Event Auditing Framework for Consistent IT Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IT system auditing frameworks face challenges in ensuring consistency and expandability of event logging, making it difficult to track and report system usage effectively, as different components log events inconsistently and new events can only be added in new versions, limiting flexibility and accuracy.
Innovation Solution
An event auditing framework that includes auditees and an auditor, where auditees are digitally signed with metadata defining authorized events, allowing for dynamic addition of new event types and ensuring consistency through validation and storage in an auditing database, enabling flexible and expandable reporting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional log files are used for tracking IT system usage, then implementation is simple and components can log events independently, but consistency of event data cannot be ensured and data is not flexible enough for reporting
Solution Approach 1:
The patent introduces an intermediary component called an 'auditor' that mediates between multiple 'auditee' components and the reporting system. The auditor receives events from auditees, validates them against a schema, standardizes the event data format, and stores it in a consistent structure. This intermediary layer maintains implementation simplicity for individual components while ensuring data consistency across the system.
Solution Approach 2:
The patent implements a configurable event schema with defined parameters and data types that transform raw, inconsistent event data into standardized formats. By changing the parameter structure from free-form text logs to typed, validated event objects with specific fields (timestamp, user, action, object, etc.), the system achieves both ease of implementation and data consistency for reporting.
2Manufacturing precision
If fixed version event tracking frameworks are used, then consistency of events can be maintained, but new events can only be added in new versions limiting expandability
Solution Approach 1:
The patent implements a dynamic event schema that allows the system to adapt to new event types without requiring version updates. The schema is designed to be extensible, enabling administrators to define new event categories, actions, and parameters at runtime. This dynamic approach maintains consistency through validation while providing flexibility to accommodate evolving system requirements and new event types.
3Adaptability or versatility
If expandable event systems are implemented, then new events can be added dynamically, but consistency of events generated by components becomes difficult to enforce
Solution Approach 1:
The patent implements a feedback mechanism where the auditor validates incoming events against the defined schema and provides feedback on compliance. The validation process checks event structure, required fields, and data types, ensuring that even as new event types are added dynamically, they conform to established consistency rules. This feedback loop maintains data quality while allowing system evolution.
4Ease of operation
If unstructured log data is collected, then all components can log independently without coordination, but data consumption for reporting purposes becomes difficult
Solution Approach 1:
The patent segments the logging system into distinct functional components: auditee components that generate events, an auditor that processes and validates events, and a reporting system that consumes standardized data. This segmentation allows independent components to log events simply while the auditor handles the complexity of standardization and validation, separating concerns and reducing overall system complexity.
Data Source
AI summary
Various embodiments of systems and methods for event auditing framework are described herein. The auditing framework includes one or more auditees, an auditor, and a memory associated with the auditor. Each auditee is associated with a digitally signed file including metadata of one or more events authorized for the auditee. The auditor validates digital signature of the file when the auditee is registered with the auditor. After validation of the digital signature, the metadata of the authorized events is stored with respect to the auditee to enable the auditee perform the authorized events. The auditing framework is expandable in that new event types can be added or updated dynamically. The auditing framework also ensures consistency of events.