1、数据库PG切换为达梦的修改版本。

haobang-security-dm/syslog-consumer-rule/docker_run.txt

@@ -8,15 +8,19 @@ docker ps -a
 
 --2.���docker image�ļ� (Dockerfile ��ǰĿ¼��
 docker build -t syslog-consumer-rule:v1.X.X  .
-
+--dm
+docker build -t syslog-consumer-rule-dm:v1.2.X  .
 
 --3.ֹͣ���� ��ɾ��
 docker stop  syslog-consumer-rule  &&  docker  rm syslog-consumer-rule
 
 --4.����docker �ļ�
-docker run --restart unless-stopped -e TZ=Asia/Shanghai -d --name ct-syslog-consumer-rule -p 8289:8289 -v /home/syslog/logs:/app/logs --privileged=true   syslog-consumer-rule:v1.X.X
+--dm
+docker run --restart unless-stopped -e TZ=Asia/Shanghai -d --name syslog-consumer-rule-dm   -v /home/syslog/logs:/app/logs --privileged=true   syslog-consumer-rule-dm:v1.2.X
+--pg
+docker run --restart unless-stopped -e TZ=Asia/Shanghai -d --name syslog-consumer-rule   -v /home/syslog/logs:/app/logs --privileged=true   syslog-consumer-rule:v1.2.X
 �ڳ�CMD��
-docker run --restart unless-stopped -e TZ=Asia/Shanghai -d --name ct-syslog-consumer-rule -p 8289:8289 -v /data/syslog/logs:/app/logs --privileged=true   syslog-consumer-rule:v1.X.X
+docker run --restart unless-stopped -e TZ=Asia/Shanghai -d --name syslog-consumer-rule-dm -p 8289:8289 -v /data/syslog/logs:/app/logs --privileged=true   syslog-consumer-rule-dm:v1.X.X
 
 --������������
 docker run  -d --name ct-syslog-consumer-rule -p 8089:8089 --privileged=true   syslog-consumer-rule:v1.X.X

haobang-security-dm/syslog-consumer-rule/pom.xml

@@ -92,12 +92,21 @@
             <version>${mybatis.version}</version>
         </dependency>
 
-        <!-- PostgreSQL驱动 -->
+        <!-- PostgreSQL驱动（已切换至达梦数据库，保留备用） -->
+        <!--
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>
             <version>${postgresql.version}</version>
         </dependency>
+        -->
+        
+        <!-- 达梦数据库驱动 JDK1.8 -->
+        <dependency>
+            <groupId>com.dameng</groupId>
+            <artifactId>DmJdbcDriver18</artifactId>
+            <version>8.1.2.141</version>
+        </dependency>
 
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
@@ -193,11 +202,7 @@
         </dependency>
 
 
-        <dependency>
-            <groupId>com.dameng</groupId>
-            <artifactId>DmJdbcDriver18</artifactId>
-            <version>8.1.2.141</version> <!-- 请根据你的数据库版本替换 -->
-        </dependency>
+
         <!-- Bouncy Castle 国密算法支持 -->
         <dependency>
             <groupId>org.bouncycastle</groupId>

haobang-security-dm/syslog-consumer-rule/src/main/java/com/Modules/etl/handler/ArrayByteTypeHandler.java

@@ -1,47 +1,86 @@
 package com.Modules.etl.handler;
 
-
-
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.ibatis.type.BaseTypeHandler;
 import org.apache.ibatis.type.JdbcType;
 import org.apache.ibatis.type.MappedJdbcTypes;
 import org.apache.ibatis.type.MappedTypes;
-import java.sql.*;
 
+import java.sql.CallableStatement;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.Base64;
+import java.util.List;
+
+/**
+ * 字节数组类型处理器 - 达梦数据库兼容版本（JSON格式）
+ * 
+ * 将 Java byte[][] 与数据库 VARCHAR 列进行互转。
+ * 存储格式: JSON 数组，每个元素为 Base64 编码字符串，如 ["YWJj","ZGVm"]
+ * 空数组: 存储为 "[]"
+ * null值: 存储为 NULL
+ * 
+ * 原 PostgreSQL 版本使用 createArrayOf("bytea", ...) 创建原生 bytea 数组，
+ * 达梦数据库不兼容此 API，改为 VARCHAR + JSON + Base64 存储。
+ */
 @MappedTypes(byte[][].class)
-@MappedJdbcTypes(JdbcType.ARRAY)
+@MappedJdbcTypes(JdbcType.VARCHAR)
 public class ArrayByteTypeHandler extends BaseTypeHandler<byte[][]> {
 
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
     @Override
     public void setNonNullParameter(PreparedStatement ps, int i, byte[][] parameter, JdbcType jdbcType) throws SQLException {
-        Array array = ps.getConnection().createArrayOf("bytea", parameter);
-        ps.setArray(i, array);
+        try {
+            String[] encoded = new String[parameter.length];
+            for (int j = 0; j < parameter.length; j++) {
+                encoded[j] = Base64.getEncoder().encodeToString(parameter[j]);
+            }
+            ps.setString(i, MAPPER.writeValueAsString(encoded));
+        } catch (JsonProcessingException e) {
+            throw new SQLException("Failed to serialize byte[][] to JSON", e);
+        }
     }
 
     @Override
     public byte[][] getNullableResult(ResultSet rs, String columnName) throws SQLException {
-        return getArray(rs.getArray(columnName));
+        return parseArray(rs.getString(columnName));
     }
 
     @Override
     public byte[][] getNullableResult(ResultSet rs, int columnIndex) throws SQLException {
-        return getArray(rs.getArray(columnIndex));
+        return parseArray(rs.getString(columnIndex));
     }
 
     @Override
     public byte[][] getNullableResult(CallableStatement cs, int columnIndex) throws SQLException {
-        return getArray(cs.getArray(columnIndex));
+        return parseArray(cs.getString(columnIndex));
     }
 
-    private byte[][] getArray(Array array) throws SQLException {
-        if (array != null) {
-            Object[] objArray = (Object[]) array.getArray();
-            byte[][] result = new byte[objArray.length][];
-            for (int i = 0; i < objArray.length; i++) {
-                result[i] = (byte[]) objArray[i];
+    private byte[][] parseArray(String value) {
+        if (value == null || value.isEmpty()) {
+            return new byte[0][];
+        }
+        try {
+            // JSON 格式: ["abc","def"]
+            List<String> list = MAPPER.readValue(value, MAPPER.getTypeFactory().constructCollectionType(List.class, String.class));
+            byte[][] result = new byte[list.size()][];
+            for (int i = 0; i < list.size(); i++) {
+                String s = list.get(i);
+                result[i] = (s == null || s.isEmpty()) ? new byte[0] : Base64.getDecoder().decode(s);
+            }
+            return result;
+        } catch (JsonProcessingException e) {
+            // 兼容旧的逗号分隔格式
+            String[] parts = value.split(",", -1);
+            byte[][] result = new byte[parts.length][];
+            for (int i = 0; i < parts.length; i++) {
+                String part = parts[i].trim();
+                result[i] = part.isEmpty() ? new byte[0] : Base64.getDecoder().decode(part);
             }
             return result;
         }
-        return null;
     }
-}
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/Modules/etl/handler/ArrayIntegerTypeHandler.java

@@ -1,43 +1,73 @@
 package com.Modules.etl.handler;
 
-
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.ibatis.type.BaseTypeHandler;
 import org.apache.ibatis.type.JdbcType;
 import org.apache.ibatis.type.MappedJdbcTypes;
 import org.apache.ibatis.type.MappedTypes;
-import java.sql.*;
-import java.util.Arrays;
 
+import java.sql.CallableStatement;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
+/**
+ * 整型数组类型处理器 - 达梦数据库兼容版本（JSON格式）
+ * 
+ * 将 Java Integer[] 与数据库 VARCHAR 列进行互转。
+ * 存储格式: JSON 数组，如 [1,2,3]
+ * 空数组: 存储为 "[]"
+ * null值: 存储为 NULL
+ * 
+ * 原 PostgreSQL 版本使用 createArrayOf("integer", ...) 创建原生数组，
+ * 达梦数据库不兼容此 API，改为 VARCHAR + JSON 存储。
+ */
 @MappedTypes(Integer[].class)
-@MappedJdbcTypes(JdbcType.ARRAY)
+@MappedJdbcTypes(JdbcType.VARCHAR)
 public class ArrayIntegerTypeHandler extends BaseTypeHandler<Integer[]> {
 
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
     @Override
     public void setNonNullParameter(PreparedStatement ps, int i, Integer[] parameter, JdbcType jdbcType) throws SQLException {
-        Array array = ps.getConnection().createArrayOf("integer", parameter);
-        ps.setArray(i, array);
+        try {
+            ps.setString(i, MAPPER.writeValueAsString(parameter));
+        } catch (JsonProcessingException e) {
+            throw new SQLException("Failed to serialize Integer[] to JSON", e);
+        }
     }
 
     @Override
     public Integer[] getNullableResult(ResultSet rs, String columnName) throws SQLException {
-        return getArray(rs.getArray(columnName));
+        return parseArray(rs.getString(columnName));
     }
 
     @Override
     public Integer[] getNullableResult(ResultSet rs, int columnIndex) throws SQLException {
-        return getArray(rs.getArray(columnIndex));
+        return parseArray(rs.getString(columnIndex));
     }
 
     @Override
     public Integer[] getNullableResult(CallableStatement cs, int columnIndex) throws SQLException {
-        return getArray(cs.getArray(columnIndex));
+        return parseArray(cs.getString(columnIndex));
     }
 
-    private Integer[] getArray(Array array) throws SQLException {
-        if (array != null) {
-            Object[] objArray = (Object[]) array.getArray();
-            return Arrays.copyOf(objArray, objArray.length, Integer[].class);
+    private Integer[] parseArray(String value) {
+        if (value == null || value.isEmpty()) {
+            return new Integer[0];
+        }
+        try {
+            return MAPPER.readValue(value, Integer[].class);
+        } catch (JsonProcessingException e) {
+            // 兼容旧的逗号分隔格式
+            String[] parts = value.split(",", -1);
+            Integer[] result = new Integer[parts.length];
+            for (int i = 0; i < parts.length; i++) {
+                String part = parts[i].trim();
+                result[i] = part.isEmpty() ? null : Integer.parseInt(part);
+            }
+            return result;
         }
-        return null;
     }
-}
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/Modules/etl/handler/ArrayStringTypeHandler.java

@@ -1,43 +1,67 @@
 package com.Modules.etl.handler;
 
-
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.ibatis.type.BaseTypeHandler;
 import org.apache.ibatis.type.JdbcType;
 import org.apache.ibatis.type.MappedJdbcTypes;
 import org.apache.ibatis.type.MappedTypes;
-import java.sql.*;
-import java.util.Arrays;
 
+import java.sql.CallableStatement;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+
+/**
+ * 字符串数组类型处理器 - 达梦数据库兼容版本（JSON格式）
+ * 
+ * 将 Java String[] 与数据库 VARCHAR 列进行互转。
+ * 存储格式: JSON 数组，如 ["value1","value2","value3"]
+ * 空数组: 存储为 "[]"
+ * null值: 存储为 NULL
+ * 
+ * 原 PostgreSQL 版本使用 createArrayOf("text", ...) 创建原生数组，
+ * 达梦数据库不兼容此 API，改为 VARCHAR + JSON 存储。
+ */
 @MappedTypes(String[].class)
-@MappedJdbcTypes(JdbcType.ARRAY)
+@MappedJdbcTypes(JdbcType.VARCHAR)
 public class ArrayStringTypeHandler extends BaseTypeHandler<String[]> {
 
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
     @Override
     public void setNonNullParameter(PreparedStatement ps, int i, String[] parameter, JdbcType jdbcType) throws SQLException {
-        Array array = ps.getConnection().createArrayOf("text", parameter);
-        ps.setArray(i, array);
+        try {
+            ps.setString(i, MAPPER.writeValueAsString(parameter));
+        } catch (JsonProcessingException e) {
+            throw new SQLException("Failed to serialize String[] to JSON", e);
+        }
     }
 
     @Override
     public String[] getNullableResult(ResultSet rs, String columnName) throws SQLException {
-        return getArray(rs.getArray(columnName));
+        return parseArray(rs.getString(columnName));
     }
 
     @Override
     public String[] getNullableResult(ResultSet rs, int columnIndex) throws SQLException {
-        return getArray(rs.getArray(columnIndex));
+        return parseArray(rs.getString(columnIndex));
     }
 
     @Override
     public String[] getNullableResult(CallableStatement cs, int columnIndex) throws SQLException {
-        return getArray(cs.getArray(columnIndex));
+        return parseArray(cs.getString(columnIndex));
     }
 
-    private String[] getArray(Array array) throws SQLException {
-        if (array != null) {
-            Object[] objArray = (Object[]) array.getArray();
-            return Arrays.copyOf(objArray, objArray.length, String[].class);
+    private String[] parseArray(String value) {
+        if (value == null || value.isEmpty()) {
+            return new String[0];
+        }
+        try {
+            return MAPPER.readValue(value, String[].class);
+        } catch (JsonProcessingException e) {
+            // 兼容旧的逗号分隔格式
+            return value.split(",", -1);
         }
-        return null;
     }
-}
+}

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceInterlocking.java

@@ -1,6 +1,6 @@
 package com.common.entity;
 
-import java.time.OffsetDateTime;
+import java.time.LocalDateTime;
 
 /**
  * 联动设备表实体类（防火墙设备信息）
@@ -17,9 +17,9 @@ public class DeviceInterlocking {
     private String tenantId;
     private Long createDept;
     private Long createBy;
-    private OffsetDateTime createTime;
+    private LocalDateTime createTime;
     private Long updateBy;
-    private OffsetDateTime updateTime;
+    private LocalDateTime updateTime;
     private String remark;
     private String authUsername;              // 用户名
     private String authPassword;              // 密码
@@ -55,14 +55,14 @@ public class DeviceInterlocking {
     public Long getCreateBy() { return createBy; }
     public void setCreateBy(Long createBy) { this.createBy = createBy; }
 
-    public OffsetDateTime getCreateTime() { return createTime; }
-    public void setCreateTime(OffsetDateTime createTime) { this.createTime = createTime; }
+    public LocalDateTime getCreateTime() { return createTime; }
+    public void setCreateTime(LocalDateTime createTime) { this.createTime = createTime; }
 
     public Long getUpdateBy() { return updateBy; }
     public void setUpdateBy(Long updateBy) { this.updateBy = updateBy; }
 
-    public OffsetDateTime getUpdateTime() { return updateTime; }
-    public void setUpdateTime(OffsetDateTime updateTime) { this.updateTime = updateTime; }
+    public LocalDateTime getUpdateTime() { return updateTime; }
+    public void setUpdateTime(LocalDateTime updateTime) { this.updateTime = updateTime; }
 
     public String getRemark() { return remark; }
     public void setRemark(String remark) { this.remark = remark; }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceInterlockingCmd.java

@@ -4,9 +4,8 @@ import com.Modules.etl.handler.ArrayIntegerTypeHandler;
 import com.Modules.etl.handler.ArrayStringTypeHandler;
 import org.apache.ibatis.type.JdbcType;
 import org.apache.ibatis.type.TypeHandler;
-import org.apache.ibatis.type.ArrayTypeHandler;
 
-import java.time.OffsetDateTime;
+import java.time.LocalDateTime;
 import java.util.Arrays;
 import java.util.List;
 
@@ -25,8 +24,8 @@ public class DeviceInterlockingCmd {
     private String banType;                    // 封禁类型（1:白名单、0:黑名单）
     private String cmdStatus;                  // 指令状态（0:未执行、1:已完成、2:执行中）
     private Integer banDuration;              // 封禁时长（秒，-1表示永久）
-    private OffsetDateTime createTime;
-    private OffsetDateTime updateTime;
+    private LocalDateTime createTime;
+    private LocalDateTime updateTime;
     private String tenantId;
     private Long createDept;
     private Long createBy;
@@ -65,11 +64,11 @@ public class DeviceInterlockingCmd {
     public Integer getBanDuration() { return banDuration; }
     public void setBanDuration(Integer banDuration) { this.banDuration = banDuration; }
 
-    public OffsetDateTime getCreateTime() { return createTime; }
-    public void setCreateTime(OffsetDateTime createTime) { this.createTime = createTime; }
+    public LocalDateTime getCreateTime() { return createTime; }
+    public void setCreateTime(LocalDateTime createTime) { this.createTime = createTime; }
 
-    public OffsetDateTime getUpdateTime() { return updateTime; }
-    public void setUpdateTime(OffsetDateTime updateTime) { this.updateTime = updateTime; }
+    public LocalDateTime getUpdateTime() { return updateTime; }
+    public void setUpdateTime(LocalDateTime updateTime) { this.updateTime = updateTime; }
 
     public String getTenantId() { return tenantId; }
     public void setTenantId(String tenantId) { this.tenantId = tenantId; }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/entity/DeviceInterlockingLog.java

@@ -1,6 +1,6 @@
 package com.common.entity;
 
-import java.time.OffsetDateTime;
+import java.time.LocalDateTime;
 
 /**
  * 封禁记录表实体类
@@ -12,15 +12,15 @@ public class DeviceInterlockingLog {
     private Long deviceInterlockingId;         // 封禁设备ID
     private String banIp;                     // 封禁IP地址
     private String deviceName;                 // 封禁设备名称
-    private OffsetDateTime banTime;            // 封禁时间
+    private LocalDateTime banTime;            // 封禁时间
     private String banMethod;                  // 封禁方式（0.人工、1.自动化封禁）
     private Integer banResult;                // 联动结果（成功：1、失败：0）
     private String tenantId;
     private Long createDept;
     private Long createBy;
-    private OffsetDateTime createTime;
+    private LocalDateTime createTime;
     private Long updateBy;
-    private OffsetDateTime updateTime;
+    private LocalDateTime updateTime;
     private String remark;
     private String respBody;                 // 响应body
     private String reqBody;                   // 请求body
@@ -41,8 +41,8 @@ public class DeviceInterlockingLog {
     public String getDeviceName() { return deviceName; }
     public void setDeviceName(String deviceName) { this.deviceName = deviceName; }
 
-    public OffsetDateTime getBanTime() { return banTime; }
-    public void setBanTime(OffsetDateTime banTime) { this.banTime = banTime; }
+    public LocalDateTime getBanTime() { return banTime; }
+    public void setBanTime(LocalDateTime banTime) { this.banTime = banTime; }
 
     public String getBanMethod() { return banMethod; }
     public void setBanMethod(String banMethod) { this.banMethod = banMethod; }
@@ -59,14 +59,14 @@ public class DeviceInterlockingLog {
     public Long getCreateBy() { return createBy; }
     public void setCreateBy(Long createBy) { this.createBy = createBy; }
 
-    public OffsetDateTime getCreateTime() { return createTime; }
-    public void setCreateTime(OffsetDateTime createTime) { this.createTime = createTime; }
+    public LocalDateTime getCreateTime() { return createTime; }
+    public void setCreateTime(LocalDateTime createTime) { this.createTime = createTime; }
 
     public Long getUpdateBy() { return updateBy; }
     public void setUpdateBy(Long updateBy) { this.updateBy = updateBy; }
 
-    public OffsetDateTime getUpdateTime() { return updateTime; }
-    public void setUpdateTime(OffsetDateTime updateTime) { this.updateTime = updateTime; }
+    public LocalDateTime getUpdateTime() { return updateTime; }
+    public void setUpdateTime(LocalDateTime updateTime) { this.updateTime = updateTime; }
 
     public String getRemark() { return remark; }
     public void setRemark(String remark) { this.remark = remark; }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/AlarmMapper.java

@@ -15,7 +15,7 @@ public interface AlarmMapper {
             "INSERT INTO alarm (",
             "id, created_at, alarm_name, alarm_level, alarm_type, ",
             "alarm_major_type, alarm_minor_type,alarm_area_id, attack_ip, victim_ip, victim_web_url, ",
-            "device_id, comment,origin_log_ids,log_start_at, log_end_at, window_time, http_status, ",
+            "device_id, \"comment\",origin_log_ids,log_start_at, log_end_at, window_time, http_status, ",
             "attack_port, victim_port, attack_method, etl_time, log_count, ",
             "attack_chain_phase, disposition_advice, attack_direction, ",
             "judged_state, disposed_state, attack_result, fall, payload,  dns_info, engine_type,   " ,
@@ -52,7 +52,7 @@ public interface AlarmMapper {
     @Insert("INSERT INTO alarm (" +
             "id, created_at, alarm_name, alarm_level, alarm_type, " +
             "alarm_major_type, alarm_minor_type,alarm_area_id, attack_ip, victim_ip, victim_web_url, " +
-            "device_id, comment,origin_log_ids, log_start_at, log_end_at, window_time, http_status, " +
+            "device_id, \"comment\",origin_log_ids, log_start_at, log_end_at, window_time, http_status, " +
             "attack_port, victim_port, attack_method, etl_time, log_count, " +
             "attack_chain_phase, disposition_advice, attack_direction, " +
             "judged_state, disposed_state, attack_result, fall, payload, dns_info, engine_type,  " +

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/AlarmVisitMapper.java

@@ -19,7 +19,7 @@ public interface AlarmVisitMapper {
             "INSERT INTO alarm_visit (",
             "id, created_at, alarm_name, alarm_level, alarm_type, ",
             "alarm_major_type, alarm_minor_type,alarm_area_id, attack_ip, victim_ip, victim_web_url, ",
-            "device_id, comment,origin_log_ids,log_start_at, log_end_at,window_time, http_status, ",
+            "device_id, \"comment\",origin_log_ids,log_start_at, log_end_at,window_time, http_status, ",
             "attack_port, victim_port, attack_method, etl_time, log_count, ",
             "attack_chain_phase, disposition_advice, attack_direction, ",
             "judged_state, disposed_state, attack_result, fall, payload, dns_info, engine_type,  " ,
@@ -56,7 +56,7 @@ public interface AlarmVisitMapper {
     @Insert("INSERT INTO alarm_visit (" +
             "id, created_at, alarm_name, alarm_level, alarm_type, " +
             "alarm_major_type, alarm_minor_type,alarm_area_id, attack_ip, victim_ip, victim_web_url,  " +
-            "device_id, comment,origin_log_ids, log_start_at, log_end_at, window_time,http_status, " +
+            "device_id, \"comment\",origin_log_ids, log_start_at, log_end_at, window_time,http_status, " +
             "attack_port, victim_port, attack_method, etl_time, log_count, " +
             "attack_chain_phase, disposition_advice, attack_direction, " +
             "judged_state, disposed_state, attack_result, fall, payload, dns_info,engine_type, " +

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/DeviceCollectHeartbeatMapper.java

@@ -37,22 +37,37 @@ public interface DeviceCollectHeartbeatMapper {
 
     /**
      * 插入或更新（根据collect_id）
+     * 达梦数据库使用 MERGE INTO 实现 upsert
      */
-    @Insert("INSERT INTO device_collect_heartbeat (" +
+    @Update("MERGE INTO device_collect_heartbeat t " +
+            "USING (SELECT " +
+            "#{collectId} AS collect_id, " +
+            "#{collectName} AS collect_name, " +
+            "#{deviceIp} AS device_ip, " +
+            "#{appVersion} AS app_version, " +
+            "#{lastHeartbeat} AS last_heartbeat, " +
+            "#{heartbeatCount} AS heartbeat_count, " +
+            "#{status} AS status, " +
+            "#{failCount} AS fail_count, " +
+            "#{updateTime} AS update_time " +
+            "FROM DUAL) s " +
+            "ON (t.collect_id = s.collect_id) " +
+            "WHEN MATCHED THEN UPDATE SET " +
+            "t.collect_name = s.collect_name, " +
+            "t.device_ip = s.device_ip, " +
+            "t.app_version = s.app_version, " +
+            "t.last_heartbeat = s.last_heartbeat, " +
+            "t.heartbeat_count = s.heartbeat_count, " +
+            "t.status = s.status, " +
+            "t.fail_count = s.fail_count, " +
+            "t.update_time = s.update_time " +
+            "WHEN NOT MATCHED THEN INSERT (" +
             "collect_id, collect_name, device_ip, app_version, last_heartbeat, " +
-            "heartbeat_count, status, fail_count, update_time " +
+            "heartbeat_count, status, fail_count, update_time" +
             ") VALUES (" +
-            "#{collectId}, #{collectName}, #{deviceIp}, #{appVersion}, #{lastHeartbeat}, " +
-            "#{heartbeatCount}, #{status}, #{failCount}, #{updateTime} " +
-            ") ON CONFLICT (collect_id) DO UPDATE SET " +
-            "collect_name = EXCLUDED.collect_name, " +
-            "device_ip = EXCLUDED.device_ip, " +
-            "app_version = EXCLUDED.app_version, " +
-            "last_heartbeat = EXCLUDED.last_heartbeat, " +
-            "heartbeat_count = EXCLUDED.heartbeat_count, " +
-            "status = EXCLUDED.status, " +
-            "fail_count = EXCLUDED.fail_count, " +
-            "update_time = EXCLUDED.update_time")
+            "s.collect_id, s.collect_name, s.device_ip, s.app_version, s.last_heartbeat, " +
+            "s.heartbeat_count, s.status, s.fail_count, s.update_time" +
+            ")")
     int upsert(DeviceCollectHeartbeat heartbeat);
 
     /**

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java

@@ -155,12 +155,12 @@ public interface DeviceCollectTaskMapper extends BaseMapper<DeviceCollectTask>{
             "<foreach collection='tasks' item='task' separator=';'>" +
             "UPDATE device_collect_task SET " +
             "  first_time = CASE " +
-            "    WHEN first_time IS NULL AND #{task.firstTime}::TIMESTAMP IS NOT NULL THEN #{task.firstTime}::TIMESTAMP " +
+            "    WHEN first_time IS NULL AND #{task.firstTime} IS NOT NULL THEN #{task.firstTime} " +
             "    ELSE first_time " +
             "  END, " +
-            "  last_success_time = #{task.lastSuccessTime}::TIMESTAMP, " +
-            "  last_failed_time = #{task.lastFailedTime}::TIMESTAMP, " +
-            "  updated_at = #{task.updatedAt}::TIMESTAMP " +
+            "  last_success_time = #{task.lastSuccessTime}, " +
+            "  last_failed_time = #{task.lastFailedTime}, " +
+            "  updated_at = #{task.updatedAt} " +
             "WHERE id = #{task.id}" +
             "</foreach>" +
             "</script>")
@@ -171,12 +171,12 @@ public interface DeviceCollectTaskMapper extends BaseMapper<DeviceCollectTask>{
      */
     @Update("UPDATE device_collect_task " +
             "SET first_time = CASE " +
-            "    WHEN first_time IS NULL AND #{firstTime}::TIMESTAMP IS NOT NULL THEN #{firstTime}::TIMESTAMP " +
+            "    WHEN first_time IS NULL AND #{firstTime} IS NOT NULL THEN #{firstTime} " +
             "    ELSE first_time " +
             "  END, " +
-            "  last_success_time = #{lastSuccessTime}::TIMESTAMP, " +
-            "  last_failed_time = #{lastFailTime}::TIMESTAMP, " +
-            "  updated_at = #{updateTime}::TIMESTAMP " +
+            "  last_success_time = #{lastSuccessTime}, " +
+            "  last_failed_time = #{lastFailTime}, " +
+            "  updated_at = #{updateTime} " +
             "WHERE id = #{deviceCollectId}")
     int updateTaskTime(@Param("deviceCollectId") String deviceCollectId,
                        @Param("firstTime") LocalDateTime firstTime,

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/DeviceInterlockingCmdMapper.java

@@ -61,8 +61,11 @@ public interface DeviceInterlockingCmdMapper {
     @Insert("INSERT INTO device_interlocking_cmd (probe_id, probe_ip, device_interlocking_id, device_interlocking_ip, " +
             "ban_ips, ban_method, ban_type, cmd_status, ban_duration, create_time, update_time, " +
             "tenant_id, create_dept, create_by, remark, ban_operation_type) " +
-            "VALUES (#{probeId}, #{probeIp}, ARRAY[:ids], ARRAY[:ips], ARRAY[:banIps], " +
-            "#{banMethod}, #{banType}, #{cmdStatus}, #{banDuration}, NOW(), NOW(), " +
+            "VALUES (#{probeId}, #{probeIp}, " +
+            "#{deviceInterlockingId, typeHandler=com.Modules.etl.handler.ArrayIntegerTypeHandler}, " +
+            "#{deviceInterlockingIp, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, " +
+            "#{banIps, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler}, " +
+            "#{banMethod}, #{banType}, #{cmdStatus}, #{banDuration}, SYSDATE, SYSDATE, " +
             "#{tenantId}, #{createDept}, #{createBy}, #{remark}, #{banOperationType})")
     @Options(useGeneratedKeys = true, keyProperty = "id")
     int insert(DeviceInterlockingCmd cmd);
@@ -73,25 +76,25 @@ public interface DeviceInterlockingCmdMapper {
      * @param cmdStatus 新状态
      * @return 影响行数
      */
-    @Update("UPDATE device_interlocking_cmd SET cmd_status = #{cmdStatus}, update_time = NOW() WHERE id = #{id}")
+    @Update("UPDATE device_interlocking_cmd SET cmd_status = #{cmdStatus}, update_time = SYSDATE WHERE id = #{id}")
     int updateStatus(@Param("id") Long id, @Param("cmdStatus") String cmdStatus);
 
     /**
      * 更新指令状态为执行中
      */
-    @Update("UPDATE device_interlocking_cmd SET cmd_status = '2', update_time = NOW() WHERE id = #{id}")
+    @Update("UPDATE device_interlocking_cmd SET cmd_status = '2', update_time = SYSDATE WHERE id = #{id}")
     int updateStatusToExecuting(@Param("id") Long id);
 
     /**
      * 更新指令状态为执行完成
      */
-    @Update("UPDATE device_interlocking_cmd SET cmd_status = '1', update_time = NOW() WHERE id = #{id}")
+    @Update("UPDATE device_interlocking_cmd SET cmd_status = '1', update_time = SYSDATE WHERE id = #{id}")
     int updateStatusToCompleted(@Param("id") Long id);
 
     /**
      * 更新指令状态为执行失败
      */
-    @Update("UPDATE device_interlocking_cmd SET cmd_status = '3', update_time = NOW() WHERE id = #{id}")
+    @Update("UPDATE device_interlocking_cmd SET cmd_status = '3', update_time = SYSDATE WHERE id = #{id}")
     int updateStatusToFailed(@Param("id") Long id);
 
     /**

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/DeviceReceiveLogMapper.java

@@ -84,7 +84,7 @@ public interface DeviceReceiveLogMapper {
      */
     @Select("SELECT device_collect_id, MAX(created_at) AS last_success_time " +
             "FROM device_receive_log " +
-            "WHERE push_success = true " +
+            "WHERE push_success = 1 " +
             "AND created_at >= CURRENT_DATE " +
             "GROUP BY device_collect_id")
     List<DeviceCollectTaskTime> selectDailySuccessTimes();
@@ -94,7 +94,7 @@ public interface DeviceReceiveLogMapper {
      */
     @Select("SELECT device_collect_id, MAX(created_at) AS last_fail_time " +
             "FROM device_receive_log " +
-            "WHERE push_success = false " +
+            "WHERE push_success = 0 " +
             "AND created_at >= CURRENT_DATE " +
             "GROUP BY device_collect_id")
     List<DeviceCollectTaskTime> selectDailyFailTimes();
@@ -104,7 +104,7 @@ public interface DeviceReceiveLogMapper {
      */
     @Select("SELECT device_collect_id, MIN(created_at) AS first_success_time " +
             "FROM device_receive_log " +
-            "WHERE push_success = true " +
+            "WHERE push_success = 1 " +
             "GROUP BY device_collect_id")
     List<DeviceCollectTaskTime> selectFirstSuccessTimes();
 
@@ -114,7 +114,7 @@ public interface DeviceReceiveLogMapper {
     @Select("SELECT device_collect_id, MIN(created_at) AS first_time, " +
             "MAX(created_at) AS last_success_time " +
             "FROM device_receive_log " +
-            "WHERE push_success = true " +
+            "WHERE push_success = 1 " +
             "AND created_at >= #{startTime} " +
             "AND created_at < #{endTime} " +
             "GROUP BY device_collect_id")

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/SyslogNormalAlarmMapper.java

@@ -49,30 +49,29 @@ public interface SyslogNormalAlarmMapper {
      */
     @Select("SELECT " +
             "to_char(log_time, 'YYYYMMDD') as log_date, " +
-            "ARRAY_AGG(DISTINCT  host(src_ip)::text)  as  attack_ips, " +
+            "WM_CONCAT(DISTINCT  src_ip)  as  attack_ips, " +
             "origin_event_name, " +
             "MAX(attack_result) as attack_result, " +
             "MIN(log_time) as min_log_time, " +
             "MAX(log_time) as max_log_time, " +
             "COUNT(1) as log_count, " +
-            "ARRAY_AGG(DISTINCT  host(dest_ip)::text) as victim_ips, " +
-            "ARRAY_AGG(DISTINCT http_url) as victim_web_urls, " +
-            "ARRAY_AGG(DISTINCT device_id) as device_ids, " +
-            "ARRAY_AGG(DISTINCT id) as origin_log_ids, " +
+            "WM_CONCAT(DISTINCT  dest_ip) as victim_ips, " +
+            "WM_CONCAT(DISTINCT http_url) as victim_web_urls, " +
+            "WM_CONCAT(DISTINCT device_id) as device_ids, " +
+            "WM_CONCAT(DISTINCT id) as origin_log_ids, " +
             "MAX(event_level) as max_event_level, " +
             "MIN(origin_event_type)  AS first_event_type, " +
             "MAX(origin_event_type) as event_type, " +
             "MIN(event_type) as min_event_type, " +
-            "ARRAY_AGG(DISTINCT src_port::int4) as attack_ports, " +
-            "ARRAY_AGG(DISTINCT dest_port::int4) as victim_ports, " +
-            "ARRAY_AGG(DISTINCT http_resp_codes::text) as http_status_codes, " +
-            "ARRAY_AGG(DISTINCT payload::BYTEA) as payload_samples, " +
-            "ARRAY_AGG(DISTINCT http_req_header) as httpReqHeaders, " +
-            "ARRAY_AGG(DISTINCT http_req_body) as httpReqBodys, " +
-            "ARRAY_AGG(DISTINCT http_resp_header) as httpRespHeaders, " +
-            "ARRAY_AGG(DISTINCT http_resp_body) as httpRespBodys, " +
-            "MODE() WITHIN GROUP (ORDER BY dest_domain) as dns_info, " +
-            "STRING_AGG(DISTINCT COALESCE(host(dest_ip)::text, ''), ',') as victim_ips_str " +
+            "WM_CONCAT(DISTINCT src_port) as attack_ports, " +
+            "WM_CONCAT(DISTINCT dest_port) as victim_ports, " +
+            "WM_CONCAT(DISTINCT http_resp_codes) as http_status_codes, " +
+            "WM_CONCAT(DISTINCT payload) as payload_samples, " +
+            "WM_CONCAT(DISTINCT http_req_header) as httpReqHeaders, " +
+            "WM_CONCAT(DISTINCT http_req_body) as httpReqBodys, " +
+            "WM_CONCAT(DISTINCT http_resp_header) as httpRespHeaders, " +
+            "WM_CONCAT(DISTINCT http_resp_body) as httpRespBodys, " +
+            "LISTAGG(DISTINCT COALESCE(dest_ip, ''), ',') as victim_ips_str " +
             "FROM syslog_normal_alarm  " +
             "WHERE log_time >= #{startTime} AND log_time < #{endTime} " +
             "AND event_level >= 1 AND src_ip NOT IN ('127.0.0.1', '127.0.0.2') " +

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/SyslogNormalDataMapper.java

@@ -46,30 +46,29 @@ public interface SyslogNormalDataMapper {
      */
     @Select("SELECT " +
             "to_char(log_time, 'YYYYMMDD') as log_date, " +
-            "ARRAY_AGG(DISTINCT  host(src_ip)::text)  as  attack_ips, " +
+            "WM_CONCAT(DISTINCT  src_ip)  as  attack_ips, " +
             "origin_event_name, " +
             "MAX(attack_result) as attack_result, " +
             "MIN(log_time) as min_log_time, " +
             "MAX(log_time) as max_log_time, " +
             "COUNT(1) as log_count, " +
-            "ARRAY_AGG(DISTINCT  host(dest_ip)::text) as victim_ips, " +
-            "ARRAY_AGG(DISTINCT http_url) as victim_web_urls, " +
-            "ARRAY_AGG(DISTINCT device_id) as device_ids, " +
-            "ARRAY_AGG(DISTINCT id) as origin_log_ids, " +
+            "WM_CONCAT(DISTINCT  dest_ip) as victim_ips, " +
+            "WM_CONCAT(DISTINCT http_url) as victim_web_urls, " +
+            "WM_CONCAT(DISTINCT device_id) as device_ids, " +
+            "WM_CONCAT(DISTINCT id) as origin_log_ids, " +
             "MAX(event_level) as max_event_level, " +
             "MIN(origin_event_type)  AS first_event_type, " +
             "MAX(origin_event_type) as event_type, " +
             "MIN(event_type) as min_event_type, " +
-            "ARRAY_AGG(DISTINCT src_port::int4) as attack_ports, " +
-            "ARRAY_AGG(DISTINCT dest_port::int4) as victim_ports, " +
-            "ARRAY_AGG(DISTINCT http_resp_codes::text) as http_status_codes, " +
-            "ARRAY_AGG(DISTINCT payload::BYTEA) as payload_samples, " +
-            "ARRAY_AGG(DISTINCT http_req_header) as httpReqHeaders, " +
-            "ARRAY_AGG(DISTINCT http_req_body) as httpReqBodys, " +
-            "ARRAY_AGG(DISTINCT http_resp_header) as httpRespHeaders, " +
-            "ARRAY_AGG(DISTINCT http_resp_body) as httpRespBodys, " +
-            "MODE() WITHIN GROUP (ORDER BY dest_domain) as dns_info, " +
-            "STRING_AGG(DISTINCT COALESCE(host(dest_ip)::text, ''), ',') as victim_ips_str " +
+            "WM_CONCAT(DISTINCT src_port) as attack_ports, " +
+            "WM_CONCAT(DISTINCT dest_port) as victim_ports, " +
+            "WM_CONCAT(DISTINCT http_resp_codes) as http_status_codes, " +
+            "WM_CONCAT(DISTINCT payload) as payload_samples, " +
+            "WM_CONCAT(DISTINCT http_req_header) as httpReqHeaders, " +
+            "WM_CONCAT(DISTINCT http_req_body) as httpReqBodys, " +
+            "WM_CONCAT(DISTINCT http_resp_header) as httpRespHeaders, " +
+            "WM_CONCAT(DISTINCT http_resp_body) as httpRespBodys, " +
+            "LISTAGG(DISTINCT COALESCE(dest_ip, ''), ',') as victim_ips_str " +
             "FROM syslog_normal_data " +
             "WHERE log_time >= #{startTime} AND log_time < #{endTime} " +
             "AND   http_resp_codes =200 and   origin_event_type <> ''   and  origin_event_name='访问日志' AND src_ip NOT IN ('127.0.0.1', '127.0.0.2') " +

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/mapper/WecomNotificationMapper.java

@@ -18,12 +18,12 @@ public interface WecomNotificationMapper {
             "wecom_notification_time, tenant_id, create_dept, create_by, create_time, " +
             "update_by, update_time, remark, wecom_notification_status" +
             ") VALUES (" +
-            "nextval('seq_wecom_notification'), #{userId}, #{wecomNotificationName}, #{wecomNotificationIp}, " +
+            "seq_wecom_notification.NEXTVAL, #{userId}, #{wecomNotificationName}, #{wecomNotificationIp}, " +
             "#{wecomNotificationType}, #{wecomNotificationLevel}, #{wecomNotificationContent}, " +
             "#{wecomNotificationTime}, #{tenantId}, #{createDept}, #{createBy}, #{createTime}, " +
             "#{updateBy}, #{updateTime}, #{remark}, #{wecomNotificationStatus}" +
             ")")
-    @SelectKey(statement = "SELECT currval('seq_wecom_notification')", keyProperty = "wecomNotificationId", resultType = Long.class, before = false)
+    @SelectKey(statement = "SELECT seq_wecom_notification.currval", keyProperty = "wecomNotificationId", resultType = Long.class, before = false)
     int insert(WecomNotification notification);
 
     /**
@@ -41,7 +41,7 @@ public interface WecomNotificationMapper {
     /**
      * 更新通知状态
      */
-    @Update("UPDATE wecom_notification SET wecom_notification_status = #{status}, update_time = NOW() " +
+    @Update("UPDATE wecom_notification SET wecom_notification_status = #{status}, update_time = SYSDATE " +
             "WHERE wecom_notification_id = #{wecomNotificationId}")
     int updateStatus(@Param("wecomNotificationId") Long wecomNotificationId, @Param("status") String status);
 }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/service/DeviceInterlockingLogService.java

@@ -4,7 +4,7 @@ import com.common.entity.DeviceInterlockingLog;
 import com.common.mapper.DeviceInterlockingLogMapper;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
-import java.time.OffsetDateTime;
+import java.time.LocalDateTime;
 import java.util.List;
 
 @Service
@@ -32,7 +32,7 @@ public class DeviceInterlockingLogService {
      */
     public int insert(DeviceInterlockingLog log) {
         if (log.getBanTime() == null) {
-            log.setBanTime(OffsetDateTime.now());
+            log.setBanTime(LocalDateTime.now());
         }
         return logMapper.insert(log);
     }
@@ -44,7 +44,7 @@ public class DeviceInterlockingLogService {
         if (logs != null && !logs.isEmpty()) {
             for (DeviceInterlockingLog log : logs) {
                 if (log.getBanTime() == null) {
-                    log.setBanTime(OffsetDateTime.now());
+                    log.setBanTime(LocalDateTime.now());
                 }
             }
         }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/service/DmNormalizeRuleService.java

@@ -77,7 +77,7 @@ public class DmNormalizeRuleService {
 
             List<Map<String, Object>>  ruleMap=dmNormalizeRuleMapper.selectByDeviceId(id);
             sqlSession.commit();
-            return ruleMap;
+            return convertClobToString(ruleMap);
 
         } catch (Exception e) {
             logger.error("DmNormalizeRuleService MyBatisUtil getSqlSession 异常", e);
@@ -95,7 +95,41 @@ public class DmNormalizeRuleService {
     {
         System.out.println("调用selectByDeviceIdAuto 方法,id:"+id);
         List<Map<String, Object>>  ruleMap=dmNormalizeRuleMapper.selectByDeviceId(id);
-        return ruleMap;
+        return convertClobToString(ruleMap);
+    }
+
+    /**
+     * 将达梦 JDBC CLOB/NCLOB 对象转换为 String，避免缓存序列化报错
+     * 达梦驱动返回的 TEXT/CLOB 列可能是 dm.jdbc.driver.DmdbNClob 等内部类型，
+     * toString() 只返回对象引用（如 DmdbNClob@xxx），必须通过 Clob 接口获取实际文本
+     */
+    private List<Map<String, Object>> convertClobToString(List<Map<String, Object>> list) {
+        if (list == null) return null;
+        for (Map<String, Object> map : list) {
+            if (map == null) continue;
+            for (Map.Entry<String, Object> entry : map.entrySet()) {
+                Object value = entry.getValue();
+                if (value != null && value.getClass().getName().startsWith("dm.jdbc.")) {
+                    try {
+                        if (value instanceof java.sql.Clob) {
+                            java.sql.Clob clob = (java.sql.Clob) value;
+                            long length = clob.length();
+                            if (length > 0) {
+                                entry.setValue(clob.getSubString(1, (int) length));
+                            } else {
+                                entry.setValue("");
+                            }
+                        } else {
+                            entry.setValue(value.toString());
+                        }
+                    } catch (Exception e) {
+                        logger.warn("CLOB/NCLOB 转换 String 失败: " + e.getMessage());
+                        entry.setValue(null);
+                    }
+                }
+            }
+        }
+        return list;
     }
 
 }

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java

@@ -734,7 +734,25 @@ public class RealtimeAnalysisEngine implements AnalysisEngine {
             return result;
         }
         // PostgreSQL数组以字符串形式返回，如 "{ip1,ip2,ip3}"
+        // 达梦 JSONB_AGG 返回 JSON 数组格式，如 "[41614, 8080]"
         String str = value.toString();
+        if (str.startsWith("[") && str.endsWith("]")) {
+            str = str.substring(1, str.length() - 1).trim();
+            if (str.isEmpty()) {
+                return new String[0];
+            }
+            // 拆分 JSON 数组元素（兼容带引号和纯数字）
+            String[] parts = str.split(",");
+            String[] result = new String[parts.length];
+            for (int i = 0; i < parts.length; i++) {
+                String part = parts[i].trim();
+                if (part.startsWith("\"") && part.endsWith("\"")) {
+                    part = part.substring(1, part.length() - 1);
+                }
+                result[i] = part;
+            }
+            return result;
+        }
         if (str.startsWith("{") && str.endsWith("}")) {
             str = str.substring(1, str.length() - 1);
             return str.split(",");

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/service/impl/SqlGeneratorServiceImpl.java

@@ -747,19 +747,19 @@ public class SqlGeneratorServiceImpl implements SqlGeneratorService {
                 return "AVG(" + columnName + ")";
             case "DUPLICATESANDSPLICE":
                 if (StringUtils.isNotBlank(argsStr)) {
-                    return "STRING_AGG(DISTINCT " + columnName + ", '" + argsStr + "')";
+                    return "LISTAGG(DISTINCT " + columnName + ", '" + argsStr + "')";
                 }
-                return "STRING_AGG(DISTINCT " + columnName + ", ',')";
+                return "LISTAGG(DISTINCT " + columnName + ", ',')";
             case "CONCAT_AGG":
                 if (StringUtils.isNotBlank(argsStr)) {
-                    return "STRING_AGG(" + columnName + ", '" + argsStr + "')";
+                    return "LISTAGG(" + columnName + ", '" + argsStr + "')";
                 }
-                return "STRING_AGG(" + columnName + ", ',')";
+                return "LISTAGG(" + columnName + ", ',')";
             case "CONCAT_AGG_ID":
                 if (StringUtils.isNotBlank(argsStr)) {
-                    return "STRING_AGG(" + columnName + ", '" + argsStr + "')";
+                    return "LISTAGG(" + columnName + ", '" + argsStr + "')";
                 }
-                return "STRING_AGG(" + columnName + ", ',')";
+                return "LISTAGG(" + columnName + ", ',')";
             case "SPLIT_DISTINCT_CONCAT":
                 if (StringUtils.isNotBlank(argsStr)) {
                     String[] splitArgs = argsStr.split(",");
@@ -767,23 +767,23 @@ public class SqlGeneratorServiceImpl implements SqlGeneratorService {
                         String separator = splitArgs[0].trim();
                         String delimiter = splitArgs[1].trim();
                         String limit = splitArgs[2].trim();
-                        return "STRING_AGG(DISTINCT REGEXP_SPLIT(" + columnName + ", '" + delimiter + "'), '" + separator + "') LIMIT " + limit;
+                        return "LISTAGG(DISTINCT REGEXP_SPLIT(" + columnName + ", '" + delimiter + "'), '" + separator + "') LIMIT " + limit;
                     }
                 }
                 return columnName;
             //自定添加方法
             case "MODE_WITH_GROUP":
-                return "MODE() WITHIN GROUP (ORDER BY   " + columnName + ")";
+                return columnName;
 
             // 聚合函数（兼容旧代码）
             case "ARRAY_AGG":
 
-                return "ARRAY_AGG(DISTINCT " + columnName + ")";
+                return "WM_CONCAT(DISTINCT " + columnName + ")";
             case "STRING_AGG":
                 if (StringUtils.isNotBlank(argsStr)) {
-                    return "STRING_AGG(" + columnSafeWrap(columnName) + ", " + argsStr + ")";
+                    return "LISTAGG(" + columnSafeWrap(columnName) + ", " + argsStr + ")";
                 }
-                return "STRING_AGG(DISTINCT " + columnName + ", ',')";
+                return "LISTAGG(DISTINCT " + columnName + ", ',')";
 
             // 时间函数
             case "YEAR":
@@ -847,7 +847,7 @@ public class SqlGeneratorServiceImpl implements SqlGeneratorService {
             case "TO_CHAR":
                 return "TO_CHAR(" + columnName + ", 'YYYYMMDD')";
             case "HOST":
-                return "HOST(" + columnName + ")::text";
+                return columnName;
             default:
                 return functionName + "(" + columnName + ")";
         }
@@ -938,12 +938,7 @@ public class SqlGeneratorServiceImpl implements SqlGeneratorService {
      * 列名安全包装（处理类型转换）
      */
     private String columnSafeWrap(String columnName) {
-        if (columnName.toLowerCase().contains("ip")) {
-            return "host(" + columnName + ")::text";
-        }
-        if (columnName.toLowerCase().contains("port")) {
-            return columnName + "::int4";
-        }
+        // DM不需要类型转换，直接返回列名
         return columnName;
     }
 

haobang-security-dm/syslog-consumer-rule/src/main/java/com/common/util/JsonbUtil.java

@@ -22,6 +22,18 @@ public class JsonbUtil {
             return null;
         }
 
+        // 达梦数据库：TEXT/CLOB 列返回 dm.jdbc.driver.DmdbNClob 对象，
+        // toString() 只返回对象引用而非实际内容，必须通过 Clob 接口读取
+        if (value instanceof java.sql.Clob) {
+            try {
+                java.sql.Clob clob = (java.sql.Clob) value;
+                long length = clob.length();
+                value = length > 0 ? clob.getSubString(1, (int) length) : "";
+            } catch (Exception e) {
+                value = value.toString();
+            }
+        }
+
         // 如果已经是字符串，直接返回
         if (value instanceof String) {
             String strValue = (String) value;

haobang-security-dm/syslog-consumer-rule/src/main/java/com/config/CacheConfig.java

@@ -1,8 +1,16 @@
 package com.config;
 
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.JsonSerializer;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.SerializerProvider;
 import com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
 import com.fasterxml.jackson.databind.jsontype.PolymorphicTypeValidator;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+import com.fasterxml.jackson.databind.ser.BeanSerializerModifier;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import org.springframework.cache.CacheManager;
 import org.springframework.cache.annotation.EnableCaching;
@@ -15,6 +23,7 @@ import org.springframework.data.redis.serializer.GenericJackson2JsonRedisSeriali
 import org.springframework.data.redis.serializer.RedisSerializationContext;
 import org.springframework.data.redis.serializer.StringRedisSerializer;
 import com.fasterxml.jackson.databind.DeserializationFeature;
+import java.io.IOException;
 import java.time.Duration;
 import java.util.Collections;
 import org.springframework.context.annotation.Primary;
@@ -35,6 +44,33 @@ public class CacheConfig {
         // 禁用将日期序列化为时间戳
         mapper.disable(com.fasterxml.jackson.databind.SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
 
+        // 注册达梦 JDBC 安全序列化器 — 拦截 dm.jdbc.* 类，直接返回 null 防止循环引用 StackOverflow
+        SimpleModule dmSafeModule = new SimpleModule("dm-safe");
+        dmSafeModule.setSerializerModifier(new BeanSerializerModifier() {
+            @Override
+            public JsonSerializer<?> modifySerializer(SerializationConfig config,
+                                                       BeanDescription beanDesc,
+                                                       JsonSerializer<?> serializer) {
+                if (beanDesc.getBeanClass().getName().startsWith("dm.jdbc.")) {
+                    return new JsonSerializer<Object>() {
+                        @Override
+                        public void serialize(Object value, JsonGenerator gen,
+                                            SerializerProvider serializers) throws IOException {
+                            gen.writeNull();
+                        }
+
+                        @Override
+                        public void serializeWithType(Object value, JsonGenerator gen,
+                                            SerializerProvider serializers, TypeSerializer typeSer) throws IOException {
+                            gen.writeNull();
+                        }
+                    };
+                }
+                return serializer;
+            }
+        });
+        mapper.registerModule(dmSafeModule);
+
         // 启用类型信息，解决 LinkedHashMap 转换问题
         PolymorphicTypeValidator ptv = BasicPolymorphicTypeValidator.builder()
                 .allowIfSubType("com.common.entity.")    // 允许你的实体类包

haobang-security-dm/syslog-consumer-rule/src/main/java/com/config/RedisConfig.java

@@ -1,6 +1,14 @@
 package com.config;
 
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.BeanDescription;
+import com.fasterxml.jackson.databind.JsonSerializer;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+import com.fasterxml.jackson.databind.ser.BeanSerializerModifier;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -9,6 +17,8 @@ import org.springframework.data.redis.core.RedisTemplate;
 import org.springframework.data.redis.serializer.Jackson2JsonRedisSerializer;
 import org.springframework.data.redis.serializer.StringRedisSerializer;
 
+import java.io.IOException;
+
 @Configuration
 public class RedisConfig {
 
@@ -23,6 +33,32 @@ public class RedisConfig {
 
         ObjectMapper mapper = new ObjectMapper();
         mapper.registerModule(new JavaTimeModule());
+        // 注册达梦 JDBC 安全序列化器 — 拦截 dm.jdbc.* 类，直接返回 null 防止循环引用 StackOverflow
+        SimpleModule dmSafeModule = new SimpleModule("dm-safe");
+        dmSafeModule.setSerializerModifier(new BeanSerializerModifier() {
+            @Override
+            public JsonSerializer<?> modifySerializer(SerializationConfig config,
+                                                       BeanDescription beanDesc,
+                                                       JsonSerializer<?> serializer) {
+                if (beanDesc.getBeanClass().getName().startsWith("dm.jdbc.")) {
+                    return new JsonSerializer<Object>() {
+                        @Override
+                        public void serialize(Object value, JsonGenerator gen,
+                                            SerializerProvider serializers) throws IOException {
+                            gen.writeNull();
+                        }
+
+                        @Override
+                        public void serializeWithType(Object value, JsonGenerator gen,
+                                            SerializerProvider serializers, TypeSerializer typeSer) throws IOException {
+                            gen.writeNull();
+                        }
+                    };
+                }
+                return serializer;
+            }
+        });
+        mapper.registerModule(dmSafeModule);
         mapper.activateDefaultTyping(
                 mapper.getPolymorphicTypeValidator(),
                 ObjectMapper.DefaultTyping.NON_FINAL

haobang-security-dm/syslog-consumer-rule/src/main/java/com/config/WebConfig.java

@@ -1,8 +1,16 @@
 package com.config;
 
 
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.BeanDescription;
 import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonSerializer;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationConfig;
+import com.fasterxml.jackson.databind.SerializerProvider;
+import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+import com.fasterxml.jackson.databind.ser.BeanSerializerModifier;
 import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -10,6 +18,7 @@ import org.springframework.http.converter.HttpMessageConverter;
 import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
+import java.io.IOException;
 import java.util.List;
 
 @Configuration
@@ -28,6 +37,33 @@ public class WebConfig implements WebMvcConfigurer {
         // 禁用将日期序列化为时间戳
         mapper.disable(com.fasterxml.jackson.databind.SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
 
+        // 注册达梦 JDBC 安全序列化器 — 拦截 dm.jdbc.* 类，直接返回 null 防止循环引用 StackOverflow
+        SimpleModule dmSafeModule = new SimpleModule("dm-safe");
+        dmSafeModule.setSerializerModifier(new BeanSerializerModifier() {
+            @Override
+            public JsonSerializer<?> modifySerializer(SerializationConfig config,
+                                                       BeanDescription beanDesc,
+                                                       JsonSerializer<?> serializer) {
+                if (beanDesc.getBeanClass().getName().startsWith("dm.jdbc.")) {
+                    return new JsonSerializer<Object>() {
+                        @Override
+                        public void serialize(Object value, JsonGenerator gen,
+                                            SerializerProvider serializers) throws IOException {
+                            gen.writeNull();
+                        }
+
+                        @Override
+                        public void serializeWithType(Object value, JsonGenerator gen,
+                                            SerializerProvider serializers, TypeSerializer typeSer) throws IOException {
+                            gen.writeNull();
+                        }
+                    };
+                }
+                return serializer;
+            }
+        });
+        mapper.registerModule(dmSafeModule);
+
         // 忽略未知属性
         mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
 

haobang-security-dm/syslog-consumer-rule/src/main/resources/application-dev.properties

@@ -24,7 +24,7 @@ influxdb.batch.size=1000
 influxdb.flush.interval=1000
 influxdb.retry.attempts=3
 influxdb.retry.delay=1000
-# InfluxDB 2.7 连接超时配置
+# InfluxDB 2.7 连接超时配置
 influxdb.connection.timeout=30s
 influxdb.connection.read-timeout=30s
 influxdb.connection.write-timeout=60s
@@ -35,16 +35,16 @@ app.metrics.enabled=true
 
 
 #database Configuration
-spring.datasource.url=jdbc:postgresql://117.72.68.72:54329/ecosys
-spring.datasource.username=postgres
-spring.datasource.password=TnLanWaidYSwTSG5
-spring.datasource.driver-class-name=org.postgresql.Driver
-
+spring.datasource.url=jdbc:dm://192.163.4.99:5237/DM_ecosys
+spring.datasource.username=SYSDBA
+spring.datasource.password=caZ2TcmXNSW8L2Ap
+spring.datasource.driver-class-name=dm.jdbc.driver.DmDriver
+spring.datasource.hikari.schema=\"PUBLIC\"
 # mybatis Configuration
 mybatis.mapper-locations=classpath:mapper/*.xml
 mybatis.type-aliases-package=com.common.entity
 
-#mybatis handler 类
+#mybatis handler 类
 mybatis.configuration.default-statement-timeout=30
 mybatis.configuration.default-fetch-size=1000
 mybatis.configuration.map-underscore-to-camel-case=true
@@ -71,22 +71,22 @@ spring.kafka.listener.concurrency= 2
 spring.kafka.listener.type=batch
 
 
-# 定时任务配置
+# 定时任务配置
 spring.task.scheduling.pool.size=10
 
-# 日志配置
+# 日志配置
 logging.level.com.common.schedule=INFO
 logging.level.com.common.service=INFO
 
-# 分区表检查配置
+# 分区表检查配置
 partition.check.tomorrow.enabled=true
 partition.check.future.days=7
 partition.auto.create=true
 
-# 开发环境缓存配置
+# 开发环境缓存配置
 spring.redis.host=localhost
 spring.redis.port=6379
-# 密码（如果没有设置密码，可以省略）
+# 密码（如果没有设置密码，可以省略）
 spring.redis.password=
 spring.redis.database=0
 spring.redis.timeout=2000
@@ -95,11 +95,11 @@ spring.redis.lettuce.pool.max-active=8
 spring.redis.lettuce.pool.max-wait=-1
 spring.redis.lettuce.pool.max-idle=8
 spring.redis.lettuce.pool.min-idle=0
-# 开发环境缓存时间较短，方便调试
+# 开发环境缓存时间较短，方便调试
 spring.cache.redis.time-to-live=600000
 
 
-# 应用处理器配置
+# 应用处理器配置
 app.processor.thread-pool.core-pool-size=10
 app.processor.thread-pool.max-pool-size=20
 app.processor.thread-pool.queue-capacity=2000
@@ -107,7 +107,7 @@ app.processor.thread-pool.keep-alive-seconds=60
 app.processor.batch-size=100
 app.processor.process-timeout-ms=30000
 
-# ETL配置
+# ETL配置
 etl.batch.page-size=1000
 etl.batch.insert-batch-size=500
 etl.schedule.cron=0 0 2 * * ?
@@ -120,10 +120,9 @@ spring.datasource.hikari.minimum-idle=5
 spring.datasource.hikari.connection-timeout=30000
 spring.datasource.hikari.idle-timeout=600000
 spring.datasource.hikari.max-lifetime=900000
-spring.datasource.hikari.connection-test-query=SELECT 1
+spring.datasource.hikari.connection-test-query=SELECT 1 FROM DUAL
 spring.datasource.hikari.validation-timeout=5000
 spring.datasource.hikari.leak-detection-threshold=30000          
 spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer-rule
 spring.datasource.hikari.auto-commit=false
-spring.datasource.hikari.schema=public
 

haobang-security-dm/syslog-consumer-rule/src/main/resources/application-pre-nw.properties

@@ -26,7 +26,7 @@ influxdb.batch.size=1000
 influxdb.flush.interval=1000
 influxdb.retry.attempts=3
 influxdb.retry.delay=1000
-# InfluxDB 2.7 连接超时配置
+# InfluxDB 2.7 连接超时配置
 influxdb.connection.timeout=30s
 influxdb.connection.read-timeout=30s
 influxdb.connection.write-timeout=60s
@@ -37,15 +37,15 @@ app.metrics.enabled=true
 
 
 #database Configuration
-spring.datasource.url=jdbc:postgresql://10.150 81.209:5432/ecosys
-spring.datasource.username=postgres
+spring.datasource.url=jdbc:dm://192.163.4.99:5237/DM_ecosys
+spring.datasource.username=SYSDBA
 spring.datasource.password=caZ2TcmXNSW8L2Ap
-spring.datasource.driver-class-name=org.postgresql.Driver
+spring.datasource.driver-class-name=dm.jdbc.driver.DmDriver
 
 # mybatis Configuration
 mybatis.mapper-locations=classpath:mapper/*.xml
 mybatis.type-aliases-package=com.common.entity
-#mybatis handler 类
+#mybatis handler 类
 mybatis.configuration.default-statement-timeout=30
 mybatis.configuration.default-fetch-size=1000
 mybatis.configuration.map-underscore-to-camel-case=true
@@ -72,23 +72,23 @@ spring.kafka.listener.concurrency= 2
 spring.kafka.listener.type=batch
 
 
-# 定时任务配置
+# 定时任务配置
 spring.task.scheduling.pool.size=10
 
-# 日志配置
+# 日志配置
 logging.level.com.common.schedule=INFO
 logging.level.com.common.service=INFO
 
-# 分区表检查配置
+# 分区表检查配置
 partition.check.tomorrow.enabled=true
 partition.check.future.days=7
 partition.auto.create=true
 
 
-# 生产环境缓存配置
+# 生产环境缓存配置
 spring.redis.host=192.168.4.26
 spring.redis.port=6379
-# 密码（如果没有设置密码，可以省略）
+# 密码（如果没有设置密码，可以省略）
 spring.redis.password=123456
 spring.redis.database=0
 spring.redis.timeout=5000
@@ -99,10 +99,10 @@ spring.redis.lettuce.pool.max-wait=5000
 spring.redis.lettuce.pool.max-idle=10
 spring.redis.lettuce.pool.min-idle=5
 
-# 生产环境缓存时间较长
+# 生产环境缓存时间较长
 spring.cache.redis.time-to-live=3600000
 
-# 应用处理器配置
+# 应用处理器配置
 app.processor.thread-pool.core-pool-size=10
 app.processor.thread-pool.max-pool-size=20
 app.processor.thread-pool.queue-capacity=2000
@@ -111,20 +111,20 @@ app.processor.batch-size=100
 app.processor.process-timeout-ms=30000
 
 
-# 配置 Elasticsearch
-# Elasticsearch连接地址
+# 配置 Elasticsearch
+# Elasticsearch连接地址
 spring.elasticsearch.uris=http://192.168.1.174:9200
-# 配置 Elasticsearch 用户名
+# 配置 Elasticsearch 用户名
 spring.elasticsearch.username=CONTAINER_NAME
-# 配置 Elasticsearch 密码
+# 配置 Elasticsearch 密码
 spring.elasticsearch.password=t2NZCiajmdazxBrF
-# 连接超时时间
+# 连接超时时间
 spring.elasticsearch.connection-timeout=10s
-# Socket 超时时间
+# Socket 超时时间
 spring.elasticsearch.socket-timeout=30s
 
 
-# ETL配置
+# ETL配置
 etl.batch.page-size=1000
 etl.batch.insert-batch-size=500
 etl.schedule.cron=0 0 2 * * ?
@@ -138,51 +138,50 @@ spring.datasource.hikari.minimum-idle=5
 spring.datasource.hikari.connection-timeout=30000
 spring.datasource.hikari.idle-timeout=600000
 spring.datasource.hikari.max-lifetime=900000
-spring.datasource.hikari.connection-test-query=SELECT 1
+spring.datasource.hikari.connection-test-query=SELECT 1 FROM DUAL
 spring.datasource.hikari.validation-timeout=5000
 spring.datasource.hikari.leak-detection-threshold=30000          
-spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
+spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer-rule
 spring.datasource.hikari.auto-commit=false
-spring.datasource.hikari.schema=public
 
 
-# 关联分析规则配置
+# 关联分析规则配置
 analysis.realtime.enabled= true
-# 检查间隔（秒） - 默认10秒
+# 检查间隔（秒） - 默认10秒
 analysis.realtime.check-interval-seconds: 10
 
 # ============================================
-# 探针联动API配置
+# 探针联动API配置
 # ============================================
-# API-KEY认证（32位，建议使用随机生成的密钥）
+# API-KEY认证（32位，建议使用随机生成的密钥）
 interlocking.api-key=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6
-# API接口基础URL（供syslog-serve调用）
+# API接口基础URL（供syslog-serve调用）
 interlocking.api.base-url=http://10.150 81.210:8089/xdrservice/interlocking
 
 # ============================================
-# 告警健康检查配置
+# 告警健康检查配置
 # ============================================
-# 告警表无数据阈值（小时）
+# 告警表无数据阈值（小时）
 alarm.health-check.alarm-hours=2
-# 告警日志表无数据阈值（小时）
+# 告警日志表无数据阈值（小时）
 alarm.health-check.alarm-visit-hours=4
-# 是否启用定时巡检
+# 是否启用定时巡检
 alarm.health-check.enabled=true
 
 # ============================================
-# 探针心跳检测配置
+# 探针心跳检测配置
 # ============================================
-# 是否启用心跳检测
+# 是否启用心跳检测
 probe.heartbeat.enabled=true
-# 探针离线阈值（分钟），超过此时间未收到心跳则判定为离线
+# 探针离线阈值（分钟），超过此时间未收到心跳则判定为离线
 probe.heartbeat.offline-threshold-minutes=10
-# 状态检查Cron表达式（默认每10分钟）
+# 状态检查Cron表达式（默认每10分钟）
 probe.status.check.cron=0 */10 * * * ?
-# 探针租户ID
+# 探针租户ID
 probe.heartbeat.tenant-id=000000
-# 心跳历史保留天数
+# 心跳历史保留天数
 probe.heartbeat.history.keep-days=10
-# 是否启用历史清理
+# 是否启用历史清理
 probe.heartbeat.history.cleanup-enabled=true
-# 历史清理Cron表达式（默认每天凌晨1点）
+# 历史清理Cron表达式（默认每天凌晨1点）
 probe.history.cleanup.cron=0 0 1 * * ?

haobang-security-dm/syslog-consumer-rule/src/main/resources/application-prod-zc.properties

@@ -25,7 +25,7 @@ influxdb.batch.size=1000
 influxdb.flush.interval=1000
 influxdb.retry.attempts=3
 influxdb.retry.delay=1000
-# InfluxDB 2.7 连接超时配置
+# InfluxDB 2.7 连接超时配置
 influxdb.connection.timeout=30s
 influxdb.connection.read-timeout=30s
 influxdb.connection.write-timeout=60s
@@ -36,16 +36,16 @@ app.metrics.enabled=true
 
 
 #database Configuration
-spring.datasource.url=jdbc:postgresql://10.11.2.141:5432/ecosys
-spring.datasource.username=ecosys
-spring.datasource.password=wsYDPjrpNZPrkPrR
-spring.datasource.driver-class-name=org.postgresql.Driver
-
+spring.datasource.url=jdbc:dm://192.163.4.99:5237/DM_ecosys
+spring.datasource.username=SYSDBA
+spring.datasource.password=caZ2TcmXNSW8L2Ap
+spring.datasource.driver-class-name=dm.jdbc.driver.DmDriver
+spring.datasource.hikari.schema=\"PUBLIC\"
 # mybatis Configuration
 mybatis.mapper-locations=classpath:mapper/*.xml
 mybatis.type-aliases-package=com.common.entity
 
-#mybatis handler 类
+#mybatis handler 类
 mybatis.configuration.default-statement-timeout=30
 mybatis.configuration.default-fetch-size=1000
 mybatis.configuration.map-underscore-to-camel-case=true
@@ -73,23 +73,23 @@ spring.kafka.listener.ack-mode= manual
 spring.kafka.listener.concurrency= 2  
 spring.kafka.listener.type=batch
 
-# 定时任务配置
+# 定时任务配置
 spring.task.scheduling.pool.size=10
 
-# 日志配置
+# 日志配置
 logging.level.com.common.schedule=INFO
 logging.level.com.common.service=INFO
 
-# 分区表检查配置
+# 分区表检查配置
 partition.check.tomorrow.enabled=true
 partition.check.future.days=7
 partition.auto.create=true
 
 
-# 生产环境缓存配置
+# 生产环境缓存配置
 spring.redis.host=10.11.2.142
 spring.redis.port=6379
-# 密码（如果没有设置密码，可以省略）
+# 密码（如果没有设置密码，可以省略）
 spring.redis.password=redis_edP6N6
 spring.redis.database=0
 spring.redis.timeout=5000
@@ -99,10 +99,10 @@ spring.redis.lettuce.pool.max-active=20
 spring.redis.lettuce.pool.max-wait=5000
 spring.redis.lettuce.pool.max-idle=10
 spring.redis.lettuce.pool.min-idle=5
-# 生产环境缓存时间较长
+# 生产环境缓存时间较长
 spring.cache.redis.time-to-live=3600000
 
-# 应用处理器配置
+# 应用处理器配置
 app.processor.thread-pool.core-pool-size=10
 app.processor.thread-pool.max-pool-size=20
 app.processor.thread-pool.queue-capacity=2000
@@ -110,20 +110,20 @@ app.processor.thread-pool.keep-alive-seconds=60
 app.processor.batch-size=100
 app.processor.process-timeout-ms=30000
 
-# 配置 Elasticsearch
-# Elasticsearch连接地址
+# 配置 Elasticsearch
+# Elasticsearch连接地址
 spring.elasticsearch.uris=http://192.168.1.174:9200
-# 配置 Elasticsearch 用户名
+# 配置 Elasticsearch 用户名
 spring.elasticsearch.username=CONTAINER_NAME
-# 配置 Elasticsearch 密码
+# 配置 Elasticsearch 密码
 spring.elasticsearch.password=t2NZCiajmdazxBrF
-# 连接超时时间
+# 连接超时时间
 spring.elasticsearch.connection-timeout=10s
-# Socket 超时时间
+# Socket 超时时间
 spring.elasticsearch.socket-timeout=30s
 
 
-# ETL配置
+# ETL配置
 etl.batch.page-size=1000
 etl.batch.insert-batch-size=500
 etl.schedule.cron=0 0 2 * * ?
@@ -137,15 +137,14 @@ spring.datasource.hikari.minimum-idle=5
 spring.datasource.hikari.connection-timeout=30000
 spring.datasource.hikari.idle-timeout=600000
 spring.datasource.hikari.max-lifetime=900000
-spring.datasource.hikari.connection-test-query=SELECT 1
+spring.datasource.hikari.connection-test-query=SELECT 1 FROM DUAL
 spring.datasource.hikari.validation-timeout=5000
 spring.datasource.hikari.leak-detection-threshold=30000          
 spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
 spring.datasource.hikari.auto-commit=false
-spring.datasource.hikari.schema=public
 
 
-# 关联分析规则配置
+# 关联分析规则配置
 analysis.realtime.enabled= true
-# 检查间隔（秒） - 默认10秒
+# 检查间隔（秒） - 默认10秒
 analysis.realtime.check-interval-seconds: 10

haobang-security-dm/syslog-consumer-rule/src/main/resources/application-prod.properties

@@ -17,15 +17,15 @@ syslog.buffer.size=1000
 syslog.sm4.generateKey=f79548ab6fa8a304fc0115e17230358a
 
 # InfluxDB 2.7 Configuration
-influxdb.url=http://192.168.4.26:8087
-influxdb.token=LFjXZyRxTf1V84oN-wwjhSjS4qIK-ZMoHzQJB67ir3qHNSBVJbMcTkPuNmM0cNxvzFEDWLYNzrz1VJKMitY5hw==
+influxdb.url=http://192.168.4.99:8087
+influxdb.token=JsUyvU8vhQEFlMM_el4Drm87fyh707IhwJNsPBucPghSdbVmdQ-UvmPcyP5NTzWxsRfEz0T51Rw4ebZUuUrmZg==
 influxdb.org=influxdb
 influxdb.bucket=yelangbucket
 influxdb.batch.size=1000
 influxdb.flush.interval=1000
 influxdb.retry.attempts=3
 influxdb.retry.delay=1000
-# InfluxDB 2.7 连接超时配置
+# InfluxDB 2.7 连接超时配置
 influxdb.connection.timeout=30s
 influxdb.connection.read-timeout=30s
 influxdb.connection.write-timeout=60s
@@ -35,15 +35,15 @@ app.max.queue.size=10000
 app.metrics.enabled=true
 
 #database Configuration
-spring.datasource.url=jdbc:postgresql://192.168.4.26:5432/ecosys
-spring.datasource.username=postgres
+spring.datasource.url=jdbc:dm://192.163.4.99:5237
+spring.datasource.username=SYSDBA
 spring.datasource.password=caZ2TcmXNSW8L2Ap
-spring.datasource.driver-class-name=org.postgresql.Driver
-
+spring.datasource.driver-class-name=dm.jdbc.driver.DmDriver
+spring.datasource.hikari.schema=\"PUBLIC\"
 # mybatis Configuration
 mybatis.mapper-locations=classpath:mapper/*.xml
 mybatis.type-aliases-package=com.common.entity
-#mybatis handler 类
+#mybatis handler 类
 mybatis.configuration.default-statement-timeout=30
 mybatis.configuration.default-fetch-size=1000
 mybatis.configuration.map-underscore-to-camel-case=true
@@ -53,7 +53,7 @@ mybatis-plus.type-handlers-package=com.Modules.etl.handler
 
 # kafka Configuration
 spring.kafka.consumer.bootstrap-servers=192.168.4.26:9092
-spring.kafka.consumer.group-id=agent-01-syslog-group
+spring.kafka.consumer.group-id=agent-01-syslog-group-dm
 spring.kafka.consumer.auto-offset-reset=latest
 spring.kafka.consumer.enable-auto-commit=false 
 spring.kafka.consumer.auto-commit-interval=1000
@@ -70,24 +70,24 @@ spring.kafka.listener.concurrency= 2
 spring.kafka.listener.type=batch
 
 
-# 定时任务配置
+# 定时任务配置
 spring.task.scheduling.pool.size=10
 
-# 日志配置
+# 日志配置
 logging.level.com.common.schedule=INFO
 logging.level.com.common.service=INFO
 
-# 分区表检查配置
+# 分区表检查配置
 partition.check.tomorrow.enabled=true
 partition.check.future.days=7
 partition.auto.create=true
 
 
-# 生产环境缓存配置
-spring.redis.host=192.168.4.26
+# 生产环境缓存配置
+spring.redis.host=192.168.4.99
 spring.redis.port=6379
-# 密码（如果没有设置密码，可以省略）
-spring.redis.password=123456
+# 密码（如果没有设置密码，可以省略）
+spring.redis.password=redis_GdGWte
 spring.redis.database=0
 spring.redis.timeout=5000
 #spring.redis.password=${REDIS_PASSWORD:default_prod_password}
@@ -97,10 +97,10 @@ spring.redis.lettuce.pool.max-wait=5000
 spring.redis.lettuce.pool.max-idle=10
 spring.redis.lettuce.pool.min-idle=5
 
-# 生产环境缓存时间较长
+# 生产环境缓存时间较长
 spring.cache.redis.time-to-live=3600000
 
-# 应用处理器配置
+# 应用处理器配置
 app.processor.thread-pool.core-pool-size=10
 app.processor.thread-pool.max-pool-size=20
 app.processor.thread-pool.queue-capacity=2000
@@ -108,7 +108,7 @@ app.processor.thread-pool.keep-alive-seconds=60
 app.processor.batch-size=100
 app.processor.process-timeout-ms=30000
 
-# ETL配置
+# ETL配置
 etl.batch.page-size=1000
 etl.batch.insert-batch-size=500
 etl.schedule.cron=0 0 2 * * ?
@@ -121,9 +121,8 @@ spring.datasource.hikari.minimum-idle=5
 spring.datasource.hikari.connection-timeout=30000
 spring.datasource.hikari.idle-timeout=600000
 spring.datasource.hikari.max-lifetime=900000
-spring.datasource.hikari.connection-test-query=SELECT 1
+spring.datasource.hikari.connection-test-query=SELECT 1 FROM DUAL
 spring.datasource.hikari.validation-timeout=5000
 spring.datasource.hikari.leak-detection-threshold=30000          
-spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
-spring.datasource.hikari.auto-commit=false
-spring.datasource.hikari.schema=public
+spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer-rule
+spring.datasource.hikari.auto-commit=false

haobang-security-dm/syslog-consumer-rule/src/main/resources/application-test.properties

@@ -33,10 +33,11 @@ app.metrics.enabled=true
 
 
 #database Configuration
-spring.datasource.url=jdbc:postgresql://192.168.4.32:5432/ecosys
-spring.datasource.username=user_eSER8N
-spring.datasource.password=password_QCYKj6
-spring.datasource.driver-class-name=org.postgresql.Driver
+spring.datasource.url=jdbc:dm://192.163.4.99:5237/DM_ecosys
+spring.datasource.username=SYSDBA
+spring.datasource.password=caZ2TcmXNSW8L2Ap
+spring.datasource.driver-class-name=dm.jdbc.driver.DmDriver
+spring.datasource.hikari.schema=\"PUBLIC\"
 
 # mybatis Configuration
 mybatis.mapper-locations=classpath:mapper/*.xml
@@ -54,23 +55,23 @@ spring.kafka.consumer.topic=agent-syslog-topic
 
 
 
-# 定时任务配置
+# 定时任务配置
 spring.task.scheduling.pool.size=10
 
-# 日志配置
+# 日志配置
 logging.level.com.common.schedule=INFO
 logging.level.com.common.service=INFO
 
-# 分区表检查配置
+# 分区表检查配置
 partition.check.tomorrow.enabled=true
 partition.check.future.days=7
 partition.auto.create=true
 
 
-# 生产环境缓存配置
+# 生产环境缓存配置
 spring.redis.host=192.168.4.32
 spring.redis.port=6379
-# 密码（如果没有设置密码，可以省略）
+# 密码（如果没有设置密码，可以省略）
 spring.redis.password=redis_edP6N6
 spring.redis.database=0
 spring.redis.timeout=5000
@@ -81,5 +82,5 @@ spring.redis.lettuce.pool.max-wait=5000
 spring.redis.lettuce.pool.max-idle=10
 spring.redis.lettuce.pool.min-idle=5
 
-# 生产环境缓存时间较长
+# 生产环境缓存时间较长
 spring.cache.redis.time-to-live=3600000

haobang-security-dm/syslog-consumer-rule/src/main/resources/application.properties

@@ -17,15 +17,15 @@ syslog.buffer.size=1000
 syslog.sm4.generateKey=f79548ab6fa8a304fc0115e17230358a
 
 # InfluxDB 2.7 Configuration
-influxdb.url=http://192.168.4.26:8087
-influxdb.token=LFjXZyRxTf1V84oN-wwjhSjS4qIK-ZMoHzQJB67ir3qHNSBVJbMcTkPuNmM0cNxvzFEDWLYNzrz1VJKMitY5hw==
+influxdb.url=http://192.168.4.99:8087
+influxdb.token=JsUyvU8vhQEFlMM_el4Drm87fyh707IhwJNsPBucPghSdbVmdQ-UvmPcyP5NTzWxsRfEz0T51Rw4ebZUuUrmZg==
 influxdb.org=influxdb
 influxdb.bucket=yelangbucket
 influxdb.batch.size=1000
 influxdb.flush.interval=1000
 influxdb.retry.attempts=3
 influxdb.retry.delay=1000
-# InfluxDB 2.7 连接超时配置
+# InfluxDB 2.7 连接超时配置
 influxdb.connection.timeout=30s
 influxdb.connection.read-timeout=30s
 influxdb.connection.write-timeout=60s
@@ -35,15 +35,15 @@ app.max.queue.size=10000
 app.metrics.enabled=true
 
 #database Configuration
-spring.datasource.url=jdbc:postgresql://192.168.4.26:5432/ecosys
-spring.datasource.username=postgres
+spring.datasource.url=jdbc:dm://192.168.4.99:5237
+spring.datasource.username=SYSDBA
 spring.datasource.password=caZ2TcmXNSW8L2Ap
-spring.datasource.driver-class-name=org.postgresql.Driver
-
+spring.datasource.driver-class-name=dm.jdbc.driver.DmDriver
+spring.datasource.hikari.schema=\"PUBLIC\"
 # mybatis Configuration
 mybatis.mapper-locations=classpath:mapper/*.xml
 mybatis.type-aliases-package=com.common.entity
-#mybatis handler 类
+#mybatis handler 类
 mybatis.configuration.default-statement-timeout=30
 mybatis.configuration.default-fetch-size=1000
 mybatis.configuration.map-underscore-to-camel-case=true
@@ -53,7 +53,7 @@ mybatis-plus.type-handlers-package=com.Modules.etl.handler
 
 # kafka Configuration
 spring.kafka.consumer.bootstrap-servers=192.168.4.26:9092
-spring.kafka.consumer.group-id=agent-01-syslog-group
+spring.kafka.consumer.group-id=agent-01-syslog-group-dm
 spring.kafka.consumer.auto-offset-reset=latest
 spring.kafka.consumer.enable-auto-commit=false 
 spring.kafka.consumer.auto-commit-interval=1000
@@ -70,24 +70,24 @@ spring.kafka.listener.concurrency= 2
 spring.kafka.listener.type=batch
 
 
-# 定时任务配置
+# 定时任务配置
 spring.task.scheduling.pool.size=10
 
-# 日志配置
+# 日志配置
 logging.level.com.common.schedule=INFO
 logging.level.com.common.service=INFO
 
-# 分区表检查配置
+# 分区表检查配置
 partition.check.tomorrow.enabled=true
 partition.check.future.days=7
 partition.auto.create=true
 
 
-# 生产环境缓存配置
-spring.redis.host=192.168.4.26
+# 生产环境缓存配置
+spring.redis.host=192.168.4.99
 spring.redis.port=6379
-# 密码（如果没有设置密码，可以省略）
-spring.redis.password=123456
+# 密码（如果没有设置密码，可以省略）
+spring.redis.password=redis_GdGWte
 spring.redis.database=0
 spring.redis.timeout=5000
 #spring.redis.password=${REDIS_PASSWORD:default_prod_password}
@@ -97,10 +97,10 @@ spring.redis.lettuce.pool.max-wait=5000
 spring.redis.lettuce.pool.max-idle=10
 spring.redis.lettuce.pool.min-idle=5
 
-# 生产环境缓存时间较长
+# 生产环境缓存时间较长
 spring.cache.redis.time-to-live=3600000
 
-# 应用处理器配置
+# 应用处理器配置
 app.processor.thread-pool.core-pool-size=10
 app.processor.thread-pool.max-pool-size=20
 app.processor.thread-pool.queue-capacity=2000
@@ -108,7 +108,7 @@ app.processor.thread-pool.keep-alive-seconds=60
 app.processor.batch-size=100
 app.processor.process-timeout-ms=30000
 
-# ETL配置
+# ETL配置
 etl.batch.page-size=1000
 etl.batch.insert-batch-size=500
 etl.schedule.cron=0 0 2 * * ?
@@ -121,9 +121,8 @@ spring.datasource.hikari.minimum-idle=5
 spring.datasource.hikari.connection-timeout=30000
 spring.datasource.hikari.idle-timeout=600000
 spring.datasource.hikari.max-lifetime=900000
-spring.datasource.hikari.connection-test-query=SELECT 1
+spring.datasource.hikari.connection-test-query=SELECT 1 FROM DUAL
 spring.datasource.hikari.validation-timeout=5000
 spring.datasource.hikari.leak-detection-threshold=30000          
-spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
-spring.datasource.hikari.auto-commit=false
-spring.datasource.hikari.schema=public
+spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer-rule
+spring.datasource.hikari.auto-commit=false

haobang-security-dm/syslog-consumer-rule/src/main/resources/logback.xml

@@ -7,9 +7,9 @@
     </appender>
 
     <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
-        <file>logs/syslog-consumer-rule.log</file>
+        <file>logs/syslog-consumer-rule-dm.log</file>
         <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
-            <fileNamePattern>logs/syslog-consumer-rule.%d{yyyy-MM-dd}.log</fileNamePattern>
+            <fileNamePattern>logs/syslog-consumer-rule-dm.%d{yyyy-MM-dd}.log</fileNamePattern>
 
             <!-- 保留的日志文件的最大天数 -->
             <maxHistory>1</maxHistory>

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/AnalysisAnalysisRuleMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.AnalysisAnalysisRuleMapper">
 
@@ -53,7 +53,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_analysis_rule
-        WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id =#{ruleId, jdbcType=OTHER}
         AND del_flag = '0'
     </select>
 
@@ -62,7 +62,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_analysis_rule
-        WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id = #{ruleId, jdbcType=OTHER}
         AND del_flag = '0'
     </select>
 
@@ -70,11 +70,11 @@
     <update id="updateTaskStatus">
         UPDATE analysis_analysis_rule
         SET task_status = #{taskStatus},
-            update_time = NOW()
+            update_time = SYSDATE
         <if test="updateBy != null">
             ,update_by = #{updateBy}
         </if>
-        WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id = #{ruleId, jdbcType=OTHER}
     </update>
 
 </mapper>

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/AnalysisFieldMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.AnalysisFieldMapper">
 
@@ -42,7 +42,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_field
-        WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id = #{ruleId, jdbcType=OTHER}
         AND del_flag = '0'
         ORDER BY id ASC
     </select>
@@ -52,7 +52,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_field
-        WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id =#{ruleId, jdbcType=OTHER}
         AND del_flag = '0'
         AND type IN ('measure', 'calc')
         ORDER BY id ASC
@@ -63,7 +63,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_field
-        WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id = #{ruleId, jdbcType=OTHER}
         AND del_flag = '0'
         AND type = 'dimension'
         ORDER BY id ASC

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/AnalysisFilterMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.AnalysisFilterMapper">
 
@@ -13,9 +13,9 @@
         <result column="column_desc" property="columnDesc" jdbcType="VARCHAR"/>
         <result column="data_type" property="dataType" jdbcType="VARCHAR"/>
         <result column="fn" property="fn" jdbcType="VARCHAR"/>
-        <result column="arguments" property="arguments" jdbcType="OTHER"/>
+        <result column="arguments" property="arguments" jdbcType="VARCHAR"/>
         <result column="operator" property="operator" jdbcType="VARCHAR"/>
-        <result column="value" property="value" jdbcType="OTHER"/>
+        <result column="value" property="value" jdbcType="VARCHAR"/>
         <result column="base_type" property="baseType" jdbcType="INTEGER"/>
         <result column="category_id" property="categoryId" jdbcType="INTEGER"/>
         <result column="create_dept" property="createDept" jdbcType="BIGINT"/>
@@ -42,7 +42,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_filter
-        WHERE rule_id  =#{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id  =#{ruleId, jdbcType=OTHER}
         AND del_flag = '0'
     </select>
 

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/AnalysisGroupByColumnMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.AnalysisGroupByColumnMapper">
 
@@ -44,7 +44,7 @@
         create_time, update_time, create_by, update_by, remark,
         tenant_id, rule_id, group_id, field_id, sort
         FROM analysis_group_by_column
-        WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id =#{ruleId, jdbcType=OTHER}
         AND del_flag = '0'
         ORDER BY sort ASC
     </select>

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/AnalysisGroupByHavingMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.AnalysisGroupByHavingMapper">
 
@@ -13,9 +13,9 @@
         <result column="column_desc" property="columnDesc" jdbcType="VARCHAR"/>
         <result column="data_type" property="dataType" jdbcType="VARCHAR"/>
         <result column="fn" property="fn" jdbcType="VARCHAR"/>
-        <result column="arguments" property="arguments" jdbcType="OTHER"/>
+        <result column="arguments" property="arguments" jdbcType="VARCHAR"/>
         <result column="operator" property="operator" jdbcType="VARCHAR"/>
-        <result column="value" property="value" jdbcType="OTHER"/>
+        <result column="value" property="value" jdbcType="VARCHAR"/>
         <result column="base_type" property="baseType" jdbcType="INTEGER"/>
         <result column="category_id" property="categoryId" jdbcType="INTEGER"/>
         <result column="create_dept" property="createDept" jdbcType="BIGINT"/>
@@ -53,7 +53,7 @@
         h.update_time, h.create_by, h.update_by, h.remark, h.tenant_id
         FROM analysis_group_by_having h
         INNER JOIN analysis_group_by g ON h.group_by_id = g.id
-        WHERE g.rule_id =#{ruleId, jdbcType=OTHER}::uuid
+        WHERE g.rule_id =#{ruleId, jdbcType=OTHER}
         AND h.del_flag = '0'
         AND g.del_flag = '0'
         ORDER BY h.id ASC

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/AnalysisGroupByMapper.xml

@@ -1,10 +1,10 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.AnalysisGroupByMapper">
 
     <resultMap id="BaseResultMap" type="com.common.entity.AnalysisGroupBy">
         <id column="id" property="id" jdbcType="BIGINT"/>
-        <result column="rule_id" property="ruleId" jdbcType="OTHER"/>
+        <result column="rule_id" property="ruleId" jdbcType="VARCHAR"/>
         <result column="group_type" property="groupType" jdbcType="INTEGER"/>
         <result column="window_type" property="windowType" jdbcType="VARCHAR"/>
         <result column="create_dept" property="createDept" jdbcType="BIGINT"/>
@@ -33,7 +33,7 @@
         SELECT
             <include refid="Base_Column_List"/>
         FROM analysis_group_by
-        WHERE rule_id = #{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id = #{ruleId, jdbcType=OTHER}
           AND del_flag = '0'
     </select>
 

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/AnalysisTaskHistoryMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.AnalysisTaskHistoryMapper">
 
@@ -33,7 +33,7 @@
         INSERT INTO analysis_task_history (
         <include refid="Base_Column_List"/>
         ) VALUES (
-        #{id}, #{ruleId}::uuid, #{startTime}, #{endTime}, #{durationTime}, #{progressPercent},
+        #{id}, #{ruleId}, #{startTime}, #{endTime}, #{durationTime}, #{progressPercent},
         #{inputCount}, #{outputCount}, #{status}, #{createDept}, #{delFlag},
         #{createTime}, #{updateTime}, #{createBy}, #{updateBy}, #{remark}, #{tenantId}
         )
@@ -48,7 +48,7 @@
         input_count = #{inputCount},
         output_count = #{outputCount},
         status = #{status},
-        update_time = NOW()
+        update_time = SYSDATE
         <if test="remark != null">
             ,remark = #{remark}
         </if>
@@ -60,7 +60,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_task_history
-        WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id =#{ruleId, jdbcType=OTHER}
         AND del_flag = '0'
         ORDER BY create_time DESC
         <if test="limit != null and limit > 0">
@@ -73,7 +73,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_task_history
-        WHERE rule_id =#{ruleId, jdbcType=OTHER}::uuid
+        WHERE rule_id =#{ruleId, jdbcType=OTHER}
         AND status = #{status}
         AND del_flag = '0'
         ORDER BY create_time DESC

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/AnalysisWhereConditionMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.AnalysisWhereConditionMapper">
 
@@ -29,7 +29,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_where_condition
-        WHERE rule_id = #{ruleId}::uuid
+        WHERE rule_id = #{ruleId}
         AND del_flag = '0'
         ORDER BY seq_num ASC
     </select>
@@ -39,7 +39,7 @@
         SELECT
         <include refid="Base_Column_List"/>
         FROM analysis_where_condition
-        WHERE rule_id = #{ruleId}::uuid
+        WHERE rule_id = #{ruleId}
         AND (parent_cond_id IS NULL OR parent_cond_id = 0)
         AND del_flag = '0'
         ORDER BY seq_num ASC

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/DeviceDeviceMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8" ?>
+<?xml version="1.0" encoding="UTF-8" ?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 
@@ -46,11 +46,11 @@
 
     <!-- 基础查询列 -->
     <sql id="Base_Column_List">
-        id, created_at::timestamp , updated_at::timestamp, deleted_at::timestamp, name, ip, device_group, device_type,
-        vendor, product_name, organization_id, last_receive_time::timestamp, agent_id, detail_id,
-        control_agent_id, license_start_time::timestamp, license_end_time::timestamp, is_monitoring,
+        id, created_at , updated_at, deleted_at, name, ip, device_group, device_type,
+        vendor, product_name, organization_id, last_receive_time, agent_id, detail_id,
+        control_agent_id, license_start_time, license_end_time, is_monitoring,
         security_scope_id, owner_id, ssh_config_id, status, created_by_id, decode_type,
-        miss_policy, tenant_id, create_time::timestamp, update_time::timestamp, create_by, update_by, del_flag,
+        miss_policy, tenant_id, create_time, update_time, create_by, update_by, del_flag,
         manager_name, today_parse_count, today_non_log_count, create_dept, device_collect_id
     </sql>
 

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/DeviceReceiveLogMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8" ?>
+<?xml version="1.0" encoding="UTF-8" ?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.DeviceReceiveLogMapper">
@@ -26,10 +26,10 @@
             receive_time_str,
             syslog_message
         ) VALUES (
-            COALESCE(#{createdAt}, NOW() AT TIME ZONE 'utc'),
+            COALESCE(#{createdAt}, SYSDATE),
             #{deviceCollectId},
             #{deviceId},
-            #{deviceIp}::inet,
+            #{deviceIp},
             #{receiveTime},
             #{receiveTimeStr},
             #{syslogMessage}
@@ -49,10 +49,10 @@
         ) VALUES
         <foreach collection="list" item="item" separator=",">
             (
-            COALESCE(#{item.createdAt}, NOW() AT TIME ZONE 'utc'),
+            COALESCE(#{item.createdAt}, SYSDATE),
             #{item.deviceCollectId},
             #{item.deviceId},
-            #{item.deviceIp}::inet,
+            #{item.deviceIp},
             #{item.receiveTime},
             #{item.receiveTimeStr},
             #{item.syslogMessage}
@@ -80,10 +80,10 @@
         ORDER BY receive_time DESC
     </select>
 
-    <!-- 根据IP地址查询（使用PostgreSQL的inet操作符） -->
+    <!-- 根据IP地址查询（） -->
     <select id="selectByDeviceIp" resultMap="BaseResultMap">
         SELECT * FROM device_receive_log
-        WHERE device_ip >>= #{deviceIp}::inet
+        WHERE device_ip = #{deviceIp}
         ORDER BY receive_time DESC
     </select>
 
@@ -105,7 +105,7 @@
                 AND device_collect_id = #{deviceCollectId}
             </if>
             <if test="deviceIp != null and deviceIp != ''">
-                AND device_ip >>= #{deviceIp}::inet
+                AND device_ip = #{deviceIp}
             </if>
             <if test="receiveTime != null">
                 AND receive_time >= #{receiveTime}
@@ -128,7 +128,7 @@
                 AND device_collect_id = #{deviceCollectId}
             </if>
             <if test="deviceIp != null and deviceIp != ''">
-                AND device_ip >>= #{deviceIp}::inet
+                AND device_ip = #{deviceIp}
             </if>
             <if test="receiveTime != null">
                 AND receive_time >= #{receiveTime}

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/DmColumnMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8" ?>
+<?xml version="1.0" encoding="UTF-8" ?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 
@@ -65,13 +65,13 @@
 
 
     <select id="findById" parameterType="java.lang.Long" resultMap="BaseResultMap">
-         SELECT Id, created_at::timestamp as created_at ,
-          updated_at::timestamp as updated_at , deleted_at::timestamp as deleted_at , name, display_name,
+         SELECT Id, created_at as created_at ,
+          updated_at as updated_at , deleted_at as deleted_at , name, display_name,
         storage_data_type, business_data_type, is_built_in, is_hidden,
         is_not_normalizable, is_required, category_id, custom_asset_category_id,
         is_virtual, table_id, asset_table_id, column_set_id, base_type,
-        user_task_id, created_by_id, create_dept, create_by, create_time::timestamp as create_time ,
-        update_by, update_time::timestamp as update_time
+        user_task_id, created_by_id, create_dept, create_by, create_time as create_time ,
+        update_by, update_time as update_time
          FROM dm_column
         WHERE   id = #{id} AND deleted_at IS NULL
     </select>
@@ -80,13 +80,13 @@
     <!-- 查询全部正常字段-->
 
     <select id="selectAllNormal" parameterType="java.lang.Long" resultType="java.util.LinkedHashMap">
-     SELECT Id, created_at::timestamp as created_at ,
-          updated_at::timestamp as updated_at , deleted_at::timestamp as deleted_at , name, display_name,
+     SELECT Id, created_at as created_at ,
+          updated_at as updated_at , deleted_at as deleted_at , name, display_name,
         storage_data_type, business_data_type, is_built_in, is_hidden,
         is_not_normalizable, is_required, category_id, custom_asset_category_id,
         is_virtual, table_id, asset_table_id, column_set_id, base_type,
-        user_task_id, created_by_id, create_dept, create_by, create_time::timestamp as create_time ,
-        update_by, update_time::timestamp as update_time
+        user_task_id, created_by_id, create_dept, create_by, create_time as create_time ,
+        update_by, update_time as update_time
          FROM dm_column
     where  deleted_at is  null and id  in ( select  distinct column_id  from dm_field_table_column  where   deleted_at is null
     )

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/DmNormalizeRuleMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8" ?>
+<?xml version="1.0" encoding="UTF-8" ?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.DmNormalizeRuleMapper">
 
@@ -16,7 +16,7 @@
         <result column="data_type" property="dataType" />
         <result column="field_cate_id" property="fieldCateId" />
         <result column="log_parsed" property="logParsed" />
-        <result column="sample_logs" property="sampleLogs" typeHandler="org.apache.ibatis.type.ArrayTypeHandler" />
+        <result column="sample_logs" property="sampleLogs" typeHandler="com.Modules.etl.handler.ArrayStringTypeHandler" />
         <result column="is_data_merge_enabled" property="isDataMergeEnabled" />
         <result column="data_merge_interval" property="dataMergeInterval" />
         <result column="data_merge_time_unit" property="dataMergeTimeUnit" />
@@ -51,12 +51,12 @@
 
         SELECT
         id,
-        created_at::timestamp as created_at,  <!-- 转换为 timestamp -->
-        updated_at::timestamp as updated_at,
-        deleted_at::timestamp as deleted_at,
-        first_data_saved_at::timestamp as first_data_saved_at,
-        create_time::timestamp as create_time,
-        update_time::timestamp as update_time,
+        created_at as created_at,  
+        updated_at as updated_at,
+        deleted_at as deleted_at,
+        first_data_saved_at as first_data_saved_at,
+        create_time as create_time,
+        update_time as update_time,
         name, display_name, description, is_built_in, is_running,
         data_type, field_cate_id, log_parsed, sample_logs,
         is_data_merge_enabled, data_merge_interval, data_merge_time_unit,
@@ -74,12 +74,12 @@
 
         SELECT
         id,
-        created_at::timestamp as created_at,  <!-- 转换为 timestamp -->
-        updated_at::timestamp as updated_at,
-        deleted_at::timestamp as deleted_at,
-        first_data_saved_at::timestamp as first_data_saved_at,
-        create_time::timestamp as create_time,
-        update_time::timestamp as update_time,
+        created_at as created_at,  
+        updated_at as updated_at,
+        deleted_at as deleted_at,
+        first_data_saved_at as first_data_saved_at,
+        create_time as create_time,
+        update_time as update_time,
         name, display_name, description, is_built_in, is_running,
         data_type, field_cate_id, log_parsed, sample_logs,
         is_data_merge_enabled, data_merge_interval, data_merge_time_unit,
@@ -113,7 +113,7 @@
             <if test="dataType != null">data_type = #{dataType},</if>
             <if test="fieldCateId != null">field_cate_id = #{fieldCateId},</if>
             <if test="logParsed != null">log_parsed = #{logParsed},</if>
-            <if test="sampleLogs != null">sample_logs = #{sampleLogs, typeHandler=org.apache.ibatis.type.ArrayTypeHandler},</if>
+            <if test="sampleLogs != null">sample_logs = #{sampleLogs, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler},</if>
             <if test="isDataMergeEnabled != null">is_data_merge_enabled = #{isDataMergeEnabled},</if>
             <if test="dataMergeInterval != null">data_merge_interval = #{dataMergeInterval},</if>
             <if test="dataMergeTimeUnit != null">data_merge_time_unit = #{dataMergeTimeUnit},</if>
@@ -142,7 +142,7 @@
             <if test="dataType != null">data_type = #{dataType},</if>
             <if test="fieldCateId != null">field_cate_id = #{fieldCateId},</if>
             <if test="logParsed != null">log_parsed = #{logParsed},</if>
-            <if test="sampleLogs != null">sample_logs = #{sampleLogs, typeHandler=org.apache.ibatis.type.ArrayTypeHandler},</if>
+            <if test="sampleLogs != null">sample_logs = #{sampleLogs, typeHandler=com.Modules.etl.handler.ArrayStringTypeHandler},</if>
             <if test="isDataMergeEnabled != null">is_data_merge_enabled = #{isDataMergeEnabled},</if>
             <if test="dataMergeInterval != null">data_merge_interval = #{dataMergeInterval},</if>
             <if test="dataMergeTimeUnit != null">data_merge_time_unit = #{dataMergeTimeUnit},</if>

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/SyslogNonNormalMessageMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8"?>
+<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.SyslogNonNormalMessageMapper">
 
@@ -118,7 +118,7 @@
         WHERE del_flag = '0'
         AND (
         <foreach collection="ids" item="id" index="index" separator=" OR ">
-            (id = #{id} AND created_at = #{createdAts[${index}]}::timestamptz)
+            (id = #{id} AND created_at = #{createdAts[${index}]}tz)
         </foreach>
         )
     </select>
@@ -137,7 +137,7 @@
     <update id="updateBatchDelFlag">
         UPDATE syslog_non_normal_message
         SET del_flag = '1',
-        update_time = NOW()
+        update_time = SYSDATE
         WHERE id IN
         <foreach collection="messages" item="item" open="(" separator="," close=")">
             #{item.id}

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/SyslogNormalAlarmMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8" ?>
+<?xml version="1.0" encoding="UTF-8" ?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.SyslogNormalAlarmMapper">
@@ -406,9 +406,9 @@
             <if test="dataMap.container_name != null">#{dataMap.container_name},</if>
             <if test="dataMap.container_id != null">#{dataMap.container_id},</if>
             <if test="dataMap.http_resp_server != null">#{dataMap.http_resp_server},</if>
-            <if test="dataMap.srcip_id != null">#{dataMap.srcip_id}::int8,</if>
-            <if test="dataMap.cdnip != null">#{dataMap.cdnip}::inet,</if>
-            <if test="dataMap.natip != null">#{dataMap.natip}::inet,</if>
+            <if test="dataMap.srcip_id != null">#{dataMap.srcip_id},</if>
+            <if test="dataMap.cdnip != null">#{dataMap.cdnip},</if>
+            <if test="dataMap.natip != null">#{dataMap.natip},</if>
             <if test="dataMap.mail_sender != null">#{dataMap.mail_sender},</if>
             <if test="dataMap.mail_receiver != null">#{dataMap.mail_receiver},</if>
             <if test="dataMap.vpn_mac != null">#{dataMap.vpn_mac},</if>
@@ -439,8 +439,8 @@
             <if test="dataMap.print_time != null">#{dataMap.print_time},</if>
             <if test="dataMap.printer != null">#{dataMap.printer},</if>
             <if test="dataMap.printer_type != null">#{dataMap.printer_type},</if>
-            <if test="dataMap.print_pages != null">#{dataMap.print_pages}::int8,</if>
-            <if test="dataMap.print_copies != null">#{dataMap.print_copies}::int8,</if>
+            <if test="dataMap.print_pages != null">#{dataMap.print_pages},</if>
+            <if test="dataMap.print_copies != null">#{dataMap.print_copies},</if>
             <if test="dataMap.src_device != null">#{dataMap.src_device},</if>
             <if test="dataMap.dst_device != null">#{dataMap.dst_device},</if>
             <if test="dataMap.src_file != null">#{dataMap.src_file},</if>
@@ -457,18 +457,18 @@
             <if test="dataMap.env != null">#{dataMap.env},</if>
             <if test="dataMap.brute_force_service != null">#{dataMap.brute_force_service},</if>
             <if test="dataMap.vuirs_name != null">#{dataMap.vuirs_name},</if>
-            <if test="dataMap.http_req_length != null">#{dataMap.http_req_length}::int8,</if>
+            <if test="dataMap.http_req_length != null">#{dataMap.http_req_length},</if>
             <if test="dataMap.http_req_content_type != null">#{dataMap.http_req_content_type},</if>
-            <if test="dataMap.tc_scan_port != null">#{dataMap.tc_scan_port}::inet,</if>
-            <if test="dataMap.tc_labels != null">#{dataMap.tc_labels}::inet,</if>
+            <if test="dataMap.tc_scan_port != null">#{dataMap.tc_scan_port},</if>
+            <if test="dataMap.tc_labels != null">#{dataMap.tc_labels},</if>
             <if test="dataMap.http_resp_content_type != null">#{dataMap.http_resp_content_type},</if>
             <if test="dataMap.dns_msg_type != null">#{dataMap.dns_msg_type},</if>
             <if test="dataMap.dns_answer_length != null">#{dataMap.dns_answer_length},</if>
             <if test="dataMap.dns_ioc != null">#{dataMap.dns_ioc},</if>
-            <if test="dataMap.tx_bytes != null">#{dataMap.tx_bytes}::double precision,</if>
-            <if test="dataMap.rx_bytes != null">#{dataMap.rx_bytes}::double precision,</if>
-            <if test="dataMap.all_bytes != null">#{dataMap.all_bytes}::double precision,</if>
-            <if test="dataMap.duration_time != null">#{dataMap.duration_time}::int8,</if>
+            <if test="dataMap.tx_bytes != null">#{dataMap.tx_bytes},</if>
+            <if test="dataMap.rx_bytes != null">#{dataMap.rx_bytes},</if>
+            <if test="dataMap.all_bytes != null">#{dataMap.all_bytes},</if>
+            <if test="dataMap.duration_time != null">#{dataMap.duration_time},</if>
             <if test="dataMap.mail_attach_name != null">#{dataMap.mail_attach_name},</if>
             <if test="dataMap.mail_subject != null">#{dataMap.mail_subject},</if>
             <if test="dataMap.mail_message != null">#{dataMap.mail_message},</if>
@@ -488,27 +488,27 @@
             <if test="dataMap.src_ip_apt != null">#{dataMap.src_ip_apt},</if>
             <if test="dataMap.srcip_name != null">#{dataMap.srcip_name},</if>
             <if test="dataMap.tc_client != null">#{dataMap.tc_client},</if>
-            <if test="dataMap.srcip_organization_id != null">#{dataMap.srcip_organization_id}::int8,</if>
+            <if test="dataMap.srcip_organization_id != null">#{dataMap.srcip_organization_id},</if>
             <if test="dataMap.dest_ip_intranetip != null">#{dataMap.dest_ip_intranetip},</if>
             <if test="dataMap.dest_ip_ioc != null">#{dataMap.dest_ip_ioc},</if>
-            <if test="dataMap.desip_id != null">#{dataMap.desip_id}::int8,</if>
+            <if test="dataMap.desip_id != null">#{dataMap.desip_id},</if>
             <if test="dataMap.desip_name != null">#{dataMap.desip_name},</if>
-            <if test="dataMap.tc_hostip != null">#{dataMap.tc_hostip}::inet,</if>
-            <if test="dataMap.desip_organization_id != null">#{dataMap.desip_organization_id}::int8,</if>
+            <if test="dataMap.tc_hostip != null">#{dataMap.tc_hostip},</if>
+            <if test="dataMap.desip_organization_id != null">#{dataMap.desip_organization_id},</if>
             <if test="dataMap.origin_confidence != null">#{dataMap.origin_confidence},</if>
             <if test="dataMap.origin_malscore != null">#{dataMap.origin_malscore},</if>
             <if test="dataMap.attacker_icampaign != null">#{dataMap.attacker_icampaign},</if>
-            <if test="dataMap.attacker_host_asset_id != null">#{dataMap.attacker_host_asset_id}::int8,</if>
-            <if test="dataMap.attacker_organization_id != null">#{dataMap.attacker_organization_id}::int8,</if>
-            <if test="dataMap.victim_host_asset_id != null">#{dataMap.victim_host_asset_id}::int8,</if>
-            <if test="dataMap.victim_organization_id != null">#{dataMap.victim_organization_id}::int8,</if>
+            <if test="dataMap.attacker_host_asset_id != null">#{dataMap.attacker_host_asset_id},</if>
+            <if test="dataMap.attacker_organization_id != null">#{dataMap.attacker_organization_id},</if>
+            <if test="dataMap.victim_host_asset_id != null">#{dataMap.victim_host_asset_id},</if>
+            <if test="dataMap.victim_organization_id != null">#{dataMap.victim_organization_id},</if>
             <if test="dataMap.logout_time != null">#{dataMap.logout_time},</if>
             <if test="dataMap.http_req_line != null">#{dataMap.http_req_line},</if>
             <if test="dataMap.desip_security_scope_id != null">#{dataMap.desip_security_scope_id},</if>
             <if test="dataMap.srcip_security_scope_id != null">#{dataMap.srcip_security_scope_id},</if>
-            <if test="dataMap.http_resp_length != null">#{dataMap.http_resp_length}::int8,</if>
+            <if test="dataMap.http_resp_length != null">#{dataMap.http_resp_length},</if>
             <if test="dataMap.tc_attack_type != null">#{dataMap.tc_attack_type},</if>
-            <if test="dataMap.tc_realip != null">#{dataMap.tc_realip}::inet,</if>
+            <if test="dataMap.tc_realip != null">#{dataMap.tc_realip},</if>
             <if test="dataMap.attacker_ip_lists != null">#{dataMap.attacker_ip_lists},</if>
             <if test="dataMap.login_password != null">#{dataMap.login_password},</if>
             <if test="dataMap.detail != null">#{dataMap.detail},</if>
@@ -525,12 +525,12 @@
             <if test="dataMap.login_abnormal_type != null">#{dataMap.login_abnormal_type},</if>
             <if test="dataMap.file_tag != null">#{dataMap.file_tag},</if>
             <if test="dataMap.file_platform != null">#{dataMap.file_platform},</if>
-            <if test="dataMap.target_ip != null">#{dataMap.target_ip}::inet,</if>
+            <if test="dataMap.target_ip != null">#{dataMap.target_ip},</if>
             <if test="dataMap.collect_date != null">#{dataMap.collect_date},</if>
-            <if test="dataMap.tc_client_ip != null">#{dataMap.tc_client_ip}::inet,</if>
-            <if test="dataMap.tc_server_ip != null">#{dataMap.tc_server_ip}::inet,</if>
-            <if test="dataMap.tc_externalip != null">#{dataMap.tc_externalip}::inet,</if>
-            <if test="dataMap.http_status_code != null">#{dataMap.http_status_code}::int8,</if>
+            <if test="dataMap.tc_client_ip != null">#{dataMap.tc_client_ip},</if>
+            <if test="dataMap.tc_server_ip != null">#{dataMap.tc_server_ip},</if>
+            <if test="dataMap.tc_externalip != null">#{dataMap.tc_externalip},</if>
+            <if test="dataMap.http_status_code != null">#{dataMap.http_status_code},</if>
             <if test="dataMap.device_domian != null">#{dataMap.device_domian},</if>
             <if test="dataMap.src_ip_str != null">#{dataMap.src_ip_str},</if>
             <if test="dataMap.src_port_str != null">#{dataMap.src_port_str},</if>
@@ -576,28 +576,28 @@
             <if test="dataMap.origin_agent_name != null">#{dataMap.origin_agent_name},</if>
             <if test="dataMap.origin_work_group != null">#{dataMap.origin_work_group},</if>
             <if test="dataMap.origin_asset_group != null">#{dataMap.origin_asset_group},</if>
-            <if test="dataMap.origin_local_port != null">#{dataMap.origin_local_port}::int8,</if>
-            <if test="dataMap.origin_agent_ip != null">#{dataMap.origin_agent_ip}::inet,</if>
-            <if test="dataMap.origin_internal_ip != null">#{dataMap.origin_internal_ip}::inet,</if>
-            <if test="dataMap.origin_external_ip != null">#{dataMap.origin_external_ip}::inet,</if>
-            <if test="dataMap.origin_local_addr != null">#{dataMap.origin_local_addr}::inet,</if>
-            <if test="dataMap.agent_id != null">#{dataMap.agent_id}::int8,</if>
+            <if test="dataMap.origin_local_port != null">#{dataMap.origin_local_port},</if>
+            <if test="dataMap.origin_agent_ip != null">#{dataMap.origin_agent_ip},</if>
+            <if test="dataMap.origin_internal_ip != null">#{dataMap.origin_internal_ip},</if>
+            <if test="dataMap.origin_external_ip != null">#{dataMap.origin_external_ip},</if>
+            <if test="dataMap.origin_local_addr != null">#{dataMap.origin_local_addr},</if>
+            <if test="dataMap.agent_id != null">#{dataMap.agent_id},</if>
             <if test="dataMap.agent_name != null">#{dataMap.agent_name},</if>
             <if test="dataMap.tc_title != null">#{dataMap.tc_title},</if>
             <if test="dataMap.log_id != null">#{dataMap.log_id},</if>
             <if test="dataMap.event_date != null">#{dataMap.event_date},</if>
             <if test="dataMap.event_time_ts != null">#{dataMap.event_time_ts},</if>
-            <if test="dataMap.event_level != null">#{dataMap.event_level}::int ,</if>
-            <if test="dataMap.src_ip != null">#{dataMap.src_ip}::inet,</if>
-            <if test="dataMap.src_port != null">#{dataMap.src_port}::BIGINT ,</if>
-            <if test="dataMap.dest_ip != null">#{dataMap.dest_ip}::inet,</if>
+            <if test="dataMap.event_level != null">#{dataMap.event_level},</if>
+            <if test="dataMap.src_ip != null">#{dataMap.src_ip},</if>
+            <if test="dataMap.src_port != null">#{dataMap.src_port},</if>
+            <if test="dataMap.dest_ip != null">#{dataMap.dest_ip},</if>
             <if test="dataMap.dest_port != null">#{dataMap.dest_port}::BIGINT,</if>
             <if test="dataMap.event_time != null">#{dataMap.event_time},</if>
             <if test="dataMap.attacker_country != null">#{dataMap.attacker_country},</if>
             <if test="dataMap.src_mac != null">#{dataMap.src_mac},</if>
             <if test="dataMap.dest_mac != null">#{dataMap.dest_mac},</if>
             <if test="dataMap.proto != null">#{dataMap.proto},</if>
-            <if test="dataMap.dev_id != null">#{dataMap.dev_id}::int8,</if>
+            <if test="dataMap.dev_id != null">#{dataMap.dev_id},</if>
             <if test="dataMap.created_time != null">#{dataMap.created_time},</if>
             <if test="dataMap.src_country != null">#{dataMap.src_country},</if>
             <if test="dataMap.src_country_code != null">#{dataMap.src_country_code},</if>
@@ -621,20 +621,20 @@
             <if test="dataMap.end_time != null">#{dataMap.end_time},</if>
             <if test="dataMap.file_created_time != null">#{dataMap.file_created_time},</if>
             <if test="dataMap.file_modified_time != null">#{dataMap.file_modified_time},</if>
-            <if test="dataMap.tc_miguan_scan_port != null">#{dataMap.tc_miguan_scan_port}::inet,</if>
+            <if test="dataMap.tc_miguan_scan_port != null">#{dataMap.tc_miguan_scan_port},</if>
             <if test="dataMap.process_path != null">#{dataMap.process_path},</if>
             <if test="dataMap.parent_process_path != null">#{dataMap.parent_process_path},</if>
             <if test="dataMap.gname != null">#{dataMap.gname},</if>
             <if test="dataMap.exe_name != null">#{dataMap.exe_name},</if>
             <if test="dataMap.exe_path != null">#{dataMap.exe_path},</if>
             <if test="dataMap.login_time != null">#{dataMap.login_time},</if>
-            <if test="dataMap.login_times != null">#{dataMap.login_times}::int8,</if>
+            <if test="dataMap.login_times != null">#{dataMap.login_times},</if>
             <if test="dataMap.check_item != null">#{dataMap.check_item},</if>
             <if test="dataMap.check_type != null">#{dataMap.check_type},</if>
-            <if test="dataMap.attacker_ip != null">#{dataMap.attacker_ip}::inet,</if>
-            <if test="dataMap.attacker_port != null">#{dataMap.attacker_port}::int8,</if>
-            <if test="dataMap.victim_ip != null">#{dataMap.victim_ip}::inet,</if>
-            <if test="dataMap.victim_port != null">#{dataMap.victim_port}::int8,</if>
+            <if test="dataMap.attacker_ip != null">#{dataMap.attacker_ip},</if>
+            <if test="dataMap.attacker_port != null">#{dataMap.attacker_port},</if>
+            <if test="dataMap.victim_ip != null">#{dataMap.victim_ip},</if>
+            <if test="dataMap.victim_port != null">#{dataMap.victim_port},</if>
             <if test="dataMap.attacker_city != null">#{dataMap.attacker_city},</if>
             <if test="dataMap.attacker_lon != null">#{dataMap.attacker_lon},</if>
             <if test="dataMap.attacker_lat != null">#{dataMap.attacker_lat},</if>
@@ -660,7 +660,7 @@
             <if test="dataMap.file_ssdeep != null">#{dataMap.file_ssdeep},</if>
             <if test="dataMap.victim_country_code != null">#{dataMap.victim_country_code},</if>
             <if test="dataMap.http_xff_ip != null">#{dataMap.http_xff_ip},</if>
-            <if test="dataMap.tc_miguan_class != null">#{dataMap.tc_miguan_class}::inet,</if>
+            <if test="dataMap.tc_miguan_class != null">#{dataMap.tc_miguan_class},</if>
             <if test="dataMap.pid != null">#{dataMap.pid},</if>
             <if test="dataMap.ppid != null">#{dataMap.ppid},</if>
             <if test="dataMap.process_name != null">#{dataMap.process_name},</if>
@@ -687,35 +687,35 @@
             <if test="dataMap.dest_city != null">#{dataMap.dest_city},</if>
             <if test="dataMap.dest_lon != null">#{dataMap.dest_lon},</if>
             <if test="dataMap.dest_lat != null">#{dataMap.dest_lat},</if>
-            <if test="dataMap.event_category != null">#{dataMap.event_category}::int4,</if>
-            <if test="dataMap.attack_result != null">#{dataMap.attack_result}::int4,</if>
-            <if test="dataMap.probe_ip != null">#{dataMap.probe_ip}::inet,</if>
-            <if test="dataMap.device_ip != null">#{dataMap.device_ip}::inet,</if>
+            <if test="dataMap.event_category != null">#{dataMap.event_category},</if>
+            <if test="dataMap.attack_result != null">#{dataMap.attack_result},</if>
+            <if test="dataMap.probe_ip != null">#{dataMap.probe_ip},</if>
+            <if test="dataMap.device_ip != null">#{dataMap.device_ip},</if>
             <if test="dataMap.device_manufacturer != null">#{dataMap.device_manufacturer},</if>
             <if test="dataMap.device_name != null">#{dataMap.device_name},</if>
             <if test="dataMap.product_name != null">#{dataMap.product_name},</if>
             <if test="dataMap.__id != null">#{dataMap.__id},</if>
-            <if test="dataMap.__count != null">#{dataMap.__count}::int8,</if>
+            <if test="dataMap.__count != null">#{dataMap.__count},</if>
             <if test="dataMap.__count_reason != null">#{dataMap.__count_reason},</if>
-            <if test="dataMap.event_type != null">#{dataMap.event_type}::int,</if>
+            <if test="dataMap.event_type != null">#{dataMap.event_type},</if>
             <if test="dataMap.protocol != null">#{dataMap.protocol},</if>
             <if test="dataMap.shell_cmd != null">#{dataMap.shell_cmd},</if>
             <if test="dataMap.parent_name != null">#{dataMap.parent_name},</if>
             <if test="dataMap.host_file_path != null">#{dataMap.host_file_path},</if>
             <if test="dataMap.uid != null">#{dataMap.uid},</if>
-            <if test="dataMap.fall != null">#{dataMap.fall}::int4,</if>
-            <if test="dataMap.tc_miguan_server_ip != null">#{dataMap.tc_miguan_server_ip}::inet,</if>
-            <if test="dataMap.dev_type != null">#{dataMap.dev_type}::int4,</if>
-            <if test="dataMap.collect_method != null">#{dataMap.collect_method}::int4,</if>
-            <if test="dataMap.field_cate_id != null">#{dataMap.field_cate_id}::int4,</if>
-            <if test="dataMap.device_type != null">#{dataMap.device_type}::int4,</if>
-            <if test="dataMap.tc_miguan_client_ip != null">#{dataMap.tc_miguan_client_ip}::inet,</if>
-            <if test="dataMap.tc_miguan_name != null">#{dataMap.tc_miguan_name}::inet,</if>
-            <if test="dataMap.origin_total_packages != null">#{dataMap.origin_total_packages}::int8,</if>
-            <if test="dataMap.origin_total_bytes != null">#{dataMap.origin_total_bytes}::int8,</if>
-            <if test="dataMap.origin_peak_packages_rate != null">#{dataMap.origin_peak_packages_rate}::int8,</if>
-            <if test="dataMap.origin_peak_bytes_rate != null">#{dataMap.origin_peak_bytes_rate}::int8,</if>
-            <if test="dataMap.origin_peak_flows_rate != null">#{dataMap.origin_peak_flows_rate}::int8,</if>
+            <if test="dataMap.fall != null">#{dataMap.fall},</if>
+            <if test="dataMap.tc_miguan_server_ip != null">#{dataMap.tc_miguan_server_ip},</if>
+            <if test="dataMap.dev_type != null">#{dataMap.dev_type},</if>
+            <if test="dataMap.collect_method != null">#{dataMap.collect_method},</if>
+            <if test="dataMap.field_cate_id != null">#{dataMap.field_cate_id},</if>
+            <if test="dataMap.device_type != null">#{dataMap.device_type},</if>
+            <if test="dataMap.tc_miguan_client_ip != null">#{dataMap.tc_miguan_client_ip},</if>
+            <if test="dataMap.tc_miguan_name != null">#{dataMap.tc_miguan_name},</if>
+            <if test="dataMap.origin_total_packages != null">#{dataMap.origin_total_packages},</if>
+            <if test="dataMap.origin_total_bytes != null">#{dataMap.origin_total_bytes},</if>
+            <if test="dataMap.origin_peak_packages_rate != null">#{dataMap.origin_peak_packages_rate},</if>
+            <if test="dataMap.origin_peak_bytes_rate != null">#{dataMap.origin_peak_bytes_rate},</if>
+            <if test="dataMap.origin_peak_flows_rate != null">#{dataMap.origin_peak_flows_rate},</if>
             <if test="dataMap.apt_orgname != null">#{dataMap.apt_orgname},</if>
             <if test="dataMap.apt_orgmsg != null">#{dataMap.apt_orgmsg},</if>
             <if test="dataMap.mail_message_id != null">#{dataMap.mail_message_id},</if>
@@ -725,18 +725,18 @@
             <if test="dataMap.mail_url != null">#{dataMap.mail_url},</if>
             <if test="dataMap.mail_cc != null">#{dataMap.mail_cc},</if>
             <if test="dataMap.algorithm != null">#{dataMap.algorithm},</if>
-            <if test="dataMap.miningpool_ip != null">#{dataMap.miningpool_ip}::inet,</if>
+            <if test="dataMap.miningpool_ip != null">#{dataMap.miningpool_ip},</if>
             <if test="dataMap.process_md5 != null">#{dataMap.process_md5},</if>
             <if test="dataMap.pprocess_md5 != null">#{dataMap.pprocess_md5},</if>
             <if test="dataMap.source_servername != null">#{dataMap.source_servername},</if>
             <if test="dataMap.origin_source_servername != null">#{dataMap.origin_source_servername},</if>
             <if test="dataMap.mail_filename != null">#{dataMap.mail_filename},</if>
             <if test="dataMap.dst_upload_appname != null">#{dataMap.dst_upload_appname},</if>
-            <if test="dataMap.target_port != null">#{dataMap.target_port}::int8,</if>
+            <if test="dataMap.target_port != null">#{dataMap.target_port},</if>
             <if test="dataMap.gid != null">#{dataMap.gid},</if>
             <if test="dataMap.origin_uid != null">#{dataMap.origin_uid},</if>
             <if test="dataMap.origin_gid != null">#{dataMap.origin_gid},</if>
-            <if test="dataMap.target_ports != null">#{dataMap.target_ports}::int8,</if>
+            <if test="dataMap.target_ports != null">#{dataMap.target_ports},</if>
             <if test="dataMap.tc_miguan_name1 != null">#{dataMap.tc_miguan_name1},</if>
             <if test="dataMap.tc_miguan_class1 != null">#{dataMap.tc_miguan_class1},</if>
             <if test="dataMap.etl_time != null">#{dataMap.etl_time},</if>
@@ -744,7 +744,7 @@
             <if test="dataMap.desip_security_scope != null">#{dataMap.desip_security_scope},</if>
             <if test="dataMap.srcip_security_scope != null">#{dataMap.srcip_security_scope},</if>
             <if test="dataMap.collect_time_ts != null">#{dataMap.collect_time_ts},</if>
-            <if test="dataMap.tc_miguan_scan_port1 != null">#{dataMap.tc_miguan_scan_port1}::inet,</if>
+            <if test="dataMap.tc_miguan_scan_port1 != null">#{dataMap.tc_miguan_scan_port1},</if>
             <if test="dataMap.src_dev_name != null">#{dataMap.src_dev_name},</if>
             <if test="dataMap.collect_protocol != null">#{dataMap.collect_protocol},</if>
             <if test="dataMap.destination_system_type != null">#{dataMap.destination_system_type},</if>

haobang-security-dm/syslog-consumer-rule/src/main/resources/mapper/SyslogNormalDataMapper.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="UTF-8" ?>
+<?xml version="1.0" encoding="UTF-8" ?>
 <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
 <mapper namespace="com.common.mapper.SyslogNormalDataMapper">
@@ -57,6 +57,7 @@
             id,
             created_at,
             log_time,
+            device_id,
             device_ip,
             dest_ip,
             dest_port,
@@ -103,6 +104,7 @@
             id,
             created_at,
             log_time,
+            device_id,
             device_ip,
             dest_ip,
             dest_port,
@@ -541,9 +543,9 @@
             <if test="dataMap.container_name != null">#{dataMap.container_name},</if>
             <if test="dataMap.container_id != null">#{dataMap.container_id},</if>
             <if test="dataMap.http_resp_server != null">#{dataMap.http_resp_server},</if>
-            <if test="dataMap.srcip_id != null">#{dataMap.srcip_id}::int8,</if>
-            <if test="dataMap.cdnip != null">#{dataMap.cdnip}::inet,</if>
-            <if test="dataMap.natip != null">#{dataMap.natip}::inet,</if>
+            <if test="dataMap.srcip_id != null">#{dataMap.srcip_id},</if>
+            <if test="dataMap.cdnip != null">#{dataMap.cdnip},</if>
+            <if test="dataMap.natip != null">#{dataMap.natip},</if>
             <if test="dataMap.mail_sender != null">#{dataMap.mail_sender},</if>
             <if test="dataMap.mail_receiver != null">#{dataMap.mail_receiver},</if>
             <if test="dataMap.vpn_mac != null">#{dataMap.vpn_mac},</if>
@@ -574,8 +576,8 @@
             <if test="dataMap.print_time != null">#{dataMap.print_time},</if>
             <if test="dataMap.printer != null">#{dataMap.printer},</if>
             <if test="dataMap.printer_type != null">#{dataMap.printer_type},</if>
-            <if test="dataMap.print_pages != null">#{dataMap.print_pages}::int8,</if>
-            <if test="dataMap.print_copies != null">#{dataMap.print_copies}::int8,</if>
+            <if test="dataMap.print_pages != null">#{dataMap.print_pages},</if>
+            <if test="dataMap.print_copies != null">#{dataMap.print_copies},</if>
             <if test="dataMap.src_device != null">#{dataMap.src_device},</if>
             <if test="dataMap.dst_device != null">#{dataMap.dst_device},</if>
             <if test="dataMap.src_file != null">#{dataMap.src_file},</if>
@@ -592,18 +594,18 @@
             <if test="dataMap.env != null">#{dataMap.env},</if>
             <if test="dataMap.brute_force_service != null">#{dataMap.brute_force_service},</if>
             <if test="dataMap.vuirs_name != null">#{dataMap.vuirs_name},</if>
-            <if test="dataMap.http_req_length != null">#{dataMap.http_req_length}::int8,</if>
+            <if test="dataMap.http_req_length != null">#{dataMap.http_req_length},</if>
             <if test="dataMap.http_req_content_type != null">#{dataMap.http_req_content_type},</if>
-            <if test="dataMap.tc_scan_port != null">#{dataMap.tc_scan_port}::inet,</if>
-            <if test="dataMap.tc_labels != null">#{dataMap.tc_labels}::inet,</if>
+            <if test="dataMap.tc_scan_port != null">#{dataMap.tc_scan_port},</if>
+            <if test="dataMap.tc_labels != null">#{dataMap.tc_labels},</if>
             <if test="dataMap.http_resp_content_type != null">#{dataMap.http_resp_content_type},</if>
             <if test="dataMap.dns_msg_type != null">#{dataMap.dns_msg_type},</if>
             <if test="dataMap.dns_answer_length != null">#{dataMap.dns_answer_length},</if>
             <if test="dataMap.dns_ioc != null">#{dataMap.dns_ioc},</if>
-            <if test="dataMap.tx_bytes != null">#{dataMap.tx_bytes}::double precision,</if>
-            <if test="dataMap.rx_bytes != null">#{dataMap.rx_bytes}::double precision,</if>
-            <if test="dataMap.all_bytes != null">#{dataMap.all_bytes}::double precision,</if>
-            <if test="dataMap.duration_time != null">#{dataMap.duration_time}::int8,</if>
+            <if test="dataMap.tx_bytes != null">#{dataMap.tx_bytes},</if>
+            <if test="dataMap.rx_bytes != null">#{dataMap.rx_bytes},</if>
+            <if test="dataMap.all_bytes != null">#{dataMap.all_bytes},</if>
+            <if test="dataMap.duration_time != null">#{dataMap.duration_time},</if>
             <if test="dataMap.mail_attach_name != null">#{dataMap.mail_attach_name},</if>
             <if test="dataMap.mail_subject != null">#{dataMap.mail_subject},</if>
             <if test="dataMap.mail_message != null">#{dataMap.mail_message},</if>
@@ -623,27 +625,27 @@
             <if test="dataMap.src_ip_apt != null">#{dataMap.src_ip_apt},</if>
             <if test="dataMap.srcip_name != null">#{dataMap.srcip_name},</if>
             <if test="dataMap.tc_client != null">#{dataMap.tc_client},</if>
-            <if test="dataMap.srcip_organization_id != null">#{dataMap.srcip_organization_id}::int8,</if>
+            <if test="dataMap.srcip_organization_id != null">#{dataMap.srcip_organization_id},</if>
             <if test="dataMap.dest_ip_intranetip != null">#{dataMap.dest_ip_intranetip},</if>
             <if test="dataMap.dest_ip_ioc != null">#{dataMap.dest_ip_ioc},</if>
-            <if test="dataMap.desip_id != null">#{dataMap.desip_id}::int8,</if>
+            <if test="dataMap.desip_id != null">#{dataMap.desip_id},</if>
             <if test="dataMap.desip_name != null">#{dataMap.desip_name},</if>
-            <if test="dataMap.tc_hostip != null">#{dataMap.tc_hostip}::inet,</if>
-            <if test="dataMap.desip_organization_id != null">#{dataMap.desip_organization_id}::int8,</if>
+            <if test="dataMap.tc_hostip != null">#{dataMap.tc_hostip},</if>
+            <if test="dataMap.desip_organization_id != null">#{dataMap.desip_organization_id},</if>
             <if test="dataMap.origin_confidence != null">#{dataMap.origin_confidence},</if>
             <if test="dataMap.origin_malscore != null">#{dataMap.origin_malscore},</if>
             <if test="dataMap.attacker_icampaign != null">#{dataMap.attacker_icampaign},</if>
-            <if test="dataMap.attacker_host_asset_id != null">#{dataMap.attacker_host_asset_id}::int8,</if>
-            <if test="dataMap.attacker_organization_id != null">#{dataMap.attacker_organization_id}::int8,</if>
-            <if test="dataMap.victim_host_asset_id != null">#{dataMap.victim_host_asset_id}::int8,</if>
-            <if test="dataMap.victim_organization_id != null">#{dataMap.victim_organization_id}::int8,</if>
+            <if test="dataMap.attacker_host_asset_id != null">#{dataMap.attacker_host_asset_id},</if>
+            <if test="dataMap.attacker_organization_id != null">#{dataMap.attacker_organization_id},</if>
+            <if test="dataMap.victim_host_asset_id != null">#{dataMap.victim_host_asset_id},</if>
+            <if test="dataMap.victim_organization_id != null">#{dataMap.victim_organization_id},</if>
             <if test="dataMap.logout_time != null">#{dataMap.logout_time},</if>
             <if test="dataMap.http_req_line != null">#{dataMap.http_req_line},</if>
             <if test="dataMap.desip_security_scope_id != null">#{dataMap.desip_security_scope_id},</if>
             <if test="dataMap.srcip_security_scope_id != null">#{dataMap.srcip_security_scope_id},</if>
-            <if test="dataMap.http_resp_length != null">#{dataMap.http_resp_length}::int8,</if>
+            <if test="dataMap.http_resp_length != null">#{dataMap.http_resp_length},</if>
             <if test="dataMap.tc_attack_type != null">#{dataMap.tc_attack_type},</if>
-            <if test="dataMap.tc_realip != null">#{dataMap.tc_realip}::inet,</if>
+            <if test="dataMap.tc_realip != null">#{dataMap.tc_realip},</if>
             <if test="dataMap.attacker_ip_lists != null">#{dataMap.attacker_ip_lists},</if>
             <if test="dataMap.login_password != null">#{dataMap.login_password},</if>
             <if test="dataMap.detail != null">#{dataMap.detail},</if>
@@ -660,12 +662,12 @@
             <if test="dataMap.login_abnormal_type != null">#{dataMap.login_abnormal_type},</if>
             <if test="dataMap.file_tag != null">#{dataMap.file_tag},</if>
             <if test="dataMap.file_platform != null">#{dataMap.file_platform},</if>
-            <if test="dataMap.target_ip != null">#{dataMap.target_ip}::inet,</if>
+            <if test="dataMap.target_ip != null">#{dataMap.target_ip},</if>
             <if test="dataMap.collect_date != null">#{dataMap.collect_date},</if>
-            <if test="dataMap.tc_client_ip != null">#{dataMap.tc_client_ip}::inet,</if>
-            <if test="dataMap.tc_server_ip != null">#{dataMap.tc_server_ip}::inet,</if>
-            <if test="dataMap.tc_externalip != null">#{dataMap.tc_externalip}::inet,</if>
-            <if test="dataMap.http_status_code != null">#{dataMap.http_status_code}::int8,</if>
+            <if test="dataMap.tc_client_ip != null">#{dataMap.tc_client_ip},</if>
+            <if test="dataMap.tc_server_ip != null">#{dataMap.tc_server_ip},</if>
+            <if test="dataMap.tc_externalip != null">#{dataMap.tc_externalip},</if>
+            <if test="dataMap.http_status_code != null">#{dataMap.http_status_code},</if>
             <if test="dataMap.device_domian != null">#{dataMap.device_domian},</if>
             <if test="dataMap.src_ip_str != null">#{dataMap.src_ip_str},</if>
             <if test="dataMap.src_port_str != null">#{dataMap.src_port_str},</if>
@@ -711,28 +713,28 @@
             <if test="dataMap.origin_agent_name != null">#{dataMap.origin_agent_name},</if>
             <if test="dataMap.origin_work_group != null">#{dataMap.origin_work_group},</if>
             <if test="dataMap.origin_asset_group != null">#{dataMap.origin_asset_group},</if>
-            <if test="dataMap.origin_local_port != null">#{dataMap.origin_local_port}::int8,</if>
-            <if test="dataMap.origin_agent_ip != null">#{dataMap.origin_agent_ip}::inet,</if>
-            <if test="dataMap.origin_internal_ip != null">#{dataMap.origin_internal_ip}::inet,</if>
-            <if test="dataMap.origin_external_ip != null">#{dataMap.origin_external_ip}::inet,</if>
-            <if test="dataMap.origin_local_addr != null">#{dataMap.origin_local_addr}::inet,</if>
-            <if test="dataMap.agent_id != null">#{dataMap.agent_id}::int8,</if>
+            <if test="dataMap.origin_local_port != null">#{dataMap.origin_local_port},</if>
+            <if test="dataMap.origin_agent_ip != null">#{dataMap.origin_agent_ip},</if>
+            <if test="dataMap.origin_internal_ip != null">#{dataMap.origin_internal_ip},</if>
+            <if test="dataMap.origin_external_ip != null">#{dataMap.origin_external_ip},</if>
+            <if test="dataMap.origin_local_addr != null">#{dataMap.origin_local_addr},</if>
+            <if test="dataMap.agent_id != null">#{dataMap.agent_id},</if>
             <if test="dataMap.agent_name != null">#{dataMap.agent_name},</if>
             <if test="dataMap.tc_title != null">#{dataMap.tc_title},</if>
             <if test="dataMap.log_id != null">#{dataMap.log_id},</if>
             <if test="dataMap.event_date != null">#{dataMap.event_date},</if>
             <if test="dataMap.event_time_ts != null">#{dataMap.event_time_ts},</if>
-            <if test="dataMap.event_level != null">#{dataMap.event_level}::int ,</if>
-            <if test="dataMap.src_ip != null">#{dataMap.src_ip}::inet,</if>
-            <if test="dataMap.src_port != null">#{dataMap.src_port}::BIGINT ,</if>
-            <if test="dataMap.dest_ip != null">#{dataMap.dest_ip}::inet,</if>
+            <if test="dataMap.event_level != null">#{dataMap.event_level},</if>
+            <if test="dataMap.src_ip != null">#{dataMap.src_ip},</if>
+            <if test="dataMap.src_port != null">#{dataMap.src_port},</if>
+            <if test="dataMap.dest_ip != null">#{dataMap.dest_ip},</if>
             <if test="dataMap.dest_port != null">#{dataMap.dest_port}::BIGINT,</if>
             <if test="dataMap.event_time != null">#{dataMap.event_time},</if>
             <if test="dataMap.attacker_country != null">#{dataMap.attacker_country},</if>
             <if test="dataMap.src_mac != null">#{dataMap.src_mac},</if>
             <if test="dataMap.dest_mac != null">#{dataMap.dest_mac},</if>
             <if test="dataMap.proto != null">#{dataMap.proto},</if>
-            <if test="dataMap.dev_id != null">#{dataMap.dev_id}::int8,</if>
+            <if test="dataMap.dev_id != null">#{dataMap.dev_id},</if>
             <if test="dataMap.created_time != null">#{dataMap.created_time},</if>
             <if test="dataMap.src_country != null">#{dataMap.src_country},</if>
             <if test="dataMap.src_country_code != null">#{dataMap.src_country_code},</if>
@@ -756,20 +758,20 @@
             <if test="dataMap.end_time != null">#{dataMap.end_time},</if>
             <if test="dataMap.file_created_time != null">#{dataMap.file_created_time},</if>
             <if test="dataMap.file_modified_time != null">#{dataMap.file_modified_time},</if>
-            <if test="dataMap.tc_miguan_scan_port != null">#{dataMap.tc_miguan_scan_port}::inet,</if>
+            <if test="dataMap.tc_miguan_scan_port != null">#{dataMap.tc_miguan_scan_port},</if>
             <if test="dataMap.process_path != null">#{dataMap.process_path},</if>
             <if test="dataMap.parent_process_path != null">#{dataMap.parent_process_path},</if>
             <if test="dataMap.gname != null">#{dataMap.gname},</if>
             <if test="dataMap.exe_name != null">#{dataMap.exe_name},</if>
             <if test="dataMap.exe_path != null">#{dataMap.exe_path},</if>
             <if test="dataMap.login_time != null">#{dataMap.login_time},</if>
-            <if test="dataMap.login_times != null">#{dataMap.login_times}::int8,</if>
+            <if test="dataMap.login_times != null">#{dataMap.login_times},</if>
             <if test="dataMap.check_item != null">#{dataMap.check_item},</if>
             <if test="dataMap.check_type != null">#{dataMap.check_type},</if>
-            <if test="dataMap.attacker_ip != null">#{dataMap.attacker_ip}::inet,</if>
-            <if test="dataMap.attacker_port != null">#{dataMap.attacker_port}::int8,</if>
-            <if test="dataMap.victim_ip != null">#{dataMap.victim_ip}::inet,</if>
-            <if test="dataMap.victim_port != null">#{dataMap.victim_port}::int8,</if>
+            <if test="dataMap.attacker_ip != null">#{dataMap.attacker_ip},</if>
+            <if test="dataMap.attacker_port != null">#{dataMap.attacker_port},</if>
+            <if test="dataMap.victim_ip != null">#{dataMap.victim_ip},</if>
+            <if test="dataMap.victim_port != null">#{dataMap.victim_port},</if>
             <if test="dataMap.attacker_city != null">#{dataMap.attacker_city},</if>
             <if test="dataMap.attacker_lon != null">#{dataMap.attacker_lon},</if>
             <if test="dataMap.attacker_lat != null">#{dataMap.attacker_lat},</if>
@@ -795,7 +797,7 @@
             <if test="dataMap.file_ssdeep != null">#{dataMap.file_ssdeep},</if>
             <if test="dataMap.victim_country_code != null">#{dataMap.victim_country_code},</if>
             <if test="dataMap.http_xff_ip != null">#{dataMap.http_xff_ip},</if>
-            <if test="dataMap.tc_miguan_class != null">#{dataMap.tc_miguan_class}::inet,</if>
+            <if test="dataMap.tc_miguan_class != null">#{dataMap.tc_miguan_class},</if>
             <if test="dataMap.pid != null">#{dataMap.pid},</if>
             <if test="dataMap.ppid != null">#{dataMap.ppid},</if>
             <if test="dataMap.process_name != null">#{dataMap.process_name},</if>
@@ -822,35 +824,35 @@
             <if test="dataMap.dest_city != null">#{dataMap.dest_city},</if>
             <if test="dataMap.dest_lon != null">#{dataMap.dest_lon},</if>
             <if test="dataMap.dest_lat != null">#{dataMap.dest_lat},</if>
-            <if test="dataMap.event_category != null">#{dataMap.event_category}::int4,</if>
-            <if test="dataMap.attack_result != null">#{dataMap.attack_result}::int4,</if>
-            <if test="dataMap.probe_ip != null">#{dataMap.probe_ip}::inet,</if>
-            <if test="dataMap.device_ip != null">#{dataMap.device_ip}::inet,</if>
+            <if test="dataMap.event_category != null">#{dataMap.event_category},</if>
+            <if test="dataMap.attack_result != null">#{dataMap.attack_result},</if>
+            <if test="dataMap.probe_ip != null">#{dataMap.probe_ip},</if>
+            <if test="dataMap.device_ip != null">#{dataMap.device_ip},</if>
             <if test="dataMap.device_manufacturer != null">#{dataMap.device_manufacturer},</if>
             <if test="dataMap.device_name != null">#{dataMap.device_name},</if>
             <if test="dataMap.product_name != null">#{dataMap.product_name},</if>
             <if test="dataMap.__id != null">#{dataMap.__id},</if>
-            <if test="dataMap.__count != null">#{dataMap.__count}::int8,</if>
+            <if test="dataMap.__count != null">#{dataMap.__count},</if>
             <if test="dataMap.__count_reason != null">#{dataMap.__count_reason},</if>
-            <if test="dataMap.event_type != null">#{dataMap.event_type}::int,</if>
+            <if test="dataMap.event_type != null">#{dataMap.event_type},</if>
             <if test="dataMap.protocol != null">#{dataMap.protocol},</if>
             <if test="dataMap.shell_cmd != null">#{dataMap.shell_cmd},</if>
             <if test="dataMap.parent_name != null">#{dataMap.parent_name},</if>
             <if test="dataMap.host_file_path != null">#{dataMap.host_file_path},</if>
             <if test="dataMap.uid != null">#{dataMap.uid},</if>
-            <if test="dataMap.fall != null">#{dataMap.fall}::int4,</if>
-            <if test="dataMap.tc_miguan_server_ip != null">#{dataMap.tc_miguan_server_ip}::inet,</if>
-            <if test="dataMap.dev_type != null">#{dataMap.dev_type}::int4,</if>
-            <if test="dataMap.collect_method != null">#{dataMap.collect_method}::int4,</if>
-            <if test="dataMap.field_cate_id != null">#{dataMap.field_cate_id}::int4,</if>
-            <if test="dataMap.device_type != null">#{dataMap.device_type}::int4,</if>
-            <if test="dataMap.tc_miguan_client_ip != null">#{dataMap.tc_miguan_client_ip}::inet,</if>
-            <if test="dataMap.tc_miguan_name != null">#{dataMap.tc_miguan_name}::inet,</if>
-            <if test="dataMap.origin_total_packages != null">#{dataMap.origin_total_packages}::int8,</if>
-            <if test="dataMap.origin_total_bytes != null">#{dataMap.origin_total_bytes}::int8,</if>
-            <if test="dataMap.origin_peak_packages_rate != null">#{dataMap.origin_peak_packages_rate}::int8,</if>
-            <if test="dataMap.origin_peak_bytes_rate != null">#{dataMap.origin_peak_bytes_rate}::int8,</if>
-            <if test="dataMap.origin_peak_flows_rate != null">#{dataMap.origin_peak_flows_rate}::int8,</if>
+            <if test="dataMap.fall != null">#{dataMap.fall},</if>
+            <if test="dataMap.tc_miguan_server_ip != null">#{dataMap.tc_miguan_server_ip},</if>
+            <if test="dataMap.dev_type != null">#{dataMap.dev_type},</if>
+            <if test="dataMap.collect_method != null">#{dataMap.collect_method},</if>
+            <if test="dataMap.field_cate_id != null">#{dataMap.field_cate_id},</if>
+            <if test="dataMap.device_type != null">#{dataMap.device_type},</if>
+            <if test="dataMap.tc_miguan_client_ip != null">#{dataMap.tc_miguan_client_ip},</if>
+            <if test="dataMap.tc_miguan_name != null">#{dataMap.tc_miguan_name},</if>
+            <if test="dataMap.origin_total_packages != null">#{dataMap.origin_total_packages},</if>
+            <if test="dataMap.origin_total_bytes != null">#{dataMap.origin_total_bytes},</if>
+            <if test="dataMap.origin_peak_packages_rate != null">#{dataMap.origin_peak_packages_rate},</if>
+            <if test="dataMap.origin_peak_bytes_rate != null">#{dataMap.origin_peak_bytes_rate},</if>
+            <if test="dataMap.origin_peak_flows_rate != null">#{dataMap.origin_peak_flows_rate},</if>
             <if test="dataMap.apt_orgname != null">#{dataMap.apt_orgname},</if>
             <if test="dataMap.apt_orgmsg != null">#{dataMap.apt_orgmsg},</if>
             <if test="dataMap.mail_message_id != null">#{dataMap.mail_message_id},</if>
@@ -860,18 +862,18 @@
             <if test="dataMap.mail_url != null">#{dataMap.mail_url},</if>
             <if test="dataMap.mail_cc != null">#{dataMap.mail_cc},</if>
             <if test="dataMap.algorithm != null">#{dataMap.algorithm},</if>
-            <if test="dataMap.miningpool_ip != null">#{dataMap.miningpool_ip}::inet,</if>
+            <if test="dataMap.miningpool_ip != null">#{dataMap.miningpool_ip},</if>
             <if test="dataMap.process_md5 != null">#{dataMap.process_md5},</if>
             <if test="dataMap.pprocess_md5 != null">#{dataMap.pprocess_md5},</if>
             <if test="dataMap.source_servername != null">#{dataMap.source_servername},</if>
             <if test="dataMap.origin_source_servername != null">#{dataMap.origin_source_servername},</if>
             <if test="dataMap.mail_filename != null">#{dataMap.mail_filename},</if>
             <if test="dataMap.dst_upload_appname != null">#{dataMap.dst_upload_appname},</if>
-            <if test="dataMap.target_port != null">#{dataMap.target_port}::int8,</if>
+            <if test="dataMap.target_port != null">#{dataMap.target_port},</if>
             <if test="dataMap.gid != null">#{dataMap.gid},</if>
             <if test="dataMap.origin_uid != null">#{dataMap.origin_uid},</if>
             <if test="dataMap.origin_gid != null">#{dataMap.origin_gid},</if>
-            <if test="dataMap.target_ports != null">#{dataMap.target_ports}::int8,</if>
+            <if test="dataMap.target_ports != null">#{dataMap.target_ports},</if>
             <if test="dataMap.tc_miguan_name1 != null">#{dataMap.tc_miguan_name1},</if>
             <if test="dataMap.tc_miguan_class1 != null">#{dataMap.tc_miguan_class1},</if>
             <if test="dataMap.etl_time != null">#{dataMap.etl_time},</if>
@@ -879,7 +881,7 @@
             <if test="dataMap.desip_security_scope != null">#{dataMap.desip_security_scope},</if>
             <if test="dataMap.srcip_security_scope != null">#{dataMap.srcip_security_scope},</if>
             <if test="dataMap.collect_time_ts != null">#{dataMap.collect_time_ts},</if>
-            <if test="dataMap.tc_miguan_scan_port1 != null">#{dataMap.tc_miguan_scan_port1}::inet,</if>
+            <if test="dataMap.tc_miguan_scan_port1 != null">#{dataMap.tc_miguan_scan_port1},</if>
             <if test="dataMap.src_dev_name != null">#{dataMap.src_dev_name},</if>
             <if test="dataMap.collect_protocol != null">#{dataMap.collect_protocol},</if>
             <if test="dataMap.destination_system_type != null">#{dataMap.destination_system_type},</if>