1、getStringArray 函数报错

2、调整配置文件spring.datasource.hikari.leak-detection-threshold=300000 ，连接池泄露问题
3、修改关联分析规则批量插入记录的参数超过65535的限制，改用每批次1000条。

haobang-security-dm/syslog-consumer/docker-compose/docker-compose-consumer-prod.yaml

@@ -88,6 +88,11 @@ services:
       # 关联分析规则配置
       - ANALYSIS_REALTIME_ENABLED=true
       - ANALYSIS_REALTIME_CHECK_INTERVAL_SECONDS=10
+
+      # 关联分析规则达梦安全版子查询模式开关（默认false，生产环境达梦安全版设为true）
+      # true → 使用 RealtimeAnalysisEngineDm，子查询包装SQL，适配 GROUP BY 不支持自定义函数
+      # false → 使用 RealtimeAnalysisEngine，平铺SQL（原有行为）
+      - ANALYSIS_DB_DAMENG_SUBQUERY_MODE=false
       # 分区表检查配置
       - PARTITION_CHECK_TOMORROW_ENABLED=true
       - PARTITION_CHECK_FUTURE_DAYS=7

haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/OfflineAnalysisEngine.java

@@ -151,7 +151,12 @@ public class OfflineAnalysisEngine implements AnalysisEngine {
                 if (!alarms.isEmpty()) {
                     //String tableName = "alarm_" + dataStartTime.format(DateTimeFormatter.ofPattern("yyyyMMdd"));
                     String tableName = "alarm";
-                    alarmMapper.batchInsert( alarms);
+                    // 分批插入，每批1000条，防止达梦参数超过65535上限
+                    int alarmBatchSize = 1000;
+                    for (int i = 0; i < alarms.size(); i += alarmBatchSize) {
+                        int end = Math.min(i + alarmBatchSize, alarms.size());
+                        alarmMapper.batchInsert(alarms.subList(i, end));
+                    }
                     alarmCount = alarms.size();
                 }
             }

haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngine.java

@@ -1,5 +1,6 @@
 package com.common.service.impl;
 
+import com.alibaba.fastjson.JSON;
 import com.common.entity.*;
 import com.common.mapper.*;
 import com.common.service.AnalysisEngine;
@@ -169,7 +170,12 @@ public class RealtimeAnalysisEngine implements AnalysisEngine {
                 if (!alarms.isEmpty()) {
                     //String tableName = "alarm_" + dataStartTime.format(DateTimeFormatter.ofPattern("yyyyMMdd"));
                     String tableName = "alarm";
-                    alarmMapper.batchInsert( alarms);
+                    // 分批插入，每批1000条，防止达梦参数超过65535上限
+                    int alarmBatchSize = 1000;
+                    for (int i = 0; i < alarms.size(); i += alarmBatchSize) {
+                        int end = Math.min(i + alarmBatchSize, alarms.size());
+                        alarmMapper.batchInsert(alarms.subList(i, end));
+                    }
                     alarmCount = alarms.size();
                 }
             }
@@ -744,16 +750,26 @@ public class RealtimeAnalysisEngine implements AnalysisEngine {
         // 达梦 JSONB_AGG 返回 JSON 数组格式，如 "[41614, 8080]"
         String str = value.toString();
         if (str.startsWith("[") && str.endsWith("]")) {
+            // 使用 fastjson 正确解析 JSON 数组，避免 split(",") 误处理含逗号/引号的元素
+            // （如 HTTP 头 "Accept: text/html, */*" 等包含逗号的字符串）
+            try {
+                List<String> parsed = JSON.parseArray(str, String.class);
+                if (parsed != null) {
+                    return parsed.toArray(new String[0]);
+                }
+            } catch (Exception e) {
+                log.warn("fastjson解析JSON数组失败，使用回退逻辑: {}", str, e);
+            }
+            // 回退逻辑：简单 JSON 数组（纯数字/无嵌套引号）仍用 split，加长度检查防越界
             str = str.substring(1, str.length() - 1).trim();
             if (str.isEmpty()) {
                 return new String[0];
             }
-            // 拆分 JSON 数组元素（兼容带引号和纯数字）
             String[] parts = str.split(",");
             String[] result = new String[parts.length];
             for (int i = 0; i < parts.length; i++) {
                 String part = parts[i].trim();
-                if (part.startsWith("\"") && part.endsWith("\"")) {
+                if (part.length() > 1 && part.startsWith("\"") && part.endsWith("\"")) {
                     part = part.substring(1, part.length() - 1);
                 }
                 result[i] = part;

haobang-security-dm/syslog-consumer/src/main/java/com/common/service/impl/RealtimeAnalysisEngineDm.java

@@ -1,5 +1,6 @@
 package com.common.service.impl;
 
+import com.alibaba.fastjson.JSON;
 import com.common.entity.*;
 import com.common.mapper.*;
 import com.common.service.AnalysisEngine;
@@ -155,7 +156,12 @@ public class RealtimeAnalysisEngineDm implements AnalysisEngine {
                 List<Alarm> alarms = convertToAlarms(rule, queryResult);
                 if (!alarms.isEmpty()) {
                     String tableName = "alarm";
-                    alarmMapper.batchInsert(alarms);
+                    // 分批插入，每批1000条，防止达梦参数超过65535上限
+                    int alarmBatchSize = 1000;
+                    for (int i = 0; i < alarms.size(); i += alarmBatchSize) {
+                        int end = Math.min(i + alarmBatchSize, alarms.size());
+                        alarmMapper.batchInsert(alarms.subList(i, end));
+                    }
                     alarmCount = alarms.size();
                 }
             }
@@ -701,6 +707,16 @@ public class RealtimeAnalysisEngineDm implements AnalysisEngine {
         }
         String str = value.toString();
         if (str.startsWith("[") && str.endsWith("]")) {
+            // 使用 fastjson 正确解析 JSON 数组，避免 split(",") 误处理含逗号/引号的元素
+            try {
+                List<String> parsed = JSON.parseArray(str, String.class);
+                if (parsed != null) {
+                    return parsed.toArray(new String[0]);
+                }
+            } catch (Exception e) {
+                log.warn("fastjson解析JSON数组失败，使用回退逻辑: {}", str, e);
+            }
+            // 回退逻辑：简单 JSON 数组仍用 split，加长度检查防越界
             str = str.substring(1, str.length() - 1).trim();
             if (str.isEmpty()) {
                 return new String[0];
@@ -709,7 +725,7 @@ public class RealtimeAnalysisEngineDm implements AnalysisEngine {
             String[] result = new String[parts.length];
             for (int i = 0; i < parts.length; i++) {
                 String part = parts[i].trim();
-                if (part.startsWith("\"") && part.endsWith("\"")) {
+                if (part.length() > 1 && part.startsWith("\"") && part.endsWith("\"")) {
                     part = part.substring(1, part.length() - 1);
                 }
                 result[i] = part;

haobang-security-dm/syslog-consumer/src/main/resources/application-prod.properties

@@ -140,7 +140,7 @@ spring.datasource.hikari.idle-timeout=600000
 spring.datasource.hikari.max-lifetime=900000
 spring.datasource.hikari.connection-test-query=SELECT 1 FROM DUAL
 spring.datasource.hikari.validation-timeout=5000
-spring.datasource.hikari.leak-detection-threshold=30000          
+spring.datasource.hikari.leak-detection-threshold=300000          
 spring.datasource.hikari.pool-name=HikariPool-SyslogConsumer
 spring.datasource.hikari.auto-commit=false
 

haobang-security-dm/syslog-serve/docker-compose/docker-compose-serve-prod.yaml

@@ -30,6 +30,7 @@ services:
       - SPRING_DATASOURCE_DRIVER_CLASS_NAME=dm.jdbc.driver.DmDriver
       - SPRING_DATASOURCE_HIKARI_SCHEMA=\"PUBLIC\"
 
+
       # Redis配置
       - SPRING_REDIS_HOST=192.168.4.99
       - SPRING_REDIS_PORT=6379

haobang-security-dm/syslog-serve/src/main/resources/application-prod.properties

@@ -9,8 +9,8 @@ server.error.include-binding-errors=always
 # Syslog Server Configuration
 syslog.tcp.port=514
 syslog.udp.port=514
-syslog.max.frame.length=262144
+syslog.max.frame.length=2621440
-syslog.buffer.size=1000
+syslog.buffer.size=10000
 # syslog 消息字符编码，国内安全设备普遍使用 GBK，如需 UTF-8 改为 syslog.charset=UTF-8
 syslog.charset=UTF-8
 syslog.sm4.generateKey=f79548ab6fa8a304fc0115e17230358a