Tenant-specific log for events related to a cloud-based service

• US 10,171,291 B2
• Filed: 11/20/2017
• Issued: 01/01/2019
• Est. Priority Date: 08/20/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Harishankar, Raman, Nguyen, Cong-Tam, Sivakumar, Gandhi, Subramanian, Vijayaganesh
• Primary Examiner(s): Parry, Chris
• Assistant Examiner(s): Hlaing, Soe M
• Application Number:
  US15/818,014
• Publication Number:
  US 20180077005A1
• Time in Patent Office: 407 Days
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method, system, and/or computer program product establishes and utilizes a tenant-specific log for events related to a cloud-based service. A metamodel is created for a cloud-based service provided to a specific tenant of a cloud. The metamodel describes types of resources that are providing the cloud-based service that the specific tenant desires to monitor. In response to the cloud-based service being executed, the metamodel is used to identify a set of resources that are actually providing the cloud-based service for the specific tenant. A tenant-specific log is established to tracks events that occur on each actual resource from the set of resources, and records access to the specific unit of hardware by an authorized user of the specific unit of hardware. Operations related to the cloud-based service are transferred from the specific unit of hardware to a local device that is available only to the specific tenant.

Claims

1. A method to establish and utilize a tenant-specific log for events related to a cloud-based service, the method comprising:

creating, by one or more processors, a metamodel for a cloud-based service running on a cloud, wherein the cloud-based service is provided to a specific tenant of the cloud, and wherein the metamodel describes types of resources, on the cloud, that are providing the cloud-based service for the specific tenant and that the specific tenant desires to monitor;

appending, by one or more processors, the metamodel to the cloud-based service;

in response to the cloud-based service being executed for the specific tenant of the cloud, applying, by one or more processors, the metamodel to identify a set of resources, on the cloud, that are providing the cloud-based service for the specific tenant;

issuing, by one or more processors, instructions to establish a tenant-specific log for events related to the cloud-based service, wherein the tenant-specific log tracks events that occur on each actual resource from the set of resources, on the cloud, that are providing the cloud-based service to the specific tenant, and wherein the tenant-specific log identifies a specific unit of hardware being used to provide the cloud-based service to the specific tenant; and

in response to the tenant-specific log recording access to the specific unit of hardware by a predefined party, transferring, by one or more processors, all operations related to the cloud-based service from the specific unit of hardware to another unit of hardware, wherein the predefined party is an authorized user of the specific unit of hardware, and wherein said another unit of hardware is a local device that is available only to the specific tenant.

2. The method of claim 1, further comprising:

in response to detecting that a function of the cloud-based service has moved from a first resource on the cloud to a second resource on the cloud, deleting, by one or more processors, the tenant-specific log from the first resource and installing the tenant-specific log on the second resource.

3. The method of claim 1, further comprising:

in response to said appending the metamodel to the cloud-based service, disabling, by one or more processors, any default log capabilities of the cloud-based service.

4. The method of claim 1, wherein the tenant-specific log tracks identifications of users who are accessing the cloud-based service, and wherein the method further comprises:

in response to detecting that an unauthorized user has accessed the cloud-based service, moving, by one or more processors, execution of the cloud-based service from a first resource on the cloud to a second resource on the cloud.

5. The method of claim 1, wherein the tenant-specific log tracks identifications of users who are accessing the cloud-based service, and wherein the method further comprises:

in response to detecting that an unauthorized user has accessed the cloud-based service, moving, by one or more processors, execution of the cloud-based service from a first resource on the cloud to a second resource that is not on the cloud, wherein the second resource is owned by a client of the specific tenant.

6. The method of claim 1, wherein the tenant-specific log identifies a physical location of a resource used to provide the cloud-based service, and wherein the method further comprises:

establishing, by one or more processors, an impermissible physical location that the cloud-based service is not permitted to operate within, wherein the impermissible physical location is a first country within which first country regulations do not permit the cloud-based service to operate; and

in response to detecting that the physical location of a first resource on the cloud used to provide the cloud-based service is within the impermissible physical location, moving, by one or more processors, execution of the cloud-based service from the first resource on the cloud to a second resource that is outside the impermissible physical location, wherein outside the impermissible physical location is a second country within which second country regulations permit the cloud-based service to operate.

7. The method of claim 1, wherein the tenant-specific log identifies an owner of a resource used to provide the cloud-based service, and wherein the method further comprises:

defining, by one or more processors, impermissible resources that the cloud-based service is not permitted to utilize, wherein the impermissible resources are owned by an impermissible owner; and

in response to detecting that a resource used to provide the cloud-based service is an impermissible resource that is owned by the impermissible owner, moving, by one or more processors, execution of the cloud-based service from the impermissible resource to another resource.

8. The method of claim 1, wherein the cloud-based service stores data for the specific tenant on a first storage device on the cloud, and wherein the method further comprises:

in response to determining, from the tenant-specific log, that data for the specific tenant has been stored on the first storage device on the cloud for longer than a predefined length of time, issuing, by one or more processors, instructions to move the data for the specific tenant from the first storage device on the cloud to a second storage device.

9. The method of claim 1, wherein the cloud-based service executes computer software instructions from an application on a first processing device on the cloud, wherein the computer software instructions are executed for the specific tenant of the cloud, and wherein the method further comprises:

determining, by one or more processors and from the tenant-specific log, an average length of time used by the first processing device on the cloud to execute the computer software instructions from the application for the specific tenant of the cloud; and

in response to determining that the average length of time exceeds a predetermined limit, issuing, by one or more processors, instructions to move execution of the computer software instructions from the first processing device on the cloud to a second processing device.

10. The method of claim 1, further comprising:

appending, by one or more processors, the metamodel to resources from the set of resources that are providing the cloud-based service for the specific tenant.

11. The method of claim 1, further comprising:

launching, by one or more processors, a single tenant log collector (TLC) for all cloud products utilized by the specific tenant of the cloud, wherein a tenant log collector collects tenant-specific logs of cloud resources used by the specific tenant.

12. The method of claim 1, further comprising:

launching, by one or more processors, a different tenant log collector (TLC) for each particular cloud product utilized by the specific tenant of the cloud, wherein a tenant log collector collects tenant-specific logs of cloud resources used by the specific tenant.

13. A computer program product for establishing and utilizing a tenant-specific log for events related to a cloud-based service, the computer program product comprising a computer readable storage medium having program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, and wherein the program code is readable and executable by a processor to perform a method comprising:

creating a metamodel for a cloud-based service running on a cloud, wherein the cloud-based service is provided to a specific tenant of the cloud, and wherein the metamodel describes types of resources, on the cloud, that are providing the cloud-based service for the specific tenant and that the specific tenant desires to monitor;

appending the metamodel to the cloud-based service;

in response to the cloud-based service being executed for the specific tenant of the cloud, applying the metamodel to identify a set of resources, on the cloud, that are providing the cloud-based service for the specific tenant;

issuing instructions to establish a tenant-specific log for events related to the cloud-based service, wherein the tenant-specific log tracks events that occur on each actual resource from the set of resources, on the cloud, that are providing the cloud-based service to the specific tenant, and wherein the tenant-specific log identifies a specific unit of hardware being used to provide the cloud-based service to the specific tenant; and

in response to the tenant-specific log recording access to the specific unit of hardware by a predefined party, transferring all operations related to the cloud-based service from the specific unit of hardware to another unit of hardware, wherein the predefined party is an authorized user of the specific unit of hardware, and wherein said another unit of hardware is a local device that is available only to the specific tenant.

14. The computer program product of claim 13, wherein the method further comprises:

in response to detecting that a function of the cloud-based service has moved from a first resource on the cloud to a second resource on the cloud, deleting the tenant-specific log from the first resource and installing the tenant-specific log on the second resource.

15. The computer program product of claim 13, wherein the method further comprises:

in response to said appending the metamodel to the cloud-based service, disabling any default log capabilities of the cloud-based service.

16. The computer program product of claim 13, wherein the tenant-specific log identifies a physical location of a resource used to provide the cloud-based service, and wherein the method further comprises:

establishing an impermissible physical location that the cloud-based service is not permitted to operate within; and

in response to detecting that the physical location of a first resource on the cloud used to provide the cloud-based service is within the impermissible physical location, moving execution of the cloud-based service from the first resource on the cloud to a second resource that is outside the impermissible physical location.

17. The computer program product of claim 13, wherein the tenant-specific log tracks identifications of users who are accessing the cloud-based service, and wherein the method further comprises:

in response to detecting that an unauthorized user has accessed the cloud-based service, moving execution of the cloud-based service from a first resource on the cloud to a second resource on the cloud.

18. The computer program product of claim 13, wherein the tenant-specific log tracks identifications of users who are accessing the cloud-based service, and wherein the method further comprises:

in response to detecting that an unauthorized user has accessed the cloud-based service, moving execution of the cloud-based service from a first resource on the cloud to a second resource that is not on the cloud, wherein the second resource is owned by a client of the specific tenant.

19. A computer system comprising:

a hardware processor, a computer readable memory, and a computer readable storage medium;

first program instructions to create a metamodel for a cloud-based service running on a cloud, wherein the cloud-based service is provided to a specific tenant of the cloud, and wherein the metamodel describes types of resources, on the cloud, that are providing the cloud-based service for the specific tenant and that the specific tenant desires to monitor;

second program instructions to append the metamodel to the cloud-based service;

third program instructions to, in response to the cloud-based service being executed for the specific tenant of the cloud, apply the metamodel to identify a set of resources, on the cloud, that are providing the cloud-based service for the specific tenant;

fourth program instructions to issue instructions to establish a tenant-specific log for events related to the cloud-based service, wherein the tenant-specific log tracks events that occur on each actual resource from the set of resources, on the cloud, that are providing the cloud-based service to the specific tenant, and wherein the tenant-specific log identifies a specific unit of hardware being used to provide the cloud-based service to the specific tenant; and

fifth program instructions to, in response to the tenant-specific log recording access to the specific unit of hardware by a predefined party, transfer all operations related to the cloud-based service from the specific unit of hardware to another unit of hardware, wherein the predefined party is an authorized user of the specific unit of hardware, and wherein said another unit of hardware is a local device that is available only to the specific tenant; and

wherein the first, second, third, fourth, and fifth program instructions are stored on the computer readable storage medium and executed by the processor via the computer readable memory.

20. The computer system of claim 19, further comprising:

sixth program instructions to, in response to detecting that a function of the cloud-based service has moved from a first resource on the cloud to a second resource on the cloud, delete the tenant-specific log from the first resource and install the tenant-specific log on the second resource; and

wherein

the sixth program instructions are stored on the computer readable storage medium and executed by the processor via the computer readable memory.