TWI830610B - How to manage cross-system audit logs - Google Patents

Abstract

The invention discloses a management method for cross-system audit logs. Based on an interaction between a first application system and a second application system, an audit log is generated. The audit log includes a flow number, a parameter set and a time stamp. The parameter set is composed of one or more parameters. The serial number, the parameter set and the timestamp of the audit log are temporarily stored in a common message queue. The common message queue is caused to transmit the serial number, the parameter set and the timestamp to a remote parameter database and then store them. Thereby, the serial number, the parameter set and the timestamp of the audit log are stored asynchronously.

Description

How to manage cross-system audit logs

The present invention relates to a management method of system audit logs, and in particular to a management method of cross-system audit logs.

When the network application system is running, in response to the needs of system detection, operation monitoring, performance tuning, and system usage analysis statistics, the important information recorded when the system program is executed can be roughly divided into several categories, such as operating system The system log "System log" thrown by the bottom layer of (Operation System), the "Access log" generated by the Web Server recording the user's request, and the Web Server (Web Server) generated due to execution errors "Error log", the developer additionally designs appropriate logs "Trace log" generated in important places or when errors occur, analysts leave statistical audit logs "Audit log(audit) in appropriate places according to business needs trail)”.

Among them, the audit log is the result of a certain transaction process or system function execution. For example, the usage records of users using or visiting a certain system are usually used to provide system users with historical information about the use of certain system functions. Therefore, these records are usually recorded in a database to facilitate querying. The content of these records usually needs to be designed based on the actual needs of users, and therefore must be described in the system requirements and analysis documents. Audit logs mainly provide audit needs of auditors, or customer complaints raised by system maintenance personnel against users, shorten the scope of problem search, and provide developers with the opportunity to find the problem area faster, and then use other types of log positioning System problem.

The content of the audit log is defined and stored in the database of the local application system according to the audit requirements. However, this arrangement often creates several problems. First, the database session of the audit log is often tied to the usual database transaction. When the transaction is rolled back for some reason, the audit log is also restored together. This is related to the final transaction. Best practice is inconsistent. Second, a large number of audit logs will also affect the database performance of the operation. Third, the audit log messages are completely recorded in the database. When the message contents other than parameters are the same, the resources of the database are greatly occupied. Fourth, user process scenarios usually flow through several application systems. For example, an end-to-end process in a shopping website will involve the shopping website system, cash flow system, order processing system, billing system, etc. Each system will use The respective records generate audit logs. Once there is a need for auditing and searching, relevant personnel usually have to search across systems and organizations.

In this regard, it is necessary to develop a management method that effectively applies the database and facilitates the search for cross-system audit logs.

The present invention provides a process and mechanism to solve the audit log requirements required when a user's usage context spans multiple application systems. At the same time, it is proposed to solve the many shortcomings of previously storing and transmitting large amounts of data.

The present invention proposes a cross-system audit log management method, which includes: generating an audit log based on an interaction between a first application system and a second application system. The audit log includes a stream number, a parameter set and a Timestamp, the parameter set consists of one or more parameters; temporarily store the serial number of the audit log, the parameter set and the timestamp in a common message queue; let the common message queue store the serial number , the parameter set and the timestamp are sent to a remote parameter data Stored behind the database; and thereby the serial number, the parameter set and the timestamp of the audit log are stored asynchronously.

In a specific embodiment, the management method further includes: defining a text message by the first application system or the second application system, and the text message represents a message customized by the first application system or the second application system. Events and descriptions.

In a specific embodiment, the management method further includes: causing the remote parameter database to select one text message to store from the same two text messages to avoid occupying resources.

In a specific embodiment, the remote parameter database is an atypical correlation database.

In a specific embodiment, the management method further includes: searching the remote parameter database based on a parameter search request input from a user terminal, wherein the parameter search request indication consists of one or more target parameters. A target parameter set; according to a target parameter set, associate at least one parameter set from multiple parameter sets stored in the remote parameter database, and according to the at least one parameter set and the time stamp corresponding to the parameter set, automatically A remote storage unit storing a template associates a target text message; and formats the associated at least one parameter set and the target text message to reproduce a target audit log.

In a specific embodiment, the remote parameter database is configured to have an unencrypted storage area and an encrypted storage area, and the encrypted storage area is configured to allow access by specific permissions.

In a specific embodiment, the management method further includes: storing the text message of the audit log before the shared message queue, and temporarily storing the text message in the local storage of the first application system or the second application system. Device in response to delivery failure for this shared message queue.

In a specific embodiment, the management method further includes: when the serial number, the parameter set and the timestamp of the audit log fail to be temporarily stored in the common message queue, the serial number, the parameter set and The timestamp is temporarily stored in a local storage device of the first application system or the second application system.

100:Application system

101:Application system

102: Audit log processing module

103:Shared message queue

104: Parameter writing module

105:Remote parameter database

200:User terminal

201: User terminal

202: Parameter search request

203: Parameter reading module

204:Format module

The present invention can be further understood with reference to the following drawings and descriptions. Non-limiting and non-exhaustive examples are described with reference to the following figures. Parts in the drawings are not necessarily to actual size; emphasis is placed on illustrating structure and principles.

The first figure illustrates the management method (storage) process of cross-system audit logs according to the present invention.

The second figure illustrates an audit log generated according to the method of the present invention.

The third figure illustrates the cross-system audit log management method (search) process of the present invention.

The present invention will now be described more fully with reference to the accompanying drawings, in which specific example embodiments are shown by way of illustration. However, the claimed subject matter can be embodied in many different forms, and therefore the construction of the covered or claimed subject matter is not limited to any example embodiments disclosed in this specification; the example embodiments are only for illustration. Likewise, this invention is intended to provide a reasonably broad scope to the claimed subject matter as claimed or covered. Additionally, for example, the claimed subject matter may be embodied as a method, apparatus, or system. Thus, embodiments may take the form of, for example, hardware, software, firmware, or any combination of these (not known as software).

The term "embodiment" used in this specification does not necessarily refer to the same specific embodiment, and the term "other (some/certain) embodiments" used in this specification does not necessarily refer to different specific embodiments. It is intended, for example, that the claimed subject matter includes combinations of all or part of the exemplary embodiments.

The first figure illustrates the process of the cross-system audit log management method of the present invention, which uses an asynchronous storage strategy to asynchronously generate audit logs and stored results to achieve the purpose of saving storage space.

The application system (100) and the application system (101) are systems established for different purposes and needs. For example, taking an online shopping application, the application system (100) can be a product display system for a shopping website, and the application system (101) It can be a transaction cash flow system or a distribution logistics system, and each application system executes its own dedicated application program, but the present invention is not limited to this.

The management method of the present invention includes generating an audit log based on an interaction between the application system (100) and the application system (101). For example, the application system of a shopping website interacts with the transaction flow system to respond to the request and payment of a shopping order. According to the content of the interaction, the application system (100) and the application system (101) can each generate one or more audit logs and transmit them to an audit log processing module (102).

Basically, the audit log contains at least a first-class number defined by the application system, a text message, a parameter set and a timestamp. The text message indicates each message between the application system (100) and the application system (101) during the interaction process. A parameter set consists of one or more parameters. The timestamp indicates when the audit log was generated.

The second picture is an example of an audit log, including multiple fields: "App ID", "ConditionID", "Level", "Event", "Requestor", "Severity", "Originator", "Parameters" and "Text".

"App ID" and "ConditionID" are serial numbers defined by the application system. They are usually given serial numbers based on the time of event occurrence in the application system.

"Level", "Event", "Requestor", "Severity", "Originator" and "Text" are text messages, which are defined by the first application system or the second application system, and the text message represents the Events and descriptions customized by the first application system or the second application system. "Text" is the description of the audit log event, such as "%1: create new role profile(%2)".

"Parameters" is a collection of parameters. In this example, the audit log parameter set has two parameters: "user id" and "role name".

Next, the audit log processing module (102) transmits the serial number, parameter set and timestamp of the audit log to the shared message queue for temporary storage. The shared message queue (103) replaces the traditional local storage and queues the text messages of the audit log generated by the application system (100 or 101) in a temporary storage unit, thereby reducing the storage burden of the local application system. In other words, the present invention adopts asynchronous means to asynchronously store the serial number, parameter set and time stamp of each audit log in the shared message queue (103) and the remote parameter database (105). Since text messages usually have a large amount of information, if the audit log is stored one by one according to the conventional practice, it may reduce the efficiency of storage and accumulate a huge amount of data waiting to be stored. Therefore, the common message queue (103) is used to temporarily store the serial number, parameter set and time stamp of each audit log until it is sent to the remote parameter database (105).

The parameter writing module (104) writes the corresponding serial number, the parameter set and the corresponding time stamp into the remote parameter database (105). For example, write the two parameters "user id" and "role name" of the parameter set in the second figure into the remote parameter database, and the serial numbers "W001" and "10001" and timestamps corresponding to these two parameters. Also stored accordingly.

The text message is defined according to the event name of each application system (100 or 101). Take the second picture as an example, it can include "Level", "Event", "Requestor", "Severity", "Originator" and "Text". The text message may be a template stored in the application system (100 or 101) or other remote systems, so that the application system (100 or 101) can generate audit logs in response to events. Since the application system (100 or 101) generates audit logs in response to events, the same event occurring at different times may generate different audit logs with the same text message in the system. In order to avoid repeatedly storing audit logs with the same content and occupying computer resources, the present invention preferably only stores a single text message in the template, and the template can be stored in the local or remote storage unit of the application system (ie, remote storage unit). any storage unit other than parameter database 105). Subsequently, corresponding rules can be used to recombine the text message and the serial number and parameter set of the remote parameter database (105) to reproduce the complete or partial content of each audit log. In one embodiment, the correspondence between the text message and the parameter set can be based on a time stamp, but the present invention is not limited to this.

In one embodiment, the remote parameter database (105) can be configured into an encrypted storage area and an unencrypted storage area. When the parameters involve the security of the application system (100, 101), they can be stored in the encrypted storage area of the remote parameter database (105) according to preset rules, which only allows access by specific permissions. In addition, the remote parameter database (105) can adopt an atypical relational database, such as "NoSQL".

In a feasible embodiment, the application system (100, 101) or the audit log processing module (102) can be configured to send the serial number and parameter set to be sent when the transmission of the common message queue (103) fails. and the timestamp are temporarily stored in the local storage device, and the message is sent to the shared message queue (103) after the transmission channel is restored.

The third figure illustrates the search process in the cross-system audit log management method process of the present invention. User terminals (200, 201) of different application systems, such as maintenance units and audit units, can search audit logs generated by past cross-system interactions. The user terminals (200, 201) can each input a parameter search request (202) according to the audit purpose, which at least includes inputting one or more target parameters, and the parameters are parameters defined by the application system. For example, the parameters entered in the parameter search request (202) may be determined according to the target application system or the target event (ie, the matter to be observed), such as the "user id" or "role name" illustrated in the second figure. The parameters mentioned above can be formulated by those skilled in the art according to various audit requirements, so they are not listed here in detail.

The parameter search request (202) may further include a time condition to limit the search scope. The time condition may indicate, but is not limited to, before a time, after a time, or at least a time interval. Therefore, the parameter search request (202) may be a combination of a parameter combination and a time condition. In other possible embodiments, the parameter search request (202) may further include other search conditions, such as application system name, network component name, etc., to further clarify the search scope.

Search the remote parameter database (105) according to the parameter search request (202) to identify one or more parameter sets that satisfy the request. Based on the parameter set indicated by the parameter search request (202), the parameter reading module (203) searches in the remote parameter database (105) that stores multiple parameter sets, and calls one or more parameters that match the request instructions. A collection of parameters stored by the pen at different times. When the parameter search request (202) contains the time condition, the parameter reading module (203) can further filter out the corresponding time condition from the stored multiple parameter sets based on the relationship between each parameter set and the time stamp. set of parameters. The parameter reading module (203) finally transmits each parameter set and the time stamp corresponding to each parameter data storage to the formatting module (204).

The formatting module (204) associates and calls the text message corresponding to each parameter set from the stored text message template according to the time stamp corresponding to each parameter set, and formats the parameter set and text message for reproduction. An audit log. Taking the second figure as an example, the formatting module (204) uses the associated parameter set "User id" and "role name" and the corresponding serial number and time stamp when storing them.

Then use the serial number (such as W001 and 10001) to correspond to the identification code of the event. Since the event identification code is a known system definition, the text message corresponding to the event code (such as Text: %1: create new role profile(%2)), and generate the audit log format as shown in the second picture accordingly. In other words, each associated parameter set is associated and integrated with the corresponding text message through the corresponding timestamp when it is stored, so as to reproduce the audit log generated in response to the initial cross-system interaction. The formatted audit log can be sent back to different user terminals (200, 201).

To further explain, in order to integrate the audit logs of multiple application systems, the present invention only transmits the serial number, the parameter set and the timestamp generated by each application system and temporarily stores them in a common message queue. Only a small amount of necessary data is transferred to the remote parameter database. In this way, in addition to effectively reducing the burden of transmitting data, if unfortunately the data is stolen, it will not be easy for the thief to see what the data means. Also because the readability of these data is poor and difficult for people to understand, the present invention also includes multiple sets of text messages (templates). After the parameter set is combined with the text messages (templates) through the formatting module (204), Relevant personnel can read the complete audit log to understand what it represents.

It should be noted that the "App ID" and "ConditionID" of the serial number are used as the primary key of each audit log. Specifically, "W001" represented by "App ID" can represent a specific system, and "10001" represented by "ConditionID" can represent a specific condition.

Although the foregoing invention has been described in certain details for the purpose of clarity of understanding, it will be understood that certain changes and modifications can be made within the scope of the claims. Therefore, the above embodiments are only for illustration and not limitation, and the present invention is not limited to the details described here, but may be modified within the scope of the appended claims and equivalents.

100:Application system

101:Application system

102: Audit log processing module

103:Shared message queue

104: Parameter writing module

105:Remote parameter database

Claims (5)

A cross-system audit log management method includes: generating an audit log based on an interaction between a first application system and a second application system. The audit log includes a stream number, a parameter set and a time stamp, The parameter set consists of one or more parameters; the serial number, the parameter set and the timestamp of the audit log are temporarily stored in a common message queue; the common message queue is made to store the serial number, the parameter The set and the timestamp are sent to a remote parameter database and then stored; thereby the serial number of the audit log, the parameter set and the timestamp are stored asynchronously; the remote parameter database is configured to have a non-encrypted Storage area and an encrypted storage area, the encrypted storage area is configured to allow access by specific permissions; search the remote parameter database based on a parameter search request input by a user terminal, wherein the parameter search request indicates by A target parameter set composed of one or more target parameters; according to a target parameter set, at least one parameter set is associated from multiple parameter sets stored in the remote parameter database, and according to the at least one parameter set and the parameter Set corresponding timestamps, associate a target text message from a remote storage unit storing a template; and format the associated at least one parameter set and the target text message to reproduce a target audit log. The management method described in claim 1 further includes: defining a text message by the first application system or the second application system, and the text message represents an event customized by the first application system or the second application system, and describe. The management method described in claim 2 further includes: causing the remote parameter database to select one text message to store from the same two text messages to avoid occupying resources. The management method as described in claim 1, wherein the remote parameter database is an atypical correlation database. The management method as described in request item 1 also includes: when the serial number, the parameter set and the timestamp of the audit log fail to be temporarily stored in the common message queue, the serial number, the parameter set and the timestamp Temporarily stored in the local storage device of the first application system or the second application system.

Images