Audit log collection method, device, equipment and storage medium

Abstract

This application discloses an audit log collection method, apparatus, device, and storage medium, relating to the database field. The method includes: determining whether a target instance is operating normally, and configuring target parameters based on the deployment mode of the OpenGauss database to enable the audit log function when the target instance is operating normally; wherein the target instance is an OpenGauss high-availability instance; using a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and writing the target data to a target file; using a log reporting tool to read the target file based on the target parameters, and uploading the read audit log information to a target log server; calling the interface of the target log server through a console, and obtaining the audit log information corresponding to the target instance based on the target instance ID. This application realizes the automated collection of audit logs for OpenGauss high-availability instances.

Description

Technical Field

[0001] The present invention relates to the field of databases, and in particular to an audit log collection method, device, equipment and storage medium. Background Art

[0002] With the rapid development of information technology, database management systems have become an important part of enterprise informatization. During enterprise operations, database security, reliability, and high availability are among the key issues that enterprises are most concerned about. However, due to the complexity of database systems, monitoring and management of databases has become increasingly difficult. Therefore, the automated collection and analysis of database audit logs has become a critical requirement in the field of database management. As an open source relational database management system, OpenGauss is widely used in various business scenarios. In order to improve the high availability of the OpenGauss database and ensure its security, it is particularly important to implement automated collection of audit logs. Currently, although some database management systems provide audit log functions, the log collection and analysis of these systems mostly require manual operations, which is inefficient and not conducive to the timely discovery and resolution of database security issues.

[0003] In summary, how to realize the automatic collection of audit logs for the OpenGauss database so as to use the collected audit logs to analyze and monitor the OpenGauss database is a problem that needs to be solved urgently. Summary of the Invention

[0004] In view of this, the present invention aims to provide an audit log collection method, apparatus, device, and storage medium that can automatically collect audit logs from an OpenGauss database so that the collected audit logs can be used to analyze and monitor the OpenGauss database. The specific solution is as follows:

[0005] In a first aspect, the present application discloses an audit log collection method, comprising:

[0006] Determine whether the target instance is running normally, and if the target instance is running normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance;

[0007] Using a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and writing the target data into a target file;

[0008] Using a log reporting tool to read the target file based on the target parameters, and uploading the read audit log information to a target log server;

[0009] The interface of the target log server is called through the console, and the audit log information corresponding to the target instance is obtained based on the target instance ID.

[0010] Optionally, before determining whether the target instance is operating normally, the method further includes:

[0011] Determine the deployment mode of the OpenGauss database, determine whether the target instance creation environment meets the preset instance creation conditions, and determine whether the first target image is ready;

[0012] If the target instance creation environment meets the preset instance creation condition and the first target image has been prepared, creating the target instance by resource orchestration in the target instance creation environment using the first target image;

[0013] Among them, the preset instance creation conditions include that the number of available nodes in the target instance creation environment is greater than the target number of nodes, and the target instance creation environment is interconnected with the target log server and the image warehouse server network, and the image warehouse server is used to store the first target image; the first target image is a virtual server image.

[0014] Optionally, before determining whether the first target image is ready, the step further includes:

[0015] If the deployment mode is a virtual server mode, the initial first target image is updated based on the second target image to produce a new first target image; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program;

[0016] Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including:

[0017] When the target instance is operating normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new first target image to enable the audit log function.

[0018] Optionally, after determining the deployment mode of the OpenGauss database, the method further includes:

[0019] If the deployment mode is the container mode, the second target image is converted into a new second target image in a target format, and the new second target image is stored on the image warehouse server; the target format is an image format compatible with the container mode; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program;

[0020] Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including:

[0021] When the target instance is operating normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new second target image to enable the audit log function.

[0022] Optionally, the using of the log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data includes:

[0023] Using the log collection tool to determine whether each target node is a master node based on the preset collection time and the configured target parameters;

[0024] If the target node is a master node, reading and filtering the audit log file of the target node to obtain target data;

[0025] If all the target nodes are slave nodes, a new master node is selected from all the target nodes, and the audit log file of the new master node is read and filtered to obtain target data.

[0026] Optionally, the using a log reporting tool to read the target file based on the target parameter and uploading the read audit log information to a target log server includes:

[0027] The target file is read based on the target parameters using a log reporting tool, and a label is added to the latest audit log information in all the audit log information, so that when the target file is read next time, it is determined based on the label whether there is new audit log information in the target file, and the new audit log information is uploaded to the target log server.

[0028] Optionally, the audit log collection method further includes:

[0029] The log polling tool is used to monitor the collected target files based on a preset polling time, and to segment the target files based on a preset log segmentation method and a preset number of old log copies.

[0030] In a second aspect, the present application discloses an audit log collection device, comprising:

[0031] An audit log function activation module is used to determine whether the target instance is operating normally and, if the target instance is operating normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance;

[0032] A target data acquisition module is used to use a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into a target file;

[0033] A log information uploading module is used to read the target file based on the target parameters using a log reporting tool and upload the read audit log information to a target log server;

[0034] The log information acquisition module is used to call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the target instance ID.

[0035] In a third aspect, the present application discloses an electronic device, comprising:

[0036] Memory, used to store computer programs;

[0037] The processor is used to execute the computer program to implement the aforementioned audit log collection method.

[0038] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned audit log collection method when executed by a processor.

[0039] In this application, in order to realize the automatic collection of audit logs, first determine whether the target instance is running normally, and when the target instance is running normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance; use the log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into the target file; use the log reporting tool to read the target file based on the target parameters, and upload the read audit log information to the target log server; call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the target instance ID. It can be seen that this application realizes the automatic collection of audit logs for the OpenGauss database by enabling the audit log function of the target instance based on the deployment mode when the target instance is running normally, that is, when the OpenGauss high-availability instance is in normal state, then using the log collection tool to obtain the target data from the audit log file, and using the log reporting tool to read the target file storing the target data to obtain the audit log information, and then uploading the audit log information to the corresponding target log server for storage. In addition, this application can also call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the ID of the target instance, so as to use the collected audit logs to analyze and monitor the OpenGauss database, timely discover database security issues and performance bottlenecks, improve management efficiency, and thus ensure the stable operation of the database system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0041] Figure 1 This is a flow chart of an audit log collection method disclosed in this application;

[0042] Figure 2 Prepare a flow chart for an audit log collection tool disclosed in this application;

[0043] Figure 3 A flowchart of a specific audit log collection method disclosed in this application;

[0044] Figure 4This is a structural diagram of an audit log collection device disclosed in this application;

[0045] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0046] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0047] To improve the high availability and security of the OpenGauss database, it is particularly important to automate the collection of audit logs. Currently, although some database management systems provide audit log functions, the log collection and analysis of these systems mostly require manual operations, which is inefficient and not conducive to timely discovery and resolution of database security issues. To address the above technical problems, this application discloses an audit log collection method that can automatically collect audit logs for the OpenGauss database so that the collected audit logs can be used to analyze and monitor the OpenGauss database.

[0048] See also Figure 1 As shown, an embodiment of the present invention discloses an audit log collection method, including:

[0049] Step S11: determine whether the target instance is running normally, and when the target instance is running normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance.

[0050] In this embodiment, in order to realize the opening, collection, reporting and display of the OpenGauss high-availability instance audit log, it is necessary to first determine the deployment mode of the OpenGauss database, then determine whether the target instance creation environment meets the preset instance creation conditions, and determine whether the first target image has been prepared; if the target instance creation environment meets the preset instance creation conditions and the first target image has been prepared, the first target image is used to create the target instance through resource orchestration in the target instance creation environment; wherein, the preset instance creation conditions include that the number of available nodes in the target instance creation environment is greater than the target number of nodes, such as three nodes, one of which is the master node and the other two nodes are slave nodes, and the target instance creation environment is interconnected with the target log server and the image warehouse server network, and the image warehouse server is used to store the first target image; the first target image is a virtual server image. The target instance creation environment can be a public cloud server or a private cloud server. If the target instance creation environment and the target log server are not connected over the network, the log reporting tool may report an error when uploading the log to the target log server, resulting in a failure to upload the audit log. However, after the target instance creation environment and the target log server resume communication, the previously unsuccessfully reported audit logs will be re-reported; if the target instance creation environment and the image repository server are not connected over the network, the target instance creation may fail. In addition, a log expiration time can be set. If the communication anomaly time exceeds the log expiration time, you can choose not to report these expired audit logs after communication. The integration of resource orchestration files is performed by the server. Resource orchestration files are sets of instructions for the cloud platform to perform a series of related actions. They enable the cloud platform to automatically install collection and reporting tools on the target instance and complete collection and reporting operations on the target instance.

[0051] In this embodiment, due to the different deployment modes of the OpenGauss database, the target images that need to be prepared will also be different. Specifically, if the deployment mode is the virtual server mode, the initial first target image is updated based on the second target image to produce a new first target image; the second target image includes the image of the OpenGauss database service, the image of the OpenGauss high-availability service, the image of the log collection tool, the image of the log reporting tool, and the image of the monitor database monitoring program. Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including: when the target instance is running normally, the environment variables are configured based on the target instance ID (Identity document) and the target product ID, and after the environment variables are configured, the scripts in the log collection tool and the scripts in the log reporting tool are executed according to the new first target image to enable the audit log function. That is, if the deployment mode is virtual server mode, the initial first target image needs to be re-made to add the images of various tools in the second target image as extensions to the first target image. When executing resource orchestration to create the target instance in the target instance creation environment, it is only necessary to communicate with the image warehouse server to obtain and install the new first target image. Without installing the second target image, the audit log function can be enabled by executing the scripts in the log collection tool and the log reporting tool in the new first target image, thereby avoiding the low efficiency of the target instance application due to slow image download and installation rates. The configured environment variables can be read and used by log reporting tools, etc.

[0052] In this embodiment, if the deployment mode is container mode, the second target image is converted into a new second target image in the target format, and the new second target image is stored on the image warehouse server; the target format is an image format compatible with the container mode; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program. Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including: when the target instance is running normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the scripts in the log collection tool and the scripts in the log reporting tool are executed according to the new second target image to enable the audit log function. In other words, if the deployment mode is container mode, it is only necessary to convert the format of the second target image into a format suitable for the container mode, thereby obtaining a new second target image, and ensuring normal communication between the image warehouse server and the target instance creation environment. When the target instance is running normally and the target parameters are configured to enable audit logging based on the OpenGauss database deployment mode, the new secondary target image in the image repository server can be directly called. The scripts in the log collection tool and the log reporting tool can be executed based on this new secondary target image, thereby enabling audit logging. Furthermore, if the target instance is created in a private cloud server, a VPC (Virtual Private Cloud) whitelist can be configured to ensure that the target instance can communicate properly with the image repository server, preventing access problems caused by firewalls and other factors. The configured environment variables can be read and used by log reporting tools and other tools.

[0053] like Figure 2As shown, after the target instance is created, you need to install the log collection tool and the log reporting tool, and then use crontab (a command used to set periodic execution) to create a system scheduled task to execute the log collection tool at the preset execution rate. At the same time, you also need to configure the log reporting tool to report the collected audit logs to the target log server based on the preset reporting time. Among them, both the log collection tool and the log reporting tool can use logagent (log agent), or you can only use logagent as a log reporting tool and use other log collection tools. In addition, you can also configure the log polling tool to use the log polling tool to monitor the collected target files based on the preset polling time, and split the target files based on the preset log segmentation method and the preset number of old log copies to avoid occupying too much memory. Configuring the log rotation tool can specifically include: setting up the logrotate scheduled task file, setting the log rotation rule to a preset file size, such as 10MB (Megabit), that is, specifying the target file size; if the target file size exceeds the limit, the target file will be automatically split, and a file with the suffix ".1" will be generated according to the rules set by logrotate. At the same time, a new empty file will be generated, and the old file will be backed up in the specified format, that is, identifiers such as 1 and 2 will be added to the file; the maximum number of saves (that is, the preset number of old log copies) can also be set. When the number of backups of the target file exceeds the preset number of old log copies, the oldest file will be deleted, thereby realizing the collection of corresponding slow log information according to the user's demand structure and feeding it back to the customer for feedback. The entire collection and reporting process does not require manual intervention.

[0054] like Figure 3 As shown, before enabling the audit log function, you must first determine whether the target instance is running normally. The audit log function cannot be enabled for an abnormal Opengauss database instance. When the target instance is running normally, you can enable the audit log function by modifying the Opengauss parameter configuration. The audit log switch can be audit_enabled; the audit log level can be audit_level; the audit log file save location can be audit_log_file; and the audit log file size can be audit_log_file_size.

[0055] In a specific embodiment, the logagent log reporting program is started by executing the start.sh script in logagent. The logagent program will read the specified files under the configured path and add tags to the read data, thereby realizing incremental reporting of audit log data, preventing duplicate data reporting, and preventing audit log data from being deleted due to exceeding the maximum number of saved entries. This configuration can also use the wildcard "*" to read specified class files so that the logrotate tool can be used to split the log files to prevent the reading rate from decreasing due to excessive file size. After the startup is complete, the status.sh script in logagent can be executed to check whether the logagent log reporting program has started normally. The configuration information can also be checked to check whether the configured reading path is correct and whether the log reporting server information is accurate. In addition, if it is docker (container) mode, after pulling the logagent container image from the image repository server, it is also necessary to execute the run statement to start docker and mount the environment variables into docker.

[0056] Step S12: Using a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into a target file.

[0057] In this embodiment, since the aforementioned steps have used crontab to create a system scheduled task to execute the log collection tool at a preset execution rate, the collection tool will automatically determine the node identity information. Using the log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data may include: using the log collection tool to determine whether each target node is a master node based on the preset collection time and the configured target parameters; if the target node is a master node, reading and filtering the audit log file of the target node to obtain the target data; if all target nodes are slave nodes, selecting a new master node from all target nodes, and reading and filtering the audit log file of the new master node to obtain the target data. That is to say, if it is a Primary node, the information in the audit log file will be read to obtain the target data (execution time, execution statement, execution duration, execution status, operation user, operation target and other related information), and recorded in the file at the specified location according to the agreed format; if the node is judged to be a Standby node, the log collection step will be skipped; if it is judged that all nodes are not Primary nodes, the OpenGauss high availability management tool will perform a failover operation, select a new primary node, and then read and filter the audit log file of the new primary node to obtain the target data, so as to ensure that it can still operate normally when the node is switched.

[0058] Step S13: Using a log reporting tool to read the target file based on the target parameters, and uploading the read audit log information to a target log server.

[0059] In this embodiment, a log reporting tool is used to read a target file based on target parameters, and the read audit log information is uploaded to a target log server. The specific process may include: using the log reporting tool to read the target file based on the target parameters, and adding a label to the latest audit log information among all the audit log information, so that when the target file is read next time, it can be determined based on the label whether there is new audit log information in the target file, and the new audit log information can be uploaded to the target log server. In other words, the previously started logagent log reporting tool automatically reads the audit log record file (i.e., the target file), and each read operation will add a label to the latest log record, and automatically determine whether there is new data in the audit log record file based on the label; if there is new audit log information in the audit log record file, the latest audit log information is read and reported to the target log server, and the log server classifies and stores the audit logs according to product type. Specifically, the logAgent log reporting tool reads the file address in the configuration, uses the newline character as the end point of a data entry, reads each piece of data in the audit log file according to the format, and automatically reports it to the target log server. During the reporting process, a tag is added to each piece of data to distinguish logs from different database instances. During reading, the last piece of data read each time is tagged, and each read uses the tag to determine whether there is new data, thereby achieving incremental reporting.

[0060] Step S14: calling the interface of the target log server through the console, and obtaining the audit log information corresponding to the target instance based on the target instance ID.

[0061] In this embodiment, the console can obtain the audit log information of the target instance through the target instance ID by calling the target log server interface, continuously execute Opengauss SQL statements that can record audit logs, and connect to the virtual machine to view the collected audit log files.

[0062] It can be seen that this application enables the audit log function of the target instance based on the deployment mode when the target instance is running normally, that is, when the OpenGauss high-availability instance is in normal state, and then uses the log collection tool to obtain the target data from the audit log file, and uses the log reporting tool to read the target file storing the target data to obtain the audit log information, and then uploads the audit log information to the corresponding target log server for storage, thereby realizing the automatic collection of audit logs for the OpenGauss database. In addition, this application can also call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the ID of the target instance, so as to use the collected audit logs to analyze and monitor the OpenGauss database, timely discover the security problems and performance bottlenecks of the database, improve management efficiency, and thus ensure the stable operation of the database system.

[0063] See also Figure 4 As shown, the present application discloses an audit log collection device, comprising:

[0064] An audit log function activation module 11 is used to determine whether a target instance is operating normally, and to configure target parameters based on the deployment mode of the OpenGauss database to enable the audit log function when the target instance is operating normally; the target instance is an OpenGauss high-availability instance;

[0065] The target data acquisition module 12 is used to use the log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into the target file;

[0066] The log information uploading module 13 is used to read the target file based on the target parameters using a log reporting tool and upload the read audit log information to a target log server;

[0067] The log information acquisition module 14 is configured to call the interface of the target log server through a console, and acquire the audit log information corresponding to the target instance based on the target instance ID.

[0068] It can be seen that this application enables the audit log function of the target instance based on the deployment mode when the target instance is running normally, that is, when the OpenGauss high-availability instance is in normal state, and then uses the log collection tool to obtain the target data from the audit log file, and uses the log reporting tool to read the target file storing the target data to obtain the audit log information, and then uploads the audit log information to the corresponding target log server for storage, thereby realizing the automatic collection of audit logs for the OpenGauss database. In addition, this application can also call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the ID of the target instance, so as to use the collected audit logs to analyze and monitor the OpenGauss database, timely discover the security problems and performance bottlenecks of the database, improve management efficiency, and thus ensure the stable operation of the database system.

[0069] In a specific embodiment, the audit log collection device may further include:

[0070] A condition judgment module is used to determine the deployment mode of the OpenGauss database, determine whether the target instance creation environment meets the preset instance creation conditions, and determine whether the first target image has been prepared;

[0071] The instance creation module is configured to create the target instance by resource orchestration in the target instance creation environment using the first target image if the target instance creation environment meets the preset instance creation condition and the first target image has been prepared.

[0072] In a specific embodiment, the audit log collection device may further include:

[0073] A first image preparation module, if the deployment mode is a virtual server mode, updates the initial first target image based on the second target image to produce a new first target image; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program;

[0074] Accordingly, the audit log function activation module 11 may specifically include:

[0075] The first script execution unit is used to configure the environment variables based on the target instance ID and the target product ID when the target instance is operating normally, and after the environment variables are configured, execute the script in the log collection tool and the script in the log reporting tool according to the new first target image to enable the audit log function.

[0076] In a specific embodiment, the audit log collection device may further include:

[0077] A second image preparation module is configured to convert the second target image into a new second target image in a target format if the deployment mode is a container mode, and store the new second target image on the image warehouse server; the target format is an image format compatible with the container mode; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program;

[0078] Accordingly, the audit log function activation module 11 may specifically include:

[0079] The second script execution unit is used to configure the environment variables based on the target instance ID and the target product ID when the target instance is operating normally, and after the environment variables are configured, execute the script in the log collection tool and the script in the log reporting tool according to the new second target image to enable the audit log function.

[0080] In a specific embodiment, the target data acquisition module 12 may specifically include:

[0081] A node judgment unit, using a log collection tool to judge whether each target node is a master node based on a preset collection time and the configured target parameters;

[0082] a first data acquisition unit, configured to read and filter the audit log file of the target node to acquire target data if the target node is a master node;

[0083] The second data acquisition unit is configured to select a new master node from all the target nodes if all the target nodes are slave nodes, and read and filter the audit log file of the new master node to obtain target data.

[0084] In a specific embodiment, the log information uploading module 13 may specifically include:

[0085] The log information uploading unit is used to use the log reporting tool to read the target file based on the target parameters, and add a label to the latest audit log information in all the audit log information, so that when the target file is read next time, it can be judged based on the label whether there is new audit log information in the target file, and the new audit log information can be uploaded to the target log server.

[0086] In a specific embodiment, the audit log collection device may further include:

[0087] The log segmentation module is used to monitor the collected target files based on a preset polling time using a log polling tool, and segment the target files based on a preset log segmentation method and a preset number of old log copies.

[0088] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0089] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the audit log collection method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0090] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0091] In addition, the memory 22 as a carrier for resource storage can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0092] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including computer programs capable of implementing the audit log collection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0093] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned audit log collection method. The specific steps of this method can be referred to the corresponding contents disclosed in the aforementioned embodiments and will not be repeated here.

[0094] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0095] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0096] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0097] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0098] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for collecting audit logs, characterized in that: include: Determine whether the target instance is running normally, and if the target instance is running normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance; The deployment modes include virtual server mode and container mode; Using a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and writing the target data into a target file; Using a log reporting tool to read the target file based on the target parameters, and uploading the read audit log information to a target log server; Call the interface of the target log server through the console, and obtain the audit log information corresponding to the target instance based on the target instance ID; Before determining whether the target instance is operating normally, the method further includes: Determine the deployment mode of the OpenGauss database, determine whether the target instance creation environment meets the preset instance creation conditions, and determine whether the first target image is ready; If the target instance creation environment meets the preset instance creation condition and the first target image has been prepared, creating the target instance by resource orchestration in the target instance creation environment using the first target image; Among them, the preset instance creation conditions include that the number of available nodes in the target instance creation environment is greater than the target number of nodes, and the target instance creation environment is interconnected with the target log server and the image warehouse server network, and the image warehouse server is used to store the first target image; the first target image is a virtual server image.

2. The audit log collection method according to claim 1, characterized in that: Before determining whether the first target image is ready, the method further includes: If the deployment mode is a virtual server mode, the initial first target image is updated based on the second target image to produce a new first target image; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high-availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program; Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including: When the target instance is operating normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new first target image to enable the audit log function.

3. The audit log collection method according to claim 1, characterized in that: After determining the deployment mode of the OpenGauss database, the method further includes: If the deployment mode is the container mode, the second target image is converted into a new second target image in a target format, and the new second target image is stored on the image warehouse server; the target format is an image format compatible with the container mode; the second target image includes an image of the OpenGauss database service, an image of the OpenGauss high availability service, an image of the log collection tool, an image of the log reporting tool, and an image of the monitor database monitoring program; Accordingly, when the target instance is running normally, the target parameters are configured based on the deployment mode of the OpenGauss database to enable the audit log function, including: When the target instance is operating normally, the environment variables are configured based on the target instance ID and the target product ID, and after the environment variables are configured, the script in the log collection tool and the script in the log reporting tool are executed according to the new second target image to enable the audit log function.

4. The audit log collection method according to claim 1, characterized in that: The log collection tool is used to read and filter the audit log file based on the configured target parameters to obtain target data, including: Using the log collection tool to determine whether each target node is a master node based on the preset collection time and the configured target parameters; If the target node is a master node, reading and filtering the audit log file of the target node to obtain target data; If all the target nodes are slave nodes, a new master node is selected from all the target nodes, and the audit log file of the new master node is read and filtered to obtain target data.

5. The audit log collection method according to claim 1, characterized in that: The log reporting tool is used to read the target file based on the target parameter, and the read audit log information is uploaded to the target log server, including: The target file is read based on the target parameters using a log reporting tool, and a label is added to the latest audit log information in all the audit log information, so that when the target file is read next time, it is determined based on the label whether there is new audit log information in the target file, and the new audit log information is uploaded to the target log server.

6. The audit log collection method according to any one of claims 1 to 5, characterized in that: Also includes: The log polling tool is used to monitor the collected target files based on a preset polling time, and to segment the target files based on a preset log segmentation method and a preset number of old log copies.

7. An audit log collection device, characterized in that: include: An audit log function activation module is used to determine whether the target instance is operating normally and, if the target instance is operating normally, configure the target parameters based on the deployment mode of the OpenGauss database to enable the audit log function; the target instance is an OpenGauss high-availability instance; The deployment modes include virtual server mode and container mode; A target data acquisition module is used to use a log collection tool to read and filter the audit log file based on the configured target parameters to obtain target data, and write the target data into a target file; A log information uploading module is used to read the target file based on the target parameters using a log reporting tool and upload the read audit log information to a target log server; A log information acquisition module is used to call the interface of the target log server through the console and obtain the audit log information corresponding to the target instance based on the target instance ID; The device further comprises: A condition judgment module is used to determine the deployment mode of the OpenGauss database, determine whether the target instance creation environment meets the preset instance creation conditions, and determine whether the first target image has been prepared; an instance creation module, configured to create the target instance by orchestrating resources in the target instance creation environment using the first target image if the target instance creation environment satisfies the preset instance creation condition and the first target image has been prepared; Among them, the preset instance creation conditions include that the number of available nodes in the target instance creation environment is greater than the target number of nodes, and the target instance creation environment is interconnected with the target log server and the image warehouse server network, and the image warehouse server is used to store the first target image; the first target image is a virtual server image.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the audit log collection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, the audit log collection method according to any one of claims 1 to 6 is implemented.

Images