Client-Based Log Governor for Throttled Error Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing logging systems are limited by storage capacity, leading to the overlaying of older logs, which can be exploited for denial-of-service attacks and require extensive statistic tracking, consuming additional resources.
Innovation Solution
Implementing a client-based log governor that throttles error logging by tracking log frequency and suppressing repetitive logs, allowing clients to specify throttling criteria and allocate storage for log governing information, thereby preventing log flooding and enabling controlled activity tracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If log space is fixed and wraps back to beginning, then storage is efficiently utilized, but old pertinent debug information is overwritten and rapid log deposits can be used as denial-of-service attacks
Solution Approach 1:
A log governor component is introduced as an intermediary between the logging source and the log manager. The governor monitors log frequency, identifies repetitive logs, and selectively suppresses them before they reach the log manager, thereby protecting against log flooding attacks while preserving genuine debug information.
Solution Approach 2:
The log governor operates autonomously using heuristics and frequency analysis to identify and suppress repetitive logs without requiring manual configuration or intervention. It self-manages the throttling process based on observed log patterns.
2Reliability
If logging managers track frequency information on all potential logs, then repetitive logs can be recognized, but storage space is consumed and requirements on log manager increase
Solution Approach 1:
The logging system is divided into distinct components: the log governor that handles frequency analysis and suppression decisions, and the log manager that handles log storage and management. This segmentation transfers the complex frequency tracking functionality from the log manager to the governor.
Solution Approach 2:
The frequency tracking and analysis functionality is extracted from the log manager and placed in the log governor. The governor maintains its own frequency information and makes suppression decisions independently, reducing the burden on the log manager.
3Adaptability or versatility
If log governor tracks log frequency in storage allocated by client, then client controls which logs are throttled, but additional storage space is required in client
Solution Approach 1:
The log governor uses heuristics and frequency analysis that require minimal storage space compared to tracking detailed information about every potential log type. Only essential frequency counts and suppression states are maintained in client-allocated storage.
Data Source
AI summary
A method, system and computer program product are provided for implementing client based throttled error logging in a computer system. A log governor, controlled by a client of a log manager, prevents the flooding of the logs, identifies how many repetitive logs have been suppressed, and is tailored such that log suppression requirements are enabled to be specified for each individual log. A space required for the log governor features or log governing information is allocated in the client.