Multi-tenant audit awareness in support of cloud environments

• US 20120179646A1
• Filed: 01/12/2011
• Published: 07/12/2012
• Est. Priority Date: 01/12/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hinton, Heather M., Cohen, Richard Jay
• Granted Patent: US 9,460,169 B2
• Time in Patent Office: Days
• US Class Current: 707/607
• CPC Class Codes: G06F 16/25 Integrating or interfacing systems involving database management systems

Abstract

A cloud enablement aggregation proxy (CEAP) receives and processes audit data from audited resources before such data is stored in a database. The CEAP manages log data for resources hosted in a multi-tenant shared pool of configurable computing resources (e.g., a compute cloud). A method for managing log data begins by the proxy aggregating and normalizing log information received from a plurality of the resources. The aggregated and normalized log information is then parsed to identify a tenant associated with each of a set of transactions. For each of the set of transactions, the CEAP annotates log data associated with the tenant and the particular transaction to include a tenant-specific identifier. An optional tenant separation proxy (TSP) separates the annotated log data on a per tenant basis prior to storage, and the tenant-specific log data may be stored in per tenant data structures or dedicated tenant log event databases to facilitate subsequent compliance or other analysis.

Claims

1. A method of managing log data generated by resources hosted in a multi-tenant shared pool of configurable computing resources, comprising:

aggregating and normalizing log information received from a plurality of the resources;

parsing the aggregated and normalized log information to identify a tenant associated with each of a set of transactions; and

for each of the set of transactions, annotating log data associated with the tenant and the particular transaction to include a tenant-specific identifier.

2. The method as described in claim 1 further including storing the annotated log data for multiple tenants.

3. The method as described in claim 2 further including separating the annotated log data on a per tenant basis prior to storing.

4. The method as described in claim 1 wherein the parsing step compares an event pattern in a transaction against a set of filters.

5. The method as described in claim 4 wherein the set of filters includes a filter that uniquely associates a tenant-specific identifier and a particular event pattern.

6. The method as described in claim 5 wherein the annotating step enriches event pattern data to include the tenant-specific identifier that is associated with a match between the event pattern in a transaction and one of the filters in the set of filters.

7. The method as described in claim 1 wherein the resource is a multi-tenant unaware resource.

8. The method as described in claim 1 further including performing a compliance analysis on per tenant-specific log data.

15. The apparatus as described in claim 8 wherein the resource is a multi-tenant unaware resource.

16. The apparatus as described in claim 8 wherein the method further includes performing a compliance analysis on per tenant-specific log data.

9. Apparatus to manage log data generated by resources hosted in a multi-tenant shared pool of configurable computing resources, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform a method comprising;

aggregating and normalizing log information received from a plurality of the resources;

parsing the aggregated and normalized log information to identify a tenant associated with each of a set of transactions; and

for each of the set of transactions, annotating log data associated with the tenant and the particular transaction to include a tenant-specific identifier.

10. The apparatus as described in claim 9 wherein the method further includes storing the annotated log data for multiple tenants.

11. The apparatus as described in claim 10 wherein the method further includes separating the annotated log data on a per tenant basis prior to storing.

12. The apparatus as described in claim 9 wherein the parsing step compares an event pattern in a transaction against a set of filters.

13. The apparatus as described in claim 12 wherein the set of filters includes a filter that uniquely associates a tenant-specific identifier and a particular event pattern.

14. The apparatus as described in claim 13 wherein the annotating step enriches event pattern data to include the tenant-specific identifier that is associated with a match between the event pattern in a transaction and one of the filters in the set of filters.

17. A computer program product in a computer readable medium for use in a data processing system to manage log data generated by resources hosted in a multi-tenant shared pool of configurable computing resources, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:

aggregating and normalizing log information received from a plurality of the resources;

parsing the aggregated and normalized log information to identify a tenant associated with each of a set of transactions; and

for each of the set of transactions, annotating log data associated with the tenant and the particular transaction to include a tenant-specific identifier.

18. The computer program product as described in claim 17 wherein the method further includes storing the annotated log data for multiple tenants.

19. The computer program product as described in claim 18 wherein the method further includes separating the annotated log data on a per tenant basis prior to storing.

20. The computer program product as described in claim 17 wherein the parsing step compares an event pattern in a transaction against a set of filters.

21. The computer program product as described in claim 20 wherein the set of filters includes a filter that uniquely associates a tenant-specific identifier and a particular event pattern.

22. The computer program product as described in claim 21 wherein the annotating step enriches event pattern data to include the tenant-specific identifier that is associated with a match between the event pattern in a transaction and one of the filters in the set of filters.

23. The computer program product as described in claim 17 wherein the resource is a multi-tenant unaware resource.

24. The computer program product as described in claim 17 wherein the method further includes performing a compliance analysis on per tenant-specific log data.

25. A cloud enablement aggregation proxy, comprising:

a processor;

computer memory holding computer program instructions executed by the processor to perform a method of managing logging data generated by resources hosted in a multi-tenant shared pool of configurable computing resources, the method comprising;

aggregating log information received from a plurality of the resources, wherein at least one resource is a multi-tenant unaware resource; and

processing the aggregated log information to identify, for each of a set of transactions, which of a set of multiple tenants was bound to the particular transaction that generated the log information.