC8r(EaA27b-s%VWirQ zBl^{VwuX1FvORcN-I~*VoR1PPUBRtSsH2O+kCb8n=u8?MhwT-ejmQkm!F~a6T-ny) z|LW+}*Z>rOm>-A2V^RM*C7H{lg7#`B}UMnD=oY-bwwdgPDq&bzlz2522nR)&D3& zOHv|bvfIeADm{1y9ehFC)e1}{DIOL4 z<;J$$)iM8Z9gyEa^P(ut>+g3>(xs9Av_&3fkS>^?-J}uitbuLeh?MulXudw@tUaKR zw?6J>-+6K|AC)s&dGTj{u$33{;^lbx7ls|&Q-~Wgi1V?puB3Mo@9Z%{DaJMT+{;XnZ%<$}F(!t#tKs<}X(4tBS~mn#HrM(kG0~$kq(nB`N^9YI}7=gPFc+ ziqf1%uIbSAZ8>dxryAIoyMvZSt{SaMBifo}M(S1@oq{)Y%$!@#qnXnXg)CE+wfy;k z>-+lknnAnkdagO0?)K8KZlMhW9geKb_{-x4)RGi(`6?!N=XTCCkK_Az5jO6EODU5L z#INs2$lA@8k8F>VmhM^lR{6N61&7|v<&4Fo4cr^{w7&##g`hkP#LbI4LqiwJlZkQF*7Fz*I_|#!0$t0$GNs>Eeu^<`YSW%+!ll zDN_OXZsPNS23Tl!>}GYU_gVUJaV|k_2ksu5gQ-G)U(me*e}(RV0-!Fij^I!ce^}d0 zhg|_b`c&q!so|`TaZ{u7el@^@G{Ymv1cl9?we%x?c6Km5DY26;X+@dYLNlz9e`+o0 z+h^6N6=bwX*X+vZ+uO?ylvhFbLpPr!M*2~YZ8egmt4$NrHf$7I=_vPn;Q!}?r~N7) zi311#z|@b0|L4K;Uw+-$)WyZp&ir3?yjV?J`G5_@??&cZc;trA5lQIIW)(1z#s)dH zUm@4@gG8+`N<7hcp!O!gba-3nZ00)Y$hp_&MB+DJufy_2(7Z~dCPFSu5MH>7nTm~h z|H47TxA>oh(C}ymN&_?;0r21Se&1KhsFn<1!!Gc$5V&_PXon*xa|U?}I2?224FCaC zF)G;@pQ;;x5|hL!OskXSD`Vob64%6_LDWx^z(C_!DjBtBWRLvG|d4 zRVk8X1g&il%;|LH$~ZD1$?aiqrF{d7@i=yXt)Z3%4SlVMS1x0|xVPMNb>>76kJh6B zPDKDujL)6+jj&G&}GJs8ymodSGqYg{Y7iLd;TSgP?~`t5bT` zMnWl2wqOVFVu1lqjveN(I9EW6!M&J3t2c<)P(xu2zkoDCXt*k?; z0h^oJ#S9fIsl91y+rl%31KEFp5tm)^$$U;UzClZZEg_bUqfY5zlm!DFbiLG`m>F!c-;IQ^2y_kKA zYmI#<6_r$xU&t#IU> z-Q#`mpfG?0=?rFHoGtxGXv9L67K>sXo>Q-3>^-+p5UtTgTk(K3U&qID(0^si4mmkF zXslb4Rhx1SJs5ZB(#Y-T>&#}r(UTWHkp=F|zI$_G#G0MmK9?yyS-3Nqw~4HgV+V>} zYhX~qTeH5=drPwQkK;boLC&R+^0M}3B+~LsF55yy&HW8v$9d|s&vZBCx5LOn9!=}0 z>mk++=b5~Rlr>nwHn}WftKAtB?3I?;e|#~Q+KnyX+s~@UVUH?TV_oTvE=Lx_OXYCf zUV6b4(Vf~iSv@$wy|6}Zyn?`z(Sh#@ol zObKeOgkl#*w&8%r(CH>rX?6==TdVsw$wnO3UghC-_Wm3{aot3*gHr?0U8MZ@&-_R( zo1NvWfrC?0s@u6`DXs0fdoZ>=FrO0{?vBYb#MHl`9NB4AIM|Azx;nY|I`)b@iI< zxN`UKb^;p9_akZ2ox$;VP!hY$Kt-Sie(j86A!y_>+V);xefh}A)VP!eX`$UrFhWS9B}WX4KD~; z$%E0?9Z;uwdQux6uvQ4IrQN$IzH%$J`#}|uVAAJHFRhDNx2yv(8M&-L+N)4+y?b5z z#0FYXR7lG*8b#=+S~GTxdY}V9NhFX&ke5>8L-fZ){ug9R1ea-&n_kSBzw+$!17~ChTFaYu<2?P3u zi|^j99s{kU(1>{y_{$FMF9hO(5jP~LRD9;}UN12*w6AX@h10HE9d182j>r&b7hAhI z;g#zWI{B8ayZ zBWH)v4a3Feb2h%FggR;j*Z3P_tB^aaObL`uoo7Xv>0dX*nC%kJB|aAWTtY%6!ZH~v zkaY-jS=czs)+E00AVWFNz+5r5Bxxp>_w8{Q%n7z^cA^w=x~q7SM93fY7{U=mH)Kh4 zuYis2;qP#s0^<`dJA|uJFXL7Y*i8#XEc6IZCIh(bU7;DOz1@_!gjL00MO#Xj=_KS6 z?rei^kn9pimG-|mJoHt@w~vR~&E3$0y-@8GbG4(v5BDpbv1JppFxZBiqP*y5Zid&s zccLCD{`!0+@~9gkSh!+L#csUc;@0wb$3YbHau$2&pB}XS+D3LUR9HKUBB#4HvIN0j zk_&~T(HTotv zn1BJu>1izwDzQgL_zw=r2>5)yQtnh7YJI37-Ure8A0&{tP{Qayo?`E( zKFv&~b)EJiSZ2DEAo5Mw*$P{Q0+Vnu+h0VTtv%yxp(_a2GEtUbbOYh>Mp%C|Q_1#t zTap5rT`d6L{#@Su1323f&ZA9P$?H)6TGQ`9#L^z=(gXui2t)^2f%&-*Q z7ZYMsPGOc4-UTJpCDtt}vuOrvVCZ@t?Id=MX(5=a`ODi37kVi>;}Tcsli&hrfxf6$ z&W>wJtUy6qz6?=WM!i(S;HPF{{k#ZqY+YkH3Y1I%fAXsR0sqtTrf`}jU;Jo)2uaH5h^x2SqnEXaq# zZW|;m#;yHk>>}*@};Ql zvp*(#J-X>zX^PFuN~i^p$x=RA=Br$ES5ie2sC1VIn#?RBjTI}emQf}Vs@=4eRqE|I zX&uYymex|PG$N%aA6q4-e1)j}oJY=*mhKgAy&%(hRpS|2rwOS)8udF(b z@q{*>mhvzwHP1LpF5%0t;2`u9x&hz51KG2c8zoLxydMJL0hbF;%ebQZnJm>C>x7>fQjNnT=m-RkV5rpiB|%W*=((Qy>PmvLC$syIXTS$NW8c7THq-9V~^X-~}? zbcN*U23eSK)Qyv20j8+P16Rmna>OUmsmsOiqP9p!_Ymu@_bGW|m~7O0xpClVPp+(! zI@8-gb9zT7EUC-O#>6i5QEvAxleS>Njh1Bbo@5xX(A#BQke<3TyNG2d)+bfui?1dVSQ0h59#TWe>5{K zCu#t1PDR_S@NV5!3&e(!;9t7C=F%gcNj2?2!8^4o*{CWD?l>tI>oRvSatm}}biUnr&Kj#TOKEatCxhx`4N^&jfkB%-WdE{aPm;q#_o6cGtXQn1~kARiSCDb{*O;P^~aRJu~k`nAW{(0uR_2fp+7e2pDnK73&w z@QtOYA|~Z1Q##wIZwAoM0i*Ez62M+Yc z)$jXrF9$!@k8h6z9k5tR8bjZ7nwG~&5Qlau)8fVAg;suW#X>zC;p2QAB=6ofFZO)O6xy{?uCW@sD#Ab*Fr=zmT(7C5j(Fqd@)0?-`)2|W;^(p|6 z8V&vPeBS(&zVO{h)=Fz8^dvAN0?GPyM)5Bv%&j^4uaB7r{!g05&lo_HE#R>-3D95? z2vwGFI$I%{g?UC2=)LF%GTaW-(`z%++t&m09pA_}N(68yePh7nz0-)6h&eueX~%?;ZS*-V5JBL!pMvT$1d??l{%vIh5%<{(tx=fVEmD;w*3)oSC56i{ zW28cN=n%<8#DlDOOaxpA1%ft5PPRiukF*CHrrAI%L&j!-B^cTYCB&gS#V#1w+knra zM;zTUHQXgvxJp`yE>08zmn+{9YN|Sy(DXnYaDTnWTxN{$urtbG3L#NO@){s(kd%kE z&Cx4#g$mFO`mtihZ(q4jC%tS;`iYBqFJT)?5Tvp)F;QVxNHdipLx$XEmeDb*I{clw z+4{_}28wW~HvYd{us-D@AnIbw8u_A*PkI>%&CR5=_OF~?Q61T_M3o0+Zdlfi;~JQQ%jgK56j!*0SU#B^_M_(u{CT+au{_%!`gVx!g43^vu-=?># zqWxNSXc|5*mMH2voZ#FjKt}%VJw98CCXPou(KK`!ICbJ(ukw&U+=@oEC1<B%t5q}&unQ( zJPl=*6KJ}q##xuwKs+fMEbNy3+u>+`X)?|2OYPQe;Z+=8q=j1A)w8f?4gq#@QD^cF z582_=aHBDO3_?L^i44wB(=KtFTUz`+fc98jY|D!br#4^_eR z9z`xYaS#yH^08!0zq?48J!@!*UrD3{LIZ?~I=1?}9dDT2evU5)^9ZA}g3-n#X}j=; z+KGgiFLBX)T(*&RS%j<@zda-(ktN-lfay4RZRerx-@M>=`Hmoav>*}3$r{rnhEw12 zUl>s@+cBWVtv0xKX}pd#FHnk$;Rx{^_b|E|7x%&E>IA!vwAd~uPH`e@45J)))}#Et zWo5j{A_7g&X4xk&>-)+<5;;)Fvc2fA##tV8cnLrkMas&nlz6(Hx$?ao9%nRXSR*R- zq0Dr^edqv8g#`KD#c-lE=Q<_+vK3-_iATcmy`>${+r##J8$jaR)BD}wAE=AP%KKuq z#Z>2qO%}&#>m=W_8HuT%$5Q7B=-Y!7`+5TEQ*=RB%G}WGgO)uGLch+iR*-3jiWyN? zS~F%DjFHKvq!)HkDvqan^@uzQ>Q(b~Yw@ll-Fx}^3Y#obYq-%q3AhgVN*3{A$JLai zK7e%$ESh;TYPC?&)htBebMOuMkFz13#(6fX%}l&xUAGB{5Zf`pc&9-{kxc1$?oPxcV+XDfAss4M6VQ0Jy*hW`!}al>1=E6 z@3}y(XkekH-Phipzk6pn{nOrGR3CRag;~F&m8%JA1S2#2k-QFavmINT<&B&552xnd z*8_!npN&dXk#Nvf<++@C9kI>nt`nZ|${VcTWA#AEonXJk4)gPRJs(2GUk5+ThQ(o)rz+>i|Dv7bv0O*300#;w zN7DVx1EB;HC|$zbb@>6(gH#+!K^rw6Nl_h2l|QA@vWB#eHLL8RBx|)uqF6uWmSO(= zl1b=+Jd&{t7m?7-qL&c59({PaTM1vhq$;Sjg;2x_>6fj|BnaQSIK~`M> zE;A*icqyhBjHd)=pdIHa#`N=70)e*LhOGwGk1U2jrQgO+ehnygSyxKmI-+OlYC-3Q zT{)=Z2wL|~M;agjvn9b?`}_M`5cfw#tu{0?_Ff@$R#Ixi`NTm>61fw((`irO4Hv;D zO%!R~z0fHXS7HVKW5V}3|1seqadP0V~myoNO`_DM5(2ra?wlEP=e4<|Pvya3oDo(g?gX5i=fi&Khw>{%Q@u*Az_kN3=kVkc4| z5)deH*By9DmK{0^B1zCsgZsH3yC|_r!_~BSoD6ufA)FqeYHv65nl84vRY6%%S6ac= zNV(JEwsv2QG4edHyk}(>XrRRt#T#u@h)Qy@Bc=!@hR;uH7%U-SDiSOCW5f;@&Tx-; z`N$OSy)@%O&Wv&`nS>E}AjzGKDJjGel9y*3@Ni53D`LI%R`hb;9$I8WD(Je<7k(YA z(qspjjR{f!PG+Afw9wG_r7k-NIf0#_Rvk^qU79kC7Pc8tQw97kW0kpg_9;M1lOG)0 zzaI}!{q4VQ*WLivojhPo$EYpRD)W>nMQLNOx#+#9niExWfwP`!*0Jqu3FgRCg8{Nk zcKZ^Hhv(sr^?~AX@6w1gknTOF61@n9+QY-%?j1{gX^6`(3YCQ)fVsmmy5uUNdk`3C zD#MV5cxWD+x!K#P@F5(<3&b3jcr1t+&R5KZGU|RLzYldRnBfUK;c=ojP?E@XN&a&y zKSlX}INeVun?AiRFuI_c#|aqQ&I?4)zOlm2I4$hG2GVhAlSt_IJb90uPc_UR$^=j% zc<>D=fQ3OHg^ft>h0||O{;p0Cy^fY&Atpfqr$ea^lbJFzjr!|hWRpmB#4~5;m_|>W zPRx2#R)zFMv&6bfScNoi@~Ba(Cntiy?&(44(cV0*;=O$>ZoX z60z`eMh)<(yZtzFu3HgswX*LjfZ-?+f z8*xxII}a5Sr#2D9jgl}i+yw(gxGfy%B%Oiiw~$Q3%pt+h1fY-f@7i*Svr0TE>mkFQ z^G*kC$zYVa0A?fVSv1JAq_Nn-@U1Zhig+gFWTa}@kTpP)u49d}87DLuVdO8eshjEm z;GkX>NIewRv3dapqDy_sR}CfNC@>zmj4$`m?SXFS|(lbS;==xAlE&Vq@E zN&xl!Ud4k$p}9W`)0G%OtvUWR&S7%C`cKCJmjf18 zUHUsU=tZBA@nZmH^vGHz4h#jyDeHjsw0mLBkzJEe;3KAj#{1Y`BeY(DT$~z9qtQR@ zmmxFm&8cifHh*ciX2Ry zZD82Cpwx$h2URkVfoW@xVJf&{e@C$dmT-^>-q55j8fluA&YPW!!(RhI!(a36>);%6 zf);R9lk^+y`4P5rbl}ihArBel!)m%QkE98EYUsew7h%{z8m%y?II3SXg-eU9Gz6@2 zhcT+0uoS&!0=iYOQM)$PmdT=^)@Eqx{`xRUbwd$9)FDJNWx9e|0_NaBOk|I!S+PiC zt{K(LXbGiHg@cnRC2{FnEdq-S8KI+-bZjD$YJ zas}Pv1yr^V`9B_KaI}Z$mch2|7j=Ec_>u$VqJzVFNE2Jz2dm8{pWo~2?9F#}<-WQo zYAeos*uFRdZj0%3utGUilR$&MIUHq|7jsv~W|hReQz2X~)#tv|YeIJwUR%W()P!JT zLqk(XPeZ*DVzTgST}ul|HA7e`ZRJ%f;z9KE+Y6p>P@$F@uS`>$nPy|okN#pKjO{&OVH?r2!OWw zyQ^EQ#0hY-R%kXr<*T0Dz&dind2ynBWlt(p-(SNarIXe9I}!}zJ`+r#h!EO)RJ;ov zB6es{mdWNIF6xzWd84LgO*^xOIQ~}4!DMMwH9#d>npTWoq@<>>Lkb<=aTd;n^$#v%NMt9im z;N2iGGvgVHxUKE=mTi)W+>->j+-{4O0dh=yk2g{jvXdMD1NWNzs|9h)dPRNF9XIqE z^%ZPCwveqi?)^U9aEiXaN2be#g{~cA+7}eY4kk6$nB@8wR^0ct>ZG)&Mk zX7+Y2DuzZj|7yeUR^PH)XF%!s-Q*tbv@-%106%-A5TiEp6Z znd#Q6uv0Q$$yI9~C7r<<0d-Gu7+eF8T>=&17AB1cZvw>t2Aw?MH8p(CX1o)pW zZ3SG=+q*qF2i_dY41{uvp6qZN4-pP&`^YjD&*@Lf$s|d{Ub4iqm^IeOpAL8#ScTCL z^}qo;W*1u!_f0a9M-365)nr@&_{NHs=ycAAapRI*j%8;8AWyW)DL!85d|Huf``)ki z4?RE-FaiXCUs07P;bw&}5KNOHG4{I*MZ`?f54IR+S=H4Bw^`E~;;jY%U^l^pzeHad zF!+FQn_*Nbk)DQ+mwTiV1iqMw6tlhmimp4?LMTpAk`8gjJd=x{dt{~->=xqP5;6eI z5#3b=2TUp`IF}^**5MPr|7zK3^#LmefI$=)Fzap=4PT}cvS7=D)g5ARQMf6QLWl3| zxmp&5uJeG^O>aGYiLRoBX*NR%Q{4200rmsb6)_^iOj&25=0FVOZ-T*Y(gXu{42&X7 zS#ypjqVO>;jzK3F9)`sacXC|JS2F+rC`1U~8?614d*Qf5(Hve;ahI%(_U>;Q7cMaY zmZ-`=#Adqi3hYogPbxKevPTDazwHLe4*~B2sT;zsD+K==yZRLU0o|G7>7Kbit;O-(Ef|Enp$9;dxHCk_ArIQ`$60{#bRX=`Y1 z%1Gy6XCB-Qs-fz*%{tJ?Ze8tbSC<`)0Y!vI1OXzHfPnr610;z1O8_C^HoniEL?pEDn_xA( zaxF-pthe8vz{o=3PLKd;S5iA348_KPuzz0I1URAAiP(iK#GMjepfF@r; zb8@3IuNm8LKHEoESLZ=6 z4>{|$bnJ3P&^4P^x5V9lxve@@UWNWjAmNkkT2PRCkL7O_0y`1`Aa*s|=k)`w8YmgN zERM+^cMEDfqPfLo)?NX&6u?NQKxiq!M>_7JcGmgf4+nq`e z$sX;?k@LJSu7fGsem74cn+V3CNZ5x<>~SBe+tay-*lUi&F_X|#ZQ~agAkECL%23f1 z{ot9*#M$sQMw`tbWh89@>Lg_Z_{val?Czg6q0N^c1HJ)ids;PeB%WG>!ocGpFsmn- zCGEV@6~wKsR;Eq)o_|hiZY}IQ@MG?Lhk8>~Vr%?gj-zq}(fFT~fDUh{BlHp2a*R95 z@%ZzqVNf87^!Q?HPwAdQX^D`Uyw34#7hG-rLSr0=F<+2HLV-=kS~N1-Tjj2fj;X<{;DAd%L{**`Pcn||3PgC3E%5+Wy)1pK(-%ZoLcrD!dlFce`>O#wb( z6L!LQp-!eGw+ngmRWlj=k&Mx;^eppt4$7zHDJR(V*OcOVBkvOXsT{Y-3ZDyFV3)CR(`sCyH;Jdk2Ma94u?Rzm-ILocI>h3 zaqE*Af|=46FPV? zo0e1N|iD-?`*fNkYj0WY>?pD zvoYnny$%YRih@sP@Vxg%eYW%L*pX#>$)=1A*;I)WuI(DSc?gyr?I7f@B)sO%sl((e zP}I26SX@NpvE%!azvAFsb>|~ygPnr5aP6Uxgvtq_$*K#>vBxMONU|@z zbHyCTIz8qwtRc9o?Bj2ttiB|7%YF<|fzRa$FRC{M7cmF71iqYK)!7RaBM-6*bD6(| zef7+n|Asd^iXq8IF1_}s6btfLdqShuKq$VGlHKgZq{A|bdoT`6e(0dG(D^^`_r1xl z9yx8Wuzu}X?%zqKeqmHAp!A||N8})zzH>KhPyzSe(av{LPxGTN|7@bmkd#J&c}Zlf z6;^{`HfV|Caz%B*#?xEBQCo+kUIJsmpVkrApWbd7ZkWcdZm{KTJ^3cMYF!V>%sFBL z8~a-InH12ej-wO+EU|d5Ur{?6cS`U=sYhJSyI zRKSewu&JXAT-G5hI0ZF6%}Au6liEr19Y?c)s5U;ZlOVvsHu2{Kei^`-D9tLN;(YM7 z8gOd$PG3iipXS}mr>PNFf0yjPvi6iq@SYmHw6Tr#ctU&RN*%3xzAd4XkUi;OT_^J@ z*qr$3Eh8tMF428SpuIw?B@k zXFBe>&6Ud~#!d6<34W_FBhab;GoJg|H}plU8+TA24#5B8y1efA<;?qikCD&fcOG10 zftTU*VT`NVY!vc`MkV2`U<%bt(fW018~6Dkv)f&N!tTpgwN6d%&>_^U)l52;5@?Nx<&o=>wexGvdpN& zCw`whbftYMFAMQ8HC$!*jt1tWI+csoM&+*hN98^`35`z4qD7G`wVi>0mcmIQw28e zu^w~qu?9+y?}-M}PUM z75kD9I@ctJFH;f;sEPL6ru%^i4`S!eqgHC;?e^W>Q;3Rts!eu}VPGq9L~Lcnw<#oN z5>{6zP77w;_pXo)LaD)yhbq+*5PtY!UdkA>d|vSR9P&9`&^!SZqtWlu5MwV zfMT{aQfAD3KGGv;4nOy%ElslO7>@7MO*2+mP4)Ks?V@?L)t%kBXUM#6sdMR`0~48S z%Mg3Jb~>AqgVEy?Svl|oX$5n~T~sc`-F?Ka=!ipK%u&Mta}gEkHQ~%~E#A=M={xeL zA4)Lr_SXQ>@HVd8p*&8_JT5wLp+EiZPxWR?!_iF(J;xSc1g;YUzh4l05&Uuz4GG&Y zrUGmmWHzJW>aTCRy|IJU&WaaXXvntc@6_?9GffAp?NWhVWG+p|yWI(v+Rac4{wd*1 z`35zpcfHJUxd)AWtbK{<$mJ?JMB39gwL07vN0#}OvNr4jsgjYQHPXh)IzH5)mtmQur2F!C7Z2 zn3T)tEa8(beS!(GTLQWG=JbG*mCh_AuqXDkMuXc!d00n)vbWs_Ej6fz_iCA%Q(DB` z5bce2p+GFz9>lFQa|u~#O_;`yBkL&4eAK(?wzRF*%dW*=7aXG6ht^A?+=coGpTKi=5BaVJD~zt4s5PEtpAki#}Lm1hu&qnW$8@vn@CCD^T?^oKC9TYMvRT6{uvvD)20@YJ(a5sI%J<#^^Kl5EgQK zvuVv4ZyA}$b8()Sv-htS+H}}(1Seb#zmRi@k7%(??BBxrJ)~4gDxqg?=p=KGB1J|1 z9{?Xf;J+Gi%<>wmysFL>h|w5>+4fky`oQ4KuhZ2+;XlMoq)fef=vN-y`6$f&KqJ=6 zU8N-Ju_x=11a}l@o!0s#vB!yf}+}zvoVUTX=Wp?D-Dix!KH`sj;>{or&j193T9g_w~9B6BSZjdp$9Y zg=H;R)iKG};#lrfTkK1-=GqeNjvNFjzwNL|%zy0(F%6144Q{%^r0hWoSP=6JMJhQ; zo@+5Sm#Xu|Iw!JosiB}wx=j^RVVRDGU~;$tyDR3+xVfFZj{cCZ*(hS^xx-w00X>H< zoLEKK`!4ib?!$L51${DBR-8P&iE1oG6N+>gjc7|Af1;I%ir}rJ)o)21J6~ZI<~kXl zpPh0Jg;{@l6Y=YIY|ovr8pf+0MJD#BiWXyI*g+|z_XUQ#w|06z(6GkR)uwfy(jFP- zuFq=I40p(f@bLQ_qZGrc42q*F12@7f*p8#%;Y{w?&FTUd9mfijVwn+f5R1c=W~$~_ z%@41G+Yr(^`d{UdMM%b}u%l%^0wBFCoY#{cj=kn(EB}E?A4p8yl9LGY@Mtu~T#(*r zlZL@B_R<5vN2GZ)5vn>=nU(j)W%209&HUHsJ4hOGQ@i?nr=2BhtAk*yH*0ECtBy{* ziaEGNS*OG-ZXU_YkH+(AuAgz*S)(&iEJ4nIY= z+R+Xis=aD2HHGoiX7#wdT7w`xo(BdbXrI*&?!+Z%K|zyX{RZ7d^d8YNU59P58sX9? zcI2J$P((%AK&JYm$${N~L4zD)tIBKw`*B78*{j;$NNj_w&-My4A+Rx0U?4n)%h2vv z&O@W7^{&uL$s8Xm&)QTEX;)`f+QPE|XaA(aEK8e5RvZf0Km*DLo8oVio`=JguS}+~ zRXb4_JiGdHoRJqti7NK)ch!W(BopOIF^76j6VGd#53o=JGkB>k)UMRE6j!b_I_QEr zwI=L!G*&%LJSv)oFDevH?^Cd5x9Mszq@Vf|LSR7ff%2CI=H}{xX*kk4Et#!$Uz-%T z;n#`N;)sl(RG)V+L9o}jn3BosrS3e~pRH=P9CP9ba}uO5H2F6gbQ?1FtU8xD=e9^1 z6)RhDwqCJVf3c*&Q)0#y(UzTZ58;D{iZ*A!7rQyKbZ(Haq7?hQoFp@2<09{i2Vg>x zTVaK%GE9PaV6Wl5ENilB;HF0qcN;~n98Gq-;D%CuvYHy+6?M%3mMcX{(d2lYO3w7DlgR|6|~B2qOfGn3S&nmDA@ z$I^dPEQkWt$a?cwV9cf~L_1wV+IJ_IzR4&y7^k8;12*2JLe$HCd%JoT2Ian92(ONUGFF-cQ{6SD+ zi1-5ua=9MDZ)m~7SN?p|`~WeU2gIh}4sv`dN0@A=B)tqFofA)M9qdufV71BMxQ0uZ7# zmgy9aB167Eez^OhYLTc#Zl?Ognwz@p;Z+FC58EByFyWL!-pR|IU(@r^F@zHB#S*Ee zgqZd%wG494vF21nXc*0L&wVManNCmFq_|%R+z!dUlWF_(6$^%|xN+-ke;sE)^SpWt= zp?nUL?v$sb*2FR8U6C)iTgc;ALlR>?4V*Z;ciM+sXx(CN*ZqLkA|2s!=PA2ycpf)X z18iaJ!aK7xoUcvRm2&_o`S@^quA=hwL0xEfIKpb#gOg!SV=$gzX^{F{6c3xkpq8&& z!-^Oj%f2=tEnNM^5PFKyHut3z(%$>hw8bY%15ax0=eCXj+EW86!Et0yZS*sGIoW@e zg}_rU72^L{7Me=2aHvUsi_LjqKwatXF@En4d(iT*P>69P(KE|xr(=Gz?=+23UelI5 zu5PGwaJ-;Cz?xxsdHLtjTwh^Hd7h|2yi_2?F?t2R=1Psl;+_=q|q(NS< zLFk$|CxJuLxtO1vf0-l|5j?#H;)PA!+7^D%<88>jes@-OW?5O9ZX$lf2U}46H(d+o zvv@VY0!I68_xW&75xt1W2^NiLvw#Zm5B`9rF$LSu45njb7bQ96$Gc zp?p?FBRi#=wvJy5l@GtZC)bErh&&8n&T%9AaoTF5<@Q2rE#(~tdq4Ota6g<=ws;n} zT&*MafKta=yE|DxRU>f?%RrqXInD7b6ws!{zo9w?@ld)N7-!{~Plyph`a>7j-PNPi zEXEn?>$szC+E)lrJFDxtK{+TB{)KNgKw=Yo=wu@TrN4a#3zD(5g$F${m@0crT%Vw4)p?zQC~iN>GWoDPfkf;ym?@%z%J} zbH@XIoLmD2jFpIS_zU-qbjf>aPCyLNwsFnl_pB7ZtP;jj(x>;+3*ez8`=$qN6gv$B z)=`ArnG(JNl&V2xDYTWU)RR?HXfi;4xg(2rQ%*2dG(7;!>aOZYh!(sRR|x&4%?P|^9*zfnKr`QD{ENAtx_z$Biu%~J9+@*-4D!874JALF;`-~wm; zr8VuH{I}@WWbTaokOiclRw`H(s@-tYcwG4=q^kGJR{8MI)>Q}!U+B*>CLoy%Sp#JI z2u8%n=^>H#(ne{i64yo0T;=tRQ%ppZWj6`~S}Hx75E^{o!~nnnMpJ>Bh9@4b?KpF$ z20F|^e)ti;;@E!!Jb-wvu%26~VM3QNn1T(s#b8sQ3v3#4ike6ff=;6hF9YhfawLF8 zHp6a*(v@^H(f4FY66fK#@-VtkUF}|GJoCs2<-BJ`Ul7K{P@>r!Qo#tB>bx-^YG+w8 zRWr7YrAmXg;{1Tnyb^PCkSB?O@(R3uER1jzq@IGU(<(fYgsVzV4m}L#HWZLsawIsz z5pp1W(?FwAC8Q&RqVpR_H|3sh$?kz`$mWuTo_Vx!IB{@gtPVmj(D!VC0YE$r5m9FOc~=Jyv^jM8!!;CV94^^adc_;IaVweM%z2>9ug=-7>fuhr%O|3c|VkBbT^iF za(00~);_V-u8@K6Wm{&tDw>++;_uSpIk0B)0$PIT9zS!q?{uv;Q2K1 z+%#rCvg=7=8w?=Fvcce~PYhDjF}+`;L8rYJf)qd%SMrO_m8T>il;Z7`ap+P_K1z9m z@lKo)WZ2NR7U+~~MpBXQM2N~kKsb51|Cf&bQEa!K9b}=62l_7#c*kKnagoKU6{KTp z`|U~(Z?rT6pnyqfUnpQn0R7e(RV3;!9#cY;Va}g*T(O*?3Uq3L7_pE*=*Wfo(*dsP z25g@i^JwG>TN2n<GF*O>#DV|9a5oXFAK}S2K{n zdOZR(hZOeBIV2A^-{}oeVm$xH7a9(4UJxCii7#v{YosiFJ-7dX{$%f$8wq+#A#(ID zS5Z34O?D~J&RmV^teB5CcPrvAR(7<-Wa!mqzY|Boox^E5qt~Idyn0z{-(zYJ*NLC} z+fAo;Q@KizM$M510|2mCSz%%ai>1({f9jgZestGoVZ9@H!6un2qjK4JBiP z;Yhxnqz`u{g|gxxK#8`nF@81TOe*#ba@jL^1}JL?Cx)kyCFwAVT9987nyUgJjrHtg z2dFQo?0%bCu=uuj=v>9GcY@{LQMfHB(${A;uj=5w5)!dXi<~?<%Y)*4*%8H`4p`F+cD1l*{eW#UFvxu zLPQvcojlfn(EMeC6()9#)BbSYpnahT8c^(ZFkCzZE_5Zq_9I~~l)>LT#9eWCz#8d% zfL?FcE>+1Ry$MoC?7II?4ACc?IpgSjJ)`Ti@1pb{h^r$o*AG;5A_Hpr3foU zEz+bcYdNV|iJU_eax5A`4HknT1@`j;sh*hADky9^KSM?mhsy{t5U(fDV$UYb^5x?> z)6}uaJ1}<2JBVDhJ4_<<_}6)?_?zlKS#wm6rA&KJ%f67u(nz$Ow=tR+zt}l! zoaktg{rv>5;5(8huqF!D=a#%CL z4=bgwn+E8C?h+RlR)_sL>T3&w{OyT!XeTKXiH&qG|)`?3_ zK_HrrBY+Hm6!Xak#habR7XCZpxJa}PN3Zy13MugVrWC&&YVi-#&6tbfMUAvC zhk4hPS&{@WbFA_!7_Hr>uRuIrBTyI8NC)3mMPXR z*BqMhgi!zK1z;8DKVy5*#dja)+9G>W7!MDuYhb{_u7M-`;^@(D{HrRa=2Bc^&FF** zFkac{8kRTWEYM>n0mK4cRganyRB0fA-xXU$LiF7jdm|Tz^bSdr8*y;_D-Ldo_OumV_6MWgS|mQz~NvkDNfSFA8~f`fIdf(Ivr2>raXa6 z<;mG2UbSq8HQGfM%{i%thm|4lwBGCehn#G;xHmJtIx`RHxOj55x_d@);iJph%;VC) z6Aan5&oktWW@G-t+X2D{AST!eSz+508*kyzKqh_~(fT%Wp&HS#N_qZ91(&tQlJQJ{ z;&5<|<+B=?`A5+`w?^h275E5fv6_V;qaj40nZ`q`q*zezg(k}iQdA#03&*N>EQT_KAKD83>B zi3tiv+#@hntVG?Z{KxSsji`XtV6m?w)S?P}(?>sh zQ8uz)rU?3W=%0JrUc`rOo;bH@QR29V;ADnwLp{*U?wUlYP*8bR*SygyhDOhokMJRz-O=YJ>*9PJTle?>6A~T zNlvhB8-!M}06^LhUadFvRhmqidno09fk<2O#a^sV^@hw^RN~f66xzn~JdFLH`Ck~q zUUzsD4ms{E&C`X@H0ZW*V+}3B#6dG-YHSb*uCg?Q;w8!_n!{fu0>yVmCEm9+$3a~m znu_r9F9voB^LXVnYV;|^UeASvSXD89pKob1H$O|&^j=FZ!E(4|uwGLE$KDF!f9UFZ z(U1#g9{{`$Ak=x`+xJ}#Vp=i#_2kXD2aY+JPzh#fM$6Ccx3(Y?eB;a(oP}m$aWHj9 z!BV7_VtEgF+%=E1^QCJ2F>@dd{j9WHN%o=Bn~_uNK!KlcF}=-gZ3|-aD{P{aH|rFB zP_ekXG$aQCx;qq?UV!FWwXMQ~$pN;T4|{`elBHgi;U9)N`kH-nV2b_&P?4u1rI?)w z+=d2OY58(gEZt{RV7VJ}6we-s_tS<}V~AO4rTfOMNSd~UR^!N6()>AF$);PW0xlA# zWtF|T{?UJXO8BmiZh9+G0n6CrY6VE zxeJx~_UV7JW{WXh#efOK!gV>xg+~h8$je9fZm*s!c5*u7lzx-41V17Wp{=;9@108v z5GjMmjx~SglbItPs9w%l+Y_8pEaC zRW80e>P*03F5Fpuz?YE#E9OqqH!|w%HXCi4cVAWOVO&y1F$$~-kfu(K@M~VTlMtj; zBLfr@Qz2Uow{)$XMv$~~R1CvN`NoU>FH|qI^NS-4Qeg~x4@`bd;WJJp(e}<-ER{^{ z{MxC{jQ|{2Pd84DGV_0&_DvFX-+BfD6EdAw+?mrT-km}Ps?xTN-5Q6+2@RT$ z6s63FD^0B5)3mU@tTzEBq<9g~^~5v=WzGjIRzeOVvovQ->h5@JJbkR7oE7P_`U~ka9rk{)rA_+=9k@{7<;y9A zgEGSKq>|c}zPY^TOzJ@0xA~Zn>N1Y(*!AkH^kW=9>DMOie;E#1fT#YVvHu;!J%swX zdDM(6yG;z&_Tf$NfU(G>Berg{NF@4fYqJ<7?B8 z=K?xgkC0INDl~}I47>8F|L`MIgm`UifdUZ3mx(`SM&66Qa;%t>6d{K{;= z_1XzUD6KLen;;}I2*uem*1QG^e`tT5av@7bWJ@3A59DCKhpV?4ph;oD=9)_qtOFz& zj?Ni^OF_tGXzHnKCt^;BZM`nuk1n=ab0oztqLFZ&yDp$kc}ITDQ);6N*D~B)=1zH5 z67-O*wnhfNq%iJR&@&Gd15GSLo7qzYFdS~0_MP&%7j{cr%;pc)Ux59CK0pt>cow~%fOLj6qOG}x+s1M? zf8yG8)VS%F!pmLwOC_&>MGD zSI@1u=Xrznt1DbeaVVT8qb<@xry701>Z7+4ltfuw;+F#y<)4q-2q5H~Oq@eg8U8QY z#vfMlopSc5*pp3-H8q@(|JG9siWtB7HFG5xdSYbL*4NQNcRFW_@j;D__z!6cpd0V~ z`(67Sbty{@3Ng{U%<+`>0P&?;%wU6VYD)QG0*0i{>TR8@F7r*(f`3YOTwA25@N^2n zE`U8sB6Sj&On1FF_sAOtJDfXhTc-}iuF@rD?qzH`_1eqoxUDz`_lp`5nygfXRbcb+T0POu*M}0M)T6RIfR(ijx5T9E1|Bdme2zKX1-`RKQs>%x9VZjIjD)u#Q|3#Y@QbsJk-Yrcdm}~w%G6(; zNDJdeK;$}|e={SE>$Pa{(=y{;6I2LW9}D9{@1x)KB-5m)`YE@b0f*$p=5*YvEcha5 zqj~WH?!{Kmo}Df6NAyGCRW9k2m9M&ZBt0=^6fyLHY6m+{xm(=kuZ$Qih%+x!#5brHRM5)MIM>Im9%Avv_C z3`-EY;#cTh2-`^zlVh2ZBRu~AtmtbJLD_2T{uDtB0xuKiWm>UsFC)oX{+H2;V`b&% z>#3Cm`xTe;hrtgQEDFl)}9X@4)gcw-{hkGe9j?86sonY1ixHv%1 zq(V_=1F%*&5={nugqapKh_O@ZK+u%p4Zxl)RhD!za5FuSqlf5;){HpH^Z#P4(@Bu= zXK7*nz;M*S8d4>)Ut6`3WYlHiw{LWnuJ<8a4w(g_ZuyHKr7vjQBg?=8ZAp=pTu`TZ zxBOIMwhZs@C0jnO6l*_1p$Xh09@5$Xj!2fCxP~1azAP-CKF2J3W-~uJSz~Plfi?{$ ztuL#_6CF1aBs-3;q%<_0O?y~>XZrVFW>u)8B1Bpz#OU zE`-Hd`!6HXRYXDf?*1osmhb)%+mt3S7~l$qt4l{=L5p7Phb+L~FM^=_U`8s#s~D?I zSpuj?es<#Vkk6U`mj%ml#!kIjn(8sRH@SA(VxYUu2CtY@92ND&1}p4{E-oO!HW z{c?~)ZZ=9~-CPi#X@=Y3Z1RjNwWrqUmP0biP5C3mhSlHW@6WPRKAobbr7`l1RG6gN zx(6+s{h11tZQHJA{mevfoG4(EW}&Lf22^dB#P)lZ1H4dUbgc3pTAdQnt%sPzzSYvly$ZP} z=fKt^tapD``bTN>XO|%UJ-_1~;+rO?;e@9*clgTY^kB|n0&tJ5nw~@2OJVGy0b4(A z=Hp!oMDUnOg~V1pdz#5-Mo+%w3%;{92m8wtg=me4Ul2q&x8ub^RF#itcSCUx4TCT-T-HOmi&$fDTKD&PQf9 zovAMU_Jj9^QwsmsNO#xJr!Nn`dLSB>F$>A1)1?!VIN%??O;=--7e&sC^+Pbb zwn0ICt;G}m!9H*D(6wC9Ob4Kq#4|Xbs9VeATw`s}YQT5MHr<=>eDe=r1|0Wxr$InQ zyV5m1-PO_Y0oo~u@^^!+b=DS?@Y+?lf7h0}LZhWW=3ktw)4&3~39C1Zk3)e5nqI_E zc34^DCmgh8I8ra{SgAH@>_L=w-`qnSt34Y~%{O;^w({HMtxj6T`Uz$?wmojybFS5w z#)~_y<-kYs%9qV`eeiw4@p#gHJm|uTfZ)k|h5@|hkt`RjI1Ot+(F&h_K?{a0(;N!l z1}<4p`LD43ZyF$p1Hmpx&)+f=*E=Yvm+qWN#~G-l?||i|1sM5T_LfM&CdfWQLLRNu zuSB4X&3)md5K_?Zt3E(90bKJiKCw?{OPD}Xt1t$TT#&g(OLu3%L7Y$+AH%s#&;sq& z_6YT@)Alwky9!HZ3612+z!qHs9inDwKT>kkD?$tDLBx6_|)>lPF9?;bdIk3OrHI!;J> zqXtgMC)V~CuRH(fM>YcZv9W*$MHxtrewu_C(pVH%)6WNcM%ewh`%dLuQANKlHI|6{ zdDMCn=OmEDrn*A3in!zihB8Wce=MX81yUBiI1NcF+3}-KV24EfC+G@a0e-_#m13e9 zgKu-eeyo|zE^i=x{`PD{A3|1e*Y{Lb1_NB5T3$o&g~=dCWAm!DD|$Qy=(o0Br7u1l z??=Fc*>_I`=zj*s7XMTI3-Gumb^%53Z>e1#+E@AZ5NAh~7WUyk!ezigckVva)Xlhl z^48G+f$Ee#!3G$`vM4Xvuu6ffvRkFR;RE%sKTKK*ZYRZ_>DRAOS-TMnP%Q<2Kr;l@ zC`x2)JdC$+01GZQSen&z`%dfNMto0()Nf>iojr1u#%b)2z|{PixK%5X6_$EN!ruNS zhxOdx{6xwN{b+8=)V0S#a(Wc!9$IhpHd0KwI?0^?z z6M;Q{9BO-<*f#IW96SH3!^4*UrNiT#@?OX0KCE5k!7&oxvv0lz9p8A=j-f(N__WCa z8Fi-rQKA~=AG8_smrGr2}H(WNywip;ENtV#4uRZD2qGWC_0x!eSIpMXpW!H}!+jadrAVA3A_GHpj>_2bJEU&+m+6*0 zAo*sUw!NXebu$A{X~rW&#Pl*&=L>6rnd+go^;g^)2eJk4+ro*U);pvDSS{*Hn;_ZE z9M7UO0R3R{Q;fY@<2%fcacK{JBImbg))a@SgEaL&3tfF=>^S+tq51aqhIPO?6S z9jegPID5)zf}lXSf@yX!yL+u7i>?yO=fM2ti_bt!@?3*m2ka9vu{@;IB^5omg*(g73<4{2T|Dux_3h(Yc!aQ_ulfRU-=VYoTnI;r za5F_5QJIH39TdKl1OCUc5sv9zdGG_1=E}$E@i=~6lE369@t*yiK@Z=@P|8a z!^qWdR5!pkr^09Pi~y?bqI!nA}KZ$_xRuGJ+_#_c!7VFGS`Er zN59Tb&Omn4@Y2K1dVuUiLy@H2zy|YKI_H2@&A zDQmn%hW|MmU)Bt3Wrk(MW{0TMrD%j6ppmsmAKJS3LtVmBYn(10=tfP>+Giwba;VvK zBSMLuYlSU!MK>yj&(v#-e?v~Mx6=2jC4FT7A)|9nga{<(Iqrqa-_LDOqb=0Zd}PKE z3|Bomn1}>vRt=hkfLZN}1_ttgWcf7aH(svT;rC(T7>hRjymdlR`BlJL+4~J*p*Wwr zHmgMkE1h9f=u#s)icx9lpFRu(0p>L;`k&*BEjb44kRvqj>jv3Asgy4Pa>Sg&{g&1w zTcz5&+7Cb8ys=@Bp;0vH=-(*ogqrFN9X2X1!a5H$E>^ABvp7;!VoB0+L+MojB>&80 zNtTuEhv@_(>V2c#_dhky#-ZL}n*SKdcz^xl>9V&4+vrkuWhyaWwRyZY>Tlv~0aEl! zg>&0^rSw7n@(Rf+4Py0*dp?cvCPZ*e32kO~@Dy$4Ce6JH4F`$GOIAm_6g>{yjH5-c zp{nsO;gmnM`TjOiN_48-#;g(45oO}&zL-dr>Cn-iNC)k2<1x()T}#n*u`(-TFI(B9 zo$I&(0wMrL)7vX>-%i7Ku15jAeoHP6r(s3wiZ+#;C-+V&Ml8#WA6~4>V_7qK)<(_6 zk(&k7@0Iz7&m$jaG0dEmsZ=;otKkZ+v?I5=T(yx-r;@?NZ{xg>kk&uzt1wuGQt2b76PyL@&ma| zXEDngY@nII*D})JW6UPx8En<@q}H%yryZk%^e$O}7M3%*W3t%=h40;*3aM=AYKHfPY!f zSpGMldmxKm%6)#@n!uECTlTjOX;ps2jP3#IT(Ns}5K(_&c@EHF`7bvaR;&rkyhN+!@eR+sEx!zQS6buJmY51{8vWgKEpT$97fpK-i8gCcoY+$ze1wA#@!5}?0%-=elzMrPizT$ zLkD>a#+UE^K6~=u$0YOi=o7GlPGqO<7(S)Z$FgDNZ#adyt1cBo% zU;LdzVh`~j@AjSJsekfrI)Ik+#3}sjzKr7S5fR$iWelO2Y^^>bv|5s83n<5tf*u%F zF0LmRuehaG(l|ILkJl_(f<83G8hD&JxSlxNHehU0{s)%DHM(lb#|4c1FJL$P1JED3 z%djF1?uI6o2I?@I@R6CqN}Ydr&s-CNxEGDybF>oXw7%!P58Du0c~A#;6*naGA-fn! zMOYb$#Uj9irTv6_x6EPymLs{Qi$xs%uOC!xqH zXJ7#xIKoDj>=bJ#iNUbB8p>ofXdUT5=R-*!dL;&osi^xYGc;(4t3t{pg>nJLz}YU+ z*cii?II>dC5o32O-rC8%edUaVQ5y8Exx)yG1Jy0$iW}<3wLEwbdMc+5SSvCg|D)rD zQ;XKgqwZ);of%{GMG#I|;kX7kyA`NK>UaJ^ECX)}tvK;0K(*sKIsDL_j7WrgH6-WK zlCI^8Ha|I<(ZC#EN)R(hqkw$e*2{DSf5M$^;5S7gtNkOrlLvs{(A#%x@sq?(uo_Jq z(#oC4tIx5AC+r+s;lDlFW-E3xgKcl(&UKh$;_D_0-DWz zDC*d_+yW-Xeo|l#tO0hW021wp`ZUR))d8}<`SaH0pBPp$@}*0;;^(z@Dnz~?@X?nLp=SlFRZf+5h7CYQHqr%w-R zchtd-pYMbY;C_;3HQS!oI=BLG`~dSC^o6Zdz}iC{A?y#OWS?iASRY!c=1zX@yxW9@ zFZQK$d5|JbI}o2YjC)tqpqt&mnkhZyw8<1`wW%wQdwgp{cAr&tZAU$jG?qe^Fh7$* z)j-U!$lKdr_2L=93HzH<#9m0n#7K>p4V_5-?DG+x!&4BJO&>M4-DNi&vX(fm){)yxC5fFoUni8tqnM*f6 z>(k58es{5I(&N|cG%A_vLX9M!NXex2(-}@twI{$M%2Qt;0FYpL1y*CtBYw`+xTI^! z?!$ums;KF51VIM9i<3^k8(viMja%pnE0Yyr=ZbQs%FK(1-;%B42NZFljM9o#QDC}4 z_@#w9Agc7g+;hgDKWS^H)JYC!ZywDFbl8?E+*p#}vFVJ~-ja4OXfRDXVl1hZL*fBdT?;j(eID~k2SRhJpkflnCJ4_RHq z|6}3!R|S@}W{{gSJuhvRIS%=S!)Y8?M3Rt@t$IBC=XbbPI%q%x2&#l4F&7aU+u9fELZ2g!N2k)hV!|i z?)$SzhyWV}XTtk&q-1o}Yq^?%`+m(aN3DC%?UAP9P&GM}^ND^rI@o2$MrG7U$ww zxsp|D08Z#JJ8W9Hses#0{(aaVICVCJ-K1IY=eNb_Eq*InZ{oso&~7bE5(RN^%2}sZ zU>y&kVoQYc;xzO*M#C5vG3v6ebj@n<)Jsmeq%^(@?*%39Q*1lqk6V-NUa`BCrE68qr~H`L30>byz(F$d36nzb5h zG4_~~Kfah~IB^&UE=r7I7Wc%B4BDDGi{&y9Xd*jN(G9zVtJsbUV8 zAU~~$E(^b;D;a6ohf}T=&wk>X((zY?wL0T!%hs)#j|l#yxR~0PHd^sqPd2A>Ku+Z# zUQmZ$Oz`SnrAPI<_>e)VxTM&)6={6z^+Xme@5q=uPw!(xuD(Q6OVLl2QdVJv^k3TY zBS+1|;skB!jOh|52*hy(UHZ*)Y1Y1u-av+5F5XUKI6Q>~kd;qj@}GgmFsY9kd0E8a z&aAs^dr4~6`(*V6pMYBjoIiZ|hp!MTLio_PfOk^b(w5!aHD#1#YP@@ilab@51K><7 zY<4XxkZ$Mo%5`*{##zAX_gx`Y59v$WL>#TGQ7aZ;qh32lGziJG&a{nWXexxNwQ1aa zp$^W*ERrw)9(80U0Q%Z^Q9DlmVqx8{bY%B+*-&4b)-Xp8tGuf-XN_!*(`jHMV8m76 zMw?d;q#Am!mTX(mhrP+ObyZen_Qh5vMi(91Xc=CNhVpgrVRS)MqV&z!AM%R_*YoH$ zl-gkfRk?{l*c#p+SV}*TdaoxtAkVUIEwLjzH3+CoLo4S@He6{SIesb#JRzDVs<}5L z9qA|6SlK=lzI4hTa7>JaY@h?0pI*~_<$>6hglhke#EN{EN0Wi(2h?DW*X_0t?XxNrZzyH@qv1 zAHES6mV2%+379yo7|Ekd{eCUJ{n#pK1Sr@*q5FF4pIodC@Eq`&V95MmP4nA2n7>(; zinQyrSzKFu{zTNw{dDOosqT;2nFuI1Q<_e|if!;P&4ixNcESCNWkvr=+0bi)@rqLM zS}#KObje>KTZXp;5VDQ^9a-b9t)$qsbF}xX8!#N--x)VdG$c@A(R9%_FYYmXy_a%U zSH|mMSyH1P^^t3cjx}V4x4Phhxd2}@X=#pENZ*EnW^$${JP2)TN)_(fq|`;}85u2r z4td1Z10J~X%xGix#`fQCeSvxRLzE2^B#=NE&rnT1?%OwL8A&d451z}9;~%1c8;;be zs8862|JGP8)lEz*iVyj^Z^X=pfP*vkv)HPp&1{u{!94-fE5XGIQovdLZY86+{p|8A zpl?>GA)2g6qbc@f(3(`G(N|hJRvpfZ`8LuHdN%Am?tk*zdxTi)j6MGdx*5XUuxn=} zpCUa-gq#9y=K(bG61CYVF6o4X?R4FFygxCtdrT3aiiJ9Exv^kA5<%BIPbz{MVU3P! z82P8Hy|?A3hnu5=1}&^i15i~~ob!L&#Zw16SwR#tk7py-QE)lI;=Z8 z^x#|Hn7sd1O7s0oU?EzOS4v3b zhwR7Y^p-p}8+O;O2PoA2yTehwoS+j9jyq6%YR{b}2ZlBLQt}RxZRZ*w{;Ki2#WJNm zm0l|C)4oXqcxIa=!PV~6)|2yJ)uz`Hpg`A_7UH><`4lR_4AhrdH^2e2&HGgY4|Q|f zPe3o@(+bblHl`(rzk)m&*zuWrBR&MvSDq}{ELuC>NAa4BU$z9a zW(wIM&A1KX12>D|4q-=@EU(ZNeJ`BDXr)8~S`Dm00s+#;11GMi;55^*<6HPHJD0MX zm_SoMrR;SOs6zYU_7!~Knn|6O`^y#)4*>4*vmG%q@tt=hkRQ?~=ou4{cVq1hPS6bs zLtmJ;ZxMzT6)gIVZK4nT&k`uW*4MRY#d%i0l{YQoo95D4_RC(2N-GGkM)XP}Mlt#Q zr-Ytp+w#jtKOvZRmOMst^BMyi^RrsTPh5rWxh~{4Mk#u%npUPCmmeAug(*(0Q{De+ zGVGNDKtlr}s5XEnVP#WydgpU_kMSycPmsXvwbJ6rI80k{LP1{&cD-H{1r8xkxEY&iZ3d- zQ4j_dm1mAhk6QnDCRG3g)q_F_3;li$g&g~dDlXI1N{EhnnzYWL+Wb8bm}8-;_t`bJxNQE9N-BQ=9v*0p zo%Xkv+LP>*4NqENlBgbgbDh4%H{j=wYYootN$zY(0a;~U3H#hbAAn|0|S zRcyflpjrng_$hSIFYPd=Vl32=Bn0fj;vie>JF#VtUHqxBDf#v5)Q2nI3GDV6+nakf z-+YbRNf0T1qR=A0OiW=$EpGdcvSBjR_Z%x}A{<2$%QcP-_{6P{^fz(u&Q1DdGUW^& zZKfg^A~$|m58{q&Jtjha7lYK9pgLaoZQU&oZ;0sg=0pVeDK#?}^mxP!icc7CVC$;W zBtoG5>G6IEl#}xvIwN)}TpmiAEt-T_WTr@FPu9rW$*fp(k0U5R(LzR%>Jo2%4RH-$)wURVxY#<-#ZVWelGr$)9ZT0=^5dhhyc)QFPzq zyq;y{pg>fpVw;jGm@J@t`}Xaxo%zq`-pu^jZ09{>KDQUworb|@rG1lAGkW~L>ujWB z_fqq;t>}m?h;Y2#lPWH#*7xo=;6?1e^NlM|%KieH z8yh2lMGx>2had@KsQmSz#&$~P(N-qnfD|#{cL7^&Y(irc3HaD5&D+F9%wAl%9b1bSYCSXCU4b>k?=ts6%$?@TD@oz{`g~d)#pZj zjNwvC6&qf8?<+k-O&uzkQ(#dn4IQ+39IWfim{jKS`!bD1+XT-|x6teI^KGuubL67& zVKt(CEZ}vGDoVHT5G7jc%}|Oy2CqnJph!FA&fVJG(&_=H_SUWDxjMkJC}BJ?d?+m} z&U2|}4hGftzHu-Aye6kR1||D_tRkakt8cLG$NFw6g1CS_>Ov4>K(dar=>YkUf#&Re ziExc6Pxa4-r>=-G_GPL^6jGUU&$=OhD56l9TzjnfwAeQg+04FHu@z?0V90ZzN-gb5 zStl4|D*Vs8p)9t%zU>K*>idNIpoA@X2vSSZ&}$ZRE8XpQw*joDQw0!7*gZ!e%P6*t zLSBRw+gDbY4%WKh`yR9bxZUQpY&G-xYGtx3_xJuTz>xm3yk9V3g*@3w^M1ORkUd_C zpULJTgBl8Ip;Q!82|Z_v{3?Ry*;SY4fhUD1jXlvbu+=r`zdhlwtE}LxsYTktlS&av zbKTZ{!lRQbq3WM_AU%_p_{i$rb9bkxnxJGas&2!RRAyxsVNQi1@BlqP!oPu=BYm_f z0SaMitT=P>xU1_?T*JBI$B7i)p_Cr7 z3)c_fc?JA5FGgbg#sEL^B(9N934EEXW%QR3c>9a6lOz@V8MBtUW2}}an{*YUt57c<<(dtl}`EP3AAx;-Z9|YrF1yTA$GKu(>X1cfvUy2 zl1uqcarRDJS~>yVO=8#C>4&9eJzi6SVd~Rssb;oOL(WR=sjKF#-PZQhq-kH%x>dX-s~1!t1z<_7Hc?7cd(kE=9>2z#;HwHMzf_>5}O~*Yj`CJ zn5vAF@=J?|90QxF#mjdD$MvDvSM1@mgLiNM@;V6`aG-snp~JgV`GT*K>5r|#cgJ@! z;<2$f<4_T_Rye4qmNVlX~ zu(7JJ{JORG8a|Qb%XwL~Ei&Ctx(EF~7JCte5T>K}cT230AX3XAW{9k(Q-A(tM*PBM z7u648p0dssLqKxiFDaYH>pu0ws>q}PEuT~*i1<{Y^h_COs4UG*u(BC;KaD?IYdR+? z5I9i2ohN)J_;8rZL$h5rf8@ml;p2_{+K7Frv*`58dKepL*;$;MdDfRTrVp`ZMcH{PKh^7RG&j8!1~%I3X2)2UpKRN@Tn#lLdz z$WM*r;}dxnwV!{x@B5(I#rxA?QXd~XQt{4S)_tQ|)U{c!)pm8ZVFPhipEL^AC&vOL zF)D2!Tx$UU5#6KA8A30a2knCS4l{Ev3}q)?m9(koY>**~U$l^;a{T z5vz4endoodmdDu(CnjY{Gk#QFog`HMo({L-({qv5^!NU0qa^Kq^=2hcLO0xG}PjJb(&Q7Aai zL#pkalV{FPrpP?~%E~n2P@N7OPrDB{=wlh5jwK)0O_tnvC&(8^5o!Wq;OaIfR!Xyn z`iNc@KHVnA^1P!kXMvvfC{Hw$)g`9=8Vk76;+HEOy%Jr&mS2G*vc0dX){00Ff|QSc z`|SMT6lp^OSj_f`bcxcpb{0#!)f<8yPMzZ~k~(>C zRwj$EVhCd4HwKzz@WZOgF6#`Dej_jniP0!UL}_`(bg_5MSU%DPL88vRtMK2 zHV1TOdO8QXsw$K|Rjwt-Uy-EcX!MkR2*1m9BkLrGcPuQHw7#;H-r`mKWA^s#UFht* z_zT2M8*d;~TTSJKj}_B*5}`(di0%-6U}b<~ViAqG>*)kd{6deLfIG@|A3f_?84{v; zL*d2Z)#*KZmb*3~8t6JK5PQJQK1YJmM0-*|l&Q!w#1=HGFN?TEL>swkJYP18hQ(bl zDd~2$6{PBloz(Y~BlX0QjA@Eh(UkdVLGHAas6r$0yjdlMiK_)`P;vs(5MgV>O?l4b z!Xb4ZACIzKta;|XHDdDkog~c(`l~T#V{@|8Pz80J;W|8NNQM{Gi(_1E79iVGaeBX- z7X4(KoZG>HQyDUFg-&s-gJ!&Yevu%G&ECtmbc1e~tLF91@*=C48&qLqY`YPDr?(56 zt-T!0!2f%^(xsU_-A;D+;8(v+a~!pF&PZtO*Y{Ex+ua%GU(foK;-HBp4L<#$d8{)x zM8o1JlP7B?w?Qc^zU@Llj=65zV-*o;{31zqN_otl?FgmTZ=w93pCxc+T}@&O#i~M_NhN4jlU`gk{;-{v|zV6*sf`*8Wrvu$YTbM zv(JsIgmWcCM3gLz$pO4Od-hWqgqwOyN@Gb{IrwFv&aUf#KnzrBJFyW}O^<(U1m4h7r*^j(p zjYIvT3HoG;SFbFM@X1a~IkU0m{>bCGygzHNtglv&ZX1|kdapP&O6%+dJu|6sTd^q{ zHw2A7?GU29OZ2)mZdggg_x)s5&L_M8HRcjrZ|B2?U=+)96WXNL>C*V7+l7kTg|k)y z_J|u%UBW+8jH*Rj@+f;MIPF@BN#>&bPNZp?|kbI`l{ogOL7KjbBU=Gu~m*Nz5(cBqm4uI z5zWokVBfAJYQW5vM`O-3*4|gDwB=cLgi1;cm(y~UV-+Bd2D|i9QDzn zS&;S!*kD1}{TycHh68n@$f6$xN|+eF=U9Bc|jD>@Bg+njX+PQp}%C1K^< zrWMIwSZqqaj%+G4yy>=%a z66H(Qih8+%o5-noJ_a|)?yzY2_J-b1;e2sJl6ZDeRmGq~Ni?@cYkK#_ywN66M5N01 z-@r5}bqsJj&&aK>%Q{X+BdTZM(z``?L9;yOTg^w+BbRU`DN6OG&qn+J)ICf*ES~)& zvS45qTddXvy;UsZo8J1B&HQeA{M}_8@J7zpvKMhbw_ey{@axI9|3d9U?1+Cnz=b^p za}Ofifr2k^d@N!vg+#kP8gi`zuS}O645%N=`X!}^QdbW!FFiqZk6(wEE;5f$_GntB zOjn)O_CZI-qfcM&hw!Ph5Wbp1w@v;G_CZ2<4ZLv-t>7Oxb^^VrK7V>=7GyVy;>{ZGx1d2!Tr&0b z&we_g#QeX`5xk#Kf|P=;jN@3UVBwUXK3j)7tgd;Ku15ev1&lKOLh`JeOUMVGM&LHM zJDYFbu)Pcov<1hv(llTb-ti=O66hzg>U86$9`hz2qd<}D@umQeh2(L zY5B`(a$A72z&i!?#@39M$b0UGyP}wv+Uc8#J~!E^ac*F)~7mKXnrGeMAOx5P}cjlYIX2} z{3E9FH$KUkKfWzJ_Ii9Zv+@1$#Fzl`+FA0<0M&cAmj52bxC@Qwbic>Ul?}L`P+p)9 z4h!1L33*v);0E*GgMP*ad6&@I$U=h9$3-sKJYzP{!Iym)@$cIKd_uoI)zs_LfS-HS z4Dmk}tRDKys8@Z#{qJjf8xCJ zV2x6hcRP8_e)Gc)jesSw9~t< zXVnsV-`+_=oObEciAn2jMz%M~Z!&Pkrza2URV}66Xkc%oeU}+qd8tIE3IGJ^qPELN z9xh~nz|~)zpQN`E%FxV7yw;Ksrh#NG7u}`0I9aL*&2hUFVDYD43P8ajwJ2S%&>Z6?ZiSKnix zxBtx%-ekazD&u$bSVPpnik1{%=K z@sQ7h-;L6ylRs@q`tg<2t9BrRE`o-1@xp_Vk zwrK_Y@%UkVeh1tLD90)Ty*|-x;N!CkCx*Ry=YX8OX6Ktf@Du4An#^@pdvq$HZnAOO zh*IWdz({)KZX;iq?AGS!%=}D%-De*q$cr@XwckfO7~z=KW0>4a4|SarOX+j>+nPP>@yVB&i2f`-)nnZVqGz! zvvxTG$MUEdYNpF+fk;GBtzFnRrsl5&7Ru1!Ml1S?Zj&%_jM&BjlEvEm1iNQ4zzzjT zqV<*)B?4(eHuGr0Fpv9iJ|?tR(l3b|K01I=UA3fSuut53k3#{|ZrxB=fxU<^pJzZ> z)$(FT@`$$g?0`~?31Y$q?|Tl#P?k4Are$7IE^Rg+;!F7{f1Llh<$m$&%+%&hsvuEt zU$Nf?kX}rk^7v2^Wp|plD%~@W%3AAoWTcmoks{xdNSC{r(E`DJOlCnFy)_bGwd#t_ z1`(cs8@##QbAK?0e0(QG3S3=O4MjQnYOECqK)wQ#p<^Z06?@U4Q`4QCNRMRJEf?W? zfA*+O-DSP*+e|}sKaZZ6Ln_psZWc*wsE+?rkysV5 z5=LecOXIh__ajPg9S72LE}sk6cso9EYI@AQA({O>%C_A!rPR>gW~F>K!e$IX^|Zi^ zAr}ki*Qt~a0*RE~KKAR@1a+$+^~HHiX3e53u3JTGtb)(|u;^yf4iSNJmMF{mALYSW z?6?h3Q10HNGO=Vk#%XUY&QLd=q>I_| zZj}nnwtw-gP#h8WRAdfVkesejlRy@FttHQ5nNoRt(X7*YD_d4>`mL9JU z`G*27C!&IWGGE54ozL7)A6Up*DFQs)r0WABo4~~_+1Xs7q>3XOTcK}TQo^078r2B8FtFDli~g~85ZU1S2-O-JW}{+N`nOaxN6dQHGE!pjL%~hkDp$KyD!%7 zCb~dD-I^Z)0Fmh}t)}@m#w?DPjIZfX1tD+KGV zAK5EoiaW^7{!qKG>+Qv++-;fv$q{7GX1Xfvt9eT91|yq8pF?Oc4!e6_Ji^Sg(m9wl zRTQR6YW&4ZdA|eJr|h6=B_*F63MBr&$VCTS4QfE2XkZP{CrZ@7p&8@!mYdD>VzB)n zU5yXTk$HxtA=o&_*Gbt!kIt2xu_a9{UR=%+ttR6;%zFNcltu|QtHQukc5Ou{B2W|n z!Gu4@68f|-w<=X@_2kvebHII{zHIL8>#}R5pfyWr(xLG>uw+E9^H0f0YAlt!C-)Ud zq4(A?u14x@{bJ~h1-fGzeVkDTPp5||4ym-biJelFWk`p*{2YsK7h+N+hK5enw;ys= z(w=lbe=cT2$ zluhnG9xExkK{8^*Ax)vHs=m%M@Hb>bL?SlqJeTlhfJoO|Q;A2seQ>~2s6EI^Q}Qei zkL98}Dp^cC2qz}_`cKhF6S-Yln)HZ6VGHlIDzgtE{pN2D?AnBcS?ah*Kb0^0%GNc0 zjrs2}8-9DXcwTbNuL$` zhhoXbf2!lguJp!Onsj)EJyFJ8>nCipOH1289g`q#=YZc>7jqPV1M;|t0wVYdRIgM%61asz|=c**0dbS+Qf#9J;YN(y^0(F>>`hxH@yN# z*$NJ=OtY(r2SVWH^?%e~q$Q27W0M3kauhxePF6nKb!s1PO}UlC6i}qYdzw_b`p1R} zl44!QClxhnEy`^!rld0F8w~Z=rp5CjQt9NdT+3G^{TPP=_b83csy|MKsw|o#3{3sf zCip5;?P#cMg$B+Ss5cpYH@-xdsnn%k8?=Px-X?0aO=-5g-7S!%VGyKN6cbr8u)_7y zYG{3Lkm?Hss$k@;t@?cbc5W=Ymb!+Xb$mK2m`ducwId~MajP>POSe*v^D z(M;==mS$&RFn0Ks_v86;83il?zx_4zKcpz+|DjeL$e@=l`WO1rLkOt)`_rhnA7caO z3zRRRXCzN2&`T>PrT7o~uuIVikqsQT_o2^Iaff@f3nN|jc+^?J9tfWm6e#?XvM#u} z``AlFz56sU6|BQ4uH{R&>13Z#A}-?|*+QLuMV0nr7JLC}SwIacjLL|$ApNOf9$o=Z z^%&u_mkq`lT>gm@(^>UqP{7ni&~?|A3RRoa!L9=sWEfn6+;eMsw-fVkoCn=T zen4?BTFKW*clTRhsMDDpnS)zg&hV-@5qy{PUA*$6fReDVY6Hoi;j_S<_ZlyToYz=;PCbDseSdm#@7io^kY5FkX#K|AaoR zO|wA)aTe7y>d1gr)11$bXBgzXf0sU2o1$CecZrSs8y;=eD;q-%{$@n}*i6e|eJkE- zW&-ltX2j?G)>LP0R$L=jbJDn*RQ&@;W6HPU9*#k|c~Er&8&CP3$tkOMWJhUfG73U~ zAEkSwk<5D5nqq9T^FbyZ{WQtVJY5nHswP}$Ef0w*P(CzF;qu#~VYK4hYkyeMz||q@ z*(fy`?v;ynKI_~vXmpwy))51WIv&)~WPRom4jyZI^2emajlKRsp>Wo-byKojOYsT} zi1Boe18V|-M8KjpvZ(wZ&ED_zX!!J4iA1oxc6a)w@gi`?9c{}NzI)eC`>bEE#@R!juR8IyuRaUdpZ%9C^Zi{HcBK)Z>RuXRtZIh?rC&EEE+h#y zUT{%LY>FkBV&nEKK4E6RX$k-DSohEM0q|al4I~t=9)1Wb?&W=EIOvNb7P3b)Cbit~ z{80wT%}Ai}=@j3n+Udz27VZJBqr(U6<3h%4ueWJ>3?ar1HJQ|ee=Zrg0Inj{!kXNR z_|kLrRc&Rv8++R2-Gro*B_e`|9-_c}qR2XqXqSPQ3ZU^ZoWJ7BSWNt~FGHCSHuZ5S zVKvm>02D6<}s^QV@HZ?~rJYR=$*~Xf;&cMULaD zh97$&91uahyZ2*avAa}lKDwV!C%daswI$QAW~%q#HU?0j6Imw!dw?#UN=Yn=P~6jE z4E=muYS)51@EL0yX%Fwhb!OxlTEUZsZD9#$!y&@73FB^85ZA5z*0^4@NQ;#{b7$g% z5g~@8x}ROXrNK6H_SYnTdfda2L7xkKW^JQDufle|DSS-HQjw9`|U~@C%o2^z4dNw-rHR;8)nHHms81kW>hdhr zLbU)@8MJ^L~M*bcpj z+`Y7f(||O_#NG1>B$sUvWNDy4P6iK{&a9m%v)vg1DSBW)hygXJdEEY_{&ZmG8~Jpy z(MN{ezWS8e?wG>&Gjhuoq+{b=F8&d2P?96-r8y5f+K(Ddb2`a5eSR*|bMcsYeSuKF zN{fg9qUYEIkTz&?sv!Tcob1hDB~2&hh&`enO|KWKkYc?FXrH<3s^$A5lTM;>5QzrSbQ8(8C- z^+OtAG$)*ujgmVvNm?PB&Dg<)?Sm@r8a?ljS-6M1Y=oiUvWHqm$NQp#AUY?-cO!Rf zlHnuzcIz9Js%3jK$)_RVn)mi`kJuUyp$hrLsg&l$csf<%!-!*>&$-}QRpyiEI-0C8 zw%L%~B7~-Q@~{%`!SW$B&3Rh zQS1a7X1^AVGy79nc%d!%&+I3-X3h#nu9;p&ZDp#BgnpUI#ZY%UrD!8F6jCY336pTd z1+2S_s?1M~4Fxz4iP=DoC<{+WahEW#CJJqJBAa%21)W^TfrNz zYKqoAC&yrt@NUh)rNseFE#=IMAy|1*F}R_#&+cOsN0X+SIQcFyLsGulMX6@xqZJz_ksG{Pp5KxIM?`hR?UJk$}H%I+DsY-3QR}4si5yjY5@8;@T2Y$SepmCK$ zSQ^158eg{}aGrj%>O90S-vemTWX8g}OZn|Qg+ispkR8&og(D&~0A&uD0S)01%h2`N z`uiOC{oKJ^f3<|h0J8rsD*TJ1b)x*Ha+D=dR|ZQP4>(h4dc3Iq*9#zEC5q?*o;cMav9el4;s5 zQbb;qCXH%Y!8-syFLGS?zX=Kz>Cab4N1?}j>obv+#}-BCb%lX}j7EP+Wd4F5Bu`fu zRuH-pp9Vj_kYF5AF=|8XA@#@qf*3qNu-g}ZIYgs=5{3qvtUR1eT+idnZ!YlqCrk?p z!FoYl0NT~*EroZ&yPZWo<;83co@)?*555DKzzPxIj4$$TN3UxpOkPl>R%LV4jpyXG zZ_f|VBN!pt)U=M3NR#?fNkNEfM2ka;zL-QWHs;j<4ycP18wd~Hi)%BHH)2rFCac86 zwvX^2V;rUE1K+teEu!G2QF1Wg978iR-(?-ht>XK2Zn_;gL+lHDaO9mA(P*ijW;jKq zdH~A@+}2^EYKq5Zy_2)R7bn(XJUDn-FlJx2m@+Bs1*v+PK@JWC#0R4);-@g-)hDaD#G?C&QcNxHf+inxQX8BC($%g( z{}=Bk@dCE!`UoG0#tr}yYi{gyt*yd4Uv7U+2mhOjpk@xPaK1S$gAHn;D=nVx$AK@p zg8aJ$jf0oxzAZ!l55)d|gZgtQm{XxSA^Lj&PcYXujT8*-5U3~8$o$3}G5eZxVC*5^ zYq;~|H%tyL4nkfQc>9z<9EhZ-y*;MTvccD4COLouB4a*qV{at1%dm0Ut{Ug}X$RgU zf%~~XYFL1(8da?m+vrpv-FLzzTa;XN0*0a8z5=JAU3d^9TVZr71AZW2unXG&pS<>1 zYmAkxi(jR}0z8wf*MRv1R^8@dGf2tlJ0JwG1q==wB1q5W zd-EV~JEf*LvY-|aRE{d<(g7yvKp&MBJS)tOHTCgpCky^Y5{aCU{aJ-B}|+9Rdp%`sCX%(~IL*si;Yh2A@q6Ix6pX{R*PiwRo^pcXS_I3KwQRUHKY$iI(q1^>_fwTqtZd$3)Ard))O3Wc|n4ta#XF z=qe!(|GJZ0DAtSYXTn8N*$4GeXQy7-~_hcFVY!G@+s0Vr4c3248N2Bvbq%!>QV znb&vl(?h4!jM=fdl&@&mqxsNAX$5q8u_yt?QQiySy9$N`7mt8fAjW~{-XcCyuC?R@wbD?WKrPDGSH`i_`GJwfs%;k zSv!qqDrnyalv<3f@5;hy0BH*Xq%#4ymjVA*Y#cO)u=jXp4K^cxD)@BoYu@~xc`>(L zq_hIgQ(`nuo{z`EsVesO*=|Bj{|x?WM&E$V<~HdOkIWcn^&OzJA*xW2Y(aEMgNdzN zdS=RGhs69hHL%wI))cW?_is%R_1~Jv>m>Zv1uk7EV+(2Qna9)ahA;z?UFJrAqR>cD zk5phO<3Ac*rt@=$)_H642r~8Epe4%2aRhEmmn^dW>1yHdMjU5Pc5Gqza|WHOUmId%F3j&u;N6opI~AR?-n-kGkouB%>wmxD=$>l(gQM^e3bmGFH23ywUFrSVIhcC)vQ~dI zY6{ZhU&t-aKjlSh!gRX&5S}hU(w~ci_U1*lZuTpNIeh^faa(j3?^irfj_#bfSg$nsXLA0Ec2-;M6NY=O06#(J7uPLO9-qD6tt|r{guSo`>*` zV{aJam_kb@loKP?|55}SOkOq5f;n`c>*M2fB$D^y%CKG`(+h#F7ryd833Td!)QSuZ zRle7yQi|`9OXs`$KWYzsqRFL?hSo0F4xO`(KER!p$6LyZ%2#v3V^uIUXD&1}-8QuM zORAchen^!wx~%d7qoMg;CqFRSaQbAvebqY3n?UTqUqsOU0y<1zKnISpP)gcVLm31K zEw@Ie2|cIGe<#hA5O_0_Vs=?gOlUIC*E3XRETU2pdEAUhh*;CuHA)g6mJpXWRHrlm}qJL%+F1w0ArW@K$^&}flIN&!QJ ztF)*oA}uzL+CLd`ps503f{Ny+6(U#b(Ri!`d7QiC%ssL7AP9sLAR!{C7>!q3aPKg; zFm7^3GepDYXh^~6XozIGCxibqSQ+~JSTHevL=z9ZZf5}dSK5$pN}f(SDyZ)1+rBNP z*9{A}p9AoBKxjTk+`&0`3p0`3UnyLw6;IS@g54Ex_?Bf9-%%!PgJZH<<3MsHd9U60 z_*1$k>9}`|dG+w=?9~^w>e=S-;jT$1(*w86dz51w2hLktMFC;P*Wz^<4KNyQF4SdJ z;mY`eRJ1B+%CvYN!GVCGGQc6R60NO5GjZ?{=i$z0d6zSE`_+t&jaIeHgVg`RgG-i5 z0j(4L1-T4p>;8;^am9bCR4D-29!Ly*=_g|EMA0y>pb^Jq4*CzdtX7%P*Af@vS z=)YCfN|2>uE;zis{l)S7|7?%=7bjiGE!bp-Rs!1q4Vb44fzAhX5kZFckHgoUfEuV3$YTD{GVO22 z1XfN<(3df!=B>y}ytszw}t<&1J6UyVa(nj{=vIcuz z(e_9IQE}-%o;R+Z1q1XZd@yk=U}(BSbWgWjvzC9wjR-W7a2*C@PXh_nN#j=h;lzEnrWI+1VHD@;}bD zUr;U4n}Zbh2dsoC&s9YzN~lcl0I634^y1!6E?ShLn~~cN5sn8a+iLGLl5cS5!J7PL&MRlvRN*I2-KHM>+US?x$l150u1VLb4%4_Zb(glFc`6 zvqJbFutVRc>avLUHYq7LcR;3iYPw<~>dF9(p=GniW^N;UX7d1s%rdj9Kml0OG53`R}b=T$4r63%+n# zM%9+7<5LsrOVzXWU<-`%6Aer8$JanGvKi}A0rDg#KJieaC-4PDC_Y)O*NnS^Tb||H ztc4GW`=vo4(@u_TU@IS(DwJRW@E=T$?Uvb@IA|&rVUx8mo`u^003WGi*NhVu<@|6BrgR>7wmQF$>4v47spxc-wtr zJ*h}H9`6`uSLA^PWi0w{y?T(suekSxo>Tk+8vWVq6kp z|IvMLb5b_Py-(eq6-xMUCU$E&>QV4?{K$EJA5bNP)Kg&$kL8R`@$Q{-h%EooLXg0uhBBnd9O2JoE|EFd?0#AM#~B?rUW*Krm_eiDQmMERYaNw?wcEHw zC;EFj&FBI8_&D}ZpbBiP%_e!uvgkJ3g=Kifnl_vyG%u8xXlBxn+0XVPDj*~i-d)aj z$IuwR$5wyf2h9Ah*9*PD z-d*pDd$-@`2(lNBU;;NqnVQx(lIp^$ZfFX$Fc}brR#3Rg5(#X{5$UerC4XU!vH6(U z2DE5Re{q4E0rVlh{{{k5fQ~L=b%Vp8A28W`BG@*78%i6|WcXpUh@JNhs1^DDgA`P3w-d|SJiv)XOJRIbkP1ES~HHDCh% zZ=IoHn?d{==yk0cTwkgk{2dW}8|6?StouZyO!tfHy_ayJTY(-2HbbM^i?%9Vr`IlW zHD!y5TiXkw+OOx3Y)ATeNlZ|oCgf_EX2Mo;_Dn_pYB}4;Aqc-ETGbrUvMpyX&^Hc^ z%@4jx=;9U2>oqc_Vj>~_wX>rHp#0><51Q+q;!Irtf15_@$Ep3b+woP3YN?FH`511i zu>59Q>6n7JMI`$BxM$Vua80}RuclR7?JjyKAxPB`_7^%&1pdI<;kDEQ`Xivq_~LRb z{Mjnnco9GX;uvEy0iRs8J?3a-+NH>>>kiU(vb>utawq`x{H|FaB0P6sdHk&p%{7Sp zaU<7@iG@_^VTeK@2jGia<3!$Nf0?GT?92%ge>5V1sL-OV;8R#JYANizIdkEBuU2r(%ZGyZi{CP#1NQs0!`Z(iuq*Zff7JtR7;&3HVM0EEIuGgv~Hgg3H-&Cbc#%E{OlL^)dzXJ^!Wpsu0=Mf|q~**dSqx(uO2fp}4n6u1vlb1n*eNG~aX6ud<8Xz3-pLE%}CJRPW9 z86^}u0ij->JG1|UIpRP7lFi%j*kW=p-z;(gMMWIk+S+-E^YHJc%sZF{$~wT7c`!oB zxd7)gEcQa;U@oEMrLEstHA#bYX@7JO(7K2V_qUn!51i5qK&aG5ow4S)8bAO&*eBcB zyMRE~tvj!Hd=?mPwxIUzZ@3GfPiy1{J!}7o8o=&x^+xcye`_KBmwVil9dL7mNF&{{ zgU?c=D#{Y}^b!NW@tRgIe1opfQSz(FzNmQc*Gw;Mqf!JDgkS{pPT(08%746HzF4={TE!0R3se@-tV@acde|9JF^ z{XvsGxrO{|U;uaP{O3Ns_!#~U zd_nV`nP7DUXl6ca#uow~7(f#CfaU@IafAA2$ML@)^}m{uEsV=^XU_Ny@gEN9)CIxs zyNK)fYoh;OrTaLX-0h^GRd6?i&3&D#&_1RD%==~l zL>taRoM2!Q29r}95-(Er$R z?x41{_rq7dVh(&;na7t34*WpRNUaXL#jbax|IITr=phZ?E2V{{AOiwEQPz_|t0e$n z#jsbTA2;BLH^iVz=Y)Xq{-pvG4&L_&tzPpa_ggP$opWpZSnah8srU93QVFrGDsB?P zY3->u=!s#~x(z(4#BD3Oc?Bq$$6?V@h;r>75lyjo7@=yLNfP=1F_L~k8%@PFHL2Yt0e zF<%S>pmI`Qci(i*c3mKI+_9b(8Kvc)Kgz<Elp^n&jeE*fGLz~OeZgvvW?a_?#xJ2a|Xp= zv6SWvYEGdI(l$2F))3Y>f?u+S@o+?*#lLRQJz2fQK0e>zU%$=d$z$etzC@{u11B8OV47ykwT5P zpX?#qe(@}>=I;a+&TeDE8XR2x|Lxr&Y~xlK2k`%Zi4T|rxF9Em&D(%MQ3pdpV{lgz zDIjKP!3G zX)}t4goucUjz?|jH0^V=u-ej^nEio=_h>gUzQs6u^WiaFv#;t2cmjR{kQJKzLH%Kw!~9+YswZtL zcL>F#CvK*?-PPfV3XM$KAae;eq40Z~pQ2?MDPnS}X5&=s#qt6fcp@4Z=4zC5+bQlv zK~LZOQ+ZgvunOZ)KIKH^XGOR(n{XjFz7j$|wXNBf#8a zy`PAPh+e1Kg7~#9txK0(%!U{wQTsD4uhAM-zNvbm(>vw&p8x=VCNIL+_w>G_*_MHH zWmg8hdG%!LEH(TKs1^~!HuKdeoh+L_Wp~$Dm7jcX}03dSXqKnIVp*Av& zL@V^7tWmGe&T*(P<j~u zZ0vSDNYI=A+S5!&GcDcj>b9lX(}wLO8S|x*MNI^~x$nu`zQFogc(7U<8H&i#&Cy9e z+X{Xb;nd${m<7eu{E42Gx1eL~N_mq>qD>_r%9-WvLk_4MQ?@-zW)|nw9BKl_4 zQJtoVb`y9mE+;=w4t#B$!F>;Gq|TREp4IvUU@ajYfMZ-tb0t~q?b{{I?v^t?Eqz%_ z#B_`uHC2l4AOa7tjQ&*llcjg2CmS0#cW>y_`|6g^sSY5xSIQ&qYNYU8xmMo>mS%5O zr%ApQc#A7n0(yV7mS4RW+az&nK`#n=dg#X1nkYk>sW1)|r<@o2VfL-YjdNd?4xO}z zKP)05B06d%EAg%K+(E7FA=&_dyI)pS-djJT18H z|3SZdzpMAVzvsW7XJ$_9cddQiz1NyKYn{Dk8ptjD4ga%N1MA9im%@Cnk^_SePTkOP zL6Y`vgb1!6S;E+)Fx4h2e5tu`Ox<(Dvy`j!+8JA;mZH5*|Bt?g^Sv)x_L~_fl=lL( zjtaU8%)q7ItzX*++)ijz5q0-)`ZovIx;N1K5Y$%a{g~*%;{n1b3n`~BcnhvX25p~V zaW%fCP)4w-GAX}nS2P?;eoRA?Z>im(biF8ACHi_@O?3Z6P!!%B+jj95_DrkSOJdWL zanTH}Ln2w52Nuo-jVbt&U@@l&X3C={4OIn@NnwD6vrtY^6Ixul2<2nr45nO7PZk;I%dc29SO55F3*_$ zYVnZL?N7IARvzYKQihh<01&(h+~0!2?(ZL!+aH^BL}& zce#Co%xgl&@kF%r6aXuVvT8CFQf9$Vl@SmLVEZV5aJ6L#z5ckeOFRI;4<7&^gdOz& zJ6o~a1FdY#*=_92t$|!@jtxsJG+7Xcm3IvNA|`}>y-DT zm~~EFPR%5^lK4#ZxKZ6y1QP&g#5{J(1GJ+uOil+K@#{2u)9A!cI9+UaT*C#{<3??6NBGLZWA z^)Tq#??>$o^KH?^&9iEG(Y+eUZy1ds3bdNA$FHf!<{Lq!<=3XOF9xc@s7rI!2p5~v z4>Wh8gFXEUr`v(Fbbp(UkC_Q%0avpx#6GR$pP5J?wtZo?2Q;bnh4snDz7i zv%yczs6B?s@|oH1{TU^pju}($`b-gJ?POx*O=^tUh$Gf#jBrEEEkk9LmM`RY9kD@+ zn@9NBb}{v)b3O+uqUio#sT=Vxtlpe3Y#k;~^h@WNEZGmzpjpdM#XNxH{nlgJ6WSUl zVJt^8IobM=Pv?E=xGAmupT4$%O(5D;iHkDnm@(H;FuNX`6{H};h)2AttZ6Q^ z-b_xl&z=-Y3>FqHSu&hJ7~DZfW)KI3wAp>tr9mfCG?sN#JJ^);VS+498mvT-UJYL5 z*(|#?d`y*YJkQ0Uqsed{I+e)k&k+*Q&%n`xCB5q`Z1Mbash1xWK^VC>&o3>D_i7I{ z+hcOc74)`{N)1(@aU?suT#sfv3D*))W;{P$c)o(-Z^Bl@p~pF;!{e`;5`|+5Dv%c4 z%@M!c%MtCDIQA@;gKITz4>^FcQnEM`Rq@6!VP?00ZocKe}rQ zqLR^H%Ad%NXm3?D3#PZ|N17nu%5M409Kd~zqWF%|Q$4jNB0xeB`NRXL?u1!+9z z_r&t&9EMTYPfL{fAx4M|H4D|IUWJH!rqg}#bwnjLJD7!OF7CTz$Rd~`Mtt>3Yn7~O zxtAF>D5%nQjm#!{SPZne7G6PVGBglhc=b(vM827rS zPlR5BIVj}yS?}0m-YS2s{04Aid@#PYs&guegF-1Nmb6^0cgmGJ3}2+pL=!=BSLT9C z^)6!?XwucNY$J0R{Dv=8cPNMY?$l~y@FS>W&w2U<|K_yThvW-*7FC}*uE5;#1Ic$) z=8pmV%IL;z9u^}?^T~H-VQ&w@GP?#t@Uir@*V9G;VQ6)8_-q*7)*3Xr+}m!#BG1*G z09LD)FEAAsFj854D7UU!!Xn74ZbSPs>Rs}u1<)!Jgs}W6j# z_KYIgPS3;$yM!Bf-@lCV{>GO)n291$G6&5)8vt8x&>+}H6ihgGKZdAAs}!(w6^u!5 zJb1fOBK6IXZf{R}#*gA?a=nv|JXV}eg_@adV#V>pdJw{3Bv)>b?qbBI8iDnSW0@!~K& ziM4<9=^-SamggJ=wLM3i^~0FciSirZWtQQvsg9%UcCKGFFTp-=1$PIqQrGPQ4Ih7G z+egnQ8J#*PBMUZP@2nbqouX^GRTmaKusts=a?%)SqwbRanj_@hx4^J~oGtFn#7i&6={41^xO}Dg+5=@6 z@q39*#|yc~g?6DBGD3>%J}Ghq2GO4GWoL|7uvMc?9XnddX3R^!GsUrLk-O3m-3r`c z0-?l|{Kd0vTn!nsoPahV=p{#qE?%p6(JAg%UwH03<6f`^P+&&T4bFH5BxMn z6aFj&)~zpcuqg)SE@{f{QBU?_a$3#Q?F?zf842d;Cjw+3V81traS{5692MpYw3Z!n zH>4?9rb3JCJ?xk@oO#qZ_Qy@`FIQi6;jII!&|AIIFAlhT zQPEXR8E3Qy0q$@K;#M=OFF7u-hv(kt16l`#%0+q2H@4j&GOdI2E8qOKETvx(%93Vm z+qZW#TMw8mxg^=6fYWF6(vnU_;F<0s8@2Nh>u-ZNir#09xqD5n*O-@~Sw7Bk|Db>5 ze~#zhWNG)9NKF;TN`!>`kwNSMtqksR_?i=+{T_&HzM0I9KTFfIKb6Lh{b`XW_nO8e zib%UT4QAOxAE6U!I^U5ACz*~Q&QEM#z0P|wJNiW3lI)r*+lN(A4Y;)-At8!jBW8Xf zXRn)lDNe8a_*)wm;Ot$Uhh%GeN#49elu9V3G(Nw2uF^9!mp1i!9ugBSQ1Eu>`@WrGwmOV<#q_60+`XwldO=gMl_0Yl_q*`zR8}= zu;rOACsDLrQaRK|s`A>n$LNf=0dHxpo-a4uQOTtSj>K5jW!5t)(0CKt&b-w>#7yhk zl&1LHnG)VO0|<v?d2VnY`_hPzdGY#y91h;)?7wBggnPMbWu_9IVVc~mp)~4ya#a|bz&+cE%>c(OQcjA;;%CSbzlJpLvnPQ1Ap~~+gK)5^TZRxmH?%Fw7nm=B z$59tark=6s4NSM+!@XX=q18$0cl5DN*tQoAbI6i!zO%59_bp4?;gLGZ5o;nE>I(ag z^>oNjlN>YY!)ms*B>(`i5qy|lzO%z0`9Zd^Q%SBTiWL(hv22w3@PdNQM7Zrsl#gwn zZ^^7{`g=W2+=!i;hwyCxv&Rvpcq$fjCGyQ*RL52rCg%HV78^9x@^&67ato@Z(seRL z#QHHO-V`q#d3?dXnt{sI@SV5yd*-ED1dI1fgt)MW_hk5AFIOm@J5k0~=*_+&NJ6fS zC|7oer|gX%dl006n6335UQTAf23hQz%r*ZftdOS8m;$fx`4O z>gMPNVOnpHgK2M`pAGZpV~1GcN)_c#dY_7*LHS8qLli`KWK8T8F}@43vwbEe3F%M< z!wYlqgKz^JrO-2?#aqtxv%-`VL^zGzyTEr-0vDXmPsZz&-^XDgK4u*eYZo;jzdN$8 zPfeK{3djS#-jh!B<*AIF>zNuMr1i5kT<13@9WrVQpF2xd2N#05bI$3x5C-( zY#0|`?b1UTT4cG_T)@p{JbTf0xNfyL6>(b&3`vYp)tb5`##$>pYny$kX`500Ur2}~ zbsj*z4dTY9OsyYIGCLX)^;$IX;m9`IM$xz(rKts$8h&!o>b6-mZS96HuJ0=LXo!{U z4}VgoW3Qy*DqshAWFgb4rcRUyUwO(xlh6G18JT8l8Rbkkmn(+In>YPDVqS^UEtJ#- z-Ih0>dp?pjOh11|S&8IBZGyw?-VSN$zWdA;5geXwE|~+GjcOE4N$`l)U0IKQSHD8H ze|7_zT37j)IlL6Q=72m04$nRQe(539*LY5RxEo;5Pt3TdS;^^bj;IA3Qf!wi*z}so zC2U3wR|cou0m6^Poa+Hl>Me{?;ubNf*ny(3*O9J_&l6#@udm|AHOT5uoTu`IiE}S<2=X!|BKQ=GE5{ z#>L||-y(d|?bucvN@?rvpo)}i{d~nMv%~17=8u|LJO1hgc@v(2zN&a~I!RV`B*E-5 z<=R2p0Mez8my~2new_%d*)zF(aoCE<4H3%tUyN7xD3I$Cni&nP+G^O{po&x)g~9%C zRpy_Q$TY~(7KycjVNBAs$?-S8EuFMSWerAEv^ z6r~;4(&F8S6nh3|w-yWz+y$#pJhx0kd!3qn#PGaGM3-~Oa99L=Dx%b+`iz-O?8#O- z*~;faDlws%A7(jJo>z~^yU!{1q5Z{dxd_@N-F%}8$&chLR(rprOh)36@d$&5utqrE z3^-Z=l1MO7F+qrJt;M0q4k+&!AW!N&y7%qct#uKw_nh88T#^^HWd}_Oo1y@Uz5^!| z#xJXBBT`dS&vBhQJ=^q5D2Bxa@pOMoSA%v}Vz#)(Y!a>4kUar6@G-OBD)0@3tLe1g zPJUb{Jkdz`@S&BS!1D`T4yMGopNEl3lL&9SlJZ^Yd*@7&+rIe3r|vqu>%NBp>!EiG z$x&|+ChOYfeO;?$SxyA}IW2L>!-XuCJvTDq(xC4Mbah}*r%y85ah!Cdq542hKBM6c5VqC06_nD9k%w5IAvO?jbEuL;U#Xm}y2qV42M<1;0S*^zWG8uj5tf{Cq+J8mlT=_no<{hkRXn zyGJoA$6_t8?dF@syMx-Zo}AN??QLZ{*O4w2q3Sd<~<8(izUjC`=lmFz=S!^kG~ zWHWswD_Q?+l|z?0kv)r#Hr%Lxyf4B#j-pT7c%k=r3?U<-aQY#Vja`N0j@k#%?VNCJ z`GhOw@#ln%NJ8f_#-TJJ3#3YFQX4Vk(qIhdjOT7*gL|))FOT^XcFbpDs*DWCLdXgh^886uAm5n_}oJj5mS;zd}Oy0Bf zGwk?JbfUVD79+p`096P80Qv6~t-zLU_CN<$HcxxdPkvjI=9D@)aKe7_+p22lmH-@U z#We@N6O#ZH+E)q2lXiV-&8uS2n|iaXx(K_0^M#n#+|<84|Dw<>j3k>HA~AIioB#OP z@W%NJF<7rzCvHA37!|dCVs~(zP=0U=ACo>_fi0E*17glf$BST~nvT7x`Tpputs2)U z*XFwP8RLM6X`kmd+(dfebRF7qg>g_(VLbEQ?r!rC&-u<9^;fa%$?;hpM$j|dq~ci7 z>R@R`5| zq$ufQC1XzHSG~NU78;1z-L6{UFAMbd1_o+`OZ|V2*S~|iO`ESkjxh4%kN^N!d>3FS z4R&yaF=ndeQ8MP~FBtA6OYOlPyA!EymF|%Z+ z$L4z|Cc(7s26^ZO1x2s$NNe+vhV0Aq_x2y8Yy3*u-+zTXS_^#HRw?Xn-7PvzAfr1C%={f zRxvG7$wnWZ)OZz8EREGTaI9l4Ht}+`Q&7%YZFmQy$H&)(apx%c?$eZU)|{L3+YCCY zQEc;VUnnTFeph2g*QY~c^dc*&;S#&mLueXq#(?srL`1^k!OmV)2Q2J<7B3Lg0-~d#x_xjm??66+~{CJ6zbgOI$MBypb4SPfA^9g-SnL=q14H}4(6~Pp{j0S#u%rK0Y6*4*{u3N4p+1BT zRuKyZzc+&W@=G~A%%}VfcXM$C+y5=#pBaW3(qHBNI(!lT@?8HHPxtQaSGk8go%zGr z{m#^%?(QD=tFd0c1OLnU{mEL2ATSvU%jjsx!xk6*rT;HUlw^N3;Xh^k2~TT#s_g;e z=Ma{bfu)CjmR}7K9w!TLXw_B#WMJb&STWtsj|3?^@SmlX#9Af)|D zNZo7xr5Kg>H{j3o6z6?<>Q51W=CuA6G1K|qB7SDL{uBY87Nd29^)3Wc$hj1=o2D|KG5CDMvle>RiM9#m4jEk!m2>2i1{~ziGU>bhv yc6|Y~2mY6teXZE*Jco@?TGBtMJN_N`6VCao;YjyCWMGDY4~T;`P50aV-v0yL9z+iS literal 0 HcmV?d00001 diff --git a/TSG发布版本更新记录/TSG-22.04/druid/top_client_ip_log.json b/TSG发布版本更新记录/TSG-22.04/druid/top_client_ip_log.json new file mode 100644 index 0000000..ce0c83c --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/druid/top_client_ip_log.json @@ -0,0 +1,55 @@ +{ + "type": "kafka", + "dataSchema": { + "dataSource": "top_client_ip_log", + "parser": { + "type": "string", + "parseSpec": { + "format": "json", + "timestampSpec": { + "column": "stat_time", + "format": "posix" + }, + "dimensionsSpec": { + "dimensions": [ + "source", + "device_group", + "data_center", + "order_by" + ] + } + } + }, + "metricsSpec" : [ + { "type" : "longSum", "name" : "session_num", "fieldName" : "session_num" }, + { "type" : "longSum", "name" : "c2s_pkt_num", "fieldName" : "c2s_pkt_num" }, + { "type" : "longSum", "name" : "s2c_pkt_num", "fieldName" : "s2c_pkt_num" }, + { "type" : "longSum", "name" : "c2s_byte_num", "fieldName" : "c2s_byte_num" }, + { "type" : "longSum", "name" : "s2c_byte_num", "fieldName" : "s2c_byte_num" } + ], + "granularitySpec": { + "type": "uniform", + "segmentGranularity": "DAY", + "queryGranularity": {"type": "period", "period": "PT5M"}, + "rollup": true + } + }, + "tuningConfig": { + "type": "kafka", + "resetOffsetAutomatically": true, + "reportParseExceptions": false + }, + "ioConfig": { + "topic": "TOP-CLIENT-IP", + "taskCount": 1, + "replicas": 1, + "taskDuration": "PT1H", + "completionTimeout": "PT30M", + "consumerProperties": { + "bootstrap.servers": "kafkabootstrap", + "sasl.mechanism": "PLAIN", + "security.protocol": "SASL_PLAINTEXT", + "sasl.jaas.config": "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"admin\" password=\"galaxy2019\";" + } + } +} diff --git a/TSG发布版本更新记录/TSG-22.04/druid/top_external_host_log.json b/TSG发布版本更新记录/TSG-22.04/druid/top_external_host_log.json new file mode 100644 index 0000000..d18f8a7 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/druid/top_external_host_log.json @@ -0,0 +1,56 @@ +{ + "type": "kafka", + "dataSchema": { + "dataSource": "top_external_host_log", + "parser": { + "type": "string", + "parseSpec": { + "format": "json", + "timestampSpec": { + "column": "stat_time", + "format": "posix" + }, + "dimensionsSpec": { + "dimensions": [ + "destination", + "device_group", + "data_center", + "order_by" + ] + } + } + }, + "metricsSpec" : [ + { "type" : "longSum", "name" : "session_num", "fieldName" : "session_num" }, + { "type" : "longSum", "name" : "c2s_pkt_num", "fieldName" : "c2s_pkt_num" }, + { "type" : "longSum", "name" : "s2c_pkt_num", "fieldName" : "s2c_pkt_num" }, + { "type" : "longSum", "name" : "c2s_byte_num", "fieldName" : "c2s_byte_num" }, + { "type" : "longSum", "name" : "s2c_byte_num", "fieldName" : "s2c_byte_num" } + ], + "granularitySpec": { + "type": "uniform", + "segmentGranularity": "DAY", + "queryGranularity": {"type": "period", "period": "PT5M"}, + "rollup": true + } + }, + "tuningConfig": { + "type": "kafka", + "resetOffsetAutomatically": true, + "maxRowsPerSegment": 5000000, + "reportParseExceptions": false + }, + "ioConfig": { + "topic": "TOP-EXTERNAL-HOST", + "taskCount": 1, + "replicas": 1, + "taskDuration": "PT1H", + "completionTimeout": "PT30M", + "consumerProperties": { + "bootstrap.servers": "kafkabootstrap", + "sasl.mechanism": "PLAIN", + "security.protocol": "SASL_PLAINTEXT", + "sasl.jaas.config": "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"admin\" password=\"galaxy2019\";" + } + } +} diff --git a/TSG发布版本更新记录/TSG-22.04/druid/top_internal_host_log.json b/TSG发布版本更新记录/TSG-22.04/druid/top_internal_host_log.json new file mode 100644 index 0000000..fa37e65 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/druid/top_internal_host_log.json @@ -0,0 +1,55 @@ +{ + "type": "kafka", + "dataSchema": { + "dataSource": "top_internal_host_log", + "parser": { + "type": "string", + "parseSpec": { + "format": "json", + "timestampSpec": { + "column": "stat_time", + "format": "posix" + }, + "dimensionsSpec": { + "dimensions": [ + "source", + "device_group", + "data_center", + "order_by" + ] + } + } + }, + "metricsSpec" : [ + { "type" : "longSum", "name" : "session_num", "fieldName" : "session_num" }, + { "type" : "longSum", "name" : "c2s_pkt_num", "fieldName" : "c2s_pkt_num" }, + { "type" : "longSum", "name" : "s2c_pkt_num", "fieldName" : "s2c_pkt_num" }, + { "type" : "longSum", "name" : "c2s_byte_num", "fieldName" : "c2s_byte_num" }, + { "type" : "longSum", "name" : "s2c_byte_num", "fieldName" : "s2c_byte_num" } + ], + "granularitySpec": { + "type": "uniform", + "segmentGranularity": "DAY", + "queryGranularity": {"type": "period", "period": "PT5M"}, + "rollup": true + } + }, + "tuningConfig": { + "type": "kafka", + "resetOffsetAutomatically": true, + "reportParseExceptions": false + }, + "ioConfig": { + "topic": "TOP-INTERNAL-HOST", + "taskCount": 1, + "replicas": 1, + "taskDuration": "PT1H", + "completionTimeout": "PT30M", + "consumerProperties": { + "bootstrap.servers": "kafkabootstrap", + "sasl.mechanism": "PLAIN", + "security.protocol": "SASL_PLAINTEXT", + "sasl.jaas.config": "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"admin\" password=\"galaxy2019\";" + } + } +} diff --git a/TSG发布版本更新记录/TSG-22.04/druid/top_server_ip_log.json b/TSG发布版本更新记录/TSG-22.04/druid/top_server_ip_log.json new file mode 100644 index 0000000..cd617e0 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/druid/top_server_ip_log.json @@ -0,0 +1,56 @@ +{ + "type": "kafka", + "dataSchema": { + "dataSource": "top_server_ip_log", + "parser": { + "type": "string", + "parseSpec": { + "format": "json", + "timestampSpec": { + "column": "stat_time", + "format": "posix" + }, + "dimensionsSpec": { + "dimensions": [ + "destination", + "device_group", + "data_center", + "order_by" + ] + } + } + }, + "metricsSpec" : [ + { "type" : "longSum", "name" : "session_num", "fieldName" : "session_num" }, + { "type" : "longSum", "name" : "c2s_pkt_num", "fieldName" : "c2s_pkt_num" }, + { "type" : "longSum", "name" : "s2c_pkt_num", "fieldName" : "s2c_pkt_num" }, + { "type" : "longSum", "name" : "c2s_byte_num", "fieldName" : "c2s_byte_num" }, + { "type" : "longSum", "name" : "s2c_byte_num", "fieldName" : "s2c_byte_num" } + ], + "granularitySpec": { + "type": "uniform", + "segmentGranularity": "DAY", + "queryGranularity": {"type": "period", "period": "PT5M"}, + "rollup": true + } + }, + "tuningConfig": { + "type": "kafka", + "resetOffsetAutomatically": true, + "maxRowsPerSegment": 5000000, + "reportParseExceptions": false + }, + "ioConfig": { + "topic": "TOP-SERVER-IP", + "taskCount": 1, + "replicas": 1, + "taskDuration": "PT1H", + "completionTimeout": "PT30M", + "consumerProperties": { + "bootstrap.servers": "kafkabootstrap", + "sasl.mechanism": "PLAIN", + "security.protocol": "SASL_PLAINTEXT", + "sasl.jaas.config": "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"admin\" password=\"galaxy2019\";" + } + } +} diff --git a/TSG发布版本更新记录/TSG-22.04/druid/top_user_log.json b/TSG发布版本更新记录/TSG-22.04/druid/top_user_log.json new file mode 100644 index 0000000..a109faa --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/druid/top_user_log.json @@ -0,0 +1,55 @@ +{ + "type": "kafka", + "dataSchema": { + "dataSource": "top_user_log", + "parser": { + "type": "string", + "parseSpec": { + "format": "json", + "timestampSpec": { + "column": "stat_time", + "format": "posix" + }, + "dimensionsSpec": { + "dimensions": [ + "subscriber_id", + "device_group", + "data_center", + "order_by" + ] + } + } + }, + "metricsSpec" : [ + { "type" : "longSum", "name" : "session_num", "fieldName" : "session_num" }, + { "type" : "longSum", "name" : "c2s_pkt_num", "fieldName" : "c2s_pkt_num" }, + { "type" : "longSum", "name" : "s2c_pkt_num", "fieldName" : "s2c_pkt_num" }, + { "type" : "longSum", "name" : "c2s_byte_num", "fieldName" : "c2s_byte_num" }, + { "type" : "longSum", "name" : "s2c_byte_num", "fieldName" : "s2c_byte_num" } + ], + "granularitySpec": { + "type": "uniform", + "segmentGranularity": "DAY", + "queryGranularity": {"type": "period", "period": "PT5M"}, + "rollup": true + } + }, + "tuningConfig": { + "type": "kafka", + "resetOffsetAutomatically": true, + "reportParseExceptions": false + }, + "ioConfig": { + "topic": "TOP-USER", + "taskCount": 1, + "replicas": 1, + "taskDuration": "PT1H", + "completionTimeout": "PT30M", + "consumerProperties": { + "bootstrap.servers": "kafkabootstrap", + "sasl.mechanism": "PLAIN", + "security.protocol": "SASL_PLAINTEXT", + "sasl.jaas.config": "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"admin\" password=\"galaxy2019\";" + } + } +} diff --git a/TSG发布版本更新记录/TSG-22.04/druid/top_website_domain_log.json b/TSG发布版本更新记录/TSG-22.04/druid/top_website_domain_log.json new file mode 100644 index 0000000..569e6cc --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/druid/top_website_domain_log.json @@ -0,0 +1,56 @@ +{ + "type": "kafka", + "dataSchema": { + "dataSource": "top_website_domain_log", + "parser": { + "type": "string", + "parseSpec": { + "format": "json", + "timestampSpec": { + "column": "stat_time", + "format": "posix" + }, + "dimensionsSpec": { + "dimensions": [ + "domain", + "device_group", + "data_center", + "order_by" + ] + } + } + }, + "metricsSpec" : [ + { "type" : "longSum", "name" : "session_num", "fieldName" : "session_num" }, + { "type" : "longSum", "name" : "c2s_pkt_num", "fieldName" : "c2s_pkt_num" }, + { "type" : "longSum", "name" : "s2c_pkt_num", "fieldName" : "s2c_pkt_num" }, + { "type" : "longSum", "name" : "c2s_byte_num", "fieldName" : "c2s_byte_num" }, + { "type" : "longSum", "name" : "s2c_byte_num", "fieldName" : "s2c_byte_num" } + ], + "granularitySpec": { + "type": "uniform", + "segmentGranularity": "DAY", + "queryGranularity": {"type": "period", "period": "PT5M"}, + "rollup": true + } + }, + "tuningConfig": { + "type": "kafka", + "resetOffsetAutomatically": true, + "maxRowsPerSegment": 5000000, + "reportParseExceptions": false + }, + "ioConfig": { + "topic": "TOP-WEBSITE-DOMAIN", + "taskCount": 1, + "replicas": 1, + "taskDuration": "PT1H", + "completionTimeout": "PT30M", + "consumerProperties": { + "bootstrap.servers": "kafkabootstrap", + "sasl.mechanism": "PLAIN", + "security.protocol": "SASL_PLAINTEXT", + "sasl.jaas.config": "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"admin\" password=\"galaxy2019\";" + } + } +} diff --git a/TSG发布版本更新记录/TSG-22.04/druid/traffic_app_stat_log.json b/TSG发布版本更新记录/TSG-22.04/druid/traffic_app_stat_log.json new file mode 100644 index 0000000..7e5f374 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/druid/traffic_app_stat_log.json @@ -0,0 +1,63 @@ +{ + "type": "kafka", + "dataSchema": { + "dataSource": "traffic_app_stat_log", + "parser": { + "type": "string", + "parseSpec": { + "format": "json", + "timestampSpec": { + "column": "stat_time", + "format": "posix" + }, + "dimensionsSpec": { + "dimensions": [ + "device_group", + "data_center", + "app_name" + ] + } + } + }, + "metricsSpec" : [ + { "type" : "longSum", "name" : "session_num","fieldName" : "session_num"}, + { "type" : "longSum", "name" : "c2s_pkt_num", "fieldName" : "c2s_pkt_num" }, + { "type" : "longSum", "name" : "s2c_pkt_num", "fieldName" : "s2c_pkt_num" }, + { "type" : "longSum", "name" : "c2s_byte_num", "fieldName" : "c2s_byte_num" }, + { "type" : "longSum", "name" : "s2c_byte_num", "fieldName" : "s2c_byte_num" } + ], + "granularitySpec": { + "type": "uniform", + "segmentGranularity": "DAY", + "queryGranularity": {"type": "period", "period": "PT5M"}, + "rollup": true + }, + "transformSpec" :{ + "transforms":[ + ], + "filter": { + "type": "not", + "field":{ "type": "selector", "dimension": "app_name", "value": "" } + } + } + }, + "tuningConfig": { + "type": "kafka", + "resetOffsetAutomatically": true, + "reportParseExceptions": false + }, + "ioConfig": { + "topic": "TRAFFIC-APP-STAT", + "taskCount": 1, + "replicas": 1, + "taskDuration": "PT1H", + "completionTimeout": "PT30M", + "earlyMessageRejectionPeriod": "PT6H", + "consumerProperties": { + "bootstrap.servers": "kafkabootstrap", + "sasl.mechanism": "PLAIN", + "security.protocol": "SASL_PLAINTEXT", + "sasl.jaas.config": "org.apache.kafka.common.security.scram.ScramLoginModule required username=\"admin\" password=\"galaxy2019\";" + } + } +} diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-ACTIVE-DEFENCE-EVENT-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-ACTIVE-DEFENCE-EVENT-COMPLETED new file mode 100644 index 0000000..ceb2235 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-ACTIVE-DEFENCE-EVENT-COMPLETED @@ -0,0 +1,67 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=active_defence_event.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=ACTIVE-DEFENCE-EVENT + +#补全数据 输出 topic +sink.kafka.topic=ACTIVE-DEFENCE-EVENT-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=active-defence-log-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=1 + +#转换函数并行度 +transform.parallelism=1 + +#kafka producer 并行度 +sink.parallelism=1 + +#数据中心，取值范围(0-63) +data.center.id.num=1 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 + diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-GTPC-RECORD-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-GTPC-RECORD-COMPLETED new file mode 100644 index 0000000..d0a8bd5 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-GTPC-RECORD-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=gtpc_record.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=GTPC-RECORD + +#补全数据 输出 topic +sink.kafka.topic=GTPC-RECORD-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=gtpc-record-log-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=1 + +#转换函数并行度 +transform.parallelism=1 + +#kafka producer 并行度 +sink.parallelism=1 + +#数据中心，取值范围(0-63) +data.center.id.num=2 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-INTERIM-SESSION-RECORD-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-INTERIM-SESSION-RECORD-COMPLETED new file mode 100644 index 0000000..2e68b03 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-INTERIM-SESSION-RECORD-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=interim_session_record.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=INTERIM-SESSION-RECORD + +#补全数据 输出 topic +sink.kafka.topic=INTERIM-SESSION-RECORD-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=linterim-session-record-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=5 + +#转换函数并行度 +transform.parallelism=1 + +#kafka producer 并行度 +sink.parallelism=5 + +#数据中心，取值范围(0-63) +data.center.id.num=3 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-PROXY-EVENT-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-PROXY-EVENT-COMPLETED new file mode 100644 index 0000000..36a746b --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-PROXY-EVENT-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=proxy_event.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=PROXY-EVENT + +#补全数据 输出 topic +sink.kafka.topic=PROXY-EVENT-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=proxy-event-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=5 + +#转换函数并行度 +transform.parallelism=5 + +#kafka producer 并行度 +sink.parallelism=5 + +#数据中心，取值范围(0-63) +data.center.id.num=4 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-RADIUS-RECORD-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-RADIUS-RECORD-COMPLETED new file mode 100644 index 0000000..89158d4 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-RADIUS-RECORD-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=radius_record.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=RADIUS-RECORD + +#补全数据 输出 topic +sink.kafka.topic=RADIUS-RECORD-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=radius-record-log-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=1 + +#转换函数并行度 +transform.parallelism=1 + +#kafka producer 并行度 +sink.parallelism=1 + +#数据中心，取值范围(0-63) +data.center.id.num=5 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SECURITY-EVENT-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SECURITY-EVENT-COMPLETED new file mode 100644 index 0000000..7198618 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SECURITY-EVENT-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=security_event.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=SECURITY-EVENT + +#补全数据 输出 topic +sink.kafka.topic=SECURITY-EVENT-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=security-event-log-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=5 + +#转换函数并行度 +transform.parallelism=10 + +#kafka producer 并行度 +sink.parallelism=5 + +#数据中心，取值范围(0-63) +data.center.id.num=6 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SESSION-RECORD-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SESSION-RECORD-COMPLETED new file mode 100644 index 0000000..b9322ec --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SESSION-RECORD-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=session_record.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=SESSION-RECORD + +#补全数据 输出 topic +sink.kafka.topic=SESSION-RECORD-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=session-record-log-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=5 + +#转换函数并行度 +transform.parallelism=10 + +#kafka producer 并行度 +sink.parallelism=5 + +#数据中心，取值范围(0-63) +data.center.id.num=0 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SYS-PACKET-CAPTURE-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SYS-PACKET-CAPTURE-COMPLETED new file mode 100644 index 0000000..b86c7e6 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-SYS-PACKET-CAPTURE-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=sys_packet_capture_event.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=SYS-PACKET-CAPTURE-EVENT + +#补全数据 输出 topic +sink.kafka.topic=SYS-PACKET-CAPTURE-EVENT-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=sys-packet-log-20210124-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=1 + +#转换函数并行度 +transform.parallelism=1 + +#kafka producer 并行度 +sink.parallelism=1 + +#数据中心，取值范围(0-63) +data.center.id.num=7 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-TRANSACTION-RECORD-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-TRANSACTION-RECORD-COMPLETED new file mode 100644 index 0000000..6378269 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-TRANSACTION-RECORD-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=transaction_record.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=TRANSACTION-RECORD + +#补全数据 输出 topic +sink.kafka.topic=TRANSACTION-RECORD-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=transaction-record-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=5 + +#转换函数并行度 +transform.parallelism=10 + +#kafka producer 并行度 +sink.parallelism=5 + +#数据中心，取值范围(0-63) +data.center.id.num=8 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-VOIP-RECORD-COMPLETED b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-VOIP-RECORD-COMPLETED new file mode 100644 index 0000000..178da53 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/config/ETL-VOIP-RECORD-COMPLETED @@ -0,0 +1,66 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.13:9094,192.168.44.14:9094,192.168.44.15:9094,192.168.44.16:9094 + +#zookeeper 地址 用于配置log_id +zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#hbase zookeeper地址 用于连接HBase +hbase.zookeeper.servers=192.168.44.11:2181,192.168.44.14:2181,192.168.44.15:2181 + +#--------------------------------HTTP/定位库------------------------------# +#定位库地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos topology_common_config.properties namespace +nacos.common.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=voip_record.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=VOIP-CONVERSATION-RECORD + +#补全数据 输出 topic +sink.kafka.topic=VOIP-RECORD-COMPLETED + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=voip-record-20220408-1 + +#生产者压缩模式 none or snappy +producer.kafka.compression.type=none + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=1 + +#转换函数并行度 +transform.parallelism=1 + +#kafka producer 并行度 +sink.parallelism=1 + +#数据中心，取值范围(0-63) +data.center.id.num=9 + +#hbase 更新时间，如填写0则不更新缓存 +hbase.tick.tuple.freq.secs=180 + +#--------------------------------默认值配置------------------------------# + +#0不需要补全原样输出日志，1需要补全 +log.need.complete=1 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/completion/start.sh b/TSG发布版本更新记录/TSG-22.04/flink/completion/start.sh new file mode 100644 index 0000000..192e3ac --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/completion/start.sh @@ -0,0 +1,40 @@ +#!/bin/bash +#启动storm任务脚本 +source /etc/profile +#任务jar所在目录 +BASE_DIR=`pwd` +#primordial +primordial='log-completion-schema-220318-Nacos.jar' +#jar name +JAR_NAME='log-completion-schema_tmp.jar' +#并行度 +PARALLELISM=1 + +yes | cp -r $primordial $JAR_NAME + +#cd $BASE_DIR +jar -xvf $BASE_DIR/$JAR_NAME service_flow_config.properties +function read_dir(){ + for file in `ls $1` #注意此处这是两个反引号，表示运行系统命令 + do + if [ -d $1"/"$file ] #注意此处之间一定要加上空格，否则会报错 + then + read_dir $1"/"$file + else + num=`flink list | grep "$file" | wc -l` + if [ $num -eq "0" ];then + cat $1$file > $BASE_DIR/service_flow_config.properties + jar -uvf $BASE_DIR/$JAR_NAME service_flow_config.properties + flink run -d -c com.zdjizhi.topology.LogFlowWriteTopology -p $PARALLELISM $JAR_NAME $file + fi + fi +done +} +if [ $# != 1 ];then + echo "usage: ./startall.sh [Configuration path]" + exit 1 +fi +#读取第一个参数 为配置文件目录名称 +read_dir $1 +rm -rf $JAR_NAME + diff --git a/TSG发布版本更新记录/TSG-22.04/flink/kafka-flinksql-top.sql b/TSG发布版本更新记录/TSG-22.04/flink/kafka-flinksql-top.sql new file mode 100644 index 0000000..2319288 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/kafka-flinksql-top.sql @@ -0,0 +1,415 @@ +--通联： +CREATE TABLE session_record_completed_log( +common_schema_type VARCHAR, +common_recv_time BIGINT, +common_client_ip VARCHAR, +common_server_ip VARCHAR, +http_host VARCHAR, +http_domain VARCHAR, +common_device_group VARCHAR, +common_data_center VARCHAR, +common_l4_protocol VARCHAR, +common_internal_ip VARCHAR, +common_external_ip VARCHAR, +common_subscriber_id VARCHAR, +common_sessions BIGINT, +common_app_label VARCHAR, +common_c2s_pkt_num BIGINT, +common_s2c_pkt_num BIGINT, +common_c2s_byte_num BIGINT, +common_s2c_byte_num BIGINT, +common_processing_time BIGINT, +stat_time as TO_TIMESTAMP(FROM_UNIXTIME(common_recv_time)), +WATERMARK FOR stat_time AS stat_time - INTERVAL '1' MINUTE) +WITH( +'connector' = 'kafka', +'properties.group.id' = 'kafka-indexing-service', +'topic' = 'SESSION-RECORD-COMPLETED', +'properties.bootstrap.servers' = 'kafkabootstrap', +'properties.security.protocol'='SASL_PLAINTEXT', +'properties.sasl.mechanism'='PLAIN', +'properties.sasl.jaas.config'= 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="galaxy2019";', +'scan.startup.mode' = 'latest-offset', +'sink.parallelism'='1', +--'sink.parallelism'='60', +'format' = 'json' +); + +--client： +CREATE TABLE top_client_ip_log( +source VARCHAR, +session_num BIGINT, +c2s_pkt_num BIGINT, +s2c_pkt_num BIGINT, +c2s_byte_num BIGINT, +s2c_byte_num BIGINT, +order_by VARCHAR, +device_group VARCHAR, +data_center VARCHAR, +stat_time BIGINT, +PRIMARY KEY (stat_time) NOT ENFORCED +)WITH( +'connector' = 'upsert-kafka', +'topic' = 'TOP-CLIENT-IP', +'properties.bootstrap.servers' = 'kafkabootstrap', +'properties.security.protocol'='SASL_PLAINTEXT', +'properties.sasl.mechanism'='PLAIN', +'properties.sasl.jaas.config'= 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="galaxy2019";', +--'sink.parallelism'='1', +'key.format' = 'json', +'value.format' = 'json' +); + +CREATE VIEW top_client_ip_view as +SELECT common_client_ip as source,sum(common_sessions) as session_num,sum(common_c2s_pkt_num) as c2s_pkt_num,sum(common_s2c_pkt_num) as s2c_pkt_num,sum(common_c2s_byte_num) as c2s_byte_num,sum(common_s2c_byte_num) as s2c_byte_num,common_device_group as device_group ,common_data_center as data_center,UNIX_TIMESTAMP(CAST(TUMBLE_END(stat_time,INTERVAL '5' MINUTE) as VARCHAR)) as stat_time +FROM session_record_completed_log +where (common_l4_protocol = 'IPv6_TCP' or common_l4_protocol = 'IPv4_TCP') and (common_device_group<>'' or common_data_center<>'') +group by common_client_ip,common_device_group,common_data_center,TUMBLE(stat_time,INTERVAL '5' MINUTE); + +INSERT INTO top_client_ip_log +(SELECT `source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'sessions' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY session_num DESC) as rownum +FROM +top_client_ip_view) +WHERE rownum <= 10000) +union all +(SELECT `source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'packets' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_pkt_num+s2c_pkt_num DESC) as rownum +FROM +top_client_ip_view) +WHERE rownum <= 10000) +union all +(SELECT `source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'bytes' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_byte_num+s2c_byte_num DESC) as rownum +FROM +top_client_ip_view) +WHERE rownum <= 10000); + +--server: +CREATE TABLE top_server_ip_log( +destination VARCHAR, +session_num BIGINT, +c2s_pkt_num BIGINT, +s2c_pkt_num BIGINT, +c2s_byte_num BIGINT, +s2c_byte_num BIGINT, +order_by VARCHAR, +device_group VARCHAR, +data_center VARCHAR, +stat_time BIGINT, +PRIMARY KEY (stat_time) NOT ENFORCED +)WITH( +'connector' = 'upsert-kafka', +'topic' = 'TOP-SERVER-IP', +'properties.bootstrap.servers' = 'kafkabootstrap', +'properties.security.protocol'='SASL_PLAINTEXT', +'properties.sasl.mechanism'='PLAIN', +'properties.sasl.jaas.config'= 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="galaxy2019";', +--'sink.parallelism'='1', +'key.format' = 'json', +'value.format' = 'json' +); + +CREATE VIEW top_server_ip_view as +SELECT common_server_ip as `destination`,sum(common_sessions) as session_num,sum(common_c2s_pkt_num) as c2s_pkt_num,sum(common_s2c_pkt_num) as s2c_pkt_num,sum(common_c2s_byte_num) as c2s_byte_num,sum(common_s2c_byte_num) as s2c_byte_num,common_device_group as device_group ,common_data_center as data_center,UNIX_TIMESTAMP(CAST(TUMBLE_END(stat_time,INTERVAL '5' MINUTE) as VARCHAR)) as stat_time +FROM session_record_completed_log +where (common_l4_protocol = 'IPv6_TCP' or common_l4_protocol = 'IPv4_TCP') and (common_device_group<>'' or common_data_center<>'') +group by common_server_ip,common_device_group,common_data_center,TUMBLE(stat_time,INTERVAL '5' MINUTE); + +INSERT INTO top_server_ip_log +(SELECT `destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'sessions' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY session_num DESC) as rownum +FROM +top_server_ip_view) +WHERE rownum <= 10000) +union all +(SELECT `destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'packets' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_pkt_num+s2c_pkt_num DESC) as rownum +FROM +top_server_ip_view) +WHERE rownum <= 10000) +union all +(SELECT destination, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +destination, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'bytes' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_byte_num+s2c_byte_num DESC) as rownum +FROM +top_server_ip_view) +WHERE rownum <= 10000); + +--internal +CREATE TABLE top_internal_ip_log ( +source VARCHAR, +session_num BIGINT, +c2s_pkt_num BIGINT, +s2c_pkt_num BIGINT, +c2s_byte_num BIGINT, +s2c_byte_num BIGINT, +order_by VARCHAR, +device_group VARCHAR, +data_center VARCHAR, +stat_time BIGINT, +PRIMARY KEY (stat_time) NOT ENFORCED +) WITH ( +'connector' = 'upsert-kafka', +'topic' = 'TOP-INTERNAL-HOST', +'properties.bootstrap.servers' = 'kafkabootstrap', +'properties.security.protocol'='SASL_PLAINTEXT', +'properties.sasl.mechanism'='PLAIN', +'properties.sasl.jaas.config'= 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="galaxy2019";', +--'sink.parallelism'='1', +'key.format' = 'json', +'value.format' = 'json' +); + +CREATE VIEW top_common_internal_ip_view as +SELECT common_internal_ip as `source`,sum(common_sessions) as session_num,sum(common_c2s_pkt_num) as c2s_pkt_num,sum(common_s2c_pkt_num) as s2c_pkt_num,sum(common_c2s_byte_num) as c2s_byte_num,sum(common_s2c_byte_num) as s2c_byte_num,common_device_group as device_group,common_data_center as data_center,UNIX_TIMESTAMP(CAST(TUMBLE_END(stat_time,INTERVAL '5' MINUTE) as VARCHAR)) as stat_time +FROM session_record_completed_log +where common_internal_ip<>'' and (common_device_group<>'' or common_data_center<>'') +group by common_internal_ip,common_device_group,common_data_center,TUMBLE(stat_time,INTERVAL '5' MINUTE); + + +INSERT INTO top_internal_ip_log +(SELECT `source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'sessions' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY session_num DESC) as rownum +FROM +top_common_internal_ip_view) +WHERE rownum <= 10000) +union all +(SELECT `source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'packets' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_pkt_num+s2c_pkt_num DESC) as rownum +FROM +top_common_internal_ip_view) +WHERE rownum <= 10000) +union all +(SELECT `source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`source`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'bytes' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_byte_num+s2c_byte_num DESC) as rownum +FROM +top_common_internal_ip_view) +WHERE rownum <= 10000); + + +--external: +CREATE TABLE top_external_ip_log ( +destination VARCHAR, +session_num BIGINT, +c2s_pkt_num BIGINT, +s2c_pkt_num BIGINT, +c2s_byte_num BIGINT, +s2c_byte_num BIGINT, +order_by VARCHAR, +device_group VARCHAR, +data_center VARCHAR, +stat_time BIGINT, +PRIMARY KEY (stat_time) NOT ENFORCED +) WITH ( +'connector' = 'upsert-kafka', +'topic' = 'TOP-EXTERNAL-HOST', +'properties.bootstrap.servers' = 'kafkabootstrap', +'properties.security.protocol'='SASL_PLAINTEXT', +'properties.sasl.mechanism'='PLAIN', +'properties.sasl.jaas.config'= 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="galaxy2019";', +--'sink.parallelism'='1', +'key.format' = 'json', +'value.format' = 'json' +); + + +CREATE VIEW top_common_external_ip_view as +SELECT common_external_ip as `destination`,sum(common_sessions) as session_num,sum(common_c2s_pkt_num) as c2s_pkt_num,sum(common_s2c_pkt_num) as s2c_pkt_num,sum(common_c2s_byte_num) as c2s_byte_num,sum(common_s2c_byte_num) as s2c_byte_num,common_device_group as device_group,common_data_center as data_center,UNIX_TIMESTAMP(CAST(TUMBLE_END(stat_time,INTERVAL '5' MINUTE) as VARCHAR)) as stat_time +FROM session_record_completed_log +where common_external_ip<>'' and (common_device_group<>'' or common_data_center<>'') +group by common_external_ip,common_device_group,common_data_center,TUMBLE(stat_time,INTERVAL '5' MINUTE); + + +INSERT INTO top_external_ip_log +(SELECT `destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'sessions' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY session_num DESC) as rownum +FROM +top_common_external_ip_view) +WHERE rownum <= 10000) +union all +(SELECT `destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'packets' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_pkt_num+s2c_pkt_num DESC) as rownum +FROM +top_common_external_ip_view) +WHERE rownum <= 10000) +union all +(SELECT `destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`destination`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'bytes' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_byte_num+s2c_byte_num DESC) as rownum +FROM +top_common_external_ip_view) +WHERE rownum <= 10000); + +--website_domain +CREATE TABLE top_website_domain_log ( +domain VARCHAR, +session_num BIGINT, +c2s_pkt_num BIGINT, +s2c_pkt_num BIGINT, +c2s_byte_num BIGINT, +s2c_byte_num BIGINT, +order_by VARCHAR, +device_group VARCHAR, +data_center VARCHAR, +stat_time BIGINT, +PRIMARY KEY (stat_time) NOT ENFORCED +) WITH ( +'connector' = 'upsert-kafka', +'topic' = 'TOP-WEBSITE-DOMAIN', +'properties.bootstrap.servers' = 'kafkabootstrap', +'properties.security.protocol'='SASL_PLAINTEXT', +'properties.sasl.mechanism'='PLAIN', +'properties.sasl.jaas.config'= 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="galaxy2019";', +--'sink.parallelism'='1', +'key.format' = 'json', +'value.format' = 'json' +); + +CREATE VIEW top_website_domain_view as +SELECT http_domain as `domain`,sum(common_sessions) as session_num,sum(common_c2s_pkt_num) as c2s_pkt_num,sum(common_s2c_pkt_num) as s2c_pkt_num,sum(common_c2s_byte_num) as c2s_byte_num,sum(common_s2c_byte_num) as s2c_byte_num,common_device_group as device_group ,common_data_center as data_center,UNIX_TIMESTAMP(CAST(TUMBLE_END(stat_time,INTERVAL '5' MINUTE) as VARCHAR)) as stat_time +FROM session_record_completed_log +where http_domain<>'' and (common_device_group<>'' or common_data_center<>'') +group by http_domain,common_device_group,common_data_center,TUMBLE(stat_time,INTERVAL '5' MINUTE); + + +INSERT INTO top_website_domain_log +(SELECT `domain`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`domain`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'sessions' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY session_num DESC) as rownum +FROM +top_website_domain_view) +WHERE rownum <= 10000) +union all +(SELECT `domain`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`domain`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'packets' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_pkt_num+s2c_pkt_num DESC) as rownum +FROM +top_website_domain_view) +WHERE rownum <= 10000) +union all +(SELECT `domain`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`domain`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'bytes' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_byte_num+s2c_byte_num DESC) as rownum +FROM +top_website_domain_view) +WHERE rownum <= 10000); + + +--user: +CREATE TABLE top_user_log ( +subscriber_id VARCHAR, +session_num BIGINT, +c2s_pkt_num BIGINT, +s2c_pkt_num BIGINT, +c2s_byte_num BIGINT, +s2c_byte_num BIGINT, +order_by VARCHAR, +device_group VARCHAR, +data_center VARCHAR, +stat_time BIGINT, +PRIMARY KEY (stat_time) NOT ENFORCED +) WITH ( +'connector' = 'upsert-kafka', +'topic' = 'TOP-USER', +'properties.bootstrap.servers' = 'kafkabootstrap', +'properties.security.protocol'='SASL_PLAINTEXT', +'properties.sasl.mechanism'='PLAIN', +'properties.sasl.jaas.config'= 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="galaxy2019";', +--'sink.parallelism'='1', +'key.format' = 'json', +'value.format' = 'json' +); + +CREATE VIEW top_user_log_view as +SELECT common_subscriber_id as `subscriber_id`,sum(common_sessions) as session_num,sum(common_c2s_pkt_num) as c2s_pkt_num,sum(common_s2c_pkt_num) as s2c_pkt_num,sum(common_c2s_byte_num) as c2s_byte_num,sum(common_s2c_byte_num) as s2c_byte_num,common_device_group as device_group ,common_data_center as data_center,UNIX_TIMESTAMP(CAST(TUMBLE_END(stat_time,INTERVAL '5' MINUTE) as VARCHAR)) as stat_time +FROM session_record_completed_log +where common_subscriber_id <>'' and (common_device_group<>'' or common_data_center<>'') +group by common_subscriber_id,common_device_group,common_data_center,TUMBLE(stat_time,INTERVAL '5' MINUTE); + +INSERT INTO top_user_log +(SELECT `subscriber_id`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`subscriber_id`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'sessions' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY session_num DESC) as rownum +FROM +top_user_log_view) +WHERE rownum <= 10000) +union all +(SELECT `subscriber_id`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`subscriber_id`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'packets' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_pkt_num+s2c_pkt_num DESC) as rownum +FROM +top_user_log_view) +WHERE rownum <= 10000) +union all +(SELECT `subscriber_id`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,order_by,device_group,data_center,stat_time FROM +(SELECT +`subscriber_id`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,'bytes' as order_by,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ORDER BY c2s_byte_num+s2c_byte_num DESC) as rownum +FROM +top_user_log_view) +WHERE rownum <= 10000); + +--app +CREATE TABLE top_app_log ( +app_name VARCHAR, +session_num BIGINT, +c2s_pkt_num BIGINT, +s2c_pkt_num BIGINT, +c2s_byte_num BIGINT, +s2c_byte_num BIGINT, +device_group VARCHAR, +data_center VARCHAR, +stat_time BIGINT, +PRIMARY KEY (stat_time) NOT ENFORCED +) WITH ( +'connector' = 'upsert-kafka', +'topic' = 'TRAFFIC-APP-STAT', +'properties.bootstrap.servers' = 'kafkabootstrap', +'properties.security.protocol'='SASL_PLAINTEXT', +'properties.sasl.mechanism'='PLAIN', +'properties.sasl.jaas.config'= 'org.apache.kafka.common.security.scram.ScramLoginModule required username="admin" password="galaxy2019";', +'key.format' = 'json', +'value.format' = 'json' +); + +CREATE VIEW top_app_log_view as +SELECT common_app_label as `app_name`,sum(common_sessions) as session_num,sum(common_c2s_pkt_num) as c2s_pkt_num,sum(common_s2c_pkt_num) as s2c_pkt_num,sum(common_c2s_byte_num) as c2s_byte_num,sum(common_s2c_byte_num) as s2c_byte_num,common_device_group as device_group ,common_data_center as data_center,UNIX_TIMESTAMP(CAST(TUMBLE_END(stat_time,INTERVAL '5' MINUTE) as VARCHAR)) as stat_time +FROM session_record_completed_log +where common_app_label<>'' and (common_device_group<>'' or common_data_center<>'') +group by common_app_label,common_device_group,common_data_center,TUMBLE(stat_time,INTERVAL '5' MINUTE); + +INSERT INTO top_app_log +(SELECT `app_name`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,device_group,data_center,stat_time FROM +(SELECT +`app_name`, session_num, c2s_pkt_num,s2c_pkt_num,c2s_byte_num,s2c_byte_num,device_group,data_center,stat_time, +ROW_NUMBER() OVER (PARTITION BY device_group,data_center ) +FROM +top_app_log_view)); diff --git a/TSG发布版本更新记录/TSG-22.04/flink/livecharts/config/LIVE-CHARTS_INTERIM-SESSION-RECORD b/TSG发布版本更新记录/TSG-22.04/flink/livecharts/config/LIVE-CHARTS_INTERIM-SESSION-RECORD new file mode 100644 index 0000000..7edd36a --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/livecharts/config/LIVE-CHARTS_INTERIM-SESSION-RECORD @@ -0,0 +1,55 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.14:9094,192.168.44.15:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.14:9094,192.168.44.15:9094 + +#--------------------------------HTTP------------------------------# +#kafka 证书地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=liveChart_interim.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=INTERIM-SESSION-RECORD + +#补全数据 输出 topic +sink.kafka.topic=TRAFFIC-PROTOCOL-STAT + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=liveCharts-interim-20220408-1 + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=1 + +#map函数并行度 +parse.parallelism=2 + +#第一次窗口计算并行度 +first.window.parallelism=2 + +#第二次窗口计算并行度 +second.window.parallelism=2 + +#producer 并行度 +sink.parallelism=1 + +#初次随机预聚合窗口时间 +first.count.window.time=5 + +#聚合窗口时间 +second.count.window.time=15 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/livecharts/config/LIVE-CHARTS_SESSION-RECORD b/TSG发布版本更新记录/TSG-22.04/flink/livecharts/config/LIVE-CHARTS_SESSION-RECORD new file mode 100644 index 0000000..42c691a --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/livecharts/config/LIVE-CHARTS_SESSION-RECORD @@ -0,0 +1,55 @@ +#--------------------------------地址配置------------------------------# + +#管理kafka地址 +source.kafka.servers=192.168.44.11:9094,192.168.44.14:9094,192.168.44.15:9094 + +#管理输出kafka地址 +sink.kafka.servers=192.168.44.11:9094,192.168.44.14:9094,192.168.44.15:9094 + +#--------------------------------HTTP------------------------------# +#kafka 证书地址 +tools.library=/home/bigdata/topology/dat/ + +#--------------------------------nacos配置------------------------------# +#nacos 地址 +nacos.server=192.168.44.67:8848 + +#nacos namespace +nacos.schema.namespace=f507879a-8b1b-4330-913e-83d4fcdc14bb + +#nacos data id +nacos.data.id=liveChart_session.json + +#--------------------------------Kafka消费组信息------------------------------# + +#kafka 接收数据topic +source.kafka.topic=SESSION-RECORD + +#补全数据 输出 topic +sink.kafka.topic=TRAFFIC-PROTOCOL-STAT + +#读取topic,存储该spout id的消费offset信息，可通过该拓扑命名;具体存储offset的位置，确定下次读取不重复的数据； +group.id=liveCharts-session-20220408-1 + +#--------------------------------topology配置------------------------------# + +#consumer 并行度 +source.parallelism=5 + +#map函数并行度 +parse.parallelism=5 + +#第一次窗口计算并行度 +first.window.parallelism=5 + +#第二次窗口计算并行度 +second.window.parallelism=5 + +#producer 并行度 +sink.parallelism=5 + +#初次随机预聚合窗口时间 +first.count.window.time=5 + +#二次聚合窗口时间 +second.count.window.time=15 diff --git a/TSG发布版本更新记录/TSG-22.04/flink/livecharts/start.sh b/TSG发布版本更新记录/TSG-22.04/flink/livecharts/start.sh new file mode 100644 index 0000000..f4695bf --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/livecharts/start.sh @@ -0,0 +1,41 @@ +#!/bin/bash +#启动storm任务脚本 +source /etc/profile +#任务jar所在目录 +BASE_DIR=`pwd` +#primordial +primordial='log-olap-analysis-schema-220323-Nacos.jar' +#jar name +JAR_NAME='log-completion-schema_tmp.jar' + +#并行度 +PARALLELISM=1 + +yes | cp -r $primordial $JAR_NAME + +#cd $BASE_DIR +jar -xvf $BASE_DIR/$JAR_NAME service_flow_config.properties +function read_dir(){ + for file in `ls $1` #注意此处这是两个反引号，表示运行系统命令 + do + if [ -d $1"/"$file ] #注意此处之间一定要加上空格，否则会报错 + then + read_dir $1"/"$file + else + num=`flink list | grep "$file" | wc -l` + if [ $num -eq "0" ];then + cat $1$file > $BASE_DIR/service_flow_config.properties + jar -uvf $BASE_DIR/$JAR_NAME service_flow_config.properties + flink run -d -c com.zdjizhi.topology.StreamAggregateTopology -p $PARALLELISM $JAR_NAME $file + fi + fi +done +} +if [ $# != 1 ];then + echo "usage: ./startall.sh [Configuration path]" + exit 1 +fi +#读取第一个参数 为配置文件目录名称 +read_dir $1 +rm -rf $JAR_NAME + diff --git a/TSG发布版本更新记录/TSG-22.04/flink/radiusOnOff/start.sh b/TSG发布版本更新记录/TSG-22.04/flink/radiusOnOff/start.sh new file mode 100644 index 0000000..7c6bb31 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/radiusOnOff/start.sh @@ -0,0 +1,40 @@ +#!/bin/bash +#启动storm任务脚本 +source /etc/profile +#任务jar所在目录 +BASE_DIR=`pwd` +#primordial +primordial='radius-account-knowledge-220413-sink.jar' +#jar name +JAR_NAME='radius-account-knowledge_tmp.jar' +#并行度 +PARALLELISM=1 + +yes | cp -r $primordial $JAR_NAME + +#cd $BASE_DIR +jar -xvf $BASE_DIR/$JAR_NAME service_flow_config.properties +function read_dir(){ + for file in `ls $1` #注意此处这是两个反引号，表示运行系统命令 + do + if [ -d $1"/"$file ] #注意此处之间一定要加上空格，否则会报错 + then + read_dir $1"/"$file + else + num=`flink list | grep "$file" | wc -l` + if [ $num -eq "0" ];then + cat $1$file > $BASE_DIR/service_flow_config.properties + jar -uvf $BASE_DIR/$JAR_NAME service_flow_config.properties + flink run -d -c com.zdjizhi.topology.RadiusKnowledgeTopology -p $PARALLELISM $JAR_NAME $file + fi + fi +done +} +if [ $# != 1 ];then + echo "usage: ./startall.sh [Configuration path]" + exit 1 +fi +#读取第一个参数 为配置文件目录名称 +read_dir $1 +rm -rf $JAR_NAME + diff --git a/TSG发布版本更新记录/TSG-22.04/flink/voipRelation/start.sh b/TSG发布版本更新记录/TSG-22.04/flink/voipRelation/start.sh new file mode 100644 index 0000000..4c6f68f --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/flink/voipRelation/start.sh @@ -0,0 +1,39 @@ +#!/bin/bash +#启动storm任务脚本 +source /etc/profile +#任务jar所在目录 +BASE_DIR=`pwd` +#primordial +primordial='log-stream-voip-relation-220413-sink.jar' +#jar name +JAR_NAME='log-stream-voip-relation_tmp.jar' +#并行度 +PARALLELISM=1 + +yes | cp -r $primordial $JAR_NAME + +#cd $BASE_DIR +jar -xvf $BASE_DIR/$JAR_NAME service_flow_config.properties +function read_dir(){ + for file in `ls $1` #注意此处这是两个反引号，表示运行系统命令 + do + if [ -d $1"/"$file ] #注意此处之间一定要加上空格，否则会报错 + then + read_dir $1"/"$file + else + num=`flink list | grep "$file" | wc -l` + if [ $num -eq "0" ];then + cat $1$file > $BASE_DIR/service_flow_config.properties + jar -uvf $BASE_DIR/$JAR_NAME service_flow_config.properties + flink run -d -c com.zdjizhi.topology.VoIpRelationTopology -p $PARALLELISM $JAR_NAME $file + fi + fi +done +} +if [ $# != 1 ];then + echo "usage: ./startall.sh [Configuration path]" + exit 1 +fi +#读取第一个参数 为配置文件目录名称 +read_dir $1 +rm -rf $JAR_NAME diff --git a/TSG发布版本更新记录/TSG-22.04/qgw/config/ck-filter.json b/TSG发布版本更新记录/TSG-22.04/qgw/config/ck-filter.json new file mode 100644 index 0000000..a0a03b0 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/qgw/config/ck-filter.json @@ -0,0 +1,99 @@ +{ + "version": "1.0", + "name": "ClickHouse-Raw", + "namespace": "ClickHouse", + "filters": [ + { + "name":"@start", + "value": "'2021-10-19 10:00:00'" + }, + { + "name":"@end", + "value": "'2021-10-20 11:00:00'" + }, + { + "name":"@common_filter", + "value": [ + "common_log_id=1153021139190754263", + "common_client_ip='118.180.48.74'", + "common_client_ip='120.242.132.200'", + "common_internal_ip='223.116.37.192'", + "common_server_ip='8.8.8.8'", + "common_server_ip='114.114.114.114'", + "common_server_ip!='114.114.114.114'", + "common_server_ip='120.239.72.226'", + "common_external_ip='111.10.53.14'", + "common_client_port=52607", + "common_server_port=443", + "common_c2s_pkt_num>5", + "common_s2c_pkt_num>5", + "common_c2s_byte_num>100", + "common_s2c_byte_num<200", + "common_schema_type='DNS'", + "common_establish_latency_ms>200", + "common_con_duration_ms>10000", + "common_stream_trace_id=1153021139190754263", + "common_tcp_client_isn=2857077935", + "common_tcp_server_isn=0", + "http_domain='qq.com'", + "http_domain!='qq.com'", + "http_domain='yunser.com'", + "mail_account='abc@xx.com'", + "mail_subject='test'", + "dns_qname='qbwup.imtt.qq.com'", + "ssl_sni='mmbiz.qpic.cn'", + "ssl_sni='openai.qq.com'", + "ssl_con_latency_ms>100", + "ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1'", + "common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8'", + "common_server_ip='111.10.53.14' and common_server_port=443", + "common_server_ip like '120.239%'", + "common_server_ip not like '120.239%'", + "common_server_ip like '%114.114%'", + "mail_account like 'abc@%'", + "http_domain like '%baidu.com%'", + "ssl_sni like '%google.com'", + "http_domain like 'baidu%'", + "http_domain like '%baidu.com%'", + "common_client_ip in ('120.239.72.226','114.114.114.114')", + "common_client_ip not in ('120.239.72.226','114.114.114.114')", + "common_server_ip='116.177.248.126' and notEmpty(http_domain)", + "common_server_ip='116.177.248.126' and common_client_ip='120.242.132.200'", + "common_server_ip='116.177.248.126' and common_stream_trace_id=1153021139190754263", + "common_client_ip='120.242.132.200' and common_server_ip='116.177.248.126'", + "http_domain='qq.com' or common_server_ip='120.239.72.226'", + "common_server_port not in (80,443)", + "http_domain not like '%qq.com'" + ] + }, + { + "name":"@index_filter", + "value": [ + "common_log_id=1153021139190754263", + "common_client_ip='118.180.48.74'", + "common_client_ip='120.242.132.200'", + "common_server_ip='114.114.114.114'", + "common_server_ip!='114.114.114.114'", + "common_server_ip='120.239.72.226'", + "http_domain='qq.com'", + "http_domain!='qq.com'", + "http_domain='yunser.com'", + "ssl_sni='mmbiz.qpic.cn'", + "ssl_sni='openai.qq.com'", + "common_server_ip like '120.239%'", + "common_server_ip not like '120.239%'", + "common_server_ip like '%114.114%'", + "common_subscriber_id='%test%'", + "http_domain like 'baidu%'", + "http_domain like '%baidu.com%'", + "common_client_ip in ('120.239.72.226','114.114.114.114')", + "common_client_ip not in ('120.239.72.226','114.114.114.114')", + "common_server_ip='116.177.248.126' and notEmpty(http_domain)", + "common_server_ip='116.177.248.126' and common_client_ip='120.242.132.200'", + "common_server_ip='116.177.248.126' and common_stream_trace_id=1153021139190754263", + "common_client_ip='120.242.132.200' and common_server_ip='116.177.248.126'", + "http_domain='qq.com' or common_server_ip='120.239.72.226'" + ] + } + ] +} \ No newline at end of file diff --git a/TSG发布版本更新记录/TSG-22.04/qgw/config/ck-queries-template.sql b/TSG发布版本更新记录/TSG-22.04/qgw/config/ck-queries-template.sql new file mode 100644 index 0000000..56b64c9 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/qgw/config/ck-queries-template.sql @@ -0,0 +1,118 @@ +--Q01.Count(1) +select count(1) FROM tsg_galaxy_v3.session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) +--Q02.All Fields Query (default) +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) LIMIT 30 +--Q03.All Fields Query order by Time desc +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time DESC LIMIT 30 +--Q04.All Fields Query order by Time asc +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time asc LIMIT 30 +--Q05.All Fields Query by Filter +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @common_filter ORDER BY common_recv_time DESC LIMIT 30 +--Q06.Default Fields Query by Filter +SELECT toDateTime(common_recv_time) AS common_recv_time , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @common_filter ORDER BY common_recv_time DESC LIMIT 30 +--Q07.All Fields Query (sub query by time) +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE toDateTime(common_recv_time) IN ( SELECT toDateTime(common_recv_time) FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time DESC LIMIT 30 +--Q08.All Fields Query (sub query by log id) +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE common_log_id IN ( SELECT common_log_id FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time DESC LIMIT 30 ) AND common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time DESC LIMIT 30 +--Q09.Default Field Query (sub query by time) +SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM tsg_galaxy_v3.session_record AS session_record WHERE toDateTime(common_recv_time) IN ( SELECT toDateTime(common_recv_time) FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time DESC LIMIT 30 +--Q10.Default Field Query (sub query by log id) +SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM tsg_galaxy_v3.session_record AS session_record WHERE common_log_id IN ( select common_log_id FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end)) ORDER BY common_recv_time DESC LIMIT 30 +--Q11.Default Field Query by Server IP (sub query by log id with Index Table) +SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM tsg_galaxy_v3.session_record AS session_record WHERE common_log_id IN ( Select common_log_id FROM tsg_galaxy_v3.session_record_common_server_ip AS session_record_common_server_ip WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time DESC LIMIT 30 +--Q12.Default Field Query by Client IP (sub query by log id with Index Table) +SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM tsg_galaxy_v3.session_record AS session_record WHERE common_log_id IN ( Select common_log_id FROM tsg_galaxy_v3.session_record_common_client_ip AS session_record_common_client_ip WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time DESC LIMIT 30 +--Q13.Default Field Query by Domain (sub query by log id with Index Table) +SELECT toDateTime(common_recv_time) AS common_recv_time_str , common_log_id , common_client_ip , common_client_port , common_server_ip , common_server_port FROM tsg_galaxy_v3.session_record AS session_record WHERE common_log_id IN ( Select common_log_id FROM tsg_galaxy_v3.session_record_http_domain AS session_record_http_domain WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time DESC LIMIT 30 +--Q14.All Fields Query by Client IP (sub query by log id with index Table) +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE common_log_id IN ( SELECT common_log_id FROM tsg_galaxy_v3.session_record_common_client_ip AS session_record_common_client_ip WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY toDateTime(common_recv_time) DESC LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time desc LIMIT 30 +--Q15.All Fields Query by Server IP(sub query by log id with index Table) +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE common_log_id IN ( SELECT common_log_id FROM tsg_galaxy_v3.session_record_common_server_ip AS session_record_common_server_ip WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time desc LIMIT 30 +--Q16.All Fields Query by Domain(sub query by log id with index Table) +SELECT * FROM tsg_galaxy_v3.session_record AS session_record WHERE common_log_id IN ( SELECT common_log_id FROM tsg_galaxy_v3.session_record_http_domain AS session_record_http_domain WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ORDER BY common_recv_time LIMIT 30 ) AND ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) AND @index_filter ) ORDER BY common_recv_time desc LIMIT 30 +--Q17.Session Logs Sent to Database Trend(Time Grain 5 minute) +SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", count(common_log_id) AS "logs" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ) ) GROUP BY "Receive Time" LIMIT 10000 +--Q18.Traffic Bandwidth Trend(Time Grain 30 second) +SELECT toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 30 SECOND)))) AS stat_time, sum(common_c2s_byte_num) AS bytes_sent, sum(common_s2c_byte_num) AS bytes_received, sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, sum(common_c2s_pkt_num + common_s2c_pkt_num) AS packets, sum(common_sessions) AS sessions FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) GROUP BY stat_time ORDER BY stat_time ASC LIMIT 10000 +--Q19.Log Tend by Type (Time Grain 5 minute) +SELECT toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE)))) AS stat_time, common_schema_type AS type, sum(common_sessions) AS sessions, sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, sum(common_c2s_pkt_num + common_s2c_pkt_num) AS packets FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) GROUP BY stat_time, common_schema_type ORDER BY stat_time ASC LIMIT 10000 +--Q20.Traffic Metrics Analytic +SELECT round(sum(common_s2c_byte_num) * 8 / 300,2) AS trafficInBits, round(sum(common_c2s_byte_num) * 8 / 300,2) AS trafficOutBits, round(sum(common_s2c_byte_num + common_c2s_byte_num) * 8 / 300,2) AS trafficTotalBits, round(sum(common_s2c_pkt_num) / 300,2) AS trafficInPackets, round(sum(common_c2s_pkt_num) / 300,2) AS trafficOutPackets, round(sum(common_s2c_pkt_num + common_c2s_pkt_num) / 300,2) AS trafficTotalPackets, round(sum(common_sessions) / 300,2) AS sessions FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) +--Q21.Traffic Endpoints Metrics Trend(Time Grain 5 minute) +SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", uniq(common_internal_ip) AS "Unique Internal IP", uniq(common_external_ip) AS "Unique External IP", uniq(common_subscriber_id) AS "Unique Subscriber ID", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Receive Time" LIMIT 10000 +--Q22.Endpoint Unique Num by L4 Protocol +SELECT 'all' AS type, uniq(common_client_ip) AS client_ips, uniq(common_internal_ip) AS internal_ips, uniq(common_server_ip) AS server_ips, uniq(common_external_ip) AS external_ips, uniq(common_subscriber_id) as subscriber_ids FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) UNION ALL SELECT 'tcp' AS type, uniq(common_client_ip) AS client_ips, uniq(common_internal_ip) AS internal_ips, uniq(common_server_ip) AS server_ips, uniq(common_external_ip) AS external_ips, uniq(common_subscriber_id) as subscriber_ids FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) UNION ALL SELECT 'UDP' AS type, uniq(common_client_ip) AS client_ips, uniq(common_internal_ip) AS internal_ips, uniq(common_server_ip) AS server_ips, uniq(common_external_ip) AS external_ips, uniq(common_subscriber_id) as subscriber_ids FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND common_l4_protocol IN ( 'IPv4_UDP', 'IPv6_UDP' ) +--Q23.One-sided Connection Trend(Time Grain 5 minute) +SELECT toDateTime(toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE)))) AS stat_time, (CASE WHEN common_stream_dir = 1 THEN 'c2s' WHEN common_stream_dir = 2 THEN 's2c' WHEN common_stream_dir = 3 THEN 'double' ELSE 'None' END) AS type, sum(common_sessions) AS sessions FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) GROUP BY stat_time, common_stream_dir ORDER BY stat_time ASC LIMIT 10000 +--Q24. Estimated One-sided Sessions with Bandwidth +SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", sum(common_sessions) AS "sessions", sum(if(common_stream_dir <> 3, common_sessions, 0)) AS "one_side_sessions", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes", round(one_side_sessions / sessions, 2) AS one_side_percent FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Receive Time" LIMIT 10000 +--Q25.Estimated TCP Sequence Gap Loss +SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", sum(common_c2s_byte_num + common_s2c_byte_num) AS "bytes", sum(common_c2s_tcp_lostlen + common_s2c_tcp_lostlen) AS "gap_loss_bytes", round(gap_loss_bytes / bytes, 2) AS gap_loss_percent FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) ) GROUP BY "Receive Time" LIMIT 10000 +--Q26.Top30 Server IP by Bytes +SELECT "server_ip" AS "server_ip" , SUM(coalesce("bytes",0)) AS "bytes" , SUM(coalesce("bytes_sent",0)) AS "Sent" , SUM(coalesce("bytes_received",0)) AS "Received" , SUM(coalesce("sessions",0)) AS "sessions" FROM ( SELECT SUM(coalesce(common_c2s_byte_num,0)) AS "bytes_sent" , SUM(coalesce(common_s2c_byte_num,0)) AS "bytes_received" , SUM(common_c2s_byte_num+common_s2c_byte_num) AS "bytes" , SUM(coalesce(common_sessions,0)) AS "sessions" , common_server_ip AS "server_ip" FROM tsg_galaxy_v3.session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty( common_server_ip) ) GROUP BY "server_ip" ORDER BY "bytes" desc ) GROUP BY "server_ip" ORDER BY "bytes" desc LIMIT 30 +--Q27.Top30 Client IP by Sessions +SELECT common_client_ip , COUNT(*) AS sessions FROM tsg_galaxy_v3.session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) GROUP BY common_client_ip ORDER BY sessions desc LIMIT 0,30 +--Q28.Top30 TCP Server Ports by Sessions +SELECT "Server Port" AS "Server Port", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT common_server_port AS "Server Port", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( common_l4_protocol IN ( 'IPv4_TCP', 'IPv6_TCP' ) ) GROUP BY "Server Port" LIMIT 1048576) GROUP BY "Server Port" ORDER BY "Sessions" DESC LIMIT 30 +--Q29.Top30 Domian by Bytes +SELECT "domain" AS "Website Domain" , SUM(coalesce("bytes",0)) AS "Throughput" FROM ( SELECT SUM(coalesce(common_c2s_byte_num,0)) AS "bytes_sent" , SUM(coalesce(common_s2c_byte_num,0)) AS "bytes_received" , SUM(coalesce(common_c2s_byte_num+common_s2c_byte_num,0)) AS "bytes" , http_domain AS "domain" FROM tsg_galaxy_v3.session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty( http_domain) ) GROUP BY "domain" ORDER BY "bytes" desc ) GROUP BY "domain" ORDER BY "Throughput" desc LIMIT 30 +--Q30.Top30 Endpoint Devices by Bandwidth +SELECT "device_id" AS "device_id", sum(coalesce("bytes", 0)) AS "bytes", sum(coalesce("bytes_sent", 0)) AS "Sent", sum(coalesce("bytes_received", 0)) AS "Received" FROM (SELECT sum(coalesce(common_c2s_byte_num, 0)) AS "bytes_sent", sum(coalesce(common_s2c_byte_num, 0)) AS "bytes_received", sum(common_c2s_byte_num + common_s2c_byte_num) AS bytes, common_device_id AS "device_id" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "device_id" ORDER BY "bytes" DESC LIMIT 1048576) GROUP BY "device_id" ORDER BY "bytes" DESC LIMIT 30 +--Q31.Top30 Domain by Unique Client IP +SELECT "Http.Domain" AS "Http.Domain", sum(coalesce("Client IP", 0)) AS "Client IP" FROM (SELECT http_domain AS "Http.Domain", uniq(common_client_ip) AS "Client IP" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) ) GROUP BY "Http.Domain" ORDER BY "Client IP" DESC LIMIT 1048576) GROUP BY "Http.Domain" ORDER BY "Client IP" DESC LIMIT 30 +--Q32.Top100 Most Time Consuming Domains +SELECT "Domain" AS "Domain", avg(coalesce("Avg Establish Latency(ms)", 0)) AS "Avg Establish Latency(ms)" FROM (SELECT http_domain AS "Domain", avg(coalesce(common_establish_latency_ms, 0)) AS "Avg Establish Latency(ms)" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) ) GROUP BY "Domain" LIMIT 1048576) GROUP BY "Domain" ORDER BY "Avg Establish Latency(ms)" DESC LIMIT 100 +--Q33.Top30 Sources by Sessions +SELECT "source" AS "source", sum(coalesce("sessions", 0)) AS "sessions" FROM (SELECT coalesce(nullif(common_subscriber_id, ''), nullif(common_client_ip, '')) AS "source", sum(coalesce(common_sessions, 0)) AS "sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "source" ORDER BY "sessions" DESC LIMIT 1048576) GROUP BY "source" ORDER BY "sessions" DESC LIMIT 30 +--Q34.Top30 Destinations by Sessions +SELECT "destination" AS "destination", sum(coalesce("sessions", 0)) AS "sessions" FROM (SELECT coalesce(nullif(http_domain, ''), nullif(common_server_ip, '')) AS "destination", sum(coalesce(common_sessions, 0)) AS "sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "destination" ORDER BY "sessions" DESC LIMIT 1048576) GROUP BY "destination" ORDER BY "sessions" DESC LIMIT 30 +--Q35.Top30 Destination Regions by Bandwidth +SELECT "server_location" AS "server_location", sum(coalesce("bytes", 0)) AS "bytes", sum(coalesce("bytes_sent", 0)) AS "Sent", sum(coalesce("bytes_received", 0)) AS "Received" FROM (SELECT arrayElement(splitByString(',', common_server_location), length(splitByString(',', common_server_location))) AS "server_location", sum(coalesce(common_c2s_byte_num, 0)) AS "bytes_sent", sum(coalesce(common_s2c_byte_num, 0)) AS "bytes_received", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "bytes", sum(coalesce(common_sessions, 0)) AS "sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "server_location" ORDER BY "bytes" DESC LIMIT 1048576) GROUP BY "server_location" ORDER BY "bytes" DESC LIMIT 30 +--Q36.Top30 URLS by Sessions +SELECT "Http URL" AS "Http URL", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT http_url AS "Http URL", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Http URL" LIMIT 1048576) GROUP BY "Http URL" ORDER BY "Sessions" DESC LIMIT 30 +--Q37.Top30 Destination Transmission APP by Bandwidth +SELECT "server_ip" AS "server_ip", groupUniqArray(coalesce("trans_app", 0)) AS "trans_app", sum(coalesce("bytes", 0)) AS "bytes", sum(coalesce("bytes_sent", 0)) AS "Sent", sum(coalesce("bytes_received", 0)) AS "Received" FROM (SELECT sum(coalesce(common_c2s_byte_num, 0)) AS "bytes_sent", sum(coalesce(common_s2c_byte_num, 0)) AS "bytes_received", sum(common_c2s_byte_num + common_s2c_byte_num) AS "bytes", groupUniqArray(concat(common_l4_protocol, '/', toString(common_server_port))) AS "trans_app", common_server_ip AS "server_ip" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(common_server_ip) ) GROUP BY "server_ip" ORDER BY "bytes" DESC LIMIT 1048576) GROUP BY "server_ip" ORDER BY "bytes" DESC LIMIT 30 +--Q38.Browsing Users by Website domains and Sessions +SELECT "Subscriber ID" AS "Subscriber ID", "Http.Domain" AS "Http.Domain", sum(coalesce("sessions", 0)) AS "sessions" FROM (SELECT http_domain AS "Http.Domain", common_subscriber_id AS "Subscriber ID", sum(coalesce(common_sessions, 0)) AS "sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) AND notEmpty(common_subscriber_id) ) GROUP BY "Http.Domain", "Subscriber ID" ORDER BY "sessions" DESC LIMIT 1048576) GROUP BY "Subscriber ID", "Http.Domain" ORDER BY "sessions" DESC LIMIT 10000 +--Q39.Top Domain and Server IP by Bytes Sent +SELECT "Http.Domain" AS "Http.Domain" , "Server IP" AS "Server IP" , SUM(coalesce("Bytes Sent",0)) AS "Bytes Sent" FROM ( SELECT common_server_ip AS "Server IP" , http_domain AS "Http.Domain" , SUM(coalesce(common_c2s_byte_num+common_s2c_byte_num,0)) AS "Bytes" , SUM(coalesce(common_c2s_byte_num,0)) AS "Bytes Sent" , SUM(coalesce(common_s2c_byte_num,0)) AS "Bytes Received" FROM tsg_galaxy_v3.session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty( http_domain) ) GROUP BY "Server IP" , "Http.Domain" ORDER BY "Bytes" desc LIMIT 1048576 ) GROUP BY "Http.Domain" , "Server IP" ORDER BY "Bytes Sent" desc LIMIT 10000 +--Q40.Top30 Website Domains by Client IP and Sessions +SELECT "Http.Domain" AS "Http.Domain", "Client IP" AS "Client IP", sum(coalesce("sessions", 0)) AS "sessions" FROM (SELECT common_client_ip AS "Client IP", http_domain AS "Http.Domain", sum(coalesce(common_sessions, 0)) AS "sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) ) GROUP BY "Client IP", "Http.Domain" ORDER BY "sessions" DESC LIMIT 1048576) GROUP BY "Http.Domain", "Client IP" ORDER BY "sessions" DESC LIMIT 10000 +--Q41.Domain is Accessed by Unique Client IP Trend(bytes Time Grain 5 minute) +SELECT toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) AS _time , http_domain AS Domain, COUNT(DISTINCT(common_client_ip)) AS nums FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND notEmpty(http_domain) AND http_domain IN ( SELECT http_domain FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND notEmpty(http_domain) GROUP BY http_domain ORDER BY SUM(common_s2c_byte_num+common_c2s_byte_num) DESC LIMIT 5 ) GROUP BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) , http_domain ORDER BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) DESC LIMIT 10000 +--Q42. Domain is Accessed by Unique Client IP Trend(sessions,Time Grain 5 minute) +SELECT toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),3600)*3600) AS stat_time , http_domain , uniq (common_client_ip) AS nums FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start)-604800 AND common_recv_time < toDateTime(@end) AND http_domain IN ( SELECT http_domain FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND notEmpty(http_domain) GROUP BY http_domain ORDER BY COUNT(*) desc LIMIT 5 ) group by toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 3600)*3600), http_domain ORDER BY stat_time desc LIMIT 10000 +--Q43.Bandwidth Trend with Device ID(Time Grain 5 minute) +SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", common_device_id AS "Device ID", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Receive Time", "Device ID" LIMIT 10000 +--Q44.Internal IP by Sled IP and Sessions +SELECT "Internal IP" AS "Internal IP", "Sled IP" AS "Sled IP", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT common_sled_ip AS "Sled IP", common_internal_ip AS "Internal IP", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Sled IP", "Internal IP" LIMIT 1048576) GROUP BY "Internal IP", "Sled IP" ORDER BY "Sessions" DESC LIMIT 10000 +--Q45.Bandwidth Trend with Internal IP (Time Grain 5 minute) +SELECT toUnixTimestamp(toDateTime(toStartOfInterval(toDateTime(common_recv_time),INTERVAL 5 MINUTE))) AS "Receive Time", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes", sum(coalesce(common_c2s_pkt_num + common_s2c_pkt_num, 0)) AS "Packets", sum(coalesce(common_sessions, 0)) AS "New Sessions", sum(coalesce(common_c2s_byte_num, 0)) AS "Bytes Sent", sum(coalesce(common_s2c_byte_num, 0)) AS "Bytes Received", sum(coalesce(common_c2s_pkt_num, 0)) AS "Packets Sent", sum(coalesce(common_s2c_pkt_num, 0)) AS "Packets Received" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) AND @common_filter ) GROUP BY "Receive Time" LIMIT 10000 +--Q46.Top30 Domains Detail with Internal IP +SELECT "Domain" AS "Domain", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT http_domain AS "Domain", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) AND @common_filter ) AND ( notEmpty(http_domain) ) GROUP BY "Domain" LIMIT 1048576) GROUP BY "Domain" ORDER BY "Sessions" DESC LIMIT 30 +--Q47.Top30 URLS Detail with Internal IP +SELECT "URL" AS "URL", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT http_url AS "URL", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) AND @common_filter ) AND ( notEmpty(http_url) ) GROUP BY "URL" LIMIT 1048576) GROUP BY "URL" ORDER BY "Sessions" DESC LIMIT 30 +--Q48.Top Domains with Unique Client IP and Subscriber ID +SELECT "Http.Domain" AS "Http.Domain", sum(coalesce("Unique Client IP", 0)) AS "Unique Client IP", sum(coalesce("Unique Subscriber ID", 0)) AS "Unique Subscriber ID" FROM (SELECT http_domain AS "Http.Domain", uniq(common_client_ip) AS "Unique Client IP", uniq(common_subscriber_id) AS "Unique Subscriber ID" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( notEmpty(http_domain) ) GROUP BY "Http.Domain" LIMIT 1048576) GROUP BY "Http.Domain" ORDER BY "Unique Client IP" DESC LIMIT 100 +--Q49.Top100 Domains by Packets sent +SELECT "Http.Domain" AS "Http.Domain", sum(coalesce("Packets Sent", 0)) AS "Packets Sent" FROM (SELECT http_domain AS "Http.Domain", sum(coalesce(common_c2s_pkt_num, 0)) AS "Packets Sent" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Http.Domain" LIMIT 1048576) GROUP BY "Http.Domain" ORDER BY "Packets Sent" DESC LIMIT 100 +--Q50.Internal and External asymmetric traffic +SELECT "Internal IP" AS "Internal IP", "External IP" AS "External IP", "Sled IP" AS "Sled IP", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT common_sled_ip AS "Sled IP", common_external_ip AS "External IP", common_internal_ip AS "Internal IP", sum(coalesce(common_c2s_byte_num + common_s2c_byte_num, 0)) AS "Bytes Sent+Bytes Received", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( common_stream_dir != 3 ) GROUP BY "Sled IP", "External IP", "Internal IP" LIMIT 1048576) GROUP BY "Internal IP", "External IP", "Sled IP" ORDER BY "Sessions" DESC LIMIT 500 +--Q51.Client and Server ASN asymmetric traffic +SELECT "Client ASN" AS "Client ASN", "Server ASN" AS "Server ASN", sum(coalesce("Sessions", 0)) AS "Sessions" FROM (SELECT common_server_asn AS "Server ASN", common_client_asn AS "Client ASN", sum(coalesce(common_sessions, 0)) AS "Sessions" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) AND ( common_stream_dir != 3 ) GROUP BY "Server ASN", "Client ASN" LIMIT 1048576) GROUP BY "Client ASN", "Server ASN" ORDER BY "Sessions" DESC LIMIT 500 +--Q52.Top handshake latency by Website and Client IPs +SELECT "SSL.SNI" AS "SSL.SNI", "Client IP" AS "Client IP", avg(coalesce("Establish Latency(ms)", 0)) AS "Establish Latency(ms)" FROM (SELECT common_client_ip AS "Client IP", ssl_sni AS "SSL.SNI", avg(coalesce(common_establish_latency_ms, 0)) AS "Establish Latency(ms)" FROM tsg_galaxy_v3.session_record AS session_record WHERE ( ( common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) ) ) GROUP BY "Client IP", "SSL.SNI" LIMIT 1048576) GROUP BY "SSL.SNI", "Client IP" ORDER BY "Establish Latency(ms)" DESC LIMIT 500 +--Q53.Domain baidu.com Drill down Client IP +select common_client_ip as "Client IP" , avg(common_establish_latency_ms) as "Establishing Time Mean(ms)", count(1) as Responses,any(common_client_location) as Location FROM tsg_galaxy_v3.session_record where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and http_domain='baidu.com' group by "Client IP" order by Responses desc limit 100 +--Q54.Domain baidu.com Drill down Server IP +select common_server_ip as "Server IP" , avg(http_response_latency_ms) as "Server Processing Time Mean(ms)", count(1) as Responses,any(common_server_location) as Location FROM tsg_galaxy_v3.session_record where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and http_domain='baidu.com' group by "Server IP" order by Responses desc limit 100 +--Q55.Domain baidu.com Drill down URI +select http_url as "URI" , avg(http_response_latency_ms) as "Server Processing Time Mean(ms)", count(1) as Responses FROM tsg_galaxy_v3.session_record where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and http_domain='baidu.com' group by "URI" order by Responses desc limit 100 +--Q56.L7 Protocol Metrics +select common_l7_protocol as "Protocol" , uniq(common_client_ip) as "Clients" , uniq(common_server_ip) as "Servers", count(1) as Sessions,sum(common_c2s_byte_num+common_s2c_byte_num) as bytes FROM tsg_galaxy_v3.session_record where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and notEmpty(common_l7_protocol) group by common_l7_protocol order by bytes desc +--Q57.L7 Protocol SIP Drill down Client IP +select common_client_ip as "Client IP" , count(1) as Sessions,sum(common_c2s_byte_num) as "Bytes Out", sum(common_s2c_byte_num) as "Bytes In",any(common_client_location) as Location FROM tsg_galaxy_v3.session_record where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and common_l7_protocol='SIP' group by "Client IP" order by Sessions desc limit 100 +--Q58.L7 Protocol SIP Drill down Server IP +select common_server_ip as "Server IP" , count(1) as Sessions,sum(common_c2s_byte_num) as "Bytes Out", sum(common_s2c_byte_num) as "Bytes In",any(common_server_location) as Location FROM tsg_galaxy_v3.session_record where common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) and common_l7_protocol='SIP' group by "Server IP" order by Sessions desc limit 100 +--Q59.Top5 Server IP keys with Unique Client IPs Trend (Grain 5 minute) +SELECT toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) AS _time , common_server_ip AS server_ip, COUNT(DISTINCT(common_client_ip)) AS nums FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND common_server_ip IN ( SELECT common_server_ip FROM tsg_galaxy_v3.session_record AS session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) GROUP BY common_server_ip ORDER BY count(*) DESC LIMIT 5 ) GROUP BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) , server_ip ORDER BY toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))),300)*300) DESC LIMIT 10000 diff --git a/TSG发布版本更新记录/TSG-22.04/qgw/config/druid-filter.json b/TSG发布版本更新记录/TSG-22.04/qgw/config/druid-filter.json new file mode 100644 index 0000000..e8286b7 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/qgw/config/druid-filter.json @@ -0,0 +1,21 @@ +{ + "version": "1.0", + "name": "druid-Raw", + "namespace": "druid", + "filters": [ + { + "name":"@start", + "value": "'2021-10-19 10:00:00'" + }, + { + "name":"@end", + "value": "'2021-10-20 11:00:00'" + }, + { + "name":"@common_filter", + "value": [ + "common_client_ip='192.168.44.21'and common_server_port=443" + ] + } + ] +} \ No newline at end of file diff --git a/TSG发布版本更新记录/TSG-22.04/qgw/config/druid-queries-template.sql b/TSG发布版本更新记录/TSG-22.04/qgw/config/druid-queries-template.sql new file mode 100644 index 0000000..11544f1 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/qgw/config/druid-queries-template.sql @@ -0,0 +1,92 @@ +--Q01.All Security Event Hits +select policy_id, sum(hits) as hits from security_event_hits_log where __time >@start and __time <@end group by policy_id +--Q02.Security Event Hits with Policy ID 0 +select policy_id, sum(hits) as hits from security_event_hits_log where __time >@start and __time <@end and policy_id in (0) group by policy_id +--Q03.All Security Event Hits Trend by 5min A +select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as start_time, sum(hits) as hits from security_event_hits_log where __time >= TIMESTAMP @start and __time < TIMESTAMP @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') limit 10000 +--Q04.Security Event Hit Time（first and last time) A +select policy_id,TIME_FORMAT(min(__time) ,'yyyy-MM-dd HH:mm:ss') as first_used, TIME_FORMAT(max(__time) ,'yyyy-MM-dd HH:mm:ss') as last_used from security_event_hits_log where policy_id in (0) group by policy_id +--Q05.Top 200 Security Policies +select policy_id, sum(hits) as hits from security_event_hits_log where __time >=TIMESTAMP @start and __time =@start and __time <@end group by policy_id, action order by hits desc limit 200 +--Q07.All Proxy Event Hits +select policy_id, sum(hits) as hits from proxy_event_hits_log where __time >=@start and __time <@end group by policy_id +--Q08.Proxy Event Hits with Policy ID 0 +select policy_id, sum(hits) as hits from proxy_event_hits_log where __time >=@start and __time <@end and policy_id=0 group by policy_id +--Q09.All Proxy Event Hits Trend by 5min A +select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as start_time, sum(hits) as hits from proxy_event_hits_log where __time >= TIMESTAMP @start and __time =TIMESTAMP @start and __time =@start and __time <@end group by policy_id, sub_action order by hits desc limit 200 +--Q13.Proxy Action Hits +select sub_action as action, sum(hits) as hits from proxy_event_hits_log where __time >= TIMESTAMP @start and __time < TIMESTAMP @end group by sub_action +--Q14.Proxy Action Hits Trend by 5min +select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as start_time, sub_action as action, sum(hits) as hits from proxy_event_hits_log where __time >=TIMESTAMP @start and __time = @start AND __time < @end UNION ALL SELECT sum(pinning_num) AS sessions, 'pinningNum' AS type FROM traffic_metrics_log WHERE __time >= @start AND __time < @end UNION ALL SELECT sum(maybe_pinning_num) AS sessions, 'maybePinningNum' AS type FROM traffic_metrics_log WHERE __time >= @start AND __time < @end +--Q16.Traffic Metrics Pinning Trend by 5Min +SELECT TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') AS statisticTime, sum(pinning_num) AS sessions FROM traffic_metrics_log WHERE __time >= @start AND __time < @end GROUP BY TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') LIMIT 10000 +--Q17.Traffic Metrics Not Pinning Trend by 5Min +SELECT TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') AS statisticTime, sum(not_pinning_num) AS sessions FROM traffic_metrics_log WHERE __time>= @start AND __time < @end GROUP BY TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') LIMIT 10000 +--Q18.Traffic Metrics Maybe Pinning Trend by 5Min +SELECT TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') AS statisticTime, sum(maybe_pinning_num) AS sessions FROM traffic_metrics_log WHERE __time >= @start AND __time < @end GROUP BY TIME_FORMAT( MILLIS_TO_TIMESTAMP( 1000 * (TIMESTAMP_TO_MILLIS(time_floor(0.001 * TIMESTAMP_TO_MILLIS( __time) * 1000,'PT300S'))/1000)),'YYYY-MM-dd HH:mm:ss') LIMIT 10000 +--Q19.Traffic Metrics Throughput Bytes IN/OUT +select sum(total_in_bytes) as traffic_in_bytes, sum(total_out_bytes) as traffic_out_bytes from traffic_metrics_log where __time >=TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time = @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'traffic_out_bytes' as type, sum(total_out_bytes) as bytes from traffic_metrics_log where __time >= @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') +--Q23.Traffic Metrics Bandwidth Packets IN/OUT +select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'traffic_in_packets' as type, sum(total_in_packets) as packets from traffic_metrics_log where __time >=TIMESTAMP @start and __time =TIMESTAMP @start and __time = @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') +--Q25.Traffic Metrics New and Live Sessions +select sum(new_conn_num) as new_conn_num, sum(established_conn_num) as established_conn_num from traffic_metrics_log where __time >=TIMESTAMP @start and __time =TIMESTAMP @start and __time < TIMESTAMP @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') union all select TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'established_conn_num' as type, sum(established_conn_num) as sessions from traffic_metrics_log where __time >= TIMESTAMP @start and __time < TIMESTAMP @end group by TIME_FORMAT(time_floor(__time,'PT30S'),'yyyy-MM-dd HH:mm:ss') +--Q27.Traffic Metrics Security Throughput Bytes +select sum(default_in_bytes+default_out_bytes) as default_bytes, sum(allow_in_bytes+allow_out_bytes) as allow_bytes, sum(deny_in_bytes+deny_out_bytes) as deny_bytes, sum(monitor_in_bytes+monitor_out_bytes) as monitor_bytes, sum(intercept_in_bytes+intercept_out_bytes) as intercept_bytes from traffic_metrics_log where __time >=TIMESTAMP @start and __time < TIMESTAMP @end +--Q28.Traffic Metrics Security Throughput Packets +select sum(default_in_packets+default_out_packets) as default_packets, sum(allow_in_packets+allow_in_packets) as allow_packets, sum(deny_in_packets+deny_out_packets) as deny_packets, sum(monitor_in_packets+monitor_out_packets) as monitor_packets, sum(intercept_in_packets+intercept_out_packets) as intercept_packets from traffic_metrics_log where __time >=TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time = TIMESTAMP @start and __time =TIMESTAMP @start and __time = @start and __time < @end group by TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') +--Q31.Traffic Metrics Security Bandwidth Packets by 5Min +select TIME_FORMAT(time_floor(__time,'PT5M'),'yyyy-MM-dd HH:mm:ss') as stat_time, 'default_packets' as type, sum(default_in_packets+default_out_packets) as packets from traffic_metrics_log where __time >=TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time = @start and __time < @end and order_by='sessions' group by destination order by sessions desc limit 100 +--Q35.Top 100 Internal IP by Sessions +select source as internal_ip, sum(session_num) as sessions, sum(c2s_byte_num) as sent_bytes, sum(s2c_byte_num) as received_bytes, sum(c2s_byte_num + s2c_byte_num) as bytes, sum(c2s_pkt_num) as sent_packets ,sum(s2c_pkt_num) as received_packets, sum(c2s_pkt_num+s2c_pkt_num) as packets from top_internal_host_log where __time >=TIMESTAMP @start and __time = @start and __time < @end and order_by='sessions' group by destination order by sessions desc limit 100 +--Q37.Top 100 Domain by Bytes +select domain, sum(session_num) as sessions, sum(c2s_byte_num) as sent_bytes, sum(s2c_byte_num) as received_bytes, sum(c2s_byte_num + s2c_byte_num) as bytes, sum(c2s_pkt_num) as sent_packets ,sum(s2c_pkt_num) as received_packets, sum(c2s_pkt_num+s2c_pkt_num) as packets from top_website_domain_log where __time >=TIMESTAMP @start and __time =TIMESTAMP @start and __time =TIMESTAMP @start and __time = @start and __time < @end group by policy_id +--Q41.Traffic Composition Metrics +SELECT APPROX_COUNT_DISTINCT_DS_HLL(ip_object) AS uniq_client_ip, SUM(one_sided_connections) AS one_sided_connections, SUM(uncategorized_bytes) AS total_uncategorized_bytes, SUM(fragmentation_packets) AS fragmentation_packets, SUM(sequence_gap_loss) AS sequence_gap_loss_bytes, SUM(s2c_byte_num+c2s_byte_num) AS summaryTotalBytes, SUM(s2c_pkt_num+c2s_pkt_num) AS summaryTotalPackets, SUM(sessions) AS summarySessions FROM traffic_summary_log WHERE __time >= TIMESTAMP @start AND __time < TIMESTAMP @end LIMIT 1 +--Q42.Traffic Composition Throughput +(SELECT SUM(c2s_byte_num + s2c_byte_num) as total_bytes, SUM(sessions) as total_sessions, (SUM(c2s_byte_num + s2c_byte_num) * 8)/((TIMESTAMP_TO_MILLIS(TIMESTAMP @end )-TIMESTAMP_TO_MILLIS(TIMESTAMP @start ))/1000) AS data_rate FROM traffic_protocol_stat_log WHERE __time >= TIMESTAMP @start AND __time < TIMESTAMP @end AND protocol_id = 'ETHERNET' LIMIT 1) UNION ALL ( SELECT SUM(sessions), 0, 0 FROM traffic_protocol_stat_log WHERE __time >= TIMESTAMP @start AND __time < TIMESTAMP @end AND protocol_id = 'ETHERNET' GROUP BY __time ORDER BY __time DESC LIMIT 1 ) +--Q43.Traffic Composition Protocol Tree +SELECT protocol_id, SUM(sessions) as sessions,SUM(c2s_byte_num) as c2s_byte_num, SUM(c2s_pkt_num) as c2s_pkt_num, SUM(s2c_byte_num) as s2c_byte_num, SUM(s2c_pkt_num) as s2c_pkt_num FROM traffic_protocol_stat_log WHERE __time >= TIMESTAMP @start AND __time < TIMESTAMP @end GROUP BY protocol_id +--Q44.System Quota +SELECT log_type, SUM(used_size) as used_size, SUM(max_size) * 7/10 as max_size, TIME_FORMAT(LATEST(last_storage) * 1000,'YYYY-MM-dd') as first_storage FROM ( SELECT log_type, LATEST(used_size) as used_size, LATEST(max_size) as max_size, LATEST(last_storage) as last_storage FROM sys_storage_log WHERE __time >= CURRENT_TIMESTAMP - INTERVAL '1' HOUR AND data_center != '' GROUP BY data_center,log_type ) GROUP BY log_type +--Q45.System Quota Daily Trend +select TIME_FORMAT(__time,'YYYY-MM-dd') as stat_time,log_type as type, sum(aggregate_size) as used_size from sys_storage_log where __time >= @start and __time < @end group by TIME_FORMAT(__time,'YYYY-MM-dd'), log_type +--Q46.Traffic Statistics(Metrics01) +select sum(total_hit_sessions) as total_hit_sessions, sum(total_bytes_transferred) as total_bytes_transferred, sum(total_packets_transferred) as total_packets_transferred, sum(total_new_sessions) as total_new_sessions , sum(total_close_sessions) as total_close_sessions, sum(average_new_sessions_per_second) as average_new_sessions_per_second , sum(average_bytes_per_second) as average_bytes_per_second , sum(average_packets_per_second) as average_packets_per_second , COUNT(DISTINCT(device_id)) as device_num, sum(live_sessions) as average_live_sessions from ( select device_id, sum(intercept_conn_num + monitor_conn_num + deny_conn_num + allow_conn_num) as total_hit_sessions, sum(total_in_bytes + total_out_bytes) as total_bytes_transferred, sum(total_in_packets + total_out_packets) as total_packets_transferred, sum(new_conn_num) as total_new_sessions, sum(close_conn_num) as total_close_sessions, avg(nullif(new_conn_num, 0))/ 5 as average_new_sessions_per_second, avg(nullif(total_in_bytes + total_out_bytes, 0))* 8 / 5 as average_bytes_per_second, avg(nullif(total_in_packets + total_out_packets, 0))/ 5 as average_packets_per_second, avg(nullif(established_conn_num, 0)) as live_sessions from traffic_metrics_log where __time >= @start and __time < @end group by device_id) diff --git a/TSG发布版本更新记录/TSG-22.04/qgw/config/engine-filter.json b/TSG发布版本更新记录/TSG-22.04/qgw/config/engine-filter.json new file mode 100644 index 0000000..525a02c --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/qgw/config/engine-filter.json @@ -0,0 +1,53 @@ +{ + "version": "1.0", + "name": "Engine-Raw", + "namespace": "Engine", + "filters": [ + { + "name":"@start", + "value": "'2021-10-19 10:00:00'" + }, + { + "name":"@end", + "value": "'2021-10-20 11:00:00'" + }, + { + "name":"@common_filter", + "value": [ + "common_log_id=1153021139190754263", + "common_client_ip='36.189.226.21'", + "common_internal_ip='223.116.37.192'", + "common_server_ip='8.8.8.8'", + "common_external_ip='111.10.53.14'", + "common_client_port=52607", + "common_server_port=443", + "common_c2s_pkt_num>5", + "common_s2c_pkt_num>5", + "common_c2s_byte_num>100", + "common_s2c_byte_num<200", + "common_schema_type='DNS'", + "common_establish_latency_ms>200", + "common_con_duration_ms>10000", + "common_stream_trace_id=1153021139190754263", + "common_tcp_client_isn=2857077935", + "common_tcp_server_isn=0", + "http_domain='microsoft.com'", + "mail_account='abc@xx.com'", + "mail_subject='test'", + "dns_qname='qbwup.imtt.qq.com'", + "ssl_sni='note.youdao.com'", + "ssl_con_latency_ms>100", + "ssl_ja3_hash='a0e9f5d64349fb13191bc781f81f42e1'", + "common_client_ip='36.189.226.21' and common_server_ip='8.8.8.8'", + "common_server_ip='111.10.53.14' and common_server_port=443", + "mail_account like 'abc@%'", + "http_domain like '%baidu.com%'", + "ssl_sni like '%youdao.com'", + "common_client_ip in ('36.189.226.21','111.10.53.14')", + "common_server_port not in (80,443)", + "notEmpty(http_domain)", + "http_domain not like '%microsoft.com'" + ] + } + ] +} \ No newline at end of file diff --git a/TSG发布版本更新记录/TSG-22.04/qgw/config/engine-queries-template.sql b/TSG发布版本更新记录/TSG-22.04/qgw/config/engine-queries-template.sql new file mode 100644 index 0000000..1c45797 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/qgw/config/engine-queries-template.sql @@ -0,0 +1,120 @@ +--Q01.CK DateTime +select toDateTime(common_recv_time) as common_recv_time from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) limit 20 +--Q02.Standard DateTime +select FROM_UNIXTIME(common_recv_time) as common_recv_time from session_record where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) limit 20 +--Q03.count(1) +select count(1) from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) +--Q04.count(*) +select count(*) from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) +--Q05.UDF APPROX_COUNT_DISTINCT_DS_HLL +SELECT policy_id, APPROX_COUNT_DISTINCT_DS_HLL(isp) as num FROM proxy_event_hits_log where __time >= @start and __time < @end and policy_id=0 group by policy_id +--Q06.UDF TIME_FLOOR_WITH_FILL +select TIME_FLOOR_WITH_FILL(common_recv_time,'PT5M','previous') as stat_time from session_record where common_recv_time > @start and common_recv_time < @end group by stat_time +--Q07.UDF GEO IP +select IP_TO_GEO(common_client_ip) as geo,IP_TO_CITY(common_server_ip) as city,IP_TO_COUNTRY(common_server_ip) as country from session_record limit 10 +--Q08.Special characters +select * from session_record where (common_protocol_label ='/$' or common_client_ip like'%') limit 10 +--Q09.Federation Query +select * from (select FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(common_recv_time,'PT5M','zero')) as stat_time from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) group by stat_time order by stat_time asc) +--Q10.Catalog Database +select * from tsg_galaxy_v3.session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) limit 20 +--Q11.Session Record Logs +select * from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) AND @common_filter order by common_recv_time desc limit 20 +--Q12.Live Session Record Logs +select * from interim_session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) AND @common_filter order by common_recv_time desc limit 20 +--Q13.Transaction Record Logs +select * from transaction_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) order by common_recv_time desc limit 20 +--Q14.Security Event Logs +select * from security_event where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) AND @common_filter order by common_recv_time desc limit 0,20 +--Q15.Proxy Event Logs +select * from proxy_event where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) order by common_recv_time desc limit 0,20 +--Q16.Radius Record Logs +select * from radius_record where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) order by common_recv_time desc limit 0,20 +--Q17.GTPC Record Logs +select * from gtpc_record where common_recv_time >= UNIX_TIMESTAMP(@start) and common_recv_time< UNIX_TIMESTAMP(@end) order by common_recv_time desc limit 0,20 +--Q18.Security Event Logs with fields +select FROM_UNIXTIME(common_recv_time) as common_recv_time,common_log_id,common_policy_id,common_subscriber_id,common_client_ip,common_client_port,common_l4_protocol,common_address_type,common_server_ip,common_server_port,common_action,common_direction,common_sled_ip,common_client_location,common_client_asn,common_server_location,common_server_asn,common_c2s_pkt_num,common_s2c_pkt_num,common_c2s_byte_num,common_s2c_byte_num,common_schema_type,common_sub_action,common_device_id, FROM_UNIXTIME(common_start_time) as common_start_time, FROM_UNIXTIME(common_end_time) as common_end_time,common_establish_latency_ms,common_con_duration_ms,common_stream_dir,common_stream_trace_id,http_url,http_host,http_domain,http_request_body,http_response_body,http_cookie,http_referer,http_user_agent,http_content_length,http_content_type,http_set_cookie,http_version,http_response_latency_ms,http_action_file_size,http_session_duration_ms,mail_protocol_type,mail_account,mail_from_cmd,mail_to_cmd,mail_from,mail_to,mail_cc,mail_bcc,mail_subject,mail_attachment_name,mail_eml_file,dns_message_id,dns_qr,dns_opcode,dns_aa,dns_tc,dns_rd,dns_ra,dns_rcode,dns_qdcount,dns_ancount,dns_nscount,dns_arcount,dns_qname,dns_qtype,dns_qclass,dns_cname,dns_sub,dns_rr,ssl_sni,ssl_san,ssl_cn,ssl_pinningst,ssl_intercept_state,ssl_server_side_latency,ssl_client_side_latency,ssl_server_side_version,ssl_client_side_version,ssl_cert_verify,ssl_error,quic_version,quic_sni,quic_user_agent,ftp_account,ftp_url,ftp_content from security_event where common_recv_time >= @start and common_recv_time < @end order by common_recv_time desc limit 10000 +--Q19.Radius ON/OFF Logs For Frame IP +select framed_ip, arraySlice(groupUniqArray(concat(toString(event_timestamp),':', if(acct_status_type=1,'start','stop'))),1,100000) as timeseries from radius_onff_log where event_timestamp >=toDateTime(@start) and event_timestamp = @start and event_timestamp < @end group by account +--Q21.Radius ON/OFF Logs total Account number +select count(distinct(framed_ip)) as active_ip_num , sum(acct_session_time) as online_duration from (select any(framed_ip) as framed_ip ,max(acct_session_time) as acct_session_time from radius_onff_log where account='000jS' and event_timestamp >= @start and event_timestamp < @end group by acct_session_id) +--Q22.Radius ON/OFF Logs Account Access Detail +select max(if(acct_status_type=1,event_timestamp,0)) as start_time,max(if(acct_status_type=2,event_timestamp,0)) as end_time, any(framed_ip) as ip,max(acct_session_time) as online_duration from radius_onff_log where event_timestamp >= @start and event_timestamp < @end group by acct_session_id order by start_time desc limit 200 +--Q23.Report for Client IP +select common_client_ip, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@end)) group by common_client_ip order by sessions desc limit 0,100 +--Q24.Report for Server IP +select common_server_ip, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) group by common_server_ip order by sessions desc limit 0,100 +--Q25.Report for SSL SNI +select ssl_sni, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) group by ssl_sni order by sessions desc limit 0,100 +--Q26.Report for SSL APP +select common_app_label as applicaiton, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) group by applicaiton order by sessions desc limit 0,100 +--Q27.Report for Domains +select http_domain AS domain,SUM(coalesce(common_c2s_byte_num, 0)) AS sent_bytes,SUM(coalesce(common_s2c_byte_num, 0)) AS received_bytes,SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) AS bytes FROM session_record WHERE common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and notEmpty(domain) GROUP BY domain ORDER BY bytes DESC LIMIT 100 +--Q28.Report for Domains with unique Client IP +select toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 300)*300) as stat_time, http_domain, uniq (common_client_ip) as nums from session_record where common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and http_domain in (select http_domain from session_record where common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and notEmpty(http_domain) group by http_domain order by SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) desc limit 10 ) group by toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 300)*300), http_domain order by stat_time asc limit 500 +--Q29. Report for HTTP Host +SELECT http_host as host, SUM(coalesce(common_c2s_byte_num, 0)) AS sent_bytes,SUM(coalesce(common_s2c_byte_num, 0)) AS received_bytes,SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) AS bytes FROM session_record WHERE common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) and notEmpty(http_host) GROUP BY host ORDER BY bytes DESC limit 100 union all SELECT 'totals' as host, SUM(coalesce(common_c2s_byte_num, 0)) AS sent_bytes, SUM(coalesce(common_s2c_byte_num, 0)) AS received_bytes, SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) AS bytes from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) and notEmpty(http_host) +--Q30.Report for HTTP/HTTPS URLS with Sessions +SELECT http_url AS url,count(*) AS sessions FROM proxy_event WHERE common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and notEmpty(http_url) GROUP BY url ORDER BY sessions DESC LIMIT 100 +--Q31.Report for HTTP/HTTPS URLS with UNIQUE Client IP +select toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 300)*300) as stat_time, http_url, count(distinct(common_client_ip)) as nums from proxy_event where common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and http_url IN (select http_url from proxy_event where common_recv_time >= toStartOfDay(toDateTime(@start))-86400 AND common_recv_time < toStartOfDay(toDateTime(@start)) and notEmpty(http_url) group by http_url order by count(*) desc limit 10 ) group by toDateTime(intDiv(toUInt32(toDateTime(toDateTime(common_recv_time))), 300)*300), http_url order by stat_time asc limit 500 +--Q32.Report for Subscriber ID with Sessions +select common_subscriber_id as user, count(*) as sessions from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) and notEmpty(user) group by common_subscriber_id order by sessions desc limit 0,100 +--Q33.Report for Subscriber ID with Bandwidth +SELECT common_subscriber_id as user,SUM(coalesce(common_c2s_byte_num, 0)) AS sent_bytes,SUM(coalesce(common_s2c_byte_num, 0)) AS received_bytes,SUM(coalesce(common_c2s_byte_num, 0)+coalesce(common_s2c_byte_num, 0)) AS bytes FROM session_record WHERE common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) and notEmpty(user) GROUP BY user ORDER BY bytes DESC LIMIT 100 +--Q34.Report Unique Endpoints +select uniq(common_client_ip) as "Client IP",uniq(common_server_ip) as "Server IP",uniq(common_internal_ip) as "Internal IP",uniq(common_external_ip) as "External IP",uniq(http_domain) as "Domain",uniq(ssl_sni) as "SNI" from session_record where common_recv_time>= toStartOfDay(toDateTime(@start))-604800 and common_recv_time< toStartOfDay(toDateTime(@start)) +--Q35.TopN Optimizer +SELECT http_url AS url, SUM(common_sessions) AS sessions FROM session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND notEmpty(http_url) GROUP BY http_url ORDER BY sessions DESC limit 10 +--Q36.All Security Event Hits Trend by 5min B +select DATE_FORMAT(FROM_UNIXTIME(FLOOR(UNIX_TIMESTAMP(__time)/300)*300),'%Y-%m-%d %H:%i:%s') as start_time, sum(hits) as hits from security_event_hits_log where __time >= @start and __time < @end group by DATE_FORMAT(FROM_UNIXTIME(FLOOR(UNIX_TIMESTAMP(__time)/300)*300),'%Y-%m-%d %H:%i:%s') limit 10000 +--Q37.Security Event Hit Time（first and last time) B +select policy_id, DATE_FORMAT(min(__time) ,'%Y-%m-%d %H:%i:%s') as first_used, DATE_FORMAT(max(__time) ,'%Y-%m-%d %H:%i:%s') as last_used from security_event_hits_log where policy_id in (0) group by policy_id +--Q38.All Proxy Event Hits Trend by 5min B +select FROM_UNIXTIME(FLOOR(UNIX_TIMESTAMP(__time)/300)*300) as start_time, sum(hits) as hits from proxy_event_hits_log where __time >= @start and __time < @end group by FROM_UNIXTIME(FLOOR(UNIX_TIMESTAMP(__time)/300)*300) limit 10000 +--Q39.Proxy Event Hit Time（first and last time) B +select policy_id, DATE_FORMAT(min(__time) ,'%Y-%m-%d %H:%i:%s') as first_used, DATE_FORMAT(max(__time) ,'%Y-%m-%d %H:%i:%s') as last_used from proxy_event_hits_log where policy_id in (0) group by policy_id +--Q40.Traffic Composition Protocol Tree Trend +(SELECT TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * TIME_FLOOR_WITH_FILL(TIMESTAMP_TO_MILLIS(__time)/1000, 'PT30S', 'zero')), 'yyyy-MM-dd HH:mm:ss') as stat_time, protocol_id as type, sum(c2s_byte_num + s2c_byte_num) as bytes from traffic_protocol_stat_log where __time >= TIMESTAMP @start AND __time < TIMESTAMP @end and protocol_id = 'ETHERNET' group by TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * TIME_FLOOR_WITH_FILL(TIMESTAMP_TO_MILLIS(__time)/1000, 'PT30S', 'zero')), 'yyyy-MM-dd HH:mm:ss'), protocol_id order by stat_time asc) union all (SELECT TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * TIME_FLOOR_WITH_FILL(TIMESTAMP_TO_MILLIS(__time)/1000, 'PT30S', 'zero')), 'yyyy-MM-dd HH:mm:ss') as stat_time, protocol_id as type, sum(c2s_byte_num + s2c_byte_num) as bytes from traffic_protocol_stat_log where __time >= TIMESTAMP @start AND __time < TIMESTAMP @end and protocol_id like CONCAT('ETHERNET','.%') and LENGTH(protocol_id) = LENGTH(REPLACE(protocol_id,'.','')) + 1 + 0 group by TIME_FORMAT(MILLIS_TO_TIMESTAMP( 1000 * TIME_FLOOR_WITH_FILL(TIMESTAMP_TO_MILLIS(__time)/1000, 'PT30S', 'zero')), 'yyyy-MM-dd HH:mm:ss'), protocol_id order by stat_time asc) +--Q41.Traffic Metrics Security Action Hits Trend +select FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1800S','zero')) as statisticTime, sum(default_in_bytes + default_out_bytes) as default_bytes, sum(default_in_packets + default_out_packets) as default_packets, sum(default_conn_num) as default_sessions, sum(allow_in_bytes + allow_out_bytes) as allow_bytes, sum(allow_in_packets + allow_out_packets) as allow_packets, sum(allow_conn_num) as allow_sessions, sum(deny_in_bytes + deny_out_bytes) as deny_bytes, sum(deny_in_packets + deny_out_packets) as deny_packets, sum(deny_conn_num) as deny_sessions, sum(monitor_in_bytes + monitor_out_bytes) as monitor_bytes, sum(monitor_in_packets + monitor_out_packets) as monitor_packets, sum(monitor_conn_num) as monitor_sessions, sum(intercept_in_bytes + intercept_out_bytes) as intercept_bytes, sum(intercept_in_packets + intercept_out_packets) as intercept_packets, sum(intercept_conn_num) as intercept_sessions from traffic_metrics_log where __time >= @start and __time < @end group by FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1800S','zero')) limit 100000 +--Q42.Traffic Metrics Proxy Action Hits Trend +SELECT FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1800S','zero')) AS statisticTime,SUM(intcp_allow_num) AS intercept_allow_conn_num,SUM(intcp_mon_num) AS intercept_monitor_conn_num,SUM(intcp_deny_num) AS intercept_deny_conn_num,SUM(intcp_rdirt_num) AS intercept_redirect_conn_num,SUM(intcp_repl_num) AS intercept_replace_conn_num,SUM(intcp_hijk_num) AS intercept_hijack_conn_num,SUM(intcp_ins_num) AS intercept_insert_conn_num FROM traffic_metrics_log WHERE __time >= @start AND __time < @end GROUP BY FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time), 'PT1800S', 'zero')) LIMIT 100000 +--Q43.Traffic Statistics(Metrics02) +select FROM_UNIXTIME(stat_time) as max_active_date_by_sessions, total_live_sessions as max_live_sessions from ( select stat_time, sum(live_sessions) as total_live_sessions from ( select TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time), 'P1D') as stat_time, device_id, avg(established_conn_num) as live_sessions from traffic_metrics_log where __time >= @start and __time<@end group by TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time), 'P1D'), device_id) group by stat_time order by total_live_sessions desc limit 1 ) +--Q44.Traffic Summary(Bandwidth Trend) +select * from ( select DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s') as stat_time,'traffic_in_bytes' as type, sum(total_in_bytes) as bytes from traffic_metrics_log where __time >= @start and __time < @end group by DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s'), 'traffic_in_bytes' union all select DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s') as stat_time,'traffic_out_bytes' as type,sum(total_out_bytes) as bytes from traffic_metrics_log where __time >= @start and __time < @end group by DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s'),'traffic_out_bytes' ) order by stat_time asc limit 100000 +--Q45.Traffic Summary(Sessions Trend) +select DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s') as stat_time, 'total_conn_num' as type, sum(new_conn_num) as sessions from traffic_metrics_log where __time >= @start and __time < @end group by DATE_FORMAT(FROM_UNIXTIME(TIME_FLOOR_WITH_FILL(UNIX_TIMESTAMP(__time),'PT1h','zero')),'%Y-%m-%d %H:%i:%s'), 'total_conn_num' order by stat_time asc limit 10000 +--Q46.Domain Baidu.com Metrics +select FROM_UNIXTIME(min(common_recv_time)) as "First Seen" , FROM_UNIXTIME(max(common_recv_time)) as "Last Seen" , median(http_response_latency_ms) as "Server Processing Time Median(ms)", count(1) as Responses,any(common_server_location) as Location from session_record WHERE common_recv_time >= toDateTime(@start) AND common_recv_time < toDateTime(@end) AND http_domain='baidu.com' +--Q47.TIME_FLOOR_WITH_FILL 01 +select "Device Group" as "Device Group" ,"Data Center" as "Data Center" ,FROM_UNIXTIME("End Time") as "End Time" , sum("counter") as "counter" from (select common_device_group as "Device Group" ,common_data_center as "Data Center" ,TIME_FLOOR_WITH_FILL (common_end_time,'PT1H','zero') as "End Time" ,count(common_log_id) as "counter" from session_record where common_recv_time >= toDateTime(@start) and common_recv_time< toDateTime(@end) group by "Device Group","Data Center","End Time") group by "Device Group" ,"Data Center" ,"End Time" order by "End Time" asc limit 5 +--Q48.TIME_FLOOR_WITH_FILL 02 +select FROM_UNIXTIME("End Time") as "End Time" , sum("counter") as "counter" from (select common_device_group as "Device Group" ,common_data_center as "Data Center" ,TIME_FLOOR_WITH_FILL (common_end_time,'PT1H','zero') as "End Time" ,count(common_log_id) as "counter" ,count(http_domain) as "HTTP.Domain" from security_event where ((common_recv_time >= toDateTime('2021-10-19 00:00:00') and common_recv_time < toDateTime('2021-10-20 00:00:00')) ) AND ( ( common_action = 2 ) ) group by "Device Group","Data Center","End Time") group by "End Time" order by "End Time" asc +--Q49.CONVERT_TZ (Druid) 01 +SELECT CONVERT_TZ('2019-09-09 09:09:09','GMT','MET') as test_time from proxy_event_hits_log limit 1 +--Q50.CONVERT_TZ (Druid) 02 +SELECT CONVERT_TZ('2019-09-09 09:09:09','Europe/London','America/New_York') as test_time from proxy_event_hits_log limit 1 +--Q51.CONVERT_TZ (Druid) 03 +SELECT CONVERT_TZ(now(),'GMT','America/New_York') as test_time from proxy_event_hits_log limit 1 +--Q52.CONVERT_TZ (clickhouse) 01 +SELECT CONVERT_TZ('2019-09-09 09:09:09','GMT','MET') as test_time from session_record limit 1 +--Q53.CONVERT_TZ (clickhouse) 02 +SELECT CONVERT_TZ('2019-09-09 09:09:09','Europe/London','America/New_York') as test_time from session_record limit 1 +--Q54.CONVERT_TZ (clickhouse) 03 +SELECT CONVERT_TZ(now(),'GMT','America/New_York') as test_time from session_record limit 1 +--Q55.CONVERT_TZ (hbase) 01 +SELECT CONVERT_TZ('2019-09-09 09:09:09','GMT','MET') as test_time from report_result limit 1 +--Q56.CONVERT_TZ (hbase) 02 +SELECT CONVERT_TZ('2019-09-09 09:09:09','Europe/London','America/New_York') as test_time from report_result limit 1 +--Q57.CONVERT_TZ (hbase) 03 +SELECT CONVERT_TZ(now(),'GMT','America/New_York') as test_time from report_result limit 1 +--Q58.CONVERT_TZ (elasticsearch) +SELECT CONVERT_TZ('2019-09-09 09:09:09','Europe/London','America/New_York') as time from report_result limit 1 +--Q59.Authentication failed(code 516) +SELECT toDateTime(common_recv_time) AS common_recv_time, common_log_id, common_subscriber_id, common_imei, common_imsi, common_phone_number, common_client_ip, common_internal_ip, common_client_port, common_l4_protocol, common_address_type, common_server_ip, common_server_port, common_external_ip, common_direction, common_sled_ip, common_client_location, common_client_asn, common_server_location, common_server_asn, common_sessions, common_c2s_pkt_num, common_s2c_pkt_num, common_c2s_byte_num, common_s2c_byte_num, common_c2s_pkt_diff, common_s2c_pkt_diff, common_c2s_byte_diff, common_s2c_byte_diff, common_schema_type, common_device_id, common_device_group, common_app_behavior, common_app_label, common_tunnels, common_protocol_label, common_l7_protocol, common_service_category, toDateTime(common_start_time) AS common_start_time, toDateTime(common_end_time) AS common_end_time, common_establish_latency_ms, common_con_duration_ms, common_stream_dir, common_stream_trace_id, common_c2s_ipfrag_num, common_s2c_ipfrag_num, common_c2s_tcp_lostlen, common_s2c_tcp_lostlen, common_c2s_tcp_unorder_num, common_s2c_tcp_unorder_num, common_c2s_pkt_retrans, common_s2c_pkt_retrans, common_c2s_byte_retrans, common_s2c_byte_retrans, common_tcp_client_isn, common_tcp_server_isn, toDateTime(common_processing_time) AS common_processing_time, http_url, http_host, http_domain, http_request_content_length, http_request_content_type, http_response_content_length, http_response_content_type, http_request_body, http_response_body, http_cookie, http_referer, http_user_agent, http_set_cookie, http_version, http_response_latency_ms, http_session_duration_ms, http_action_file_size, mail_protocol_type, mail_account, mail_from_cmd, mail_to_cmd, mail_from, mail_to, mail_cc, mail_bcc, mail_subject, mail_attachment_name, mail_eml_file, dns_message_id, dns_qr, dns_opcode, dns_aa, dns_tc, dns_rd, dns_ra, dns_rcode, dns_qdcount, dns_ancount, dns_nscount, dns_arcount, dns_qname, dns_qtype, dns_qclass, dns_sub, ssl_sni, ssl_cn, ssl_pinningst, ssl_intercept_state, ssl_server_side_latency, ssl_client_side_latency, ssl_server_side_version, ssl_client_side_version, ssl_cert_verify, ssl_error, ssl_con_latency_ms, ssl_ja3_hash, ssl_cert_issuer, ssl_cert_subject, quic_version, quic_sni, quic_user_agent, ftp_account, ftp_url, ftp_content, ftp_link_type, app_extra_info, sip_call_id, sip_originator_description, sip_responder_description, sip_user_agent, sip_server, sip_originator_sdp_connect_ip, sip_originator_sdp_media_port, sip_originator_sdp_media_type, sip_originator_sdp_content, sip_responder_sdp_connect_ip, sip_responder_sdp_media_port, sip_responder_sdp_media_type, sip_responder_sdp_content, sip_duration_s, sip_bye, rtp_payload_type_c2s, rtp_payload_type_s2c, rtp_pcap_path, rtp_originator_dir, ssh_version, ssh_auth_success, ssh_client_version, ssh_server_version, ssh_cipher_alg, ssh_mac_alg, ssh_compression_alg, ssh_kex_alg, ssh_host_key_alg, ssh_host_key, ssh_hassh, stratum_cryptocurrency, stratum_mining_pools, stratum_mining_program FROM tsg_galaxy_v3.interim_session_record AS interim_session_record WHERE common_recv_time >= toUnixTimestamp(@start) AND common_recv_time < toUnixTimestamp(@end) ORDER BY common_recv_time DESC LIMIT 43233, 20 +--Q60.Function MAX_DURATION +SELECT destination_ip, IP_TO_GEO(destination_ip) AS destination_geo, MAX_DURATION(end_time,600) AS max_duration, any(destination_country) AS destination_country, groupUniqArray(arrayJoin(splitByString(',',source_country_list))) AS source_coutries,max(bit_rate) AS max_bit_rate,max(packet_rate) AS max_packet_rate,max(session_rate) AS max_session_rate,min(start_time) AS first_active_time,max(end_time) AS last_active_time,groupUniqArray(attack_type) AS attack_type,count(*) AS count from dos_event where start_time >= toUnixTimestamp(@start) AND start_time < toUnixTimestamp(@end) GROUP BY destination_ip ORDER BY count desc \ No newline at end of file diff --git a/TSG发布版本更新记录/TSG-22.04/qgw/config/hbase-filter.json b/TSG发布版本更新记录/TSG-22.04/qgw/config/hbase-filter.json new file mode 100644 index 0000000..d54cf14 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/qgw/config/hbase-filter.json @@ -0,0 +1,15 @@ +{ + "version": "1.0", + "name": "hbase-Raw", + "namespace": "tsg", + "filters": [ + { + "name":"@start", + "value": "'2021-10-19 10:00:00'" + }, + { + "name":"@end", + "value": "'2021-10-20 11:00:00'" + } + ] +} \ No newline at end of file diff --git a/TSG发布版本更新记录/TSG-22.04/qgw/config/hbase-queries-template.sql b/TSG发布版本更新记录/TSG-22.04/qgw/config/hbase-queries-template.sql new file mode 100644 index 0000000..6ff5571 --- /dev/null +++ b/TSG发布版本更新记录/TSG-22.04/qgw/config/hbase-queries-template.sql @@ -0,0 +1,4 @@ +--Q01. 范围查询 +SELECT last_update_time FROM relation_account_framedip WHERE last_update_time>=CAST(TO_TIMESTAMP (@start,'yyyy-MM-dd HH:mm:ss','Asia/Shanghai') AS UNSIGNED_LONG) AND last_update_time