Database Log Enrichment via Sniffer and Correlator Components
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database logging mechanisms lack the ability to capture and include contextual information about database client operations, especially in cloud deployments, making it difficult to determine which applications or users performed specific database operations, and requiring cumbersome agent installations on multiple client stations or servers.
Innovation Solution
A sniffer component is installed on servers to detect database connections, generate keys based on connection information, and provide contextual data to a correlator component, which enriches database logs by correlating operation records with contextual information such as process IDs, OS user names, and authentication details.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional database logging mechanisms are used, then database operations are recorded, but contextual information about which applications or users performed operations is lost
Solution Approach 1:
A sniffer component is introduced as an intermediary between the database server and the logging mechanism. This sniffer captures contextual information (process IDs, OS user names, authentication details) from database connections and passes it to a correlator component, which enriches the logs with this contextual data without requiring changes to the database server itself
Solution Approach 2:
Instead of modifying the database server to generate enriched logs, the system creates a copy of the logging functionality through external components (sniffer and correlator). The sniffer copies connection information, and the correlator copies and merges this with operation logs, preserving the original logging mechanism while adding contextual enrichment
2Loss of information
If agents are installed on multiple client stations to capture contextual information, then contextual data is obtained, but deployment complexity and cost increase
Solution Approach 1:
The sniffer component acts as a centralized intermediary that captures contextual information from database connections passing through a single server. This eliminates the need to deploy agents on multiple client stations, as the sniffer intercepts and records connection data at the server level where all database traffic converges
Solution Approach 2:
The sniffer component installed on a single server serves multiple functions: it captures contextual information from all database connections, generates unique keys for correlation, and provides this data to the correlator. This multi-functional approach replaces the need for separate agents on each client station
3Loss of information
If database servers are monitored to capture contextual information, then operational context is obtained, but access to servers and complex agent deployment is required
Solution Approach 1:
The sniffer component is positioned as an intermediary that can be installed on a server without requiring deep access to the database server's internal mechanisms. It captures necessary contextual information from passing connections and relays it to the correlator, simplifying the monitoring process while maintaining comprehensive data collection
4Reliability
If detailed contextual information is collected from database connections, then security investigations are improved, but information processing complexity increases
Solution Approach 1:
The information processing is segmented into distinct functional components: the sniffer captures and processes connection contextual information separately, generating unique keys; the correlator then processes operation logs and correlates them with the captured contextual data. This segmentation distributes processing complexity across specialized components rather than concentrating it in a single system
Solution Approach 2:
The correlator creates enriched log entries by copying and merging data from multiple sources (operation logs and contextual information). This copying approach allows the system to preserve original data while adding contextual enrichment, making the processing pipeline more manageable and reliable
Data Source
AI summary
A method by a network device to enrich database logs. The method includes detecting that a process executing on the network device has created a database connection to a database server, determining contextual information of the process in response to detecting that the process has created the database connection, generating a key associated with the database connection based on information that is known to be included in a database log of the database, and providing the key and the contextual information to a correlator component.