Audit log storage method, device, equipment and medium based on namespace

Abstract

The present invention relates to the field of audit log technology and discloses a namespace-based audit log storage method, apparatus, device, and medium. The namespace-based audit log storage method includes: creating a namespace; obtaining a first operation to be audited from an operation list; storing the first operation in the namespace; obtaining a target operation and reading the namespace corresponding to the target operation; determining whether the target operation is the first operation; and if the target operation is the first operation, storing an audit log for the target operation. The present invention selectively stores audit logs, reducing the storage space occupied by audit logs.

Description

Technical Field

[0001] The present invention relates to the technical field of audit logs, and in particular to a namespace-based audit log storage method, apparatus, device and medium. Background Art

[0002] Audit logs record all user operations on the file system, including success or failure, user name, client address, command, and directory. The storage service generates a fixed-format audit log of user operations in the form of key-value pairs and records it in the log file. Audit logs allow users to view file system operations in real time, track misoperations, and monitor performance indicators.

[0003] However, the traditional audit log community records all user operations on the file system and does not give users a certain degree of selection power. This will cause the log file to occupy too much space, have poor selectivity, and cannot enable users to freely configure the operations and log records that need to be audited. Summary of the Invention

[0004] In view of this, the present invention provides a namespace-based audit log storage method, apparatus, device, and medium to solve the problem of excessive audit log storage space.

[0005] In a first aspect, the present invention provides an audit log storage method based on a namespace, comprising: creating a namespace; obtaining the first operation that needs to be audited in an operation list; storing the first operation in the namespace; obtaining the target operation and reading the namespace corresponding to the target operation; determining whether the target operation is the first operation; and if the target operation is the first operation, storing the audit log for the target operation.

[0006] Beneficial effects: The present invention creates a namespace. Since the namespace can separate different global entities, the creation of a namespace can realize the separate storage of different audit logs. Get the first operation that needs to be audited in the operation list, store the first operation in the namespace, get the target operation, read the namespace corresponding to the target operation, and judge whether the target operation is the first operation. If the target operation is the first operation, it means that the target operation needs to be audited, and then the audit log of the target operation is stored. The present invention creates a namespace, stores the first operation that needs to be audited, judges whether the target operation is the first operation that needs to be audited, and then stores the target operation that needs to be audited. The present invention does not store all audit logs, which improves the selectivity of audit log storage. It only stores the acquired audit logs that need to be audited, reduces the accumulation of worthless audit logs, and saves the storage space occupied by audit logs.

[0007] In an optional implementation, after creating the namespace, the method further includes: determining whether to perform audit log recording; if the audit log recording is performed, obtaining the first operation that needs to be audited in the operation list.

[0008] Beneficial effects: Determine whether to perform audit log recording. If audit log recording is performed, obtain the first operation that needs to be audited in the operation list. If audit log recording is not performed, there is no need to record the audit log. For some worthless audit logs, you can choose not to record them, which improves the selectivity of audit log storage and reduces the accumulation of worthless audit logs.

[0009] In an optional implementation, a first operation that needs to be audited is obtained from the operation list; after the first operation is stored in the namespace, the method further includes: obtaining a second operation that does not need to be audited from the operation list, and storing the second operation in the namespace.

[0010] Beneficial effect: The first operation that needs to be audited and the second operation that does not need to be audited are both stored in the namespace, which facilitates the subsequent determination of whether the target operation needs to be audited.

[0011] In an optional embodiment, obtaining a first operation that needs to be audited in an operation list; storing the first operation in a namespace, obtaining a second operation that does not need to be audited in the operation list, and storing the second operation in the namespace, includes: reading the operation list; setting the character used to represent the first operation in the operation list to the first character, and setting the character used to represent the second operation in the operation list to the second character; arranging the first character and the second character in the operation list in the order of the characters in the operation list, and obtaining a binary number according to the arrangement result; converting the binary number into a configuration number; saving the configuration number in a user operation field; judging whether a message of successful saving is received; if a message of successful saving is received, determining that the first operation and the second operation are successfully stored in the namespace; if a message of successful saving is not received, determining that the first operation and the second operation are failed to be stored in the namespace.

[0012] Beneficial effects: Reading an operation list, setting the character representing the first operation in the operation list as the first character, and setting the character representing the second operation in the operation list as the second character, arranging the first and second characters in the operation list in the order of the characters in the operation list, obtaining a binary number based on the arrangement result to identify and record the first operation that needs to be audited and the second operation that does not need to be audited, and converting the binary number into a configuration number. Since the storage capacity of the user operation field is limited, the binary number is long and occupies a large amount of capacity, converting the binary number into a configuration number saves storage resources. Determining whether a successful save message is received and clarifying whether the configuration number is successfully saved.

[0013] In an optional embodiment, determining whether the target operation is the first operation includes: determining whether the configuration number can be obtained; if the configuration number can be obtained, reading the configuration number; converting the configuration number into a binary number; matching the binary number with the target operation list corresponding to the namespace; if the binary number corresponding to the target operation is the first character, determining that the target operation is the first operation.

[0014] Beneficial effects: Read the configuration number, convert the configuration number into a binary number, and match the binary number with the target operation list corresponding to the namespace. It can be known whether each operation in the target operation list corresponding to the namespace needs to be audited, and query whether the character of the binary number corresponding to the target operation is the first character. If the binary number corresponding to the target operation is the first character, it is determined that the target operation is the first operation, that is, the operation that needs to be audited, so as to determine whether the target operation is audited.

[0015] In an optional embodiment, if the configuration number cannot be obtained, the audit process is interrupted.

[0016] In an optional implementation, if the binary number corresponding to the target operation is the second character, the audit process is interrupted.

[0017] In an optional implementation, audit log storage for the target operation includes: obtaining basic audit fields and namespace fields; saving the basic audit fields and namespace fields to form a target operation log to store the audit log for the target operation.

[0018] Beneficial effect: The basic audit fields and namespace fields are saved to form a target operation log, and the audit log of the target operation is stored so that the stored audit log has an identifier, and the audit log can be identified according to the basic audit fields and namespace fields.

[0019] In an optional embodiment, after saving the basic audit field and the namespace field to form a target operation log to store the audit log of the target operation, the method also includes: determining whether to turn on the namespace separate saving switch; if the namespace separate saving switch is turned on, saving the target operation log to a separate log file; if the namespace separate saving switch is not turned on, saving the target operation log to a public log file.

[0020] Beneficial effect: Determine whether the namespace separate saving switch is turned on. If it is turned on, the target operation log will be saved in a separate log file. If it is not turned on, the target operation log will be saved in a public log file, increasing the selectivity of the audit log and realizing the separate saving of the target operation log.

[0021] In the second aspect, the present invention provides an audit log storage device based on a namespace, including: a creation module for creating a namespace; an operation acquisition module for acquiring the first operation that needs to be audited in the operation list; an operation storage module for storing the first operation in the namespace; a target operation acquisition module for acquiring the target operation and reading the namespace corresponding to the target operation; a judgment module for judging whether the target operation is the first operation; and a storage module for storing the audit log of the target operation based on whether the target operation is the first operation.

[0022] Beneficial effects: The creation module of the present invention is used to create a namespace. Since the namespace can separate different global entities, the creation of the namespace can realize the separate storage of different audit logs. The operation acquisition module is used to obtain the first operation that needs to be audited in the operation list, the operation storage module stores the first operation in the namespace, the target operation acquisition module is used to obtain the target operation, read the namespace corresponding to the target operation, and the judgment module is used to judge whether the target operation is the first operation. If the target operation is the first operation, it means that the target operation needs to be audited, and the storage module stores the audit log of the target operation. The present invention creates a namespace, stores the first operation that needs to be audited, judges whether the target operation is the first operation that needs to be audited, and then stores the target operation that needs to be audited. The present invention does not store all audit logs, thereby improving the selectivity of audit log storage. It only stores the acquired audit logs that need to be audited, reduces the accumulation of worthless audit logs, and saves the storage space occupied by audit logs.

[0023] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, computer instructions being stored in the memory, and the processor executing the namespace-based audit log storage method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0024] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the namespace-based audit log storage method of the above-mentioned first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0026] Figure 1 1 is a flowchart of a namespace-based audit log storage method according to an embodiment of the present invention;

[0027] Figure 2 1 is a flowchart of another namespace-based audit log storage method according to an embodiment of the present invention;

[0028] Figure 3 is a flowchart of an operation storage method according to an embodiment of the present invention;

[0029] Figure 4 is a schematic diagram of a flow chart for determining whether a target operation is a first operation according to an embodiment of the present invention;

[0030] Figure 5 is a schematic diagram of namespace management according to an embodiment of the present invention;

[0031] Figure 6 is a schematic diagram of audit execution according to an embodiment of the present invention;

[0032] Figure 7 This is a log output diagram according to an embodiment of the present invention;

[0033] Figure 8 is a structural block diagram of an audit log storage device based on a namespace according to an embodiment of the present invention;

[0034] Figure 9 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0036] Audit logs are audits and checks on the information recorded daily. By centrally collecting various types of information in the information system, such as system security events, user access records, system operation logs, system operation status, etc., and processing them through normalization, filtering, merging and alarm analysis, they are stored and managed in a unified log format. Combined with rich log statistics summary and correlation analysis functions, a comprehensive audit of information system logs is achieved.

[0037] The audit log system should include at least four basic functions in terms of functional composition: information collection, information analysis, information storage, and information display. The information collection function includes log collection from network security devices, network equipment, databases, hosts, servers, virtualization platforms and other devices, and the collection methods include distributed external collectors, agent collection, etc. The information analysis function includes convenient log analysis operations, grouping logs, querying groups, and directly querying and analyzing logs from leaf nodes. The information storage function includes the storage of original logs and normalized logs, customizable storage cycles, and various storage extension methods such as file transfer protocol log backup and network file sharing storage. The information display function includes providing a rich set of built-in reports and flexible custom report modes, providing a directory interface for editing reports, referencing statistical items, setting report titles, displaying headers and page numbers, and configuring basic report content (name, description, etc.) for the display of audit logs.

[0038] In addition, the functions of the audit log system also include log monitoring, log retrieval, log forwarding, and log event alarms. Among them, log monitoring supports monitoring the real-time status of collectors and collector assets, and also supports viewing the total amount and current usage of the central processing unit, disk, and memory. Log retrieval provides log query methods, supports full-text, key-value pairs, brackets, regular, fuzzy and other retrieval methods, provides convenient log retrieval operations, supports saving searches, importing multiple conditions from saved searches, etc. The log forwarding function supports the forwarding of original logs and normalized logs. The log event alarm function has built-in rich single-source and multi-source event correlation analysis rules, supports custom event rules, and can customize rules according to logs, field Boolean logical relationships, etc. It supports customization of alarm rules and can set various filtering rules and alarm levels for events.

[0039] However, the traditional audit log community records all user operations on the file system, conducts a comprehensive audit of the information system log, and also stores some unnecessary audit logs, which causes the log files to occupy too much space. It does not give users a certain degree of choice and cannot enable users to freely configure the operations and log records that need to be audited.

[0040] The embodiment of the present invention provides a namespace-based audit log storage method, which creates a namespace to achieve the effect of freely configuring operations to be audited and audit logs.

[0041] According to an embodiment of the present invention, an embodiment of a namespace-based audit log storage method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0042] In this embodiment, a namespace-based audit log storage method is provided, which can be used for the above-mentioned audit logs. Figure 1 Flowchart of the audit log storage method based on namespace according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0043] Step S101: Create a namespace.

[0044] Among them, Namespace (NS) is a form of code organization used by many programming languages. It can specify some named space domains and place some global entities in different namespaces, so as to separate the above global entities from other global entities.

[0045] In the embodiment of the present invention, a namespace is created to store audit logs of different operations separately.

[0046] Step S102: Obtain the first operation that needs to be audited in the operation list.

[0047] Among them, the operation (Operate, OP) list is a selectable list provided by the interface. There are several OPs in the list. Select whether to enable audit for each operation according to the order of the operations in the operation list. For example, the operations can be creation, renaming, and deletion, etc.

[0048] Step S103: store the first operation in the namespace.

[0049] In the embodiment of the present invention, the first operation that needs to be audited is stored in the namespace to record the operations that need to be audited in the operation list.

[0050] Step S104: Obtain the target operation and read the namespace corresponding to the target operation.

[0051] In an embodiment of the present invention, a target operation is acquired, where the target operation is an operation to be executed, a namespace corresponding to the target operation is read, and an operation list where the target operation is located is acquired according to the namespace.

[0052] Step S105: determine whether the target operation is the first operation.

[0053] In the embodiment of the present invention, the target operation is located according to the operation list where the target operation is located, and it is determined whether the target operation is the first operation, that is, the operation that needs to be audited.

[0054] Step S106: If the target operation is the first operation, an audit log is stored for the target operation.

[0055] In some optional implementations, if the target operation is the second operation and the second operation is an operation that does not require auditing, there is no need to store an audit log for the target operation.

[0056] The audit log storage method based on namespace provided by the embodiment of the present invention creates a namespace. Since the namespace can separate different global entities, the creation of a namespace can realize the separate storage of different audit logs. The first operation that needs to be audited in the operation list is obtained, the first operation is stored in the namespace, the target operation is obtained, the namespace corresponding to the target operation is read, and it is determined whether the target operation is the first operation. If the target operation is the first operation, it means that the target operation needs to be audited, and the audit log of the target operation is stored. The present invention creates a namespace, stores the first operation that needs to be audited, determines whether the target operation is the first operation that needs to be audited, and then stores the target operation that needs to be audited. The present invention does not store all audit logs, thereby improving the selectivity of audit log storage. It only stores the acquired audit logs that need to be audited, reduces the accumulation of worthless audit logs, and saves the storage space occupied by audit logs.

[0057] In this embodiment, a namespace-based audit log storage method is provided, which can be used for the above-mentioned audit logs, etc. Figure 2 FIG. 1 is a flowchart of another namespace-based audit log storage method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0058] Step S201: Create a namespace. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0059] Step S202: Determine whether to perform audit log recording.

[0060] In an embodiment of the present invention, whether to execute the audit log record is optional. Therefore, it is necessary to determine whether to execute the audit log record. When selecting for the first time, it is selected not to execute the audit log record. If you want to execute the audit log record later, you can reselect to execute the audit log record.

[0061] Step S203: If the audit log is recorded, the first operation that needs to be audited in the operation list is obtained, and the first operation is stored in the namespace.

[0062] Step S204: Obtain a second operation in the operation list that does not require auditing, and store the second operation in the namespace.

[0063] In an embodiment of the present invention, a first operation that needs to be audited and a second operation that does not need to be audited are obtained from an operation list, and the first operation and the second operation are stored in a namespace for subsequent determination of whether the target operation is the first operation.

[0064] Step S205: Get the target operation and read the namespace corresponding to the target operation. Figure 1 Step S104 of the illustrated embodiment will not be described in detail here.

[0065] Step S206: Determine whether the target operation is the first operation. Figure 1 Step S105 of the illustrated embodiment will not be described in detail here.

[0066] Step S207: If the target operation is the first operation, then the audit log is stored for the target operation. Figure 1 Step S106 of the illustrated embodiment will not be described in detail here.

[0067] In some optional implementations, audit log storage for the target operation includes: obtaining basic audit fields and namespace fields; saving the basic audit fields and namespace fields to form a target operation log to store the audit log for the target operation.

[0068] The basic fields are the fields corresponding to the basic data in the audit log storage process. The namespace field is used to store the namespace configuration. During the storage process, the basic fields are obtained from the storage configuration. The basic fields record the operation time, the client address corresponding to the operation, and other information.

[0069] Step S208: Determine whether the namespace separate storage switch is turned on.

[0070] Step S209: If the namespace separate saving switch is turned on, the target operation log is saved in a separate log file.

[0071] Step S2010: If the namespace separate saving switch is not enabled, the target operation log is saved in a public log file.

[0072] In an embodiment of the present invention, if the namespace separate saving switch is turned on, all target operation logs in the namespace are saved separately in a log file by default. If the namespace separate saving switch is not turned on, the target operation logs are saved in a public log file, increasing the selectivity of the audit log and realizing the separate saving of the target operation logs.

[0073] In an embodiment of the present invention, it is determined whether to perform audit log recording. If audit log recording is performed, the first operation that needs to be audited in the operation list is obtained. If audit log recording is not performed, there is no need to record the audit log. For some worthless audit logs, you can choose not to record them, which improves the selectivity of audit log storage and reduces the accumulation of worthless audit logs.

[0074] In this embodiment, a namespace-based audit log storage method is provided, which can be used for the above-mentioned audit logs, etc. Figure 3 is a flow chart of an operation storage method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0075] Step S301: read the operation list.

[0076] Step S302: Set the character in the operation list used to represent the first operation as the first character, and set the character in the operation list used to represent the second operation as the second character.

[0077] The first character is 1, the second character is 0, the operation corresponding to the first character is the first operation, which is an operation that requires auditing, and the operation corresponding to the second character is the second operation, which is an operation that does not require auditing. The setting character is used to mark and distinguish the first operation from the second operation.

[0078] Step S303: Arrange the first character and the second character in the operation list according to the order of the characters in the operation list, and obtain a binary number according to the arrangement result.

[0079] In the embodiment of the present invention, the order of operations in the operation list remains unchanged, and after the characters corresponding to each operation are set, a string of binary digits corresponding to the entire operation list is obtained.

[0080] Step S304: convert the binary number into a configuration number.

[0081] In the embodiment of the present invention, since the storage capacity of the user operation field is limited and the binary number is long and occupies more capacity, the binary number is converted into a decimal configuration number to save storage resources.

[0082] Step S305: Save the configuration number into the user operation field.

[0083] Among them, it is saved in the user operation (user.audit) field by calling the extended attribute interface.

[0084] Step S306: Determine whether a message indicating successful saving is received.

[0085] Step S307: If a message indicating successful saving is received, it is determined that the first operation and the second operation are successfully stored in the namespace.

[0086] Step S308: If no message indicating successful saving is received, it is determined that storing the first operation and the second operation in the namespace fails.

[0087] In an embodiment of the present invention, an operation list is read, a character representing a first operation in the operation list is set as the first character, and a character representing a second operation in the operation list is set as the second character, the first character and the second character in the operation list are arranged in the order of the characters in the operation list, a binary number is obtained based on the arrangement result, and the first operation that requires auditing and the second operation that does not require auditing are identified and recorded, and the binary number is converted into a configuration number. Since the storage capacity of the user operation field is limited and the binary number is long, it occupies a large amount of storage capacity, so the binary number is converted into a configuration number to save storage resources. A determination is made as to whether a successful save message has been received, and whether the configuration number has been successfully saved is determined.

[0088] In this embodiment, a namespace-based audit log storage method is provided, which can be used for the above-mentioned audit logs, etc. Figure 4 FIG. 1 is a flowchart of determining whether a target operation is a first operation according to an embodiment of the present invention. Figure 4 As shown, the process includes the following steps:

[0089] Step S401, determining whether the configuration number can be obtained.

[0090] Step S402: If the configuration number can be obtained, the audit process is interrupted.

[0091] In an embodiment of the present invention, if the configuration number can be obtained, it means that auditing is enabled for the namespace and the audit log needs to be stored, so the configuration number is read. If the configuration number cannot be obtained, it means that auditing is not enabled for the namespace and the audit process is interrupted.

[0092] Step S403: convert the configuration number into a binary number.

[0093] Step S404: Match the binary number with the target operation list corresponding to the namespace.

[0094] The binary number is matched with the target operation list corresponding to the namespace, and each operation in the target operation list can correspond to a different character in the binary number.

[0095] Step S405 : If the binary number corresponding to the target operation is the first character, it is determined that the target operation is the first operation.

[0096] In some optional implementations, if the binary number corresponding to the target operation is the second character, the audit process is interrupted.

[0097] Step S406: If the configuration number cannot be obtained, the audit process is interrupted.

[0098] In an embodiment of the present invention, the configuration number is read, the configuration number is converted into a binary number, and the binary number is matched with the target operation list corresponding to the namespace. It can be known whether each operation in the target operation list corresponding to the namespace needs to be audited, and it is queried whether the character of the binary number corresponding to the target operation is the first character. If the binary number corresponding to the target operation is the first character, it is determined that the target operation is the first operation, that is, the operation that needs to be audited, so as to determine whether the target operation is audited.

[0099] In the embodiment of the present invention, Figure 5The following figure shows a schematic diagram of namespace management. First, a namespace is created. During namespace creation, the user selects whether to enable audit logging. If auditing is not enabled, the audit configuration is not saved. If auditing is enabled, a list of available operations is read from the configuration file. The user selects a first operation to be audited and a second operation to be unaudited. Examples include create, delete, rename, create directory, and clear. If auditing is disabled and needs to be enabled again, the user can select enable audit again and update the namespace audit operation to re-enable it. The interface provides a list of available operations. In this list, the first operation corresponds to the binary number with the first character being 1, and the second operation corresponds to the binary number with the second character being 2. The entire list of operations forms a series of corresponding binary numbers. For example, the binary number is 11100. The binary number is converted to a decimal configuration number and saved as an extended attribute in the directory file corresponding to the namespace, that is, saved in the user operation field. For example, 11100 is converted to the decimal configuration number 28 and saved in the user operation field. If the save fails, an error message is displayed. A storage cluster has many nodes, and each node will start a storage service process. To ensure configuration consistency, all nodes must receive the configuration refresh command. After successful saving, the cache of the storage process is refreshed, and its own cache is updated. The command to update the cache is sent to refresh the configuration to all nodes on the storage service side to ensure that the configuration cache of all nodes is consistent, avoid some nodes recording audit logs while some nodes do not record audit logs, ensure the timeliness of the audit, and enhance the selectivity of audit log storage by judging whether to execute audit log recording.

[0100] like Figure 6As shown, it is a schematic diagram of audit execution, which obtains the target operation, processes the operation execution result, that is, executes the logic of the target operation, records the response result of the target operation, obtains the namespace to which the target operation belongs, obtains the user operation field of the namespace in the cache, reads the decimal configuration number from the configuration cache, if the configuration number is read, it means that the namespace has enabled audit log recording, converts the configuration number into a binary number, and performs operation association, if the configuration number is not read, it means that the namespace has not enabled audit log recording, then the audit is interrupted, and the binary number is matched one-to-one with each operation in the target operation table where the target operation is located, then it can be known whether the character corresponding to each operation is the first character or the second character, obtains the character corresponding to the target operation, and determines whether the target operation requires recording. If the character corresponding to the target operation is the first character, then it means that the target operation is an operation that needs to be audited, executes the log recording event, that is, stores the audit log for the target operation, if the character corresponding to the target operation is the second character, then it means that the target operation is an operation that does not need to be audited, then the audit is interrupted. The present invention does not store all audit logs, thereby improving the selectivity of audit log storage and only storing the acquired audit logs that need to be audited, thereby reducing the accumulation of worthless audit logs and saving storage space occupied by audit logs.

[0101] like Figure 7 As shown, it is a log output diagram. If the log recording event is executed, fields are added. There are two types of added fields. The first type is the basic field. For example, the basic fields include: Allowed: the result of the operation; Ugi: the user of the client; Ip: the client IP; Cmd: the type of instruction executed by the client; Src: the source file executed by the client; Dst: the final file executed by the client; Perm: the permission attributes of the file; Proto: the protocol information used. The second type is, for example, the namespace field includes: ServreIP: storage IP; Namespace: namespace. After the fields are added, it is determined whether the namespace separate save switch is turned on. If the namespace separate save switch is turned on, the target operation log is saved in a separate log file. For example, the separate log files are named audit file 1, audit file 2, audit file 3, etc. If the namespace separate save switch is not turned on, the target operation log is saved in a public log file. For example, the public log file is a public audit file.

[0102] In this embodiment, a namespace-based audit log storage device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation methods. The details that have been described will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0103] This embodiment provides an audit log storage device based on namespace, such as Figure 8 Shown, including:

[0104] The creation module 801 is used to create a namespace.

[0105] The operation acquisition module 802 is used to acquire the first operation that needs to be audited in the operation list.

[0106] The operation storage module 803 is configured to store the first operation in a namespace.

[0107] The target operation acquisition module 804 is used to acquire the target operation and read the namespace corresponding to the target operation.

[0108] The judging module 805 is configured to judge whether the target operation is the first operation.

[0109] The storage module 806 is configured to store an audit log of the target operation according to the target operation being the first operation.

[0110] Specifically, the operation acquisition module 802 further includes: acquiring a second operation in the operation list that does not require auditing.

[0111] Specifically, the operation storage module 803 further includes: storing the second operation in the namespace.

[0112] Specifically, the operation storage module 803 includes:

[0113] Read unit, used to read the operation list.

[0114] The character setting unit is configured to set the character in the operation list used to represent the first operation as the first character, and set the character in the operation list used to represent the second operation as the second character.

[0115] The binary number determining unit is used to arrange the first character and the second character in the operation list according to the order of the characters in the operation list, and obtain a binary number according to the arrangement result.

[0116] The mode conversion unit is used to convert a binary number into a configuration number.

[0117] The saving unit is used to save the configuration number to the user operation field.

[0118] The judgment unit is used to judge whether a message of successful saving is received; if a message of successful saving is received, it is judged that the first operation and the second operation are successfully stored in the namespace; if no message of successful saving is received, it is judged that the first operation and the second operation are failed to be stored in the namespace.

[0119] Specifically, the judgment module 805 includes:

[0120] The judging unit is used to judge whether the configuration number can be obtained.

[0121] The reading unit is used to read the configuration number according to the obtainable configuration number.

[0122] The conversion unit is used to convert the configuration number into a binary number.

[0123] The corresponding unit is used to correspond the binary number to the target operation list corresponding to the namespace.

[0124] The determining unit is configured to determine that the target operation is the first operation according to the binary number corresponding to the target operation being the first character.

[0125] The present invention provides a namespace-based audit log storage device. A creation module 801 is used to create a namespace. Since namespaces can separate different global entities, creating a namespace can achieve separate storage of different audit logs. An operation acquisition module 802 is used to obtain the first operation that needs to be audited from an operation list. An operation storage module 803 is used to store the first operation in the namespace. A target operation acquisition module 804 is used to obtain the target operation and read the namespace corresponding to the target operation. A judgment module 805 is used to determine whether the target operation is the first operation. If the target operation is the first operation, indicating that the target operation needs to be audited, the storage module 806 is used to store the audit log for the target operation. The present invention creates a namespace, stores the first operation that needs to be audited, determines whether the target operation is the first operation that needs to be audited, and then stores the target operation that needs to be audited. The present invention does not store all audit logs, thereby improving the selectivity of audit log storage. Only the acquired audit logs that need to be audited are stored, reducing the accumulation of worthless audit logs and saving storage space occupied by audit logs.

[0126] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0127] The namespace-based audit log storage device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0128] The embodiment of the present invention also provides a computer device having the above Figure 8 The namespace-based audit log storage device is shown.

[0129] See also Figure 9 , Figure 9 is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 9 As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 9 A processor 10 is taken as an example.

[0130] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0131] The memory 20 stores instructions that can be executed by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0132] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0133] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0134] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0135] The embodiment of the present invention also provides a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0136] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A namespace-based audit log storage method, characterized in that: The method comprises: Create a namespace; obtain a first operation to be audited from an operation list; store the first operation in the namespace; the namespace is used to store audit logs of different operations separately; the operations include create, rename, and delete; Obtain a target operation and read the namespace corresponding to the target operation; the target operation is the operation to be executed; Determine whether the target operation is the first operation; if the target operation is the first operation, store the target operation in an audit log; if the target operation is the second operation, store the target operation in an audit log, and the second operation is an operation that does not require auditing; After the namespace is created, the method further includes: determining whether to perform audit log recording; if the audit log recording is performed, obtaining the first operation that needs to be audited in the operation list; The obtaining of the first operation to be audited from the operation list; storing the first operation in the namespace includes: reading the operation list; setting the character representing the first operation in the operation list as the first character; arranging the first character in the operation list according to the order of the characters in the operation list, and obtaining a binary number according to the arrangement result; converting the binary number into a configuration number; saving the configuration number into a user operation field; determining whether a message of successful saving is received; if a message of successful saving is received, determining that the first operation is successfully stored in the namespace; if no message of successful saving is received, determining that the first operation is failed to be stored in the namespace; Determining whether the target operation is the first operation includes: determining whether the configuration number can be obtained; if the configuration number can be obtained, reading the configuration number; converting the configuration number into a binary number; matching the binary number with a target operation list corresponding to the namespace; if the binary number corresponding to the target operation is the first character, determining that the target operation is the first operation; The method further includes: if the configuration number cannot be obtained, interrupting the audit process; The method further includes: if the binary number corresponding to the target operation is the second character, interrupting the audit process.

2. The method according to claim 1, characterized in that The storing of an audit log for the target operation includes: Get basic audit fields and namespace fields; The basic audit field and the namespace field are saved to form a target operation log to perform audit log storage on the target operation.

3. The method according to claim 2, characterized in that After the basic audit field and the namespace field are saved to form a target operation log so as to store an audit log for the target operation, the method further includes: Determine whether to enable the switch for saving namespaces separately; If the namespace separate save switch is turned on, the target operation log will be saved in a separate log file; If the namespace-specific saving switch is not enabled, the target operation log is saved in the public log file.

4. A namespace-based audit log storage device, characterized in that: The device comprises: A creation module is used to create a namespace; the namespace is used to store audit logs of different operations separately; the operations include creation, renaming and deletion; An operation acquisition module is used to acquire the first operation that needs to be audited in the operation list; an operation storage module, configured to store the first operation in the namespace; A target operation acquisition module is used to acquire a target operation and read a namespace corresponding to the target operation; the target operation is the operation to be executed; A judging module, configured to judge whether the target operation is the first operation; a storage module configured to store an audit log for the target operation if the target operation is the first operation; and to store no audit log for the target operation if the target operation is the second operation, the second operation being an operation that does not require auditing; After the namespace is created, the device further comprises: determining whether to perform audit log recording; if the audit log recording is performed, obtaining the first operation that needs to be audited in the operation list; The operation storage module includes: a reading unit for reading an operation list; a character setting unit for setting a character in the operation list used to represent a first operation as the first character; a binary number determination unit for arranging the first character in the operation list according to the order of the characters in the operation list and obtaining a binary number based on the arrangement result; a mode conversion unit for converting the binary number into a configuration number; a saving unit for saving the configuration number into a user operation field; a judgment unit for judging whether a message of successful saving is received; if a message of successful saving is received, judging that the first operation is successfully stored in the namespace; if no message of successful saving is received, judging that the first operation is failed to be stored in the namespace; The judgment module includes: a judgment unit for judging whether the configuration number can be obtained; a reading unit for reading the configuration number based on whether the configuration number can be obtained; a conversion unit for converting the configuration number into a binary number; a corresponding unit for matching the binary number with a target operation list corresponding to the namespace; and a judgment unit for judging that the target operation is the first operation based on the binary number corresponding to the target operation being the first character. The apparatus further comprises: if the configuration number cannot be obtained, interrupting the audit process; The device further includes: if the binary number corresponding to the target operation is the second character, interrupting the audit process.

5. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the namespace-based audit log storage method described in any one of claims 1 to 3 by executing the computer instructions.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the namespace-based audit log storage method according to any one of claims 1 to 3.

Images