Cluster Audit Log Aggregation for Scalable Debugging Serviceability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cluster network systems lack the capability to efficiently process and utilize standard log information to generate comprehensive audit logs, making it difficult for vendors to provide effective support and debugging services, especially in large-scale environments.
Innovation Solution
A support bundle processing mechanism is implemented to collect and aggregate log information across all components and nodes in a cluster network, using a collector service with filter criteria, and a coordinator-worker design for scalable collection, generating a single interface for vendors to analyze and debug issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If per-node processing is used to generate audit logs, then audit log generation capability is improved, but system complexity and processing overhead increase significantly
Solution Approach 1:
The patent introduces a centralized audit log processing service that acts as an intermediary between individual nodes and the audit log generation process. This service collects standard log information from multiple nodes and centrally processes it into audit logs, eliminating the need for each node to perform complex per-node processing while maintaining comprehensive audit coverage across the entire cluster system.
2Ease of repair
If comprehensive log collection from all nodes is implemented, then debugging serviceability is improved, but data processing time and resource consumption increase
Solution Approach 1:
The patent implements preliminary action by having nodes continuously collect and buffer standard log information in real-time before debugging is needed. This pre-collection approach ensures that when a debugging event occurs, the log data is already prepared and available for immediate analysis, eliminating the need for time-consuming data gathering during actual debugging sessions while maintaining comprehensive coverage of all nodes.
Data Source
AI summary
A multi-node, multi-container cluster system that generates, aggregates, and manages log files from services and components to be used for audit logs used by an auditor. Logs are collected from all components of the system and aggregated using a central persistent volume for non-critical applications and additional dedicated persistent volumes for critical tasks. Audit logs are formatted to provide a consistent logging format in conformance with relevant corporate and government requirements. Log files are stored persistently outside of pods to ensure high availability for any audit log management needs. Audit logs can be exported to external, secure syslog server, and can be made subject to defined retention policies, as needed.