在IIS日志文件中记录了黑客攻击网站的相关线索和违法网站的犯罪证据,研究海量IIS日志信息的自动分析方法对公安机关的侦查、办案工作有重要意义。结合具体实例研究了海量日志自动分析过程中面临的三个关键问题:不规则数据的去除方法;特定数据的定位和提取方法;UTF-8和Base64编码的解析方法,最后介绍了IIS日志自动分析软件的总体设计流程以及软件的测试情况,得出应用这款日志分析软件可以有效地完成海量日志自动分析工作的结论。 In the IIS log file records the clues of hacking websites and the criminal evidence of illegal websites. It is of great significance to study the automatic analysis method of massive IIS log information on the investigation and case handling of public security organs. In this paper, three key problems in the automatic analysis of mass log are studied with examples: irregular data removal method, specific data location and extraction method, UTF-8 and Base64 code analysis method, and finally the IIS log automatic analysis The overall design process of the software and the testing of the software, and concludes that the application of this log analysis software can effectively accomplish the automatic analysis of massive logs.