Cloud auditing method, device, system, electronic device and medium

Abstract

The present disclosure provides a cloud audit method, device, system, electronic equipment and medium, relating to the technical field of cloud audit, which comprises: collecting operation event data in a resource pool corresponding to a cloud audit unit through a resource operating system of the cloud audit unit, and sending the operation event data to a cloud audit subsystem of the cloud audit unit; storing the operation event data to a database of the cloud audit unit by the cloud audit subsystem; processing data of the resource pool corresponding to each cloud audit unit by using each cloud audit unit in the cloud audit system, realizing a distributed cloud audit method, improving the performance of the cloud audit system when data of multiple resource pools need to be processed simultaneously, that is, improving the processing speed and throughput of the cloud audit system. At the same time, since each cloud audit unit can work independently, the reliability and stability of the cloud audit system are also improved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of cloud audit, and in particular, to a cloud audit method, device, system, electronic device and medium. BACKGROUND

[0002] Under the background of gradual cloudification of information systems, cloud audit is a core component of information security audit function. The cloud audit system is a professional audit service in the mobile cloud security solution, which provides collection, storage and query functions for various cloud resource operation records, and can be used to support common application scenarios such as security analysis, compliance audit, resource tracking and problem positioning.

[0003] At present, the cloud audit method in the related art is mostly a centralized cloud audit method, that is, the resource management system of each resource pool uniformly reports the resource operation request and result record of the user cloud service to the cloud audit middle station of the cloud audit system for centralized processing and storage. However, this centralized cloud audit method has obvious performance bottlenecks, especially when multiple resource pools need to be processed at the same time, the centralized cloud audit method processes multiple resource pools through the cloud audit middle station in the cloud audit system, which may cause the performance of the cloud audit system in the centralized cloud audit method to decline due to excessive load, such as throughput and processing speed, which often cannot meet the demand. SUMMARY

[0004] The present disclosure provides a cloud audit method, device, system, electronic device and medium to solve the problems in the related art, by processing the data of each resource pool corresponding to each cloud audit unit in the cloud audit system through each cloud audit unit, a distributed cloud audit method is realized, and the performance of the cloud audit system when multiple resource pools need to be processed at the same time is improved, that is, the processing speed and throughput of the cloud audit system are improved. At the same time, since each cloud audit unit can work independently, the reliability and stability of the cloud audit system are also improved.

[0005] The first aspect embodiment of the present disclosure provides a cloud audit method, which is applied to a cloud audit unit in a cloud audit system, and the method comprises: collecting operation event data in a resource pool corresponding to the cloud audit unit through a resource operation system of the cloud audit unit, and sending the operation event data to a cloud audit subsystem of the cloud audit unit; and storing the operation event data in a database of the cloud audit unit by the cloud audit subsystem.

[0006] In some embodiments of the present disclosure, the cloud audit subsystem storing the operation event data in the database of the cloud audit unit comprises: if the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is an open state, storing the operation event data in the database.

[0007] In some embodiments of the present disclosure, the operation event data in the resource pool corresponding to the cloud audit unit is collected by the resource operating system of the cloud audit unit, comprising: the resource operating system collects the operation event data in the resource pool corresponding to the cloud audit unit by using the message queue mode and / or the interface mode.

[0008] In some embodiments of the present disclosure, the operation event data is stored in the database of the cloud audit unit by the cloud audit subsystem, and then the method comprises: in the case that the operation event data is collected by the resource operating system using the interface mode, if the cloud audit subsystem is configured with the object storage function, the cloud audit subsystem sends the dump task corresponding to the object storage function to the distributed coordination server of the cloud audit unit, and stores the dump task in the database; if the cloud audit subsystem monitors that the distributed coordination server creates the sub-node corresponding to the dump task, the operation event data is stored in the object storage of the cloud audit unit.

[0009] In some embodiments of the present disclosure, if the cloud audit subsystem monitors that the distributed coordination server creates the sub-node corresponding to the dump task, the operation event data is stored in the object storage of the cloud audit unit, comprising: if the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is the open state, the cloud audit subsystem obtains the dump key corresponding to the dump task from the object storage control system of the cloud audit unit; if the cloud audit subsystem monitors that the distributed coordination server creates the sub-node corresponding to the dump task, the cloud audit subsystem dumps the operation event data to the object storage by using the dump key.

[0010] In some embodiments of the present disclosure, if the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is the open state, the cloud audit subsystem obtains the dump key corresponding to the dump task from the object storage control system of the cloud audit unit, comprising: if the dump key is abnormal, the cloud audit subsystem obtains the normal dump key in the object storage control system, and updates the dump key to the normal dump key.

[0011] In some embodiments of the present disclosure, if the cloud audit subsystem monitors that the distributed coordination server creates the sub-node corresponding to the dump task, the cloud audit subsystem dumps the operation event data to the object storage by using the dump key, and then the method comprises: the cloud audit subsystem deletes the dump task stored in the database.

[0012] In some embodiments of the present disclosure, the resource operating system collects operation event data in the resource pool corresponding to the cloud audit unit, and sends the operation event data to the cloud audit subsystem. Then, the method comprises: the cloud audit subsystem sends the operation event data to the message notification unit of the cloud audit unit; the message notification unit determines the event level corresponding to the operation event data and the notification mode corresponding to the event level, and sends the event level corresponding to the operation event data to the user end by using the notification mode.

[0013] The second aspect embodiment of the present disclosure provides a cloud audit device, which comprises:

[0014] The collection unit is configured to collect operation event data in a resource pool corresponding to the cloud audit unit by a resource operating system of the cloud audit unit, and send the operation event data to a cloud audit subsystem of the cloud audit unit.

[0015] The storage unit is configured to store the operation event data in a database by the cloud audit subsystem of the cloud audit unit.

[0016] The third aspect embodiment of the present disclosure provides a cloud audit system, which comprises:

[0017] At least one cloud audit unit;

[0018] Any cloud audit unit of the at least one cloud audit unit comprises a resource operating system, a cloud audit subsystem and a database.

[0019] The resource operating system is connected with the cloud audit subsystem, and is configured to collect operation event data in a resource pool corresponding to the cloud audit unit, and send the operation event data to the cloud audit subsystem.

[0020] The cloud audit subsystem is connected with the database, and is configured to store the operation event data in the database.

[0021] The fourth aspect embodiment of the present disclosure provides an electronic device, which comprises a processor and a memory for storing a computer program capable of running on the processor. When the processor runs the computer program, the processor executes the method described in the first aspect embodiment of the present disclosure.

[0022] The fifth aspect embodiment of the present disclosure provides a non-transitory computer readable storage medium storing computer instructions, wherein the computer instructions are used to make a computer execute the method described in the first aspect embodiment of the present disclosure.

[0023] The sixth aspect embodiment of the present disclosure provides a computer program product comprising a computer program, wherein the computer program, when executed by a processor, implements the method described in the first aspect embodiment of the present disclosure.

[0024] In summary, according to the cloud auditing method proposed in the present disclosure, the operation event data in the resource pool corresponding to the cloud auditing unit is collected by the resource operating system of the cloud auditing unit, and the operation event data is sent to the cloud auditing subsystem of the cloud auditing unit; the cloud auditing subsystem stores the operation event data to the database of the cloud auditing unit, and the data of each resource pool corresponding to each cloud auditing unit is stored by using each cloud auditing unit in the cloud auditing system, so as to realize the distributed cloud auditing method, improve the performance of the cloud auditing system when the data of multiple resource pools need to be processed at the same time, that is, improve the processing speed and throughput of the cloud auditing system. At the same time, since each cloud auditing unit can work independently, the reliability and stability of the cloud auditing system are also improved.

[0025] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0026] The accompanying drawings incorporated in the specification and forming a part of the specification illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the disclosure without imposing undue limitation on the disclosure.

[0027] Figure 1 A schematic diagram of a cloud auditing system in a related technology provided for an embodiment of the present disclosure;

[0028] Figure 2 A flowchart of a cloud auditing method provided for an embodiment of the present disclosure;

[0029] Figure 3 A flowchart of a cloud auditing method provided for an embodiment of the present disclosure;

[0030] Figure 4 A flowchart of a cloud auditing method provided for an embodiment of the present disclosure;

[0031] Figure 5 A schematic diagram of a resource operating system collecting operation event data through a message queue mode provided for an embodiment of the present disclosure;

[0032] Figure 6 A schematic diagram of a resource operating system collecting operation event data through an interface mode provided for an embodiment of the present disclosure;

[0033] Figure 7 A flowchart of a cloud auditing method provided for an embodiment of the present disclosure;

[0034] Figure 8 A flowchart of a cloud auditing method provided for an embodiment of the present disclosure;

[0035] Figure 9This is a schematic diagram illustrating a notification based on the event level of operational event data, provided as an embodiment of this disclosure.

[0036] Figure 10 A schematic diagram of a cloud auditing system provided in an embodiment of this disclosure;

[0037] Figure 11 A schematic diagram illustrating a specific cloud auditing method provided in an embodiment of this disclosure;

[0038] Figure 12 A timing diagram of a specific cloud auditing method provided in an embodiment of this disclosure;

[0039] Figure 13 A schematic diagram of the logical architecture of a specific cloud auditing system provided in this disclosure embodiment;

[0040] Figure 14 This is a schematic diagram illustrating the relationship between a cloud auditing subsystem, an object storage control system, and a persistence layer, as provided in an embodiment of this disclosure.

[0041] Figure 15 This is a schematic diagram of the structure of a cloud auditing device provided in an embodiment of the present disclosure;

[0042] Figure 16 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0043] Embodiments of this disclosure are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments are described below with reference to the accompanying drawings.

[0044] With the increasing cloudification of information systems, cloud auditing is a core and essential component of information security auditing. A cloud auditing system is a professional auditing service within mobile cloud security solutions, providing the collection, storage, and querying of operation records for various cloud resources. It can be used to support common application scenarios such as security analysis, compliance auditing, resource tracking, and problem localization. It is offered as a mobile cloud product to serve customers' resources on the mobile cloud.

[0045] like Figure 1 The diagram shown illustrates a cloud auditing system in a related technology. Currently, most cloud auditing methods in related technologies are centralized cloud auditing methods. (Refer to...) Figure 1The resource management systems of the resource pool 1, the resource pool 2, and the resource pool 3 uniformly report the resource operation request and result record of the user cloud service to the cloud audit middle station (the audit system) for centralized processing and storage (for example, storing data in the form of a file to an object storage, and sending data to a log system for analysis). However, the centralized cloud audit method has obvious performance bottlenecks, especially under the pressure of multiple resource pools. When the data of multiple resource pools need to be processed at the same time, the centralized cloud audit method may be challenged in performance of the cloud audit system in the centralized cloud audit method due to excessive load, and the throughput and processing speed often cannot meet the demand.

[0046] At the same time, the data collection form of the cloud audit method in the related art generally adopts an interface or a file form. Although the interface form reports event operation data in real time, it is limited by the processing capacity, concurrency, and throughput of the cloud audit system, resulting in limited concurrent processing capacity of the cloud audit system. If flow limiting and degradation are not performed, the cloud audit system may collapse in a high concurrency scenario; the file form reports event operation data, which has improved throughput of the cloud audit system compared with the interface form, but lacks a certain real-time performance, and has low security and poor reliability. Moreover, the data collection method of the cloud audit system in the related art is single, and cannot provide appropriate data collection forms in multiple scenarios such as internal and external systems. In addition, if the user sets the dump to the object storage in the cloud audit system in the related art, the data collection interface processing flow is long, and the interface processing logic needs to be optimized to reduce the system performance.

[0047] In addition, the cloud audit system in the related art lacks a proactive alarm mechanism. When the user resources change significantly, the corresponding user is not actively notified, resulting in low security.

[0048] To solve the problems in the related art, the cloud audit method provided by the present disclosure can efficiently and reliably perform the data storage process of cloud audit, and can be applied to fields such as the financial industry and the retail industry, which are not limited in the embodiments of the present disclosure.

[0049] The cloud audit method provided by the present disclosure will be described in detail below with reference to the accompanying drawings.

[0050] Figure 2 A flowchart of a cloud audit method provided by an embodiment of the present disclosure. As shown in the figure, the method is applied to any cloud audit unit in a cloud audit system, and the cloud audit method includes steps 101-102. Figure 2

[0051] ​In step 101, the resource operating system of the cloud audit unit collects operation event data in the resource pool corresponding to the cloud audit unit and sends the operation event data to the cloud audit subsystem of the cloud audit unit.

[0052] In an embodiment of the present disclosure, each cloud audit unit corresponds to a resource pool, and the resource operating system in each cloud audit unit processes the resource pool corresponding to the current cloud audit unit.

[0053] The resource operating system can collect operation event data in the resource pool corresponding to the cloud audit unit in two ways, namely, a message queue way and an interface way. The operation event data is operation event data in a predefined format.

[0054] In step 102, the cloud audit subsystem stores the operation event data in the database of the cloud audit unit.

[0055] In an embodiment of the present disclosure, after receiving the operation event data sent by the resource operating system, the cloud audit subsystem of the cloud audit unit can store the operation event data in the database in the cloud audit unit for subsequent query and analysis.

[0056] In summary, according to the cloud audit method provided in the present disclosure, the resource operating system of the cloud audit unit collects operation event data in the resource pool corresponding to the cloud audit unit and sends the operation event data to the cloud audit subsystem of the cloud audit unit; the cloud audit subsystem stores the operation event data in the database of the cloud audit unit. By storing the data of the resource pool corresponding to each cloud audit unit in each cloud audit unit of the cloud audit system, a distributed cloud audit method is realized, the performance of the cloud audit system is improved when the data of multiple resource pools need to be processed at the same time, that is, the processing speed and throughput of the cloud audit system are improved. At the same time, since each cloud audit unit can work independently, the reliability and stability of the cloud audit system are also improved.

[0057] As a possible implementation manner, as shown in a flowchart of a cloud audit method, Figure 3 On the basis of the above embodiment, the specific process of storing the operation event data in the database by the cloud audit subsystem includes the following steps:

[0058] In step 201, if the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is an open state, the operation event data is stored in the database.

[0059] In an embodiment of the present disclosure, the cache middleware of the cloud audit unit can be Redis, which is used to store and quickly retrieve the tracker state. The tracker state determines whether the operation event data is stored in the database.

[0060] The cloud audit subsystem can determine the state of the tracer from the cache middleware. The tracer is usually a flag or a configuration item indicating whether the current operation event data should be recorded.

[0061] If the cloud audit subsystem determines that the tracer is set to the on state, indicating that the user wants to record the current operation event data, the cloud audit subsystem can store the operation event data to the database.

[0062] In summary, the present disclosure dynamically determines whether to store operation event data based on the state of the tracer in the cache middleware (such as Redis), thereby achieving flexible management and control of operation event data.

[0063] As a possible implementation, as shown in a flowchart of a cloud audit method, the specific process of the resource operating system collecting operation event data in the resource pool corresponding to the cloud audit unit includes the following steps: Figure 4

[0064] Step 301: The resource operating system collects operation event data in the resource pool corresponding to the cloud audit unit by using a message queue method and / or an interface method.

[0065] In the embodiments of the present disclosure, the resource operating system can collect operation event data of internal systems and external systems in the resource pool by using a message queue method and / or an interface method. The internal systems in the resource pool can report operation event data by using a message queue method, and the external systems in the resource pool can report operation event data by using an interface method.

[0066] In an optional embodiment of the present disclosure, operation event data can be reported in a predefined format, i.e., a general format defined by cloud audit, as shown in Table 1.

[0067]

[0068] Table 1

Operation event data table in a predefined format

[0069] Referring to Table 1, the meanings and contents of the fields are as follows:

[0070] Operation subject resource id: Resource id of an operation behavior subject cloud resource such as a virtual machine, a cloud hard disk, etc.

[0071] Operation subject resource name: Resource name of an operation behavior subject cloud resource such as a virtual machine, a cloud hard disk, etc.

[0072] Operation subject resource type: Resource type of an operation behavior subject cloud resource such as a virtual machine, a cloud hard disk, etc., product code. ​

[0073] Operation Object Resource ID: The resource ID of the associated cloud resource triggered by the operation behavior.

[0074] Operation Object Resource Name: The resource name of the associated cloud resource triggered by the operation behavior.

[0075] Object Resource Type: The resource type of the associated cloud resource triggered by the operation behavior.

[0076] Operation Name: The name of the resource operation behavior.

[0077] Source IP: The source IP address of the operation initiation.

[0078] Operation Time: The time of the resource operation.

[0079] Operation Result: The result of the operation. For example, the result of creating a security group is success.

[0080] User ID: The id of the user.

[0081] Customer ID: The id of the customer.

[0082] Resource Pool: The resource pool to which the resource belongs.

[0083] Event Source: The source of the operation event, such as ConsoleAction indicating an operation performed through the public cloud management console. SystemAction indicating an operation triggered internally by the public cloud system. ApiCall indicating an operation triggered by calling an api interface.

[0084] Operation Event Level: The event level of the operation event, divided into normal, warning, and incident. According to different event levels, it is determined whether to send an alarm message to notify the user contact.

[0085] Operation Account Name: The name of the cloud management platform operation account.

[0086] Request ID at Event Occurrence: The request id at the time of event triggering, used for subsequent investigation.

[0087] Among them, for the definition of resource operation events, the cloud audit system supports fixed operation events, which are stored in the dictionary table. The corresponding OPERATION (unique identifier), RESOURCE (related resource type), and DESCRIPTION (description) need to be agreed with the resource data reporting party, and the new operation event data is stored in the database table. As shown in the operation event dictionary in Table 2, only part of the operations are taken as examples:

[0088] OPERATION RESOURCE DESCRIPTION createServer ecs Create cloud host deleteServer ecs Delete cloud host startServer ecs Start cloud host stopServer ecs Stop cloud host restartServer ecs Restart cloud host ECSRename ecs Rename cloud host vncLogin ecs VNC login ResetPassword ecs Change password of cloud host ECSRebuild ecs Reinstall cloud host createImage ecs Create image of cloud host ModifySystemDisk ecs Change system disk

[0089] Table 2

Operation event dictionary

[0090] In an optional embodiment of the present disclosure, as shown in Figure 5 , a resource operation system collects operation event data through a message queue mode. Referring to Figure 5 , the cloud audit units (resource operation layer systems in the cloud resource operation platform system, i.e., the resource operation layer systems in the cloud resource operation platform system) of the resource pool A, the resource pool B, and the resource pool C can report data to the message queue rocketMQ in a predefined data format. The cloud audit subsystems of the respective resource pools can subscribe to and consume messages, and distinguish event messages of the respective resource pools according to tags. The topic names specified by the delivery messages and the consumption messages are fixed. The tags are different for each resource pool, and the tag values are set as resource pool codes. For example, the cloud audit subsystem of the resource pool A consumes messages with a tag PoolA, and the cloud audit subsystem of the resource pool B consumes messages with a tag PoolB. Figure 5

[0091] The resource operation system collects data through the message queue mode to solve the problem of interface concurrency limitation in the related art, improve the throughput concurrency of the cloud audit system, and realize peak shaving in peak periods. Meanwhile, the coupling between other systems and the cloud audit system is reduced, and the strong dependency relationship is weakened. The efficiency of the access of other systems to the cloud audit is improved, and only one set of message queue needs to be connected, without the need to focus on the audit deployment node and the request url. In addition, the real-time performance of data is also ensured to a certain extent. The cluster mode is started to adapt to the non-repeated consumption of messages in a distributed environment, and the collection efficiency is improved.

[0092] In an optional embodiment of the present disclosure, as shown in Figure 6 , a resource operation system collects operation event data through an interface mode. Referring to Figure 6 , the resource operation layer systems of the resource pool A, the resource pool B, and the resource pool C can first send operation event data to a central gateway, and then the central gateway sends the operation event data to the cloud audit subsystems of the resource pool A, the resource pool B, and the resource pool C through the local gateways corresponding to the respective resource pools.

[0093] In summary, the present disclosure adds the message queue collection mode to the internal system in collecting operation event data of different resource pools, solves the problem of interface concurrency limitation, improves the throughput concurrency of the system, realizes peak shaving in peak periods, starts the cluster mode to adapt to the non-repeated consumption of messages in a distributed environment, and improves the collection efficiency. The coupling between the resource system and the cloud audit system is reduced, and the strong dependency relationship is weakened. The interface cost is reduced, and the resource system does not need to focus on many interface information, but only needs to access according to the standard of the unified message queue. ​

[0094] As a possible implementation, as shown in a flowchart of a cloud auditing method, Figure 7 on the basis of the above embodiment, the cloud auditing subsystem stores the operation event data to the database, and the specific process thereafter includes the following steps:

[0095] Step 401, in the case where the resource operating system collects operation event data by using the interface mode, if the cloud auditing subsystem is configured with the object storage function, the cloud auditing subsystem sends a dump task corresponding to the object storage function to the distributed coordination server of the cloud auditing unit, and stores the dump task to the database.

[0096] In the embodiment of the present disclosure, when the resource operating system collects operation event data by using the interface mode, the cloud auditing system saves the operation event data to the database, and the cloud auditing subsystem checks whether the object storage function is configured, i.e., the function of dumping the operation event data to the object storage. The object storage is usually used for long-term storage of a large amount of data, and provides high availability and scalability. In the dumping process, the cloud auditing system can save the database table of the value database, such as the dump table, when saving the operation event data to the database.

[0097] If the cloud auditing subsystem is configured with the object storage function, the cloud auditing subsystem can create a dump task, and save the dump task to the database. At the same time, the distributed coordination server (ZooKeeper) of the cloud auditing unit can create a sub-node (new znode) according to the dump task created by the cloud auditing subsystem.

[0098] Step 402, if the cloud auditing subsystem monitors the sub-node corresponding to the dump task created by the distributed coordination server, the operation event data is stored to the object storage of the cloud auditing unit.

[0099] In the embodiment of the present disclosure, the cloud auditing subsystem can continuously listen to the changes of the nodes on the distributed coordination server. When the cloud auditing subsystem monitors the sub-node corresponding to the dump task created by the distributed coordination server, the cloud auditing subsystem asynchronously triggers the dump operation corresponding to the dump task, i.e., stores the operation event data to the object storage. The asynchronous processing means that the dump operation will not block other functions of the cloud auditing system, thereby ensuring the high availability of the cloud auditing system.

[0100] In the process of storing the operation event data into the object storage, the disclosure requires obtaining the dump key first. That is, if the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is in the open state, the cloud audit subsystem obtains the dump key corresponding to the dump task from the object storage control system of the cloud audit unit; if the cloud audit subsystem monitors that the distributed coordination server creates a subnode corresponding to the dump task, the cloud audit subsystem dumps the operation event data into the object storage using the dump key.

[0101] In an optional embodiment of the disclosure, the cloud audit subsystem can obtain the state of the tracker from the cache middleware of the cloud audit unit, and the dump key (AKSK) stored in the object storage control system of the cloud audit unit. The dump key (AKSK) is an authentication credential of the object storage, which is used for authorization access.

[0102] The cloud audit subsystem can use the obtained dump key to dump the operation event data into the configured object storage of the cloud audit unit. The dumping process may involve operations such as encryption, compression, and uploading of data.

[0103] It should be noted that, before storing the operation event data in the object storage using the dump key, the disclosure needs to verify the dump key to ensure that the dump key is normal and does not have abnormal situations such as expiration and invalidation. If the dump key is abnormal, the cloud audit subsystem obtains a normal dump key in the object storage control system, and updates the dump key to a normal dump key. Among them, the normal dump key is the latest dump key in the current object storage control system. The dump key can also be stored in the cache middleware, and when the dump key is abnormal, the object storage control system can send the latest dump key to the cache middleware to update the stored dump key in the cache middleware.

[0104] Meanwhile, in the embodiment of the disclosure, if the cloud audit subsystem monitors that the distributed coordination server creates a subnode corresponding to the dump task, the cloud audit subsystem dumps the operation event data into the object storage using the dump key, and then the disclosure further comprises: the cloud audit subsystem deletes the dump task stored in the database.

[0105] In other words, once the dump operation is successfully completed and it is confirmed that the operation event data has been safely stored in the object storage, the cloud audit subsystem will delete the corresponding dump task record from the database. This helps to release database resources and avoid repeated processing of completed tasks. Among them, the cloud audit subsystem can delete the dump task stored in the database at a preset period, for example, it can delete the dump task stored in the database seven days ago at a period of seven days.

[0106] In summary, the cloud auditing method of the present disclosure fully utilizes the cache function of the cache middleware, the data persistence ability of the database, the distributed coordination mechanism of the distributed coordination server, and the scalability and high availability of the object storage in the dump process to ensure the integrity of the operation event data and the stability of the cloud auditing system, and to improve the system performance and system efficiency.

[0107] As a possible implementation, as shown in a flow diagram of a cloud auditing method, Figure 8 the resource operating system collects operation event data in the resource pool corresponding to the cloud auditing unit, and sends the operation event data to the cloud auditing subsystem. The specific process after that includes the following steps:

[0108] Step 501, the cloud auditing subsystem sends the operation event data to the message notification unit of the cloud auditing unit.

[0109] In the embodiment of the present disclosure, the cloud auditing subsystem can be connected with the message notification unit, which can determine the event type of the operation event data and the notification method corresponding to the event type to send the event type to the user end.

[0110] Step 502, the message notification unit determines the event level corresponding to the operation event data and the notification method corresponding to the event level, and sends the event level corresponding to the operation event data to the user end by using the notification method.

[0111] In the embodiment of the present disclosure, the event level corresponding to different operation event data is pre-marked, and the user end can mark the event level of different operation event data. The event level in the present disclosure can be divided into three levels of normal, warning and incident. As shown in a diagram of notifying according to the event level of the operation event data, Figure 9 the user end can set the corresponding notification person information including mobile phone and email in the message notification management of the message notification system, and can also set the operation event level, product type, resource type, etc. to be notified. The message notification system can perform real-time notification for high-risk operation, sensitive operation, and unauthorized operation according to the user's settings.

[0112] In summary, the present disclosure adds a hierarchical marking to the operation event data and adds a message notification system, and the user can set the notification strategy and the notification person information, so as to realize the timely notification of information to the user end according to the event level of the operation event data, and improve the security of the cloud auditing system.

[0113] Based on the embodiment shown in Figure 1 to Figure 9 the present disclosure provides a schematic diagram of a cloud auditing system, as shown in Figure 10The cloud audit system in the present disclosure comprises:

[0114] at least one cloud audit unit;

[0115] Any cloud audit unit of the at least one cloud audit unit comprises a resource operating system, a cloud audit subsystem and a database;

[0116] The resource operating system is connected with the cloud audit subsystem, and the resource operating system is configured to collect operation event data in a resource pool corresponding to the cloud audit unit and send the operation event data to the cloud audit subsystem;

[0117] The cloud audit subsystem is connected with the database, and the cloud audit subsystem is configured to store the operation event data to the database.

[0118] In an embodiment of the present disclosure, the cloud audit unit further comprises a cache middleware, the cloud audit subsystem is connected with the cache middleware, and the cloud audit subsystem is configured to determine a state of a tracer in the cache middleware, and if the cloud audit subsystem determines that the state of the tracer in the cache middleware is an open state, the cloud audit subsystem stores the operation event data to the database.

[0119] In an embodiment of the present disclosure, the resource operating system collects the operation event data in the resource pool corresponding to the cloud audit unit by using a message queue mode and / or an interface mode.

[0120] In an embodiment of the present disclosure, the cloud audit unit further comprises a distributed coordination server and an object storage, the distributed coordination server is connected with the cloud audit subsystem, if the cloud audit subsystem is configured with an object storage function, the cloud audit subsystem sends a dump task corresponding to the object storage function to the distributed coordination server and stores the dump task to the database, the object storage is connected with the cloud audit subsystem, and if the cloud audit subsystem monitors that the distributed coordination server creates a sub-node corresponding to the dump task, the cloud audit subsystem stores the operation event data to the object storage.

[0121] In an embodiment of the present disclosure, the cloud audit unit further comprises an object storage control system, the cloud audit subsystem is connected with the object storage control system, if the cloud audit subsystem determines that the state of the tracer in the cache middleware is the open state, the cloud audit subsystem acquires a dump key corresponding to the dump task from the object storage control system, if the cloud audit subsystem monitors that the distributed coordination server creates the sub-node corresponding to the dump task, the cloud audit subsystem dumps the operation event data to the object storage by using the dump key.

[0122] In an embodiment of the present disclosure, if the dump key is abnormal, the cloud audit subsystem acquires a normal dump key in the object storage control system and updates the dump key to the normal dump key.

[0123] In the embodiment of the present disclosure, if the cloud audit subsystem monitors that the distributed coordination server creates a sub-node corresponding to the dump task, the cloud audit subsystem dumps the operation event data to the object storage by using the dump key, and then the cloud audit subsystem deletes the dump task stored in the database.

[0124] In the embodiment of the present disclosure, the cloud audit unit comprises a message notification unit, the cloud audit subsystem is connected with the message notification unit, the cloud audit subsystem sends the operation event data to the message notification unit, the message notification unit determines the event level corresponding to the operation event data and the notification mode corresponding to the event level, and sends the event level corresponding to the operation event data to the user end by using the notification mode.

[0125] In summary, the cloud audit system in the present disclosure adopts a distributed system architecture, divides the entire cloud audit system into a plurality of cloud audit units corresponding to a plurality of resource pools, and each cloud audit unit processes the operation event data in the resource pool corresponding thereto. Meanwhile, the data collection mode of each cloud audit unit in the cloud audit system adopts a combination of message queues and interfaces to cope with different needs of internal and external systems. Among them, when the resource operation system collects operation event data by using the interface, asynchronous threads can be used to realize the dumping of resource operation data to the object storage. Meanwhile, each cloud audit unit of the cloud audit system can determine the event level of the operation event data, and send the event level corresponding to the operation event data to the user end by using the notification mode corresponding to the event level, which can flexibly notify and alarm the events in the dimensions of service type, resource type, event level, etc., and improve the security of the cloud audit system.

[0126] Based on Figure 1 to Figure 10 As shown in the embodiment, the present disclosure provides a schematic diagram of a specific cloud audit method, and as shown in the embodiment, the present disclosure provides a timing diagram of a specific cloud audit method. Figure 11 As shown in the embodiment, the present disclosure provides a schematic diagram of a specific cloud audit method, and as shown in the embodiment, the present disclosure provides a timing diagram of a specific cloud audit method. Figure 12 As shown in the embodiment, the present disclosure provides a schematic diagram of a specific cloud audit method, and as shown in the embodiment, the present disclosure provides a timing diagram of a specific cloud audit method.

[0127] In the embodiment of the present disclosure, refer to Figure 11Due to the particularity of the business, the asynchronous thread design is adopted for the interface. In order to improve the performance of the cloud audit system, the main thread of the interface returns the response success information in priority, and the subsequent business logic is processed by the asynchronous thread. The asynchronous thread stores the operation event data into the database of the cloud audit unit in the cloud audit system. The cloud audit subsystem in the cloud audit unit judges whether to dump to the object storage according to the user's setting. If the user sets to dump to the object storage, the cloud audit subsystem stores the operation event data into the special database table and increases the corresponding subnode (znode) on the distributed coordination server (zookeeper). The operation event data reporting process is completed. The cloud audit subsystem listens to the corresponding subnode on the zookeeper. When the change of the subnode is found, the corresponding logic processing is triggered to encrypt the data in the special database table and dump it to the object storage. The original data collection interface processing flow is long and does to many judgment tests, including testing whether to start dumping, then dumping to the object storage, and maintaining high coupling with the object storage. The distributed notification coordination capability of the zookeeper is used to reduce the main flow of collection. The performance is improved. And real-time processing of data changes can be realized. The asynchronous thread processing of the dumping operation improves the system efficiency.

[0128] Referring to Figure 12 When the operation event data is reported to the cloud audit system, the state of the tracer is obtained from the cache middleware. If the tracer is set to the start state, that is, the user sets to record the operation event data and save the operation event log to the database. The cloud audit subsystem can check whether the dumping to the object storage is started. If it has been set to start, the dumping task is sent to the distributed coordination server, and the dumping task is stored to the database. The distributed coordination server (zookeeper) creates a subnode (znode) based on the dumping task. When the cloud audit subsystem listens to the change of the znode of the zookeeper, the asynchronous triggering of the dumping operation is triggered. In the dumping process, the cloud audit subsystem obtains the state of the tracer and the dumping key (AKSK) of the object storage from the cache middleware (redis). When the tracer is in the start state and the dumping key is normal, the operation event data is dumped to the object storage by using the dumping key. If the dumping key verification fails, the latest dumping key of the object storage can be obtained from the object storage control system, and the cache middleware is updated to re-execute the dumping operation to store the operation event data to the object storage. After the operation event data is stored to the object storage, the cloud audit system can delete the dumping task in the database.

[0129] Based on Figure 1 to Figure 12 The present disclosure provides a specific cloud audit system logical architecture diagram, and as Figure 13 The present disclosure provides a specific cloud audit system logical architecture diagram, and as Figure 14The cloud audit subsystem and the schematic diagram of the relationship between the object storage control system and the persistent layer are provided.

[0130] In the embodiments of the present disclosure, with reference to Figure 13 The cloud audit system in the present disclosure is divided into four layers, namely, a persistent layer, a data layer, an intermediate layer, an application layer, and a presentation layer. The specific content of each layer is as follows.

[0131] The persistent layer is mainly composed of a MySQL database, a Redis cache middleware, and object storage. The database persistently stores console operation events generated by the platform in a primary-standby mode. The Redis cache middleware mainly stores trackers generated during platform operation, basic operation events, and other platform data with high throughput performance requirements. The object storage mainly stores user operation log events, including computing, storage, and network.

[0132] The data layer mainly performs operations on data, handles cache processing, data backup, transactions, and the like.

[0133] The business capability layer mainly includes basic functions required by cloud audit, including log event management, tracker management, and dump log processing.

[0134] The application layer provides API capabilities, restful interface capabilities, and the like to the outside.

[0135] The presentation layer mainly includes front-end page rendering and client app rendering.

[0136] Corresponding to the method provided in the above several embodiments, the present disclosure also provides a cloud audit device. Since the device provided in the embodiments of the present disclosure corresponds to the method provided in the above several embodiments, the implementation manner of the method is also applicable to the device provided in the present embodiment, and will not be described in detail in the present embodiment.

[0137] Figure 15 A structural schematic diagram of a cloud audit device 1500 provided in the embodiments of the present disclosure is shown in FIG. 15. Figure 15 As shown in the figure, the cloud audit device includes:

[0138] The acquisition unit 1510 is configured to acquire operation event data in a resource pool corresponding to the cloud audit unit through a resource operating system of the cloud audit unit, and send the operation event data to a cloud audit subsystem of the cloud audit unit.

[0139] The storage unit 1520 is configured to store the operation event data to a database of the cloud audit unit by the cloud audit subsystem.

[0140] In some embodiments of the present disclosure, the storage unit 1520 is configured to store the operation event data into the database if the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is the open state.

[0141] In some embodiments of the present disclosure, the collection unit 1510 is configured to collect, by the resource operating system, the operation event data in the resource pool corresponding to the cloud audit unit by using the message queue mode and / or the interface mode.

[0142] In some embodiments of the present disclosure, the apparatus 1500 further comprises a dump unit configured to, after the cloud audit subsystem stores the operation event data into the database, in the case that the resource operating system collects the operation event data by using the interface mode, if the cloud audit subsystem is configured with the object storage function, the cloud audit subsystem sends a dump task corresponding to the object storage function to the distributed coordination server of the cloud audit unit and stores the dump task into the database; and if the cloud audit subsystem monitors that the distributed coordination server creates a child node corresponding to the dump task, the cloud audit subsystem stores the operation event data into the object storage of the cloud audit unit.

[0143] In some embodiments of the present disclosure, the dump unit is configured to, if the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is the open state, the cloud audit subsystem acquires a dump key corresponding to the dump task from the object storage control system of the cloud audit unit; and if the cloud audit subsystem monitors that the distributed coordination server creates a child node corresponding to the dump task, the cloud audit subsystem dumps the operation event data into the object storage by using the dump key.

[0144] In some embodiments of the present disclosure, the dump unit is configured to, if the dump key is abnormal, the cloud audit subsystem acquires a normal dump key in the object storage control system and updates the dump key to the normal dump key.

[0145] In some embodiments of the present disclosure, the dump unit is configured to, if the cloud audit subsystem monitors that the distributed coordination server creates a child node corresponding to the dump task, the cloud audit subsystem dumps the operation event data into the object storage by using the dump key, and then the cloud audit subsystem deletes the dump task stored in the database.

[0146] In some embodiments of the present disclosure, the apparatus 1500 further comprises a notification unit configured to, after the resource operating system collects the operation event data in the resource pool corresponding to the cloud audit unit and sends the operation event data to the cloud audit subsystem, the cloud audit subsystem sends the operation event data to the message notification unit of the cloud audit unit; and the message notification unit determines an event level corresponding to the operation event data and a notification mode corresponding to the event level, and sends the event level corresponding to the operation event data to the user end by using the notification mode.

[0147] In summary, through the cloud audit device, the resource operating system of the cloud audit unit collects operation event data in the resource pool corresponding to the cloud audit unit, and sends the operation event data to the cloud audit subsystem of the cloud audit unit; the cloud audit subsystem stores the operation event data to the database of the cloud audit unit, and processes the data of each resource pool corresponding to each cloud audit unit by using each cloud audit unit in the cloud audit system, realizes the distributed cloud audit method, improves the performance of the cloud audit system when the data of multiple resource pools need to be processed at the same time, that is, improves the processing speed and throughput of the cloud audit system. At the same time, since each cloud audit unit can work independently, the reliability and stability of the cloud audit system are also improved.

[0148] The above embodiments of the present application provide methods and devices. In order to realize the functions of the above-mentioned methods provided by the embodiments of the present application, the electronic device can include hardware structures, software modules, and the above-mentioned functions can be implemented in the form of hardware structures, software modules, or hardware structures plus software modules. Some of the above-mentioned functions can be executed in the form of hardware structures, software modules, or hardware structures plus software modules.

[0149] Figure 16 is a block diagram of an electronic device 1600 for implementing the above-mentioned cloud audit method according to an exemplary embodiment. For example, the electronic device 1600 can be a mobile phone, a computer, a message transmission device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, etc.

[0150] Referring to Figure 16 , the electronic device 1600 can include a communication interface 1601 capable of interacting with other devices; a processor 1602 connected to the communication interface 1601 to realize interaction with other devices, used to run computer programs, and execute the method provided by one or more technical solutions described above; a memory 1603, on which a computer program is stored. Specifically, the specific processing process of the processor 1602 can refer to the cloud audit method described in the above embodiments of the present disclosure.

[0151] Of course, in actual application, each component in the electronic device 1600 is coupled together through a bus system 1604. It can be understood that the bus system 1604 is used to realize the connection and communication between the components. In addition to including a data bus, the bus system 1604 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, all kinds of buses are marked as the bus system 1604 in Figure 16 .

[0152] The memory 1603 in the embodiments of the present application is used to store various types of data to support the operation of the electronic device 1600. Examples of these data include any computer programs used for operation on the electronic device 1600.

[0153] The method disclosed in the embodiments of the present application can be applied to the processor 1602 or implemented by the processor 1602. The processor 1602 can be an integrated circuit chip having a processing capability of signals. In the implementation process, each step of the above method can be completed by the integrated logic circuit of hardware or the instruction in the form of software in the processor 1602. The processor 1602 described above can be a general processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The processor 1602 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the hardware decoding processor can be directly embodied to execute the above method, or the combination of hardware and software modules in the decoding processor can be executed. The software module can be located in the storage medium, which is located in the memory 1603. The processor 1602 reads the information in the memory 1603 and combines the hardware to complete the steps of the above method.

[0154] In the exemplary embodiments, the electronic device 1600 can be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, micro controllers (MCUs), microprocessors (Microprocessors), or other electronic elements, for executing the above method.

[0155] The embodiments of the present disclosure also propose a non-transitory computer readable storage medium having computer instructions stored therein, wherein the computer instructions are used to make a computer execute the cloud auditing method described in the above embodiments of the present disclosure.

[0156] The embodiments of the present disclosure also propose a computer program product comprising a computer program, which, when executed by a processor, executes the cloud auditing method described in the above embodiments of the present disclosure.

[0157] Embodiments of the present disclosure also provide a chip, comprising one or more interface circuits and one or more processors; the interface circuit is configured to receive a signal from a memory of an electronic device, and send a signal to the processor, the signal comprising computer instructions stored in the memory, when the processor executes the computer instructions, causing the electronic device to perform the cloud auditing method described in the above embodiments of the present disclosure.

[0158] It should be noted that the terms "first", "second", and the like in the description of the present disclosure and claims and the above-described drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present disclosure described herein can be implemented in an order other than that illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0159] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "exemplary embodiment", "example", "specific example" or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In the present specification, the exemplary description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0160] Any process or method descriptions or descriptions of the flow diagrams in the present specification can be understood as representing code modules, segments or portions of code which include one or more executable instructions for performing specific logic functions or steps in the process, and the preferred embodiments of the present invention include additional implementations in which the order of steps can be different, including use of the same or different code modules, segments or portions of code, and the functions described can be performed in an order different from that shown or discussed, including substantially concurrently or in reverse order, as will be appreciated by those skilled in the art.

[0161] The logic and / or steps represented in flow diagrams or otherwise described herein, for example, can be considered as a sequence of instructions to implement logic functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processing module, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. In the context of this specification, a "computer-readable medium" can be any means that can contain, store, communicate, propagate or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be a machine-readable storage device (control method), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber device, and a portable compact disc read-only memory (CD-ROM). In addition, the computer-readable medium can even be paper or other suitable medium upon which the program can be printed, as the program can be electronically captured, for example, by optically scanning the paper or other suitable medium, then electronically converted into a form that can be further processed by a computer. For example, the program can be transmitted from the website, server, or other remote sources using a modem, which is connected to a telephone line, and used to electronically capture the program.

[0162] It should be understood that each of the elements of the embodiments of the present application can be implemented in hardware, software, firmware, or a combination thereof. In the above-described embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and as in another embodiment, any one or a combination of the following technologies known in the art can be used: discrete logic circuitry having logic gates for implementing logic functions on data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), etc.

[0163] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-described embodiment methods can be completed by programs instructing related hardware, and the programs can be stored in a computer-readable storage medium. When the programs are executed, they include one or a combination of the steps of the method embodiments.

[0164] In addition, each function unit in each embodiment of the present application can be integrated in one processing module, or each unit can exist physically independently, or two or more units can be integrated in one module. The integrated module can be realized in the form of hardware, or in the form of software function module. When the integrated module is realized in the form of software function module and sold or used as an independent product, it can also be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0165] Although the embodiments of the present application have been shown and described above, it should be understood by those skilled in the art that the above embodiments are exemplary and cannot be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments within the scope of the present application.

Claims

1. A cloud auditing method, characterized by, The method is applied to any cloud audit unit in a cloud audit system, and the method comprises: An operation event data in a resource pool corresponding to the cloud audit unit is collected by a resource operating system of the cloud audit unit, and the operation event data is sent to a cloud audit subsystem of the cloud audit unit; The cloud audit subsystem stores the operation event data to a database of the cloud audit unit; The operation event data in the resource pool corresponding to the cloud audit unit is collected by the resource operating system in an interface mode; The cloud audit subsystem stores the operation event data to the database of the cloud audit unit, and then the method comprises: In the case that the operation event data is collected by the resource operating system in the interface mode, if the cloud audit subsystem is configured with an object storage function, the cloud audit subsystem sends a dump task corresponding to the object storage function to a distributed coordination server of the cloud audit unit, and stores the dump task to the database; If the cloud audit subsystem monitors that the distributed coordination server creates a sub-node corresponding to the dump task, the operation event data is stored to an object storage of the cloud audit unit. The cloud audit subsystem stores the operation event data to the database of the cloud audit unit comprises:

2. The method of claim 1, wherein, If the cloud audit subsystem determines that a state of a tracker in a cache middleware of the cloud audit unit is an open state, the operation event data is stored to the database. The cloud audit subsystem stores the operation event data to the object storage of the cloud audit unit if the cloud audit subsystem monitors that the distributed coordination server creates the sub-node corresponding to the dump task comprises:

3. The method of claim 1, wherein, If the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is the open state, the cloud audit subsystem acquires a dump key corresponding to the dump task from an object storage control system of the cloud audit unit; If the cloud audit subsystem monitors that the distributed coordination server creates the sub-node corresponding to the dump task, the cloud audit subsystem dumps the operation event data to the object storage by using the dump key. The cloud audit subsystem acquires the dump key corresponding to the dump task from the object storage control system of the cloud audit unit if the cloud audit subsystem determines that the state of the tracker in the cache middleware of the cloud audit unit is the open state comprises:

4. The method of claim 1, wherein, If the dump key is abnormal, the cloud audit subsystem acquires a normal dump key in the object storage control system, and updates the dump key to the normal dump key. The cloud audit subsystem dumps the operation event data to the object storage by using the dump key if the cloud audit subsystem monitors that the distributed coordination server creates the sub-node corresponding to the dump task, and then the method comprises:

5. The method of claim 3, wherein, The cloud audit subsystem deletes the dump task stored in the database. ​ 6. The method of claim 1, wherein, The resource operating system collects operation event data in a resource pool corresponding to the cloud audit unit, and sends the operation event data to a cloud audit subsystem. Subsequently, the method comprises: The cloud audit subsystem sends the operation event data to a message notification unit of the cloud audit unit; The message notification unit determines an event level corresponding to the operation event data and a notification mode corresponding to the event level, and sends the event level corresponding to the operation event data to a user terminal using the notification mode.

7. A cloud auditing apparatus, characterized by, The device comprises: A collection unit configured to collect operation event data in a resource pool corresponding to a cloud audit unit by a resource operating system of the cloud audit unit, and send the operation event data to a cloud audit subsystem of the cloud audit unit; The collection of operation event data in a resource pool corresponding to a cloud audit unit by a resource operating system of the cloud audit unit comprises: The resource operating system collects operation event data in a resource pool corresponding to the cloud audit unit using an interface mode; A storage unit configured to store the operation event data to a database of the cloud audit unit by the cloud audit subsystem; Subsequently, the cloud audit subsystem stores the operation event data to a database of the cloud audit unit, which comprises: In the case that the resource operating system collects the operation event data using the interface mode, if the cloud audit subsystem is configured with an object storage function, the cloud audit subsystem sends a dump task corresponding to the object storage function to a distributed coordination server of the cloud audit unit, and stores the dump task to the database; If the cloud audit subsystem monitors that the distributed coordination server creates a child node corresponding to the dump task, the cloud audit subsystem stores the operation event data to an object storage of the cloud audit unit.

8. A cloud auditing system, characterized by, The system comprises: At least one cloud audit unit; Any cloud audit unit in the at least one cloud audit unit comprises a resource operating system, a cloud audit subsystem, and a database; The resource operating system is connected with the cloud audit subsystem, and is configured to collect operation event data in a resource pool corresponding to the cloud audit unit, and send the operation event data to the cloud audit subsystem; The collection of operation event data in a resource pool corresponding to a cloud audit unit by a resource operating system of the cloud audit unit comprises: The resource operating system collects operation event data in a resource pool corresponding to the cloud audit unit using an interface mode; The cloud audit subsystem is connected with the database, and is configured to store the operation event data to the database; Subsequently, the cloud audit subsystem stores the operation event data to a database of the cloud audit unit, which comprises: In the case that the resource operating system collects the operation event data using the interface mode, if the cloud audit subsystem is configured with an object storage function, the cloud audit subsystem sends a dump task corresponding to the object storage function to a distributed coordination server of the cloud audit unit, and stores the dump task to the database; If the cloud audit subsystem monitors that the distributed coordination server creates a child node corresponding to the dump task, the operation event data is stored to an object storage of the cloud audit unit.

9. An electronic device, comprising: Comprising: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, performs the method of any one of claims 1 to 6.

10. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are for causing the computer to perform the method of any one of claims 1 to 6.

11. A computer program product, characterised in that, A computer program which, when executed by a processor, implements the method of any one of claims 1 to 6.

Images