diff --git a/haobang-security-dm/.idea/workspace.xml b/haobang-security-dm/.idea/workspace.xml
index e789142..1a787ff 100644
--- a/haobang-security-dm/.idea/workspace.xml
+++ b/haobang-security-dm/.idea/workspace.xml
@@ -2,11 +2,6 @@
 <project version="4">
   <component name="ChangeListManager">
     <list default="true" id="a9c448ac-d772-4746-916f-923fb3063966" name="Default Changelist" comment="1、新增降噪日志数据健康监测告警&#10;2、IP联动封禁功能完善">
-      <change afterPath="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-rule-prod.yaml" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/config/AppProperties.java" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/config/KafkaConsumerProperties.java" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java" afterDir="false" />
-      <change afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/SqlGeneratorServiceImplDm.java" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/logs/syslog-client.2025-12-01.log" beforeDir="false" />
       <change beforePath="$PROJECT_DIR$/logs/syslog-client.log" beforeDir="false" />
@@ -20,80 +15,14 @@
       <change beforePath="$PROJECT_DIR$/syslog-client/logs/syslog-client.2025-12-29.log" beforeDir="false" />
       <change beforePath="$PROJECT_DIR$/syslog-client/logs/syslog-client.2026-04-30.log" beforeDir="false" />
       <change beforePath="$PROJECT_DIR$/syslog-client/logs/syslog-client.log" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-client/logs/syslog-client.log" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-nw.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-nw.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-prod.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-prod.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/pom.xml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/pom.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/Modules/NormalData/LogNormalProcessor.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/Modules/NormalData/LogNormalProcessor.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/Modules/NormalData/SysLogProcessor.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/Modules/NormalData/SysLogProcessor.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/entity/AlarmVisit.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/entity/AlarmVisit.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/entity/DeviceCollectTask.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/entity/DeviceCollectTask.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/mapper/AlarmVisitMapper.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/mapper/AlarmVisitMapper.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/service/DataTransformer.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/service/DataTransformer.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/service/InfluxSyslogService.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/common/service/InfluxSyslogService.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/controllers/DmColumnController.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/controllers/DmColumnController.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/influx/InfluxDBClient.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/influx/InfluxDBClient.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/influx/InfluxDBConfig.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/influx/InfluxDBConfig.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/influx/SyslogToInfluxApp.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/influx/SyslogToInfluxApp.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/kafka/kafkalogconsumer.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/kafka/kafkalogconsumer.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/kafka/kafkalogconsumerThead.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/kafka/kafkalogconsumerThead.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-dev.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-dev.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-prod.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-prod.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/mapper/DeviceCollectTaskMapper.xml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/mapper/DeviceCollectTaskMapper.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-nw.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-nw.yaml" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/pom.xml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/pom.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/Modules/NormalData/LogNormalProcessor.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/Modules/NormalData/LogNormalProcessor.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/Modules/NormalData/SysLogProcessor.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/Modules/NormalData/SysLogProcessor.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/entity/AlarmVisit.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/entity/AlarmVisit.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/entity/DeviceCollectTask.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/entity/DeviceCollectTask.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/AlarmVisitMapper.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/AlarmVisitMapper.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/DeviceReceiveLogMapper.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/DeviceReceiveLogMapper.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/SyslogNormalDataMapper.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/SyslogNormalDataMapper.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/ETLOrchestrator.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/ETLOrchestrator.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/PartitionTableSchedule.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/PartitionTableSchedule.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/AccessLogAlertService.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/AccessLogAlertService.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/DataTransformer.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/DataTransformer.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/DeviceCollectTaskUpdateService.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/DeviceCollectTaskUpdateService.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/DeviceStatsUpdateService.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/DeviceStatsUpdateService.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/InfluxSyslogService.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/InfluxSyslogService.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/PartitionTableService.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/PartitionTableService.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/DeviceReceiveLogServiceImpl.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/DeviceReceiveLogServiceImpl.java" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/SqlGeneratorServiceImpl.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/SqlGeneratorServiceImpl.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/controllers/DmColumnController.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/controllers/DmColumnController.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/controllers/SyslogController.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/controllers/SyslogController.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/influx/InfluxDBClient.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/influx/InfluxDBClient.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/influx/InfluxDBConfig.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/influx/InfluxDBConfig.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/influx/SyslogToInfluxApp.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/influx/SyslogToInfluxApp.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/kafka/kafkalogconsumer.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/kafka/kafkalogconsumer.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/kafka/kafkalogconsumerThead.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/kafka/kafkalogconsumerThead.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application-dev.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application-dev.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application-pre-nw.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application-pre-nw.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application-prod-zc.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application-prod-zc.properties" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application-prod.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application-prod.properties" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/resources/application.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/DeviceCollectTaskMapper.xml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/DeviceCollectTaskMapper.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/SyslogNormalDataMapper.xml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/SyslogNormalDataMapper.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve-nw.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve-nw.yaml" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve-prod.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve-prod.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve.yaml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve.yaml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/pom.xml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/pom.xml" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/java/com/Modules/Device/DeviceProcess.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/java/com/Modules/Device/DeviceProcess.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/java/com/SyslogServeMainApp.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/java/com/SyslogServeMainApp.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/java/com/common/entity/DeviceCollectTask.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/java/com/common/entity/DeviceCollectTask.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/java/com/common/mapper/DeviceCollectTaskMapper.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/java/com/haobang/util/DeviceInfoUtil.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/java/com/haobang/util/DeviceInfoUtil.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/java/com/kafka/kafkaProducer.java" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/java/com/kafka/kafkaProducer.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/resources/application-dev.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/resources/application-dev.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod-zc.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod-zc.properties" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/resources/application.properties" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/resources/application.properties" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/syslog-serve/src/main/resources/mapper/DeviceCollectTaskMapper.xml" beforeDir="false" afterPath="$PROJECT_DIR$/syslog-serve/src/main/resources/mapper/DeviceCollectTaskMapper.xml" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/../haobang-security-xdr/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/../haobang-security-xdr/.idea/workspace.xml" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/../haobang-security-xdr/syslog-client/logs/syslog-client.log" beforeDir="false" afterPath="$PROJECT_DIR$/../haobang-security-xdr/syslog-client/logs/syslog-client.log" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/../haobang-security-xdr/syslog-consumer/src/main/java/com/common/service/AlarmHealthCheckService.java" beforeDir="false" afterPath="$PROJECT_DIR$/../haobang-security-xdr/syslog-consumer/src/main/java/com/common/service/AlarmHealthCheckService.java" afterDir="false" />
@@ -256,12 +185,13 @@
     <session id="-807770361">
       <usages-collector id="statistics.lifecycle.project">
         <counts>
-          <entry key="project.closed" value="23" />
+          <entry key="project.closed" value="29" />
           <entry key="project.open.time.1" value="1" />
           <entry key="project.open.time.10" value="1" />
           <entry key="project.open.time.12" value="1" />
-          <entry key="project.open.time.14" value="2" />
-          <entry key="project.open.time.15" value="4" />
+          <entry key="project.open.time.13" value="1" />
+          <entry key="project.open.time.14" value="3" />
+          <entry key="project.open.time.15" value="5" />
           <entry key="project.open.time.16" value="4" />
           <entry key="project.open.time.17" value="2" />
           <entry key="project.open.time.18" value="2" />
@@ -269,50 +199,53 @@
           <entry key="project.open.time.20" value="1" />
           <entry key="project.open.time.21" value="1" />
           <entry key="project.open.time.22" value="2" />
+          <entry key="project.open.time.23" value="1" />
           <entry key="project.open.time.3" value="1" />
+          <entry key="project.open.time.32" value="1" />
           <entry key="project.open.time.38" value="1" />
           <entry key="project.open.time.4" value="3" />
           <entry key="project.open.time.5" value="3" />
-          <entry key="project.opened" value="30" />
+          <entry key="project.open.time.6" value="1" />
+          <entry key="project.opened" value="36" />
         </counts>
       </usages-collector>
       <usages-collector id="statistics.file.extensions.open">
         <counts>
           <entry key="class" value="3" />
           <entry key="iml" value="5" />
-          <entry key="java" value="83" />
-          <entry key="properties" value="57" />
+          <entry key="java" value="92" />
+          <entry key="properties" value="74" />
           <entry key="txt" value="3" />
-          <entry key="xml" value="17" />
-          <entry key="yaml" value="31" />
+          <entry key="xml" value="22" />
+          <entry key="yaml" value="42" />
         </counts>
       </usages-collector>
       <usages-collector id="statistics.file.types.open">
         <counts>
           <entry key="CLASS" value="3" />
           <entry key="IDEA_MODULE" value="5" />
-          <entry key="JAVA" value="83" />
+          <entry key="JAVA" value="92" />
           <entry key="PLAIN_TEXT" value="3" />
-          <entry key="Properties" value="57" />
-          <entry key="XML" value="17" />
-          <entry key="YAML" value="31" />
+          <entry key="Properties" value="74" />
+          <entry key="XML" value="22" />
+          <entry key="YAML" value="42" />
         </counts>
       </usages-collector>
       <usages-collector id="statistics.file.extensions.edit">
         <counts>
           <entry key="java" value="111" />
-          <entry key="properties" value="79" />
+          <entry key="properties" value="83" />
           <entry key="xml" value="28" />
-          <entry key="yaml" value="227" />
+          <entry key="yaml" value="265" />
         </counts>
       </usages-collector>
       <usages-collector id="statistics.file.types.edit">
         <counts>
           <entry key="JAVA" value="111" />
-          <entry key="Properties" value="79" />
+          <entry key="Properties" value="83" />
           <entry key="SQL" value="1" />
           <entry key="XML" value="27" />
-          <entry key="YAML" value="227" />
+          <entry key="YAML" value="265" />
         </counts>
       </usages-collector>
     </session>
@@ -322,88 +255,93 @@
   </component>
   <component name="FileEditorManager">
     <leaf SIDE_TABS_SIZE_LIMIT_KEY="300">
+      <file pinned="false" current-in-tab="true">
+        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/application.properties">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="413">
+              <caret line="146" lean-forward="true" selection-start-line="146" selection-end-line="146" />
+            </state>
+          </provider>
+        </entry>
+      </file>
       <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/SyslogNormalAlarmMapper.xml">
+        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RuleExecutionTimeServiceImpl.java">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="572">
+              <caret line="38" column="24" selection-start-line="38" selection-start-column="24" selection-end-line="38" selection-end-column="24" />
+            </state>
+          </provider>
+        </entry>
+      </file>
+      <file pinned="false" current-in-tab="false">
+        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="406">
+              <caret line="178" column="47" lean-forward="true" selection-start-line="178" selection-start-column="47" selection-end-line="178" selection-end-column="47" />
+              <folding>
+                <element signature="e#9930#9931#0" expanded="true" />
+                <element signature="e#9961#9962#0" expanded="true" />
+                <element signature="e#27830#27860#0" expanded="true" />
+              </folding>
+            </state>
+          </provider>
+        </entry>
+      </file>
+      <file pinned="false" current-in-tab="false">
+        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/application-prod.properties">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="594">
+              <caret line="42" column="53" selection-start-line="42" selection-start-column="53" selection-end-line="42" selection-end-column="53" />
+            </state>
+          </provider>
+        </entry>
+      </file>
+      <file pinned="false" current-in-tab="false">
+        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="181">
+              <caret line="20" column="13" selection-start-line="20" selection-start-column="13" selection-end-line="20" selection-end-column="13" />
+            </state>
+          </provider>
+        </entry>
+      </file>
+      <file pinned="false" current-in-tab="false">
+        <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application-dev.properties">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="946">
+              <caret line="43" column="43" selection-start-line="43" selection-start-column="27" selection-end-line="43" selection-end-column="43" />
+            </state>
+          </provider>
+        </entry>
+      </file>
+      <file pinned="false" current-in-tab="false">
+        <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-rule-prod.yaml">
           <provider selected="true" editor-type-id="text-editor" />
         </entry>
       </file>
       <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/SyslogNormalDataMapper.xml">
+        <entry file="file://$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer.yaml">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="2464">
-              <caret line="112" column="21" selection-start-line="112" selection-start-column="21" selection-end-line="112" selection-end-column="21" />
+            <state relative-caret-position="836">
+              <caret line="38" column="30" selection-start-line="38" selection-start-column="30" selection-end-line="38" selection-end-column="30" />
             </state>
           </provider>
         </entry>
       </file>
       <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/ETLOrchestrator.java">
+        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/AccessLogAlertService.java">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="440">
-              <caret line="32" column="53" selection-start-line="32" selection-start-column="53" selection-end-line="32" selection-end-column="53" />
+            <state relative-caret-position="9086">
+              <caret line="444" column="43" selection-start-line="444" selection-start-column="43" selection-end-line="444" selection-end-column="43" />
             </state>
           </provider>
         </entry>
       </file>
       <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/SqlGeneratorService.java">
+        <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod.properties">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="198">
-              <caret line="10" column="17" selection-start-line="10" selection-start-column="17" selection-end-line="10" selection-end-column="17" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/SqlGeneratorServiceImpl.java">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="286">
-              <caret line="26" column="13" selection-start-line="26" selection-start-column="13" selection-end-line="26" selection-end-column="13" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="true">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="317">
-              <caret line="43" lean-forward="true" selection-start-line="43" selection-end-line="43" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/AlarmHealthCheckScheduler.java">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="198">
-              <caret line="14" column="13" selection-start-line="14" selection-start-column="13" selection-end-line="14" selection-end-column="13" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/OfflineAnalysisScheduler.java">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="198">
-              <caret line="17" column="13" selection-start-line="17" selection-start-column="13" selection-end-line="17" selection-end-column="13" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/influx/InfluxDBClient.java">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="3762">
-              <caret line="189" column="37" selection-start-line="189" selection-start-column="37" selection-end-line="189" selection-end-column="37" />
-            </state>
-          </provider>
-        </entry>
-      </file>
-      <file pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod-zc.properties">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="242">
-              <caret line="11" column="30" selection-start-line="11" selection-start-column="24" selection-end-line="11" selection-end-column="30" />
+            <state relative-caret-position="506">
+              <caret line="23" column="7" selection-start-line="23" selection-start-column="7" selection-end-line="23" selection-end-column="7" />
             </state>
           </provider>
         </entry>
@@ -463,8 +401,6 @@
   <component name="IdeDocumentHistory">
     <option name="CHANGED_PATHS">
       <list>
-        <option value="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-nw.yaml" />
-        <option value="$PROJECT_DIR$/syslog-consumer-rule/Dockerfile" />
         <option value="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer.yaml" />
         <option value="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-dev.properties" />
         <option value="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-prod-zc.properties" />
@@ -493,12 +429,10 @@
         <option value="$PROJECT_DIR$/pom.xml" />
         <option value="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-prod.yaml" />
         <option value="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/DeviceReceiveLogServiceImpl.java" />
-        <option value="$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve-prod.yaml" />
         <option value="$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/Modules/NormalData/SysLogProcessor.java" />
         <option value="$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-rule-prod.yaml" />
         <option value="$PROJECT_DIR$/syslog-serve/src/main/java/com/kafka/kafkaProducer.java" />
         <option value="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-prod.properties" />
-        <option value="$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod.properties" />
         <option value="$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod-zc.properties" />
         <option value="$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application.properties" />
         <option value="$PROJECT_DIR$/syslog-consumer/pom.xml" />
@@ -510,10 +444,14 @@
         <option value="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/ETLOrchestrator.java" />
         <option value="$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/entity/AlarmVisitProcesslog.java" />
         <option value="$PROJECT_DIR$/syslog-serve/src/main/resources/application-dev.properties" />
-        <option value="$PROJECT_DIR$/syslog-serve/src/main/resources/application.properties" />
         <option value="$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/SyslogNormalDataMapper.xml" />
-        <option value="$PROJECT_DIR$/syslog-consumer/src/main/resources/application.properties" />
         <option value="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml" />
+        <option value="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-nw.yaml" />
+        <option value="$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer.yaml" />
+        <option value="$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve-prod.yaml" />
+        <option value="$PROJECT_DIR$/syslog-serve/src/main/resources/application.properties" />
+        <option value="$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod.properties" />
+        <option value="$PROJECT_DIR$/syslog-consumer/src/main/resources/application.properties" />
       </list>
     </option>
   </component>
@@ -546,6 +484,11 @@
           <item name="security-xdr" type="9519ce18:MavenProjectsStructure$ProjectNode" />
           <item name="Lifecycle" type="58874e2:MavenProjectsStructure$LifecycleNode" />
         </path>
+        <path>
+          <item name="" type="16c1761:MavenProjectsStructure$RootNode" />
+          <item name="security-xdr" type="9519ce18:MavenProjectsStructure$ProjectNode" />
+          <item name="Plugins" type="7aea1407:MavenProjectsStructure$PluginsNode" />
+        </path>
         <path>
           <item name="" type="16c1761:MavenProjectsStructure$RootNode" />
           <item name="syslog-consumer" type="9519ce18:MavenProjectsStructure$ProjectNode" />
@@ -553,7 +496,7 @@
         <path>
           <item name="" type="16c1761:MavenProjectsStructure$RootNode" />
           <item name="syslog-consumer" type="9519ce18:MavenProjectsStructure$ProjectNode" />
-          <item name="Dependencies" type="f4be9f2a:MavenProjectsStructure$DependenciesNode" />
+          <item name="Lifecycle" type="58874e2:MavenProjectsStructure$LifecycleNode" />
         </path>
         <path>
           <item name="" type="16c1761:MavenProjectsStructure$RootNode" />
@@ -569,7 +512,7 @@
     </treeState>
   </component>
   <component name="ProjectFrameBounds" extendedState="6">
-    <option name="x" value="1912" />
+    <option name="x" value="-8" />
     <option name="y" value="-8" />
     <option name="width" value="1936" />
     <option name="height" value="1048" />
@@ -580,8 +523,6 @@
       <foldersAlwaysOnTop value="true" />
     </navigator>
     <panes>
-      <pane id="Scope" />
-      <pane id="PackagesPane" />
       <pane id="ProjectPane">
         <subPane>
           <expand>
@@ -599,12 +540,6 @@
               <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
               <item name="syslog-consumer" type="462c0819:PsiDirectoryNode" />
             </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer" type="462c0819:PsiDirectoryNode" />
-              <item name="docker-compose" type="462c0819:PsiDirectoryNode" />
-            </path>
             <path>
               <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
               <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
@@ -668,26 +603,6 @@
               <item name="service" type="462c0819:PsiDirectoryNode" />
               <item name="impl" type="462c0819:PsiDirectoryNode" />
             </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="java" type="462c0819:PsiDirectoryNode" />
-              <item name="com" type="462c0819:PsiDirectoryNode" />
-              <item name="haobang" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="java" type="462c0819:PsiDirectoryNode" />
-              <item name="com" type="462c0819:PsiDirectoryNode" />
-              <item name="influx" type="462c0819:PsiDirectoryNode" />
-            </path>
             <path>
               <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
               <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
@@ -706,95 +621,6 @@
               <item name="main" type="462c0819:PsiDirectoryNode" />
               <item name="resources" type="462c0819:PsiDirectoryNode" />
             </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="resources" type="462c0819:PsiDirectoryNode" />
-              <item name="mapper" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="docker-compose" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="java" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="java" type="462c0819:PsiDirectoryNode" />
-              <item name="com" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="java" type="462c0819:PsiDirectoryNode" />
-              <item name="com" type="462c0819:PsiDirectoryNode" />
-              <item name="config" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="java" type="462c0819:PsiDirectoryNode" />
-              <item name="com" type="462c0819:PsiDirectoryNode" />
-              <item name="Modules" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="java" type="462c0819:PsiDirectoryNode" />
-              <item name="com" type="462c0819:PsiDirectoryNode" />
-              <item name="Modules" type="462c0819:PsiDirectoryNode" />
-              <item name="NormalData" type="462c0819:PsiDirectoryNode" />
-            </path>
-            <path>
-              <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
-              <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
-              <item name="syslog-consumer-rule" type="462c0819:PsiDirectoryNode" />
-              <item name="src" type="462c0819:PsiDirectoryNode" />
-              <item name="main" type="462c0819:PsiDirectoryNode" />
-              <item name="resources" type="462c0819:PsiDirectoryNode" />
-            </path>
             <path>
               <item name="security-xdr" type="b2602c69:ProjectViewProjectNode" />
               <item name="haobang-security-dm" type="462c0819:PsiDirectoryNode" />
@@ -926,6 +752,8 @@
           <select />
         </subPane>
       </pane>
+      <pane id="PackagesPane" />
+      <pane id="Scope" />
     </panes>
   </component>
   <component name="PropertiesComponent">
@@ -935,7 +763,7 @@
     <property name="RequestMappingsPanelWidth1" value="75" />
     <property name="WebServerToolWindowFactoryState" value="false" />
     <property name="aspect.path.notification.shown" value="true" />
-    <property name="com.android.tools.idea.instantapp.provision.ProvisionBeforeRunTaskProvider.myTimeStamp" value="1784716681624" />
+    <property name="com.android.tools.idea.instantapp.provision.ProvisionBeforeRunTaskProvider.myTimeStamp" value="1785124069216" />
     <property name="last_opened_file_path" value="$PROJECT_DIR$" />
     <property name="nodejs_interpreter_path.stuck_in_default_project" value="undefined stuck path" />
     <property name="nodejs_npm_path_reset_for_default_project" value="true" />
@@ -1214,7 +1042,13 @@
       <workItem from="1784009878810" duration="756000" />
       <workItem from="1784098933694" duration="1292000" />
       <workItem from="1784713006111" duration="199000" />
-      <workItem from="1784716332411" duration="345000" />
+      <workItem from="1784716332411" duration="2291000" />
+      <workItem from="1784816089162" duration="1542000" />
+      <workItem from="1784968187519" duration="1693000" />
+      <workItem from="1784997075233" duration="780000" />
+      <workItem from="1785048788172" duration="4573000" />
+      <workItem from="1785121298680" duration="2555000" />
+      <workItem from="1785311137688" duration="1015000" />
     </task>
     <task id="LOCAL-00001" summary="1、修改算子运算结果后入库BUG&#10;2、根据设备ID获取设备IP、设备厂商、设备名称 信息补全标准化表&#10;3、完善告警表字段内容：syslog_normal_alarm: http_url -&gt;alarm: victim_web_url">
       <created>1769412046230</created>
@@ -1273,7 +1107,7 @@
     </history-entry>
   </component>
   <component name="TimeTrackingManager">
-    <option name="totallyTimeSpent" value="855904000" />
+    <option name="totallyTimeSpent" value="870008000" />
   </component>
   <component name="TodoView">
     <todo-panel id="selected-file">
@@ -1285,10 +1119,10 @@
     </todo-panel>
   </component>
   <component name="ToolWindowManager">
-    <frame x="1912" y="-8" width="1936" height="1048" extended-state="6" />
+    <frame x="-8" y="-8" width="1936" height="1048" extended-state="6" />
     <editor active="true" />
     <layout>
-      <window_info content_ui="combo" x="2058" y="127" width="479" height="485" id="Project" order="0" sideWeight="0.7275542" visible="true" weight="0.2707889" />
+      <window_info active="true" content_ui="combo" x="2058" y="127" width="479" height="485" id="Project" order="0" sideWeight="0.7275542" visible="true" weight="0.26599148" />
       <window_info id="Structure" order="1" sideWeight="0.4136253" side_tool="true" weight="0.2553305" />
       <window_info id="Designer" order="2" />
       <window_info id="Image Layers" order="3" />
@@ -1298,7 +1132,7 @@
       <window_info id="Web" order="7" sideWeight="0.4136253" side_tool="true" weight="0.2553305" />
       <window_info anchor="bottom" id="Message" order="0" />
       <window_info anchor="bottom" id="Find" order="1" weight="0.32932165" />
-      <window_info active="true" anchor="bottom" id="Run" order="2" sideWeight="0.69402987" visible="true" weight="0.43763676" />
+      <window_info anchor="bottom" id="Run" order="2" sideWeight="0.69402987" visible="true" weight="0.37199125" />
       <window_info anchor="bottom" id="Debug" order="3" sideWeight="0.7153518" weight="0.3785558" />
       <window_info anchor="bottom" id="Cvs" order="4" weight="0.25" />
       <window_info anchor="bottom" id="Inspection" order="5" weight="0.4" />
@@ -1315,7 +1149,7 @@
       <window_info anchor="right" content_ui="combo" id="Hierarchy" order="2" weight="0.25" />
       <window_info anchor="right" id="Palette" order="3" />
       <window_info anchor="right" id="Capture Analysis" order="4" />
-      <window_info anchor="right" id="Maven Projects" order="5" visible="true" weight="0.2260128" />
+      <window_info anchor="right" id="Maven Projects" order="5" visible="true" weight="0.19989339" />
       <window_info anchor="right" id="Database" order="6" weight="0.32995737" />
       <window_info anchor="right" id="Palette&#9;" order="7" />
       <window_info anchor="right" id="Theme Preview" order="8" />
@@ -1412,114 +1246,6 @@
     <option name="FILTER_TARGETS" value="false" />
   </component>
   <component name="editorHistoryManager">
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/SyslogNormalDataService.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="110">
-          <caret line="19" column="13" selection-start-line="19" selection-start-column="13" selection-end-line="19" selection-end-column="13" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/SyslogNormalDataMapper.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="1826">
-          <caret line="90" column="15" selection-start-line="90" selection-start-column="15" selection-end-line="90" selection-end-column="15" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="jar://$USER_HOME$/.m2/repository/org/springframework/spring-web/5.3.23/spring-web-5.3.23.jar!/org/springframework/http/MediaType.class">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="462">
-          <caret line="22" column="7" selection-start-line="22" selection-start-column="7" selection-end-line="22" selection-end-column="7" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/syslogconsumerrule.iml">
-      <provider selected="true" editor-type-id="text-editor" />
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/syslog-consumer-rule.iml">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="242">
-          <caret line="11" column="63" selection-start-line="11" selection-start-column="63" selection-end-line="11" selection-end-column="63" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/Modules/NormalData/LogNormalProcessor.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="198">
-          <caret line="33" column="13" selection-start-line="33" selection-start-column="13" selection-end-line="33" selection-end-column="13" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/Modules/NormalData/logNormalData.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="88">
-          <caret line="20" column="13" selection-start-line="20" selection-start-column="13" selection-end-line="20" selection-end-column="13" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/Modules/NormalData/SysLogProcessor.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="3036">
-          <caret line="151" column="30" lean-forward="true" selection-start-line="151" selection-start-column="30" selection-end-line="151" selection-end-column="30" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/kafka/kafkalogconsumer.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="66">
-          <caret line="27" column="13" selection-start-line="27" selection-start-column="13" selection-end-line="27" selection-end-column="13" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/config/AppConfig.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="88">
-          <caret line="8" column="13" selection-start-line="8" selection-start-column="13" selection-end-line="8" selection-end-column="13" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/config/AppProperties.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="220">
-          <caret line="12" column="13" selection-start-line="12" selection-start-column="13" selection-end-line="12" selection-end-column="13" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/config/KafkaConsumerProperties.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="374">
-          <caret line="19" column="46" selection-start-line="19" selection-start-column="46" selection-end-line="19" selection-end-column="46" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/config/KafkaConsumerProperties.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="506">
-          <caret line="25" column="19" selection-start-line="25" selection-start-column="19" selection-end-line="25" selection-end-column="19" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/java/com/Modules/Device/DeviceProcess.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="1078">
-          <caret line="69" column="65" selection-start-line="69" selection-start-column="65" selection-end-line="69" selection-end-column="65" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/java/com/common/service/DeviceDeviceService.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="154">
-          <caret line="9" column="30" selection-start-line="9" selection-start-column="30" selection-end-line="9" selection-end-column="30" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/java/com/common/controller/BlacklistController.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="154">
-          <caret line="10" column="13" selection-start-line="10" selection-start-column="13" selection-end-line="10" selection-end-column="13" />
-        </state>
-      </provider>
-    </entry>
     <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/java/com/common/controller/DeviceCollectTaskController.java">
       <provider selected="true" editor-type-id="text-editor">
         <state relative-caret-position="132">
@@ -1572,60 +1298,6 @@
     <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/application-dev.properties">
       <provider selected="true" editor-type-id="text-editor" />
     </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/application.properties">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="550">
-          <caret line="56" column="21" selection-start-line="56" selection-start-column="13" selection-end-line="56" selection-end-column="21" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-prod.yaml">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="399">
-          <caret line="43" column="15" lean-forward="true" selection-start-line="43" selection-start-column="15" selection-end-line="43" selection-end-column="15" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/application-prod.properties">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="330">
-          <caret line="42" column="53" selection-start-line="42" selection-start-column="53" selection-end-line="42" selection-end-column="53" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer.yaml">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="704">
-          <caret line="44" column="30" selection-start-line="44" selection-start-column="30" selection-end-line="44" selection-end-column="30" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-nw.yaml">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="-264" />
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="330">
-          <caret line="69" column="54" lean-forward="true" selection-start-line="69" selection-start-column="54" selection-end-line="69" selection-end-column="54" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve-prod.yaml">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="-613">
-          <caret line="18" column="27" lean-forward="true" selection-start-line="18" selection-start-column="27" selection-end-line="18" selection-end-column="27" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod.properties">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="242">
-          <caret line="11" column="30" lean-forward="true" selection-start-line="11" selection-start-column="30" selection-end-line="11" selection-end-column="30" />
-        </state>
-      </provider>
-    </entry>
     <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/java/com/Modules/NormalData/SysLogProcessor.java">
       <provider selected="true" editor-type-id="text-editor">
         <state relative-caret-position="5632">
@@ -1633,37 +1305,6 @@
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application.properties">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="2156">
-          <caret line="98" selection-start-line="98" selection-end-line="98" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-test.properties">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="660">
-          <caret line="30" column="24" selection-start-line="30" selection-start-column="24" selection-end-line="30" selection-end-column="24" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-dev.properties">
-      <provider selected="true" editor-type-id="text-editor" />
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-prod-zc.properties">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="880">
-          <caret line="40" column="43" selection-start-line="40" selection-start-column="43" selection-end-line="40" selection-end-column="43" />
-        </state>
-      </provider>
-    </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-prod.properties">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="682">
-          <caret line="31" column="27" selection-start-line="31" selection-start-column="27" selection-end-line="31" selection-end-column="27" />
-        </state>
-      </provider>
-    </entry>
     <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/controllers/SyslogController.java">
       <provider selected="true" editor-type-id="text-editor">
         <state relative-caret-position="1870">
@@ -1678,13 +1319,6 @@
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/AccessLogAlertService.java">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="10120">
-          <caret line="491" column="22" selection-start-line="491" selection-start-column="22" selection-end-line="491" selection-end-column="22" />
-        </state>
-      </provider>
-    </entry>
     <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/SyslogNormalAlarmMapper.xml">
       <provider selected="true" editor-type-id="text-editor" />
     </entry>
@@ -1730,13 +1364,6 @@
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod-zc.properties">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="242">
-          <caret line="11" column="30" selection-start-line="11" selection-start-column="24" selection-end-line="11" selection-end-column="30" />
-        </state>
-      </provider>
-    </entry>
     <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/SqlGeneratorServiceImpl.java">
       <provider selected="true" editor-type-id="text-editor">
         <state relative-caret-position="286">
@@ -1746,8 +1373,206 @@
     </entry>
     <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="317">
-          <caret line="43" lean-forward="true" selection-start-line="43" selection-end-line="43" />
+        <state relative-caret-position="550">
+          <caret line="36" column="92" selection-start-line="36" selection-start-column="92" selection-end-line="36" selection-end-column="92" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/mapper/AnalysisAnalysisRuleMapper.java">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="682">
+          <caret line="36" column="19" selection-start-line="36" selection-start-column="19" selection-end-line="36" selection-end-column="19" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/DmNormalizeRuleMapper.xml">
+      <provider selected="true" editor-type-id="text-editor" />
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/mybatis-config.xml">
+      <provider selected="true" editor-type-id="text-editor" />
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/logback.xml">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="836">
+          <caret line="38" column="16" selection-start-line="38" selection-start-column="16" selection-end-line="38" selection-end-column="16" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/mybatis-config-dev.xml">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="352">
+          <caret line="16" column="49" selection-start-line="16" selection-start-column="49" selection-end-line="16" selection-end-column="49" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/mapper/AnalysisAnalysisRuleMapper.xml">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="572">
+          <caret line="47" column="47" selection-start-line="47" selection-start-column="47" selection-end-line="47" selection-end-column="47" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-test.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="330">
+          <caret line="15" column="26" selection-start-line="15" selection-start-column="26" selection-end-line="15" selection-end-column="26" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-prod-zc.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="841">
+          <caret line="40" column="43" selection-start-line="40" selection-start-column="43" selection-end-line="40" selection-end-column="43" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="308">
+          <caret line="14" column="19" selection-start-line="14" selection-start-column="19" selection-end-line="14" selection-end-column="19" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-dev.properties">
+      <provider selected="true" editor-type-id="text-editor" />
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-pre-nw.properties">
+      <provider selected="true" editor-type-id="text-editor" />
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/src/main/resources/application-prod.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="308">
+          <caret line="14" selection-start-line="14" selection-end-line="14" selection-end-column="23" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod-zc.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="242">
+          <caret line="11" column="30" selection-start-line="11" selection-start-column="24" selection-end-line="11" selection-end-column="30" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="682">
+          <caret line="31" selection-start-line="31" selection-end-line="33" selection-end-column="31" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer-nw.yaml">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="814">
+          <caret line="37" selection-start-line="37" selection-end-line="39" selection-end-column="31" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-prod.yaml">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="528">
+          <caret line="24" column="33" selection-start-line="24" selection-start-column="33" selection-end-line="24" selection-end-column="33" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="242">
+          <caret line="11" column="30" selection-start-line="11" selection-start-column="30" selection-end-line="11" selection-end-column="30" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve-prod.yaml">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="638">
+          <caret line="29" column="67" selection-start-line="29" selection-start-column="67" selection-end-line="29" selection-end-column="67" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-serve/docker-compose/docker-compose-serve.yaml">
+      <provider selected="true" editor-type-id="text-editor" />
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/kafka/kafkalogconsumer.java">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="66">
+          <caret line="27" column="13" selection-start-line="27" selection-start-column="13" selection-end-line="27" selection-end-column="13" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/schedule/RealtimeAnalysisScheduler.java">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="1452">
+          <caret line="84" column="75" selection-start-line="84" selection-start-column="75" selection-end-line="84" selection-end-column="75" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RuleExecutionTimeServiceImpl.java">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="572">
+          <caret line="38" column="24" selection-start-line="38" selection-start-column="24" selection-end-line="38" selection-end-column="24" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application-dev.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="946">
+          <caret line="43" column="43" selection-start-line="43" selection-start-column="27" selection-end-line="43" selection-end-column="43" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer-rule/docker-compose/docker-compose-consumer-rule-prod.yaml">
+      <provider selected="true" editor-type-id="text-editor" />
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/docker-compose/docker-compose-consumer.yaml">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="836">
+          <caret line="38" column="30" selection-start-line="38" selection-start-column="30" selection-end-line="38" selection-end-column="30" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/AccessLogAlertService.java">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="9086">
+          <caret line="444" column="43" selection-start-line="444" selection-start-column="43" selection-end-line="444" selection-end-column="43" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-serve/src/main/resources/application-prod.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="506">
+          <caret line="23" column="7" selection-start-line="23" selection-start-column="7" selection-end-line="23" selection-end-column="7" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="181">
+          <caret line="20" column="13" selection-start-line="20" selection-start-column="13" selection-end-line="20" selection-end-column="13" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="406">
+          <caret line="178" column="47" lean-forward="true" selection-start-line="178" selection-start-column="47" selection-end-line="178" selection-end-column="47" />
+          <folding>
+            <element signature="e#9930#9931#0" expanded="true" />
+            <element signature="e#9961#9962#0" expanded="true" />
+            <element signature="e#27830#27860#0" expanded="true" />
+          </folding>
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/application-prod.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="594">
+          <caret line="42" column="53" selection-start-line="42" selection-start-column="53" selection-end-line="42" selection-end-column="53" />
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/syslog-consumer/src/main/resources/application.properties">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="413">
+          <caret line="146" lean-forward="true" selection-start-line="146" selection-end-line="146" />
         </state>
       </provider>
     </entry>
diff --git a/haobang-security-dm/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml b/haobang-security-dm/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml
index 18c7b7a..05a97b3 100644
--- a/haobang-security-dm/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml
+++ b/haobang-security-dm/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml
@@ -88,6 +88,11 @@ services:
       # 关联分析规则配置
       - ANALYSIS_REALTIME_ENABLED=true
       - ANALYSIS_REALTIME_CHECK_INTERVAL_SECONDS=10
+
+      # 关联分析规则达梦安全版子查询模式开关（默认false，生产环境达梦安全版设为true）
+      # true → 使用 RealtimeAnalysisEngineDm，子查询包装SQL，适配 GROUP BY 不支持自定义函数
+      # false → 使用 RealtimeAnalysisEngine，平铺SQL（原有行为）
+      - ANALYSIS_DB_DAMENG_SUBQUERY_MODE=false
       # 分区表检查配置
       - PARTITION_CHECK_TOMORROW_ENABLED=true
       - PARTITION_CHECK_FUTURE_DAYS=7
diff --git a/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java b/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java
index d5b7b98..5c869a5 100644
--- a/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java
+++ b/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java
@@ -151,7 +151,12 @@ public class OfflineAnalysisEngine implements AnalysisEngine {
                 if (!alarms.isEmpty()) {
                     //String tableName = "alarm_" + dataStartTime.format(DateTimeFormatter.ofPattern("yyyyMMdd"));
                     String tableName = "alarm";
-                    alarmMapper.batchInsert( alarms);
+                    // 分批插入，每批1000条，防止达梦参数超过65535上限
+                    int alarmBatchSize = 1000;
+                    for (int i = 0; i < alarms.size(); i += alarmBatchSize) {
+                        int end = Math.min(i + alarmBatchSize, alarms.size());
+                        alarmMapper.batchInsert(alarms.subList(i, end));
+                    }
                     alarmCount = alarms.size();
                 }
             }
diff --git a/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java b/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java
index 4bd641c..44d58c7 100644
--- a/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java
+++ b/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java
@@ -1,5 +1,6 @@
 package com.common.service.impl;
 
+import com.alibaba.fastjson.JSON;
 import com.common.entity.*;
 import com.common.mapper.*;
 import com.common.service.AnalysisEngine;
@@ -169,7 +170,12 @@ public class RealtimeAnalysisEngine implements AnalysisEngine {
                 if (!alarms.isEmpty()) {
                     //String tableName = "alarm_" + dataStartTime.format(DateTimeFormatter.ofPattern("yyyyMMdd"));
                     String tableName = "alarm";
-                    alarmMapper.batchInsert( alarms);
+                    // 分批插入，每批1000条，防止达梦参数超过65535上限
+                    int alarmBatchSize = 1000;
+                    for (int i = 0; i < alarms.size(); i += alarmBatchSize) {
+                        int end = Math.min(i + alarmBatchSize, alarms.size());
+                        alarmMapper.batchInsert(alarms.subList(i, end));
+                    }
                     alarmCount = alarms.size();
                 }
             }
@@ -744,16 +750,26 @@ public class RealtimeAnalysisEngine implements AnalysisEngine {
         // 达梦 JSONB_AGG 返回 JSON 数组格式，如 "[41614, 8080]"
         String str = value.toString();
         if (str.startsWith("[") && str.endsWith("]")) {
+            // 使用 fastjson 正确解析 JSON 数组，避免 split(",") 误处理含逗号/引号的元素
+            // （如 HTTP 头 "Accept: text/html, */*" 等包含逗号的字符串）
+            try {
+                List<String> parsed = JSON.parseArray(str, String.class);
+                if (parsed != null) {
+                    return parsed.toArray(new String[0]);
+                }
+            } catch (Exception e) {
+                log.warn("fastjson解析JSON数组失败，使用回退逻辑: {}", str, e);
+            }
+            // 回退逻辑：简单 JSON 数组（纯数字/无嵌套引号）仍用 split，加长度检查防越界
             str = str.substring(1, str.length() - 1).trim();
             if (str.isEmpty()) {
                 return new String[0];
             }
-            // 拆分 JSON 数组元素（兼容带引号和纯数字）
             String[] parts = str.split(",");
             String[] result = new String[parts.length];
             for (int i = 0; i < parts.length; i++) {
                 String part = parts[i].trim();
-                if (part.startsWith("\"") && part.endsWith("\"")) {
+                if (part.length() > 1 && part.startsWith("\"") && part.endsWith("\"")) {
                     part = part.substring(1, part.length() - 1);
                 }
                 result[i] = part;
diff --git a/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java b/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java
index e32f532..b47340d 100644
--- a/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java
+++ b/haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java
@@ -1,5 +1,6 @@
 package com.common.service.impl;
 
+import com.alibaba.fastjson.JSON;
 import com.common.entity.*;
 import com.common.mapper.*;
 import com.common.service.AnalysisEngine;
@@ -155,7 +156,12 @@ public class RealtimeAnalysisEngineDm implements AnalysisEngine {
                 List<Alarm> alarms = convertToAlarms(rule, queryResult);
                 if (!alarms.isEmpty()) {
                     String tableName = "alarm";
-                    alarmMapper.batchInsert(alarms);
+                    // 分批插入，每批1000条，防止达梦参数超过65535上限
+                    int alarmBatchSize = 1000;
+                    for (int i = 0; i < alarms.size(); i += alarmBatchSize) {
+                        int end = Math.min(i + alarmBatchSize, alarms.size());
+                        alarmMapper.batchInsert(alarms.subList(i, end));
+                    }
                     alarmCount = alarms.size();
                 }
             }
@@ -701,6 +707,16 @@ public class RealtimeAnalysisEngineDm implements AnalysisEngine {
         }
         String str = value.toString();
         if (str.startsWith("[") && str.endsWith("]")) {
+            // 使用 fastjson 正确解析 JSON 数组，避免 split(",") 误处理含逗号/引号的元素
+            try {
+                List<String> parsed = JSON.parseArray(str, String.class);
+                if (parsed != null) {
+                    return parsed.toArray(new String[0]);
+                }
+            } catch (Exception e) {
+                log.warn("fastjson解析JSON数组失败，使用回退逻辑: {}", str, e);
+            }
+            // 回退逻辑：简单 JSON 数组仍用 split，加长度检查防越界
             str = str.substring(1, str.length() - 1).trim();
             if (str.isEmpty()) {
                 return new String[0];
@@ -709,7 +725,7 @@ public class RealtimeAnalysisEngineDm implements AnalysisEngine {
             String[] result = new String[parts.length];
             for (int i = 0; i < parts.length; i++) {
                 String part = parts[i].trim();
-                if (part.startsWith("\"") && part.endsWith("\"")) {
+                if (part.length() > 1 && part.startsWith("\"") && part.endsWith("\"")) {
                     part = part.substring(1, part.length() - 1);
                 }
                 result[i] = part;
diff --git a/haobang-security-dm/syslog-consumer/src/main/resources/application-prod.properties b/haobang-security-dm/syslog-consumer/src/main/resources/application-prod.properties
index 9aa89e1..11ba24d 100644
--- a/haobang-security-dm/syslog-consumer/src/main/resources/application-prod.properties
+++ b/haobang-security-dm/syslog-consumer/src/main/resources/application-prod.properties
@@ -140,7 +140,7 @@ spring.datasource.hikari.idle-timeout=600000
 spring.datasource.hikari.max-lifetime=900000
 spring.datasource.hikari.connection-test-query=SELECT 1 FROM DUAL
 spring.datasource.hikari.validation-timeout=5000
-spring.datasource.hikari.leak-detection-threshold=30000          
+spring.datasource.hikari.leak-detection-threshold=300000          
 spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
 spring.datasource.hikari.auto-commit=false
 
diff --git a/haobang-security-dm/syslog-serve/docker-compose/docker-compose-serve-prod.yaml b/haobang-security-dm/syslog-serve/docker-compose/docker-compose-serve-prod.yaml
index d35a225..2e93ece 100644
--- a/haobang-security-dm/syslog-serve/docker-compose/docker-compose-serve-prod.yaml
+++ b/haobang-security-dm/syslog-serve/docker-compose/docker-compose-serve-prod.yaml
@@ -30,6 +30,7 @@ services:
       - SPRING_DATASOURCE_DRIVER_CLASS_NAME=dm.jdbc.driver.DmDriver
       - SPRING_DATASOURCE_HIKARI_SCHEMA=\"PUBLIC\"
 
+
       # Redis配置
       - SPRING_REDIS_HOST=192.168.4.99
       - SPRING_REDIS_PORT=6379
diff --git a/haobang-security-dm/syslog-serve/src/main/resources/application-prod.properties b/haobang-security-dm/syslog-serve/src/main/resources/application-prod.properties
index 3f5b10d..a3146be 100644
--- a/haobang-security-dm/syslog-serve/src/main/resources/application-prod.properties
+++ b/haobang-security-dm/syslog-serve/src/main/resources/application-prod.properties
@@ -9,8 +9,8 @@ server.error.include-binding-errors=always
 # Syslog Server Configuration
 syslog.tcp.port=514
 syslog.udp.port=514
-syslog.max.frame.length=262144
-syslog.buffer.size=1000
+syslog.max.frame.length=2621440
+syslog.buffer.size=10000
 # syslog 消息字符编码，国内安全设备普遍使用 GBK，如需 UTF-8 改为 syslog.charset=UTF-8
 syslog.charset=UTF-8
 syslog.sm4.generateKey=f79548ab6fa8a304fc0115e17230358a