Audit log collection method and device, equipment and storage medium

Abstract

The invention discloses an audit log collection method and device, equipment and a storage medium, and relates to the field of databases, and the method comprises the following steps: judging whether a target instance normally runs, and configuring a target parameter based on a deployment mode of an OpenGauss database when the target instance normally runs to start an audit log function; wherein the target instance is an OpenGauss high-availability instance; reading and filtering the audit log file based on the configured target parameter by using the log collection tool to obtain target data, and writing the target data into a target file; reading the target file based on the target parameter by using a log reporting tool, and uploading the read audit log information to a target log server; and calling an interface of the target log server through the console, and obtaining audit log information corresponding to the target instance based on the target instance ID. According to the method and the device, the auditing log can be automatically collected by the OpenGauss high-availability instance.

Description

Technical Field

[0001] The present invention relates to the field of databases, and in particular to an audit log collection method, device, equipment and storage medium. Background Art

[0002] With the rapid development of information technology, database management systems have become an important part of enterprise informatization. In the process of enterprise operation, the security, reliability and high availability of databases are one of the key issues that enterprises are most concerned about. However, due to the complexity of database systems, monitoring and management of databases have become increasingly difficult. Therefore, the automatic collection and analysis of database audit logs has become an important demand in the field of database management. As an open source relational database management system, OpenGauss is widely used in various business scenarios. In order to improve the high availability of the OpenGauss database and ensure its security, it is particularly important to realize the automatic collection of audit logs. At present, although some database management systems provide audit log functions, the log collection and analysis of these systems mostly require manual operation, which is inefficient and not conducive to timely discovery and handling of database security issues.

[0003] In summary, how to realize the automatic collection of audit logs for the OpenGauss database so as to use the collected audit logs to analyze and monitor the OpenGauss database is a problem that needs to be solved urgently. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide an audit log collection method, device, equipment and storage medium, which can realize the automatic collection of audit logs for the OpenGauss database so as to analyze and monitor the OpenGauss database using the collected audit logs. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses an audit log collection method, comprising:

[0006] Determine whether the target instance is running normally, and configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function when the target instance is running normally; the target instance is an OpenGauss high-availability instance;

[0007] Using a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into a target file;

[0008] Using a log reporting tool to read the target file based on the target parameters, and uploading the read audit log information to a target log server;

[0009] The interface of the target log server is called through the console, and the audit log information corresponding to the target instance is obtained based on the target instance ID.

[0010] Optionally, before determining whether the target instance is running normally, the method further includes:

[0011] Determine the deployment mode of the OpenGauss database, determine whether the target instance creation environment meets the preset instance creation conditions, and determine whether the first target image has been prepared;

[0012] If the target instance creation environment meets the preset instance creation condition and the first target image has been prepared, the target instance is created by resource orchestration in the target instance creation environment using the first target image;

[0013] Among them, the preset instance creation conditions include that the number of available nodes in the target instance creation environment is greater than the target number of nodes, and the target instance creation environment is network-interconnected with the target log server and the image warehouse server, and the image warehouse server is used to store the first target image; the first target image is a virtual server image.

[0014] Optionally, before determining whether the first target image is ready, the step further includes:

[0015] If the deployment mode is a virtual server mode, the initial first target image is updated based on the second target image to produce a new first target image; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program;

[0016] Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including:

[0017] When the target instance is operating normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new first target image to enable the audit log function.

[0018] Optionally, after determining the deployment mode of the OpenGauss database, the method further includes:

[0019] If the deployment mode is the container mode, the second target image is converted into a new second target image in a target format, and the new second target image is stored on the image warehouse server; the target format is an image format compatible with the container mode; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program;

[0020] Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including:

[0021] When the target instance is operating normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new second target image to enable the audit log function.

[0022] Optionally, the using of the log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data includes:

[0023] Using the log collection tool to determine whether each target node is a master node based on the preset collection time and the configured target parameters;

[0024] If the target node is a master node, the audit log file of the target node is read and filtered to obtain target data;

[0025] If all the target nodes are slave nodes, a new master node is selected from all the target nodes, and the audit log file of the new master node is read and filtered to obtain target data.

[0026] Optionally, the using a log reporting tool to read the target file based on the target parameter and uploading the read audit log information to a target log server includes:

[0027] The target file is read based on the target parameters using a log reporting tool, and a label is added to the latest audit log information in all the audit log information, so that when the target file is read next time, it is determined based on the label whether there is new audit log information in the target file, and the new audit log information is uploaded to the target log server.

[0028] Optionally, the audit log collection method further includes:

[0029] The collected target files are monitored by using a log polling tool based on a preset polling time, and the target files are segmented based on a preset log segmentation method and a preset number of old log copies.

[0030] In a second aspect, the present application discloses an audit log collection device, comprising:

[0031] An audit log function activation module is used to determine whether the target instance is running normally, and when the target instance is running normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance;

[0032] A target data acquisition module is used to use a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into a target file;

[0033] A log information uploading module, used to read the target file based on the target parameter using a log reporting tool, and upload the read audit log information to a target log server;

[0034] The log information acquisition module is used to call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the target instance ID.

[0035] In a third aspect, the present application discloses an electronic device, comprising:

[0036] Memory, used to store computer programs;

[0037] The processor is used to execute the computer program to implement the aforementioned audit log collection method.

[0038] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned audit log collection method when executed by a processor.

[0039] In this application, in order to realize the automatic collection of audit logs, first determine whether the target instance is running normally, and when the target instance is running normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance; use the log collection tool to read and filter the audit log file based on the configured target parameters to obtain the target data, and write the target data into the target file; use the log reporting tool to read the target file based on the target parameters, and upload the read audit log information to the target log server; call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the target instance ID. It can be seen that this application enables the audit log function of the target instance based on the deployment mode when the target instance is running normally, that is, when the OpenGauss high-availability instance is in normal state, and then uses the log collection tool to obtain the target data from the audit log file, and uses the log reporting tool to read the target file storing the target data to obtain the audit log information, and then uploads the audit log information to the corresponding target log server for storage, thereby realizing the automatic collection of audit logs for the OpenGauss database. In addition, the present application can also call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the ID of the target instance, so as to use the collected audit logs to analyze and monitor the OpenGauss database, timely discover the security issues and performance bottlenecks of the database, improve management efficiency, and thus ensure the stable operation of the database system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0041] Figure 1 A flow chart of an audit log collection method disclosed in this application;

[0042] Figure 2 A flowchart of an audit log collection tool disclosed in this application is prepared;

[0043] Figure 3 A schematic diagram of a specific audit log collection method disclosed in this application;

[0044] Figure 4This is a schematic diagram of the structure of an audit log collection device disclosed in this application;

[0045] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] In order to improve the high availability of the OpenGauss database and ensure its security, it is particularly important to realize the automatic collection of audit logs. At present, although some database management systems provide audit log functions, the log collection and analysis of these systems mostly require manual operations, which is inefficient and not conducive to timely discovery and handling of database security issues. In order to solve the above technical problems, the present application discloses an audit log collection method, which can realize the automatic collection of audit logs for the OpenGauss database so as to analyze and monitor the OpenGauss database using the collected audit logs.

[0048] See also Figure 1 As shown, an embodiment of the present invention discloses an audit log collection method, including:

[0049] Step S11, determining whether the target instance is running normally, and configuring the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function when the target instance is running normally; the target instance is an OpenGauss high-availability instance.

[0050] In this embodiment, in order to enable, collect, report and display the OpenGauss high-availability instance audit log, it is necessary to first determine the deployment mode of the OpenGauss database, then determine whether the target instance creation environment meets the preset instance creation conditions, and determine whether the first target image has been prepared; if the target instance creation environment meets the preset instance creation conditions and the first target image has been prepared, the first target image is used to create the target instance in the target instance creation environment through resource orchestration; wherein the preset instance creation conditions include that the number of available nodes in the target instance creation environment is greater than the target number of nodes, such as three nodes, one of which is the master node and the other two are slave nodes, and the target instance creation environment is interconnected with the target log server and the image warehouse server network, and the image warehouse server is used to store the first target image; the first target image is a virtual server image. The target instance creation environment can be a public cloud server or a private cloud server. If the target instance creation environment and the target log server are not connected to the network, the log reporting tool log may report an error when uploading the log to the target log server, resulting in the failure of audit log upload. However, after the target instance creation environment and the target log server resume communication, the previously unsuccessfully reported audit logs will be re-reported; if the target instance creation environment and the image warehouse server are not connected to the network, the target instance creation may fail. In addition, the log expiration time can be set. If the communication abnormality time exceeds the log expiration time, you can choose not to report these expired audit logs after communication. The integration of resource orchestration files is performed by the server. Resource orchestration files are instruction sets used by the cloud platform to perform a series of related actions. The cloud platform can automatically install collection and reporting tools on the target instance and complete collection and reporting operations on the target instance.

[0051] In this embodiment, due to the different deployment modes of the OpenGauss database, the target images that need to be prepared will also be different. Specifically, if the deployment mode is a virtual server mode, the initial first target image is updated based on the second target image to produce a new first target image; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program. Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including: when the target instance is running normally, the environment variables are configured based on the target instance ID (Identity document) and the target product ID, and after the environment variables are configured, the scripts in the log collection tool and the scripts in the log reporting tool are executed according to the new first target image to enable the audit log function. That is to say, if the deployment mode is the virtual server mode, the initial first target image needs to be remade to add the images of various tools in the second target image as extensions to the first target image, so that when executing resource orchestration to create the target instance in the target instance creation environment, it is only necessary to communicate with the image warehouse server to obtain and install the new first target image, and it is not necessary to install the second target image. By executing the scripts in the log collection tool and the log reporting tool in the new first target image, the audit log function can be enabled, avoiding the low efficiency of the target instance application due to the slow image download and installation rate. The configured environment variables can be read and used by log reporting tools, etc.

[0052] In this embodiment, if the deployment mode is container mode, the second target image is converted into a new second target image in the target format, and the new second target image is stored on the image warehouse server; the target format is an image format compatible with the container mode; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program. Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including: when the target instance is running normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new second target image to enable the audit log function. In other words, if the deployment mode is container mode, it is only necessary to convert the format of the second target image into a format suitable for the container mode, so as to obtain a new second target image, and ensure that the communication between the image warehouse server and the target instance creation environment is normal. When the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function. The new second target image in the image warehouse server can be directly called, and the scripts in the log collection tool and the log reporting tool can be executed according to the new second target image, thereby enabling the audit log function. In addition, if the target instance creation environment is a private cloud server, the VPC (Virtual Private Cloud) whitelist can be configured to ensure that the target instance can communicate normally with the image warehouse server to prevent inaccessibility due to factors such as firewalls. The configured environment variables can be read and used by log reporting tools, etc.

[0053] like Figure 2As shown, after the target instance is created, you need to install the log collection tool and the log reporting tool, and then use crontab (a command used to set periodic execution) to create a system scheduled task to execute the log collection tool at the preset execution rate. At the same time, you also need to configure the log reporting tool to report the collected audit logs to the target log server based on the preset reporting time. Among them, both the log collection tool and the log reporting tool can use logagent (log agent), or you can only use logagent as a log reporting tool and use other log collection tools. In addition, you can also configure the log polling tool to use the log polling tool to monitor the collected target files based on the preset polling time, and split the target files based on the preset log segmentation method and the preset number of old logs, so as to avoid occupying too much memory. Configuring the log rotation tool can specifically include: setting up the logrotate scheduled task file, setting the log rotation rule to a preset file size, such as 10MB (Megabit), that is, specifying the target file size; if the target file size exceeds the limit, the target file will be automatically split, and a file with the suffix ".1" will be generated according to the rules set by logrotate. At the same time, a new empty file will be generated, and the old file will be backed up in the specified format, that is, 1, 2, etc. will be added after the file; the maximum number of saves (that is, the preset number of old log copies) can also be set. When the number of backups of the target file exceeds the preset number of old log copies, the oldest file will be deleted, thereby realizing the collection of corresponding slow log information according to the user's demand structure and feeding it back to the customer for feedback. The entire collection and reporting process does not require manual intervention.

[0054] like Figure 3 As shown in the figure, before enabling the audit log function, you need to determine whether the target instance is running normally. The audit log function cannot be enabled for an Opengauss database instance that is not running normally. When the target instance is running normally, you can enable the audit log function by modifying the Opengauss parameter configuration. The audit log switch can be audit_enabled; the audit log level can be audit_level; the audit log file save address can be audit_log_file; and the audit log file size can be audit_log_file_size.

[0055] In a specific implementation, the logagent log reporting program is started by executing the start.sh script in logagent. The logagent program will read the specified file under the configuration path and add tags to the read data, thereby realizing incremental reporting of audit log data, preventing repeated reporting of data, and avoiding audit log data from being deleted due to exceeding the maximum number of saved entries; this configuration can also use the wildcard "*" to read the specified class file so that the logrotate tool can be used to split the log file to prevent the file from being too large and causing the reading rate to drop. After the startup is complete, the status.sh script in logagent can be executed to check whether the logagent log reporting program is started normally, and the configuration information can also be checked to check whether the configured reading path is correct and whether the log reporting server information is accurate. In addition, if it is docker (container) mode, after pulling the container image of logagent from the image warehouse server, it is also necessary to execute the run statement to start docker and mount the environment variables into docker.

[0056] Step S12: Using a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into a target file.

[0057] In this embodiment, since the aforementioned steps have used crontab to create a system scheduled task to execute the log collection tool at a preset execution rate, the collection tool will automatically determine the node identity information. Using the log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data may include: using the log collection tool to determine whether each target node is a master node based on the preset collection time and the configured target parameters; if the target node is a master node, then reading and filtering the audit log file of the target node to obtain the target data; if each target node is a slave node, then selecting a new master node from all target nodes, and reading and filtering the audit log file of the new master node to obtain the target data. That is to say, if it is a Primary node, the information in the audit log file will be read to obtain the target data (execution time, execution statement, execution duration, execution status, operation user, operation target and other related information), and recorded in the file at the specified location according to the agreed format; if the node is judged to be a Standby node, the log collection step will be skipped; if it is judged that all nodes are not Primary nodes, the OpenGauss high availability management tool will perform a failover operation, select a new primary node, and then read and filter the audit log file of the new primary node to obtain the target data, so as to ensure that the node can still operate normally when switching.

[0058] Step S13: Using a log reporting tool to read the target file based on the target parameters, and uploading the read audit log information to a target log server.

[0059] In this embodiment, the target file is read based on the target parameters by using the log reporting tool, and the read audit log information is uploaded to the target log server. The specific process may include: the target file is read based on the target parameters by using the log reporting tool, and the latest audit log information in all the audit log information is added with a label, so that when the target file is read next time, it is determined whether there is new audit log information in the target file based on the label, and the new audit log information is uploaded to the target log server. That is to say, the previously started logagent log reporting tool will automatically read the audit log record file (that is, the target file), and each read operation will add a label to the latest log record, and automatically determine whether there is new data in the audit log record file based on the label; if the audit log record file has new audit log information, the latest audit log information is read and reported to the target log server, and the log server classifies and stores the audit log according to the product type. Specifically, the logAgent log reporting tool reads the file address in the configuration, uses the newline character as the end point of a data record, reads each piece of data information in the audit log record file according to the format, and automatically reports it to the target log server. During the reporting process, a tag is added to each piece of data to distinguish logs of different database instances. When reading, the last piece of data read each time is labeled. Each time the data is read, the tag is used to determine whether there is new data, thereby achieving incremental reporting.

[0060] Step S14: calling the interface of the target log server through the console, and obtaining the audit log information corresponding to the target instance based on the target instance ID.

[0061] In this embodiment, the console can obtain the audit log information of the target instance through the target instance ID by calling the target log server interface, continuously execute Opengauss SQL statements that can record audit logs, and connect to the virtual machine to view the collected audit log files.

[0062] It can be seen that the present application enables the audit log function of the target instance based on the deployment mode when the target instance is running normally, that is, when the OpenGauss high-availability instance is in normal state, and then uses the log collection tool to obtain the target data from the audit log file, and uses the log reporting tool to read the target file storing the target data to obtain the audit log information, and then uploads the audit log information to the corresponding target log server for storage, thereby realizing the automatic collection of audit logs for the OpenGauss database. In addition, the present application can also call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the ID of the target instance, so as to use the collected audit logs to analyze and monitor the OpenGauss database, timely discover the security problems and performance bottlenecks of the database, improve management efficiency, and thus ensure the stable operation of the database system.

[0063] See also Figure 4 As shown, the present application discloses an audit log collection device, comprising:

[0064] The audit log function activation module 11 is used to determine whether the target instance is running normally, and when the target instance is running normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance;

[0065] The target data acquisition module 12 is used to use the log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into the target file;

[0066] The log information uploading module 13 is used to read the target file based on the target parameter using a log reporting tool, and upload the read audit log information to a target log server;

[0067] The log information acquisition module 14 is used to call the interface of the target log server through the console, and acquire the audit log information corresponding to the target instance based on the target instance ID.

[0068] It can be seen that the present application enables the audit log function of the target instance based on the deployment mode when the target instance is running normally, that is, when the OpenGauss high-availability instance is in normal state, and then uses the log collection tool to obtain the target data from the audit log file, and uses the log reporting tool to read the target file storing the target data to obtain the audit log information, and then uploads the audit log information to the corresponding target log server for storage, thereby realizing the automatic collection of audit logs for the OpenGauss database. In addition, the present application can also call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the ID of the target instance, so as to use the collected audit logs to analyze and monitor the OpenGauss database, timely discover the security problems and performance bottlenecks of the database, improve management efficiency, and thus ensure the stable operation of the database system.

[0069] In a specific embodiment, the audit log collection device may further include:

[0070] A condition judgment module, used to determine the deployment mode of the OpenGauss database, judge whether the target instance creation environment meets the preset instance creation conditions, and judge whether the first target image has been prepared;

[0071] The instance creation module is used to create the target instance by resource orchestration in the target instance creation environment using the first target image if the target instance creation environment meets the preset instance creation condition and the first target image has been prepared.

[0072] In a specific embodiment, the audit log collection device may further include:

[0073] A first image preparation module, if the deployment mode is a virtual server mode, updates the initial first target image based on the second target image to produce a new first target image; the second target image includes an image of an OpenGauss database service, an image of an OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of a monitor database monitoring program;

[0074] Accordingly, the audit log function activation module 11 may specifically include:

[0075] The first script execution unit is used to configure the environment variables based on the target instance ID and the target product ID when the target instance is running normally, and after the environment variables are configured, execute the script in the log collection tool and the script in the log reporting tool according to the new first target image to enable the audit log function.

[0076] In a specific embodiment, the audit log collection device may further include:

[0077] A second image preparation module is used for converting the second target image into a new second target image in a target format if the deployment mode is a container mode, and storing the new second target image on the image warehouse server; the target format is an image format compatible with the container mode; the second target image includes an image of an OpenGauss database service, an image of an OpenGauss high availability service, an image of the log collection tool, an image of the log reporting tool, and an image of a monitor database monitoring program;

[0078] Accordingly, the audit log function activation module 11 may specifically include:

[0079] The second script execution unit is used to configure the environment variables based on the target instance ID and the target product ID when the target instance is running normally, and after the environment variables are configured, execute the script in the log collection tool and the script in the log reporting tool according to the new second target image to enable the audit log function.

[0080] In a specific embodiment, the target data acquisition module 12 may specifically include:

[0081] A node judgment unit, using a log collection tool to judge whether each target node is a master node based on a preset collection time and the configured target parameters;

[0082] A first data acquisition unit, configured to read and filter the audit log file of the target node to acquire target data if the target node is a master node;

[0083] The second data acquisition unit is used to select a new master node from all the target nodes if all the target nodes are slave nodes, and read and filter the audit log file of the new master node to obtain target data.

[0084] In a specific embodiment, the log information uploading module 13 may specifically include:

[0085] The log information uploading unit is used to use the log reporting tool to read the target file based on the target parameters, and add a label to the latest audit log information in all the audit log information, so that when the target file is read next time, it is determined whether there is new audit log information in the target file based on the label, and the new audit log information is uploaded to the target log server.

[0086] In a specific embodiment, the audit log collection device may further include:

[0087] The log segmentation module is used to monitor the collected target files based on the preset polling time by using the log polling tool, and segment the target files based on the preset log segmentation method and the preset number of old log copies.

[0088] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0089] Figure 5 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the audit log collection method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0090] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0091] In addition, the memory 22 as a carrier for storing resources may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222, etc., and the storage method may be temporary storage or permanent storage.

[0092] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the audit log collection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0093] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed audit log collection method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0094] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0095] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0096] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0097] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0098] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An audit log collection method, characterized in that: include: Determine whether the target instance is running normally, and configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function when the target instance is running normally; the target instance is an OpenGauss high-availability instance; Using a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into a target file; Using a log reporting tool to read the target file based on the target parameters, and uploading the read audit log information to a target log server; The interface of the target log server is called through the console, and the audit log information corresponding to the target instance is obtained based on the target instance ID.

2. The audit log collection method according to claim 1, characterized in that: Before determining whether the target instance is running normally, the method further includes: Determine the deployment mode of the OpenGauss database, determine whether the target instance creation environment meets the preset instance creation conditions, and determine whether the first target image has been prepared; If the target instance creation environment meets the preset instance creation condition and the first target image has been prepared, the target instance is created by resource orchestration in the target instance creation environment using the first target image; Among them, the preset instance creation conditions include that the number of available nodes in the target instance creation environment is greater than the target number of nodes, and the target instance creation environment is network-interconnected with the target log server and the image warehouse server, and the image warehouse server is used to store the first target image; the first target image is a virtual server image.

3. The audit log collection method according to claim 2, characterized in that: Before determining whether the first target image is ready, the method further includes: If the deployment mode is a virtual server mode, the initial first target image is updated based on the second target image to produce a new first target image; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program; Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including: When the target instance is operating normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new first target image to enable the audit log function.

4. The audit log collection method according to claim 2, characterized in that: After determining the deployment mode of the OpenGauss database, the method further includes: If the deployment mode is the container mode, the second target image is converted into a new second target image in a target format, and the new second target image is stored on the image warehouse server; the target format is an image format compatible with the container mode; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program; Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including: When the target instance is operating normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new second target image to enable the audit log function.

5. The audit log collection method according to claim 1, characterized in that: The log collection tool is used to read and filter the audit log file based on the configured target parameters to obtain target data, including: Using the log collection tool to determine whether each target node is a master node based on the preset collection time and the configured target parameters; If the target node is a master node, the audit log file of the target node is read and filtered to obtain target data; If all the target nodes are slave nodes, a new master node is selected from all the target nodes, and the audit log file of the new master node is read and filtered to obtain target data.

6. The audit log collection method according to claim 1, characterized in that: The log reporting tool is used to read the target file based on the target parameter, and the read audit log information is uploaded to the target log server, including: The target file is read based on the target parameters using a log reporting tool, and a label is added to the latest audit log information in all the audit log information, so that when the target file is read next time, it is determined based on the label whether there is new audit log information in the target file, and the new audit log information is uploaded to the target log server.

7. The audit log collection method according to any one of claims 1 to 6, characterized in that: Also includes: The collected target files are monitored by using a log polling tool based on a preset polling time, and the target files are segmented based on a preset log segmentation method and a preset number of old log copies.

8. An audit log collection device, characterized in that: include: An audit log function activation module is used to determine whether the target instance is running normally, and when the target instance is running normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance; A target data acquisition module is used to use a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into a target file; A log information uploading module, used to read the target file based on the target parameter using a log reporting tool, and upload the read audit log information to a target log server; The log information acquisition module is used to call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the target instance ID.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the audit log collection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the audit log collection method according to any one of claims 1 to 7 is implemented.

Images