Audit log generation and processing for cluster file system serviceability
AssigneeDell Products L.P.
InventorsVishal Tiwary, Philip Shilane
Life of this patent
Estimating the term…
Abstract
A multi-node, multi-container cluster system that generates, aggregates, and manages log files from services and components to be used for audit logs used by an auditor. Logs are collected from all components of the system and aggregated using a central persistent volume for non-critical applications and additional dedicated persistent volumes for critical tasks. Audit logs are formatted to provide a consistent logging format in conformance with relevant corporate and government requirements. Log files are stored persistently outside of pods to ensure high availability for any audit log management needs. Audit logs can be exported to external, secure syslog server, and can be made subject to defined retention policies, as needed.
Claims13
A method of logging activities in a cluster system having a plurality of nodes executing containerized applications, the method comprising:
- collecting logs for each node of a plurality of nodes in the cluster system, wherein the logs record transactions of the nodes during execution of the applications;
- generating, for the entire cluster system, log files from the logs for each node;
- aggregating the logs into a consistent audit log format to produce audit logs, wherein the audit log format dictates inclusion of information including sender ID, receiver ID, specified user operations, and actions performed in the cluster system, and further facilitates display of log information to a user through a graphical user interface and transfer of the logs to an audit log management system;
- storing the log files in one or more persistent volume locations outside of any application pod of the cluster system;
- and
- providing, upon request, the audit logs to an auditor, wherein the audit logs are produced to conform the cluster system to one or more security protocols as required by corporate or government agencies and that dictate minimum data security requirements for availability, protection against tampering, and secure access, and are configured to conform to a government defined Event Logging (EL) level that specifies four levels of data security that meet defined requirements including logging categories, minimum logging data, defined time standards, and allowance for log forwarding must be allowed.
A method of providing to an auditor, log information for a cluster system having a plurality of nodes executing containerized applications, comprising:
- monitoring system operation to detect a problem in the cluster system;
- logging activity of the cluster system as the applications are executed;
- generating log files from logs around a time of the problem for each node to form collected data that is combined with system statistics and system information;
- and
- aggregating the log files into audit logs for provision upon request to the auditor, wherein the cluster system comprises a Santorini network processing containerized data utilizing a Kubernetes-based framework, and wherein the cluster system comprises part of a Data Domain deduplication backup system performing backup and restore operations for the nodes, and wherein the containerized applications comprise at least one of a Data Domain container running deduplication and compression processes, a cloud-native data protection manager, and a scalable object storage manager.
A system for logging activities in a cluster system having a plurality of nodes executing containerized applications, the system comprising:
- a collector component collecting logs for each node of a plurality of nodes in the cluster system, wherein the logs record transactions of the nodes during execution of the applications;
- a log file generator generating, for the entire cluster system, log files from the logs for each node;
- an aggregator aggregating the logs into a consistent audit log format to produce audit logs;
- and
- a hardware data store storing the log files in one or more persistent volume locations outside of any application pod of the cluster system, wherein the cluster system comprises a Santorini network processing containerized data utilizing a Kubernetes-based framework, and wherein the cluster system comprises part of a Data Domain deduplication backup system performing backup and restore operations for the nodes, and wherein the containerized applications comprise at least one of a Data Domain container running deduplication and compression processes, a cloud-native data protection manager, and a scalable object storage manager, and wherein an auditor of the log files comprises a corporate or government agency.
Dependencies are inferred from the claim text.