支持拼接app_name和parent_app_name字符串v4.1.0

修正配置文件

13 files changed, 192 insertions, 174 deletions

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 6d051ac..9cea789 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -49,6 +49,7 @@ install(FILES bin/tsg_static_tableinfo.conf DESTINATION ${CMAKE_INSTALL_PREFIX}/
 install(FILES bin/tsg_dynamic_tableinfo.conf DESTINATION ${CMAKE_INSTALL_PREFIX}/tsgconf COMPONENT PROFILE)
 install(FILES bin/tsg_log_field.conf DESTINATION ${CMAKE_INSTALL_PREFIX}/tsgconf COMPONENT PROFILE)
 install(FILES bin/app_l7_proto_id.conf DESTINATION ${CMAKE_INSTALL_PREFIX}/tsgconf COMPONENT PROFILE)
+install(FILES bin/tsg_l7_protocol.conf DESTINATION ${CMAKE_INSTALL_PREFIX}/tsgconf COMPONENT PROFILE)
 install(FILES bin/tsg_maat.json DESTINATION ${CMAKE_INSTALL_PREFIX}/tsgconf COMPONENT PROFILE)
 
 install(FILES inc/tsg_send_log.h DESTINATION /opt/MESA/include/tsg COMPONENT HEADER)
diff --git a/bin/app_l7_proto_id.conf b/bin/app_l7_proto_id.conf
index 8c48b31..525133f 100644
--- a/bin/app_l7_proto_id.conf
+++ b/bin/app_l7_proto_id.conf
@@ -1,8 +1,8 @@
 #TYPE：1:UCHAR,2:USHORT,3:USTRING,4:ULOG,5:USTRING,6:FILE,7:UBASE64,8:PACKET
 #TYPE	FIELD		VALUE
 STRING	UNCATEGORIZED	100
-STRING	UNCATEGORIZED	101
-STRING	UNKNOWN_OTHER	102
+#STRING	UNCATEGORIZED	101
+#STRING	UNKNOWN_OTHER	102
 STRING	DNS		103
 STRING	FTP		104
 STRING	FTPS		105
diff --git a/bin/maat.conf b/bin/maat.conf
index ec29619..7a2ddfc 100644
--- a/bin/maat.conf
+++ b/bin/maat.conf
@@ -30,5 +30,21 @@ INC_CFG_DIR=tsgrule/inc/index/
 FULL_CFG_DIR=tsgrule/full/index/
 EFFECTIVE_RANGE_FILE=/opt/tsg/etc/tsg_device_tag.json
 
+[APP_SIGNATURE_MAAT]
+MAAT_MODE=1
+STAT_SWITCH=1
+PERF_SWITCH=1
+TABLE_INFO=tsgconf/app_sketch_tableinfo.conf
+STAT_FILE=app_sketch_maat.status
+EFFECT_INTERVAL_S=1
+REDIS_IP=127.0.0.1
+REDIS_PORT_NUM=1
+REDIS_PORT=7002
+REDIS_INDEX=0
+JSON_CFG_FILE=tsgconf/app_sketch_maat.json
+INC_CFG_DIR=tsgrule/inc/index/
+FULL_CFG_DIR=tsgrule/full/index/
+EFFECTIVE_RANGE_FILE=/opt/tsg/etc/tsg_device_tag.json
+
 [MAAT]
 ACCEPT_TAGS={"tags":[{"tag":"device_id","value":"device_1"}]}
diff --git a/bin/main.conf b/bin/main.conf
index 2e9e042..25e85d7 100644
--- a/bin/main.conf
+++ b/bin/main.conf
@@ -1,35 +1,40 @@
 [MAAT]
-PROFILE=./tsgconf/maat.conf
-IP_ADDR_TABLE=TSG_SECURITY_ADDR
-SUBSCRIBER_ID_TABLE=TSG_OBJ_SUBSCRIBER_ID
-CB_SUBSCRIBER_IP_TABLE=TSG_DYN_SUBSCRIBER_IP
+PROFILE="./tsgconf/maat.conf"
+IP_ADDR_TABLE="TSG_SECURITY_ADDR"
+SUBSCRIBER_ID_TABLE="TSG_OBJ_SUBSCRIBER_ID"
+CB_SUBSCRIBER_IP_TABLE="TSG_DYN_SUBSCRIBER_IP"
 
 [TSG_LOG]
 MODE=1
-NIC_NAME=lo
+NIC_NAME="lo"
 LOG_LEVEL=10
-LOG_PATH=./tsglog/tsglog
-BROKER_LIST=127.0.0.1:9092
-COMMON_FIELD_FILE=tsgconf/tsg_log_field.conf
+LOG_PATH="./tsglog/tsglog"
+BROKER_LIST="127.0.0.1:9092"
+COMMON_FIELD_FILE="tsgconf/tsg_log_field.conf"
 
 [STATISTIC]
 CYCLE=30
 TELEGRAF_PORT=8100
-TELEGRAF_IP=127.0.0.1
-OUTPUT_PATH=./tsg_statistic.log
-APP_NAME=statistic
+TELEGRAF_IP="127.0.0.1"
+OUTPUT_PATH="./tsg_statistic.log"
+APP_NAME="statistic"
 
 [FIELD_STAT]
 CYCLE=30
 TELEGRAF_PORT=8125
-TELEGRAF_IP=127.0.0.1
-OUTPUT_PATH=./tsg_stat.log
-APP_NAME=tsg_master
+TELEGRAF_IP="127.0.0.1"
+OUTPUT_PATH="./tsg_stat.log"
+APP_NAME="tsg_master"
 
 [SYSTEM]
 ENTRANCE_ID=18
 LOG_LEVEL=10
-LOG_PATH=./tsglog/tsg_master
-POLICY_PRIORITY_LABEL=POLICY_PRIORITY
+SCAN_TIME_INTERVAL=5
+DEFAULT_POLICY_ID=0
+DEFAULT_POLICY_SWITCH=0
+LOG_PATH="./tsglog/tsg_master"
+APP_BRIDGE_NAME="APP_BRIDGE"
+POLICY_PRIORITY_LABEL="POLICY_PRIORITY"
 L7_RPTOCOL_FILE="./tsgconf/tsg_l7_protocol.conf"
-DEVICE_ID_COMMAND=hostname | awk -F'-' '{print $3}'| awk -F'ADC' '{print $2}'
\ No newline at end of file
+DEVICE_SN_FILENAME="/opt/tsg/etc/tsg_sn.json"
+DEVICE_ID_COMMAND="hostname | awk -F'-' '{print $3}'| awk -F'ADC' '{print $2}'"
\ No newline at end of file
diff --git a/bin/tsg_l7_protocol.conf b/bin/tsg_l7_protocol.conf
index 9c287c1..7b53843 100644
--- a/bin/tsg_l7_protocol.conf
+++ b/bin/tsg_l7_protocol.conf
@@ -1,8 +1,8 @@
 #TYPE：1:UCHAR,2:USHORT,3:USTRING,4:ULOG,5:USTRING,6:FILE,7:UBASE64,8:PACKET
 #TYPE	FIELD		VALUE
 STRING	UNCATEGORIZED	15001
-STRING	UNCATEGORIZED	15002
-STRING	UNKNOWN_OTHER	15003
+#STRING	UNCATEGORIZED	15002
+#STRING	UNKNOWN_OTHER	15003
 STRING	DNS		32
 STRING	FTP		45
 STRING	FTPS		751
@@ -52,4 +52,4 @@ STRING	BJNP		2481
 STRING	LDAP		100
 STRING	RTMP		337
 STRING	RTSP		176
-STRING	ESNI		15009
+STRING	ESNI		8008
diff --git a/bin/tsg_maat.json b/bin/tsg_maat.json
index b8bbdb2..1d2db87 100644
--- a/bin/tsg_maat.json
+++ b/bin/tsg_maat.json
@@ -1,55 +1,34 @@
 {
     "compile_table": "TSG_SECURITY_COMPILE",
-    "group_table": "GROUP_COMPILE_RELATION",
+    "group2compile_table": "GROUP_COMPILE_RELATION",
+    "group2group_table": "GROUP_GROUP_RELATION",
     "rules": [
-        {
-            "compile_id": 1,
+	    {
+            "compile_id": 2,
             "service": 0,
-            "action": 128,
+            "action": 1,
             "do_blacklist": 0,
             "do_log": 1,
             "effective_rage": 0,
-            "user_region": "anything",
+            "user_region": "Virtual",
             "is_valid": "yes",
             "groups": [
                 {
-                    "group_name": "IP_ADDR_1",
+                    "group_name":"OBJ_DST_IP_ADDR",
+                    "virtual_table":"TSG_SECURITY_SOURCE_ADDR",
+                    "not_flag" : 0,
                     "regions": [
-                        {
-                            "table_name": "TSG_OBJ_IP_ADDR",
+                        {  
                             "table_type": "ip_plus",
-                            "table_content": {
-                                "addr_type": "ipv4",
-                                "src_ip": "192.168.100.5",
-                                "mask_src_ip": "255.255.255.255",
-                                "src_port": "0",
-                                "mask_src_port": "65535",
-                                "dst_ip": "0.0.0.0",
-                                "mask_dst_ip": "255.255.255.255",
-                                "dst_port": "0",
-                                "mask_dst_port": "65535",
-                                "protocol": 6,
-                                "direction": "double"
-                            }
-                        }
-                    ]
-                },
-                {
-                    "group_name": "IP_ADDR_2",
-                    "regions": [
-                        {
                             "table_name": "TSG_OBJ_IP_ADDR",
-                            "table_type": "ip_plus",
                             "table_content": {
                                 "addr_type": "ipv4",
-                                "src_ip": "192.168.50.37",
-                                "mask_src_ip": "255.255.255.255",
-                                "src_port": "0",
-                                "mask_src_port": "65535",
-                                "dst_ip": "0.0.0.0",
-                                "mask_dst_ip": "255.255.255.255",
-                                "dst_port": "0",
-                                "mask_dst_port": "65535",
+                                "saddr_format": "range",
+                                "src_ip1": "192.168.41.228",
+                                "src_ip2": "192.168.41.228",
+                                "sport_format": "range",
+                                "src_port1": "0",
+                                "src_port2": "0",
                                 "protocol": 6,
                                 "direction": "double"
                             }
@@ -57,94 +36,36 @@
                     ]
                 },
                 {
-                    "group_name": "ASN",
+                    "group_name": "HTTP_APP_ID",
                     "regions": [
                         {
-                            "table_name": "TSG_OBJ_AS_NUMBER",
-                            "table_type": "expr",
+                            "table_name": "TSG_OBJ_APP_ID",
+                            "table_type": "intval",
                             "table_content": {
-                                "keywords": "101",
-                                "expr_type": "none",
-                                "match_method": "sub",
-                                "format": "uncase plain"
+                                "low_boundary": 106,
+                                "up_boundary": 106
                             }
                         },
-                        {
-                            "table_name": "TSG_OBJ_AS_NUMBER",
-                            "table_type": "expr",
-                            "table_content": {
-                                "keywords": "102",
-                                "expr_type": "none",
-                                "match_method": "sub",
-                                "format": "uncase plain"
-                            }
-                        }
-                    ]
-                },
-                {
-                    "group_name": "LOCATION",
-                    "regions": [
-                        {
-                            "table_name": "TSG_OBJ_GEO_LOCATION",
-                            "table_type": "expr",
+		    	{
+                            "table_name": "TSG_OBJ_APP_ID",
+                            "table_type": "intval",
                             "table_content": {
-                                "keywords": "China",
-                                "expr_type": "none",
-                                "match_method": "sub",
-                                "format": "uncase plain"
+                                "low_boundary": 67,
+                                "up_boundary": 67
                             }
                         }
                     ]
                 }
-            ]    
-        },
-        {
-            "compile_id": 5,
-            "service": 0,
-            "action": 128,
-            "do_blacklist": 0,
-            "do_log": 1,
-            "effective_rage": 0,
-            "user_region": "anything",
-            "is_valid": "yes",
-            "groups": [
-                {
-                    "group_name":"IP_ADDR_1",
-                    "virtual_table":"TSG_SECURITY_SOURCE_ADDR",
-                    "not_flag":0                   
-                },
-                {
-                    "group_name":"IP_ADDR_2",
-                    "virtual_table":"TSG_SECURITY_DESTINATION_ADDR",
-                    "not_flag":0                   
-                },
-                {
-                    "group_name":"ASN",
-                    "virtual_table":"TSG_SECURITY_SOURCE_ASN",
-                    "not_flag":0                   
-                },
-                {
-                    "group_name":"LOCATION",
-                    "virtual_table":"TSG_SECURITY_DESTINATION_LOCATION",
-                    "not_flag":0                   
-                }
             ]
         }
     ],
     "plugin_table": [
         {
-            "table_name": "TSG_IP_ASN_USER_DEFINED",
-            "table_content": [
-                "101\t4\t192.168.50.1\t192.168.50.255\t101\tmesa\t1",
-                "102\t4\t192.168.100.1\t192.168.100.255\t102\tgeedge\t1"
-            ]
-        },
-        {
-            "table_name": "TSG_IP_LOCATION_USER_DEFINED",
+            "table_name": "APP_ID_DICT",
             "table_content": [
-                "201\t20100\t4\t192.168.50.1\t192.168.50.255\t11.12\t11.12\t0\ten\tAS\tAsia\tCN\tChina\tBJ\tBeijing\tBeijing\tAsia/Singapore\t1",
-                "202\t20200\t4\t192.168.100.1\t192.168.100.255\t11.12\t11.12\t0\ten\tAS\tAsia\tCN\tChina\tSH\tShanghai\tShanghai\tAsia/Singapore\t1"
+                "20002\tUSER_DEFINE\t20000\tparent_name\tcategory\tsubcategory\ttechnology\trisk\tcharacteristics\tnull\tnull\t1\t0\t3600\t3600\t1800\t1800\t1",
+                "20001\tWhatsApp_video\t20000\tWhatsApp\tcategory\tsubcategory\ttechnology\trisk\tcharacteristics\tnull\tnull\t1\t0\t3600\t3600\t1800\t1800\t1"
             ]
         }
-    ]
+    ] 
 }
diff --git a/bin/tsg_static_tableinfo.conf b/bin/tsg_static_tableinfo.conf
index ed336e2..ca3861b 100644
--- a/bin/tsg_static_tableinfo.conf
+++ b/bin/tsg_static_tableinfo.conf
@@ -72,4 +72,4 @@
 60	APP_SELECTOR_ID	intval	UTF8	UTF8	yes	0
 61	TSG_FIELD_SIP_ORIGINATOR_DESCRIPTION	virtual	TSG_OBJ_ACCOUNT	--
 62	TSG_FIELD_SIP_RESPONDER_DESCRIPTION	virtual	TSG_OBJ_ACCOUNT	--
-63	APP_ID_DICT	plugin	{"key":1,"valid":16}
\ No newline at end of file
+63	APP_ID_DICT	plugin	{"key":1,"valid":18}
\ No newline at end of file
diff --git a/inc/tsg_rule.h b/inc/tsg_rule.h
index 74d6f34..d412db1 100644
--- a/inc/tsg_rule.h
+++ b/inc/tsg_rule.h
@@ -55,6 +55,7 @@ struct app_id_dict_table
 {
 	int ref_cnt;
 	int app_id;
+	int parent_app_id;
 	int deny_action;
 	int continue_scanning;
 	int tcp_timeout;
@@ -64,6 +65,7 @@ struct app_id_dict_table
 	int is_valid;
 	char risk[MAX_APP_ID_PROPERTY_LEN*4];
 	char app_name[MAX_APP_ID_PROPERTY_LEN];
+	char parent_app_name[MAX_APP_ID_PROPERTY_LEN];
 	char category[MAX_APP_ID_PROPERTY_LEN*4];
 	char subcategroy[MAX_APP_ID_PROPERTY_LEN*4];
 	char technology[MAX_APP_ID_PROPERTY_LEN*4];
@@ -85,5 +87,7 @@ struct Maat_rule_t *tsg_fetch_deny_rule(Maat_rule_t *result, int result_num);
 int tsg_get_method_id(char *method);
 
 int tsg_get_fqdn_category_id(Maat_feather_t maat_feather, char *fqdn, unsigned int *category_id, int category_id_num, void *logger, int thread_seq);
+int tsg_scan_app_id_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, char *name, unsigned int id, int thread_seq);
+int tsg_scan_fqdn_category_id(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, int table_id, unsigned int *category_id, int category_id_num, int thread_seq);
 
 #endif
diff --git a/inc/tsg_send_log.h b/inc/tsg_send_log.h
index f0c6dc8..50b2090 100644
--- a/inc/tsg_send_log.h
+++ b/inc/tsg_send_log.h
@@ -36,5 +36,7 @@ int TLD_cancel(struct TLD_handle_t *handle);
 int tsg_send_log(struct tsg_log_instance_t *instance, struct TLD_handle_t *handle, tsg_log_t *log_msg, int thread_id);
 
 unsigned long long tsg_get_stream_id(struct streaminfo *a_stream);
+char *tsg_l7_protocol_id2name(unsigned int l7_protocol_id);
+unsigned int tsg_l7_protocol_name2id(const char *l7_protocol_name);
 
 #endif
diff --git a/src/tsg_entry.cpp b/src/tsg_entry.cpp
index 7a4d786..790771f 100644
--- a/src/tsg_entry.cpp
+++ b/src/tsg_entry.cpp
@@ -1400,7 +1400,6 @@ extern "C" int TSG_MASTER_INIT()
 
 	MESA_load_profile_int_def(tsg_conffile, "SYSTEM", "ENTRANCE_ID", &g_tsg_para.entrance_id, 0);
 	MESA_load_profile_short_def(tsg_conffile, "SYSTEM", "TIMEOUT", (short *)&g_tsg_para.timeout, 300);
-	MESA_load_profile_int_def(tsg_conffile, "SYSTEM", "MAIL_PROTOCOL_ID",&(g_tsg_para.mail_proto_id), 110);	
 	MESA_load_profile_int_def(tsg_conffile, "SYSTEM", "SCAN_TIME_INTERVAL", &g_tsg_para.scan_time_interval, 5);
 
 	MESA_load_profile_string_def(tsg_conffile, "SYSTEM", "DEVICE_ID_COMMAND", g_tsg_para.device_id_command, sizeof(g_tsg_para.device_id_command), NULL);
diff --git a/src/tsg_entry.h b/src/tsg_entry.h
index 1da3a8f..3f0ee07 100644
--- a/src/tsg_entry.h
+++ b/src/tsg_entry.h
@@ -108,7 +108,6 @@ struct l7_protocol
     UT_hash_handle hh2;        /* handle for second hash table */
 };
 
-
 struct _fqdn_category_t
 {
 	int ref_cnt;	
@@ -132,7 +131,6 @@ struct master_context
 typedef	struct _tsg_para
 {
 	int level;	
-	int mail_proto_id;
 	unsigned short timeout;
 	int app_id_table_type;
 	int device_id;
@@ -247,6 +245,9 @@ typedef	struct _tsg_statistic
 
 int tsg_statistic_init(const char *conffile, void *logger);
 
+//parent_app_name.app_name
+int tsg_app_id2name(int app_id, char *app_name, int app_name_len, int is_joint_parent);
+
 void location_free_data(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp);
 void ASN_free_data(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp);
 void subscribe_id_free_data(int table_id, MAAT_PLUGIN_EX_DATA* ad, long argl, void* argp);
@@ -255,12 +256,7 @@ void security_compile_free(int idx, const struct Maat_rule_t* rule, const char*
 struct Maat_rule_t *tsg_policy_decision_criteria(struct streaminfo *a_stream, Maat_rule_t *result, int result_num, int thread_seq);
 int tsg_scan_addr(Maat_feather_t maat_feather, const struct streaminfo *a_stream, tsg_protocol_t proto, scan_status_t *mid, Maat_rule_t*result, int result_num);
 int tsg_scan_shared_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, char *domain, Maat_rule_t *result, int result_num,  scan_status_t *mid, int table_id, int thread_seq);
-int tsg_scan_app_id_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, char *name, unsigned int id, int thread_seq);
 int tsg_scan_app_properties_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, char *property, char *district, int thread_seq);
 int tsg_scan_subscribe_id_policy(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, struct _subscribe_id_info_t *user_info, int thread_seq);
-int tsg_scan_fqdn_category_id(Maat_feather_t maat_feather, const struct streaminfo *a_stream, struct Maat_rule_t *result, int result_num, scan_status_t *mid, int table_id, unsigned int *category_id, int category_id_num, int thread_seq);
-unsigned int tsg_l7_protocol_name2id(const char *l7_protocol_name);
-char *tsg_l7_protocol_id2name(unsigned int l7_protocol_id);
-
 
 #endif
diff --git a/src/tsg_rule.cpp b/src/tsg_rule.cpp
index 9dda5cf..b27849d 100644
--- a/src/tsg_rule.cpp
+++ b/src/tsg_rule.cpp
@@ -448,9 +448,11 @@ static void app_id_dict_new_data(int table_id, const char* key, const char* tabl
 	app_id_dict=(struct app_id_dict_table *)calloc(1, sizeof(struct app_id_dict_table));
 	
 	ret=sscanf(table_line,
-				"%d\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d\t%d\t%d\t%d\t%d\t%d\t%d",
+				"%d\t%s\t%d\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%d\t%d\t%d\t%d\t%d\t%d\t%d",
 				&app_id_dict->app_id, 
 				app_id_dict->app_name,
+				&app_id_dict->parent_app_id, 
+				app_id_dict->parent_app_name,
 				app_id_dict->category, 
 				app_id_dict->subcategroy, 
 				app_id_dict->technology,
@@ -465,7 +467,7 @@ static void app_id_dict_new_data(int table_id, const char* key, const char* tabl
 				&app_id_dict->tcp_half_close,
 				&app_id_dict->tcp_time_wait, 
 				&app_id_dict->is_valid);
-	if(ret!=16)
+	if(ret!=18)
 	{
 		free(app_id_dict);
 		app_id_dict=NULL;
@@ -483,6 +485,7 @@ static void app_id_dict_new_data(int table_id, const char* key, const char* tabl
 
 	atomic_inc(&app_id_dict->ref_cnt);
 	eliminate_default_value(app_id_dict->app_name);
+	eliminate_default_value(app_id_dict->parent_app_name);
 	eliminate_default_value(app_id_dict->category);
 	eliminate_default_value(app_id_dict->subcategroy);
 	eliminate_default_value(app_id_dict->technology);
@@ -1613,3 +1616,36 @@ int tsg_scan_subscribe_id_policy(Maat_feather_t maat_feather, const struct strea
 
 	return 0;
 }
+
+
+int tsg_app_id2name(int app_id, char *app_name, int app_name_len, int is_joint_parent)
+{
+	int offset=0;
+	char app_id_buff[128]={0};
+	struct app_id_dict_table *dict=NULL;
+
+	if(app_id<=0 || app_name==NULL || app_name_len<=0)
+	{
+		return offset;
+	}
+
+	snprintf(app_id_buff, sizeof(app_id_buff), "%d", app_id);
+	dict=(struct app_id_dict_table *)Maat_plugin_get_EX_data(g_tsg_maat_feather, g_tsg_para.table_id[TABLE_APP_ID_DICT], (const char *)app_id_buff);
+	if(dict!=NULL)
+	{
+		if(dict->parent_app_id!=0)
+		{		
+			offset=snprintf(app_name, app_name_len, "%s.%s", dict->parent_app_name, dict->app_name);
+		}
+		else
+		{
+			offset=snprintf(app_name, app_name_len, "%s", dict->app_name);
+		}
+		
+		app_id_dict_free_data(g_tsg_para.table_id[TABLE_APP_ID_DICT], (MAAT_PLUGIN_EX_DATA *)&dict, 0, NULL);
+
+		return offset;
+	}
+
+	return offset;
+}
diff --git a/src/tsg_send_log.cpp b/src/tsg_send_log.cpp
index c7de8bc..ab9d891 100644
--- a/src/tsg_send_log.cpp
+++ b/src/tsg_send_log.cpp
@@ -291,7 +291,7 @@ static int set_fqdn_category(struct tsg_log_instance_t *_instance, struct TLD_ha
 	
 	for(i=0; i< category_id_num; i++)
 	{
-		offset+=snprintf(category_str+offset, sizeof(category_str)-offset, "%d,", category_id[i]);
+		offset+=snprintf(category_str+offset, sizeof(category_str)-offset, "%s%d", ((i>0) ? "," : ""), category_id[i]);
 	}
 
 	if(offset>0)
@@ -360,10 +360,24 @@ static int get_l7_protocol(struct app_identify_result *result, char *protocol_li
 	return 1;
 }
 
-static int get_app_id_list(struct app_identify_result *result, char *app_list, int app_list_len, char *surrogate_list, int surrogate_list_len, int *flag)
+static int get_app_id_list(struct app_identify_result *result, char *app_list, int app_list_len, char *surrogate_list, int surrogate_list_len)
 {
 	int i=0;
 	int offset1=0,offset2=0;
+	
+	for(i=0; i<result->app_id_num; i++)
+	{
+		offset1+=snprintf(app_list+offset1, app_list_len-offset1, "APP%d=%d;", result->origin, result->app_id[i]);
+		offset2+=snprintf(surrogate_list+offset2, surrogate_list_len-offset2, "SURROGATE%d=%d;", result->origin, result->surrogate_id[i]);
+	}
+
+	return 1;
+}
+
+static int get_app_name_list(struct app_identify_result *result, char *app_name, int app_name_len, int *flag, int is_joint_parent)
+{
+	int i=0;
+	int offset=0;
 
 	if((*flag)==1)
 	{
@@ -373,8 +387,14 @@ static int get_app_id_list(struct app_identify_result *result, char *app_list, i
 	for(i=0; i<result->app_id_num; i++)
 	{
 		(*flag)=1;
-		offset1+=snprintf(app_list+offset1, app_list_len-offset1, "%d;", result->app_id[i]);
-		offset2+=snprintf(surrogate_list+offset2, surrogate_list_len-offset2, "%d;", result->surrogate_id[i]);
+
+		if(i>0 && offset>0 && (app_name_len-offset)>0)
+		{
+			app_name[offset]='.';
+			offset++;
+		}
+		
+		offset+=tsg_app_id2name(result->app_id[i], app_name+offset, app_name_len-offset, is_joint_parent);
 	}
 
 	return 1;
@@ -383,37 +403,56 @@ static int get_app_id_list(struct app_identify_result *result, char *app_list, i
 static int set_app_id(struct tsg_log_instance_t *_instance, struct TLD_handle_t *_handle, struct streaminfo *a_stream)
 {
 	int app_id_flag=0;
+	int app_offset=0;
+	int surrogate_offset=0;
 	int l7_protocol_flag=0;
-	char app_list[256]={0};
+	char app_list[512]={0};
+	char app_name[512]={0};
 	char protocol_list[256]={0};
-	char surrogate_list[256]={0};
+	char surrogate_list[512]={0};
 	struct gather_app_result *label=NULL;
 	
 	label=(struct gather_app_result *)project_req_get_struct(a_stream, g_tsg_para.gather_app_project_id);
-	if(label!=NULL)
-	{		
-		get_l7_protocol(&(label->result[ORIGIN_BASIC_PROTOCOL]), protocol_list, sizeof(protocol_list), &l7_protocol_flag);
-		get_app_id_list(&(label->result[ORIGIN_USER_DEFINE]), app_list, sizeof(app_list), surrogate_list, sizeof(surrogate_list), &app_id_flag);
-		if(app_id_flag!=1)
-		{
-			get_app_id_list(&(label->result[ORIGIN_DKPT]), app_list, sizeof(app_list), surrogate_list, sizeof(surrogate_list), &app_id_flag);
-		}
+	if(label==NULL)
+	{
+		return 0;
+	}
+	
+	get_l7_protocol(&(label->result[ORIGIN_BASIC_PROTOCOL]), protocol_list, sizeof(protocol_list), &l7_protocol_flag);
+	if(l7_protocol_flag==1)
+	{
+		TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)protocol_list, TLD_TYPE_STRING);
+	}
 
-		if(app_id_flag!=1)
-		{
-			get_app_id_list(&(label->result[ORIGIN_QM_ENGINE]), app_list, sizeof(app_list), surrogate_list, sizeof(surrogate_list), &app_id_flag);
-		}
-		
-		if(app_id_flag==1)
-		{
-			TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, (void *)app_list, TLD_TYPE_STRING);		
-			TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_SURROGATE_ID].name, (void *)surrogate_list, TLD_TYPE_STRING);	
-		}
+	app_offset=0;
+	surrogate_offset=0;
+	get_app_id_list(&(label->result[ORIGIN_USER_DEFINE]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset);
 
-		if(l7_protocol_flag==1)
-		{
-			TLD_append(_handle, _instance->id2field[LOG_COMMON_L7_PROTOCOL].name, (void *)protocol_list, TLD_TYPE_STRING);
-		}
+	app_offset=strlen(app_list);
+	surrogate_offset=strlen(surrogate_list);
+	get_app_id_list(&(label->result[ORIGIN_DKPT]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset);
+
+	app_offset=strlen(app_list);
+	surrogate_offset=strlen(surrogate_list);
+	get_app_id_list(&(label->result[ORIGIN_QM_ENGINE]), app_list+app_offset, sizeof(app_list)-app_offset, surrogate_list+surrogate_offset, sizeof(surrogate_list)-surrogate_offset);
+
+	get_app_name_list(&(label->result[ORIGIN_USER_DEFINE]), app_name, sizeof(app_name), &app_id_flag, 1);
+	if(app_id_flag!=1)
+	{
+		get_app_name_list(&(label->result[ORIGIN_DKPT]), app_name, sizeof(app_name), &app_id_flag, 0);
+	}
+
+	if(app_id_flag!=1)
+	{
+		get_app_name_list(&(label->result[ORIGIN_QM_ENGINE]), app_name, sizeof(app_name), &app_id_flag, 1);
+	}
+	
+	if(app_id_flag==1)
+	{
+		TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_ID].name, (void *)app_list, TLD_TYPE_STRING);		
+		TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_SURROGATE_ID].name, (void *)surrogate_list, TLD_TYPE_STRING);
+
+		TLD_append(_handle, _instance->id2field[LOG_COMMON_APP_LABEL].name, (void *)app_name, TLD_TYPE_STRING);
 	}
 
 	return 1;
@@ -1236,11 +1275,10 @@ int tsg_send_log(struct tsg_log_instance_t *instance, struct TLD_handle_t *handl
 			set_common_sub_action(_handle, _instance->id2field[LOG_COMMON_SUB_ACTION].name, &(log_msg->result[i]));
 		}
 		
-		payload = cJSON_PrintUnformatted(_handle->object);
-
-		status = rd_kafka_produce(_instance->topic_rkt[log_msg->result[i].service_id], RD_KAFKA_PARTITION_UA, RD_KAFKA_MSG_F_COPY, payload, strlen(payload), NULL, 0, NULL);			
+		payload=cJSON_PrintUnformatted(_handle->object);
 
-		if(status < 0)
+		status=rd_kafka_produce(_instance->topic_rkt[log_msg->result[i].service_id], RD_KAFKA_PARTITION_UA, RD_KAFKA_MSG_F_COPY, payload, strlen(payload), NULL, 0, NULL);
+		if(status<0)
 		{
 			clock_gettime(CLOCK_REALTIME, &cur_time);
 			if(cur_time.tv_sec - _instance->drop_start[thread_id].tv_sec>=1)