CN117591490A - Data processing methods, devices, equipment and storage media for audit logs - Google Patents

Abstract

The invention relates to the technical field of data processing, and discloses a data processing method, device, equipment and storage medium of an audit log, which comprises the following steps: acquiring an object change request initiated for any one of the audit objects in the target cluster and original version copy information corresponding to the original version information; generating an audit log based on the object change request, and updating original version copy information based on the object change request; analyzing the audit log to obtain the object name of the audit object and the corresponding version identification field; generating a version acquisition request based on the object name and the version identification field to acquire original version information of the audit object; the invention can store the historical version of the audit object in the data storage center, and change the copy information of the historical version information when the audit object changes the object, thereby obtaining the historical version information of each audit object according to the audit log and recovering the cluster to the original state when the cluster fails.

Description

Data processing methods, devices, equipment and storage media for audit logs

Technical field

The invention relates to the field of data processing technology, and specifically to a data processing method, device, equipment and storage medium for audit logs.

Background technique

k8s (Kubernetes) is an open source container orchestration platform used to automate the deployment, scaling and management of containers. Audit logs are used for recording operational events in k8s clusters, as well as for auditing, security, and troubleshooting purposes to ensure the security and reliability of k8s clusters. When a cluster failure occurs, the cluster needs to be restored to its original state based on the audit log. However, since the audit log records the request and the corresponding message body, but does not record the value before the change field is changed, at this time, all requests in the k8s cluster need to be intercepted, and the request needs to be passed after obtaining the object value to be modified. , turning a modification request into a modification plus an acquisition request. It increases the k8s request response time, increases the burden on the k8s cluster, and reduces the operating efficiency of the entire cluster.

Contents of the invention

In view of this, the present invention provides a data processing method, device, equipment and storage medium for audit logs to solve the problem that existing audit logs need to intercept the field values in the Kubernetes cluster when obtaining the field values before the corresponding objects in the Kubernetes cluster are changed. All requests need to be passed after obtaining the object value to be modified, turning a modification request into a modification plus an acquisition request, which increases the Kubernetes request response time, increases the burden on the Kubernetes cluster, and reduces the operating efficiency of the entire cluster. question.

In a first aspect, the present invention provides a data processing method for audit logs, which is applied to the data storage center of the target cluster. The data storage center stores an original version set, and the original version set includes multiple original version information. The method includes: Obtain the object change request initiated for any audit object in the target cluster and the original version copy information corresponding to the original version information; generate an audit log based on the object change request, and update the original version copy information based on the object change request to convert the original The version copy information is updated to the target version information; the audit log is parsed to obtain the object name of the audit object and the corresponding version identification field; a version acquisition request is generated based on the object name and version identification field to obtain the original version information of the audit object. Through the above process, the historical version data of each audit object can be stored in the data storage center. When each audit object in the cluster changes the object, the copy information of the historical version information can be changed, so that when the cluster fails, the audit log can be updated based on the audit log. Obtain the historical version information of each audit object and restore the cluster to its original state.

This enables the cloud host to normally use the data in the encrypted disk that has been migrated or mounted from other cloud hosts, and ensures the security and integrity of the encrypted information conversion of the data stored in the encrypted data disk.

In some optional implementations, obtain the object change request initiated for any audit object in the target cluster and the original version copy information corresponding to the original version information, including:

Obtain one or more audit objects to be audited in the target cluster;

For any audit object, when an object change request is received, the latest original version information in the original version set is obtained based on the object change request;

Update the latest original version information to the information copy to obtain the original version copy information.

In some optional implementations, the original version copy information is updated based on the object change request, including:

Obtain the request information of the object change request;

Compare the first information length of the request information with the second information length of the original version copy information to obtain a length comparison result;

When the comparison result indicates that the first information length and the second information length are different, the original version copy information is updated based on the request information to update the original version copy information to the target version information.

In some optional implementations, the above method further includes:

When the comparison result indicates that the length of the first information and the length of the second information are the same, intercept the first request information with a preset step size from both ends of the request information, and combine them to obtain the first combined request information;

Intercept the second request information of the preset step size from both ends of the original version copy information, and combine them to obtain the second combined request information;

When both ends of the request information are smaller than the preset step size, both ends of the request information are padded so that both ends of the request information reach the preset step size;

When both ends of the original version copy information are smaller than the preset step size, the two ends of the original version copy information are padded so that both ends of the original version copy information reach the preset step size;

Compare the content of the first combination request information with the content of the second combination request information to obtain a content comparison result;

When the content comparison result indicates that the content of the first combination request information is different from the content of the second combination request information, update the original version copy information based on the request information;

When the content comparison result indicates that the content of the first combination request information is the same as the content of the second combination request information, obtain the first remaining request information excluding the first combination request information in the request information, and the original version copy information excluding the second combining the second remaining request information of the request information;

Compare the content of the first remaining request information with the content of the second remaining request information, and update the original version copy information based on the comparison result.

In some optional implementations, compare the content of the first combined request information with the content of the second combined request information to obtain a content comparison result, including:

Obtain the character value of each character in the first combination of request information;

Compare the character value of each character in the first combination request information with the character value of the corresponding character in the second combination request information;

When the character value of each character in the first combination request information is the same as the character value of the corresponding character in the second combination request information, a content comparison result indicating that the content of the first combination request information and the content of the second combination request information are the same is generated. ;

When the character value of each character in the first combination request information is different from the character value of any corresponding character in the second combination request information, a content ratio indicating that the content of the first combination request information is different from the content of the second combination request information is generated. to the results.

In some optional implementations, obtaining the original version information of the audit object includes:

Splice the object name and version identification field to obtain the version acquisition request;

Identify the version information corresponding to the version acquisition request in the original version set to obtain the original version information of the audit object.

In some optional implementations, obtaining the original version information of the audit object also includes:

Convert the version identification field into a version number;

Based on the version number and object name, obtain the storage path corresponding to the original version information in the original version set;

Obtain the original version information of the audit object based on the storage path.

In a second aspect, the present invention provides a data processing device for audit logs, which is applied to a data storage center of a target cluster. An original version set is stored in the data storage center. The original version set includes multiple original version information. The device mainly includes : Information acquisition module, information update module, log parsing module, and request generation module; among them, the information acquisition module is used to obtain an object change request initiated for any audit object in the target cluster and a copy of the original version of the corresponding original version information Information; information update module, used to generate audit logs based on object change requests, and update original version copy information based on object change requests, so as to update original version copy information to target version information; log parsing module, used to analyze audit logs Parse to obtain the object name of the audit object and the corresponding version identification field; the request generation module is used to generate a version acquisition request based on the object name and version identification field to obtain the original version information of the audit object. Through the above process, the historical version data of each audit object can be stored in the data storage center. When each audit object in the cluster changes the object, the copy information of the historical version information can be changed, so that when the cluster fails, the audit log can be updated based on the audit log. Obtain the historical version information of each audit object and restore the cluster to its original state.

In a third aspect, the present invention provides a computer device, including: a memory and a processor. The memory and the processor are communicatively connected to each other. Computer instructions are stored in the memory, and the processor executes the computer instructions to execute the first aspect. Or the data processing method of the audit log in any of its corresponding embodiments.

In a fourth aspect, the present invention provides a computer-readable storage medium. Computer instructions are stored on the computer-readable storage medium. The computer instructions are used to cause the computer to execute the audit log of the above-mentioned first aspect or any of its corresponding embodiments. data processing methods.

Description of drawings

In order to more clearly explain the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings that need to be used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description The drawings illustrate some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without exerting any creative effort.

Figure 1 is a schematic flow chart of an audit log data processing method according to an embodiment of the present invention;

Figure 2 is a schematic flow chart of another audit log data processing method according to an embodiment of the present invention;

Figure 3 is a schematic flow chart of another audit log data processing method according to an embodiment of the present invention;

Figure 4 is a schematic flow chart of another audit log data processing method according to an embodiment of the present invention;

Figure 5 is a schematic diagram of an application scenario according to an embodiment of the present invention;

Figure 6 is a schematic diagram of another application scenario according to the embodiment of the present invention;

Figure 7 is a structural block diagram of an audit log data processing device according to an embodiment of the present invention;

Figure 8 is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the scope of protection of the present invention.

The terms "first" and "second" in the description and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than describing a specific sequence. Furthermore, the term "includes" and any variations thereof are intended to cover non-exclusive protection. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes Other steps or units inherent to such processes, methods, products or devices. "Plural" in the present invention can mean at least two, for example, it can be two, three or more, which is not limited by the embodiment of the present invention.

In this embodiment, a data processing method for audit logs is provided, which is applied to the data storage center of a target cluster. The target cluster includes a data storage center and an information processing center. The data storage center stores an original version set. The original version set Including multiple original version information; the information processing center is responsible for processing user requests, such as object change requests, and after the processing is completed, according to the configured audit policy, generate audit logs and send them to the designated audit log backend; the data storage center is responsible for It stores and updates the data of audit objects in the K8s cluster. It has multi-version data management functions, supports users to access specified versions of data, and can automatically clean historical data according to configured cleaning parameters. Figure 1 is a flow chart of an audit log data processing method according to an embodiment of the present invention. As shown in Figure 1, the process includes the following steps:

Step S101: Obtain the object change request initiated for any audit object in the target cluster and the original version copy information corresponding to the original version information.

As above, by obtaining the object change request initiated for any audit object in the target cluster so that the original version information of the audit object can be changed based on the object change request, and through the original version copy information corresponding to the original version information based on the object change request, In order to facilitate the version data change of the audit object based on the original version copy information, and avoid the situation where the version data of the audit object cannot be traced back if the cluster fails after the version data is updated directly based on the original version information.

In some optional implementations, since the target cluster, that is, the k8s cluster usually includes one or more audit objects to be audited, when the version information of the centralized audit object is changed, one or more of the target clusters can be obtained. Multiple audit objects to be audited; for any audit object, when an object change request is received, the latest original version information in the original version set is obtained based on the object change request; the latest original version information is updated to the information copy to obtain Original version copy information. Obtain the latest original version information in the original version set based on the object change request, so as to store the latest original version information in the information copy, thereby obtaining the original version copy information of the original version information, providing the necessary information for auditing object version changes and backtracking condition. Among them, object changes include the attributes and related information that need to be changed for the audit object, resulting in version changes.

Step S102: Generate an audit log based on the object change request, and update the original version copy information based on the object change request to update the original version copy information to the target version information.

As above, the audit log is generated based on the object change request to facilitate version backtracking of the audit object, and the original version copy information is updated based on the object change request to update the original version copy information to the target version information.

In some optional implementations, the audit log receiving component can be configured as the audit log backend through the information processing center. When there are audit objects in the k8s cluster that need to be changed, that is, when the user initiates an object change request to the information processing center , the information processing center will generate an audit log based on the object change request and send it to the audit log receiving component.

Step S103, parse the audit log to obtain the object name of the audit object and the corresponding version identification field.

As above, by parsing the audit log, the object name of the audit object and the corresponding version identification field are obtained, so that the complete history of the audit object can be obtained from the data storage center based on the object name and the corresponding version identification field of the audit object. Version data.

In some optional implementations, the audit log can be parsed through the audit log receiving component to obtain the object name of the audit object and the corresponding version identification field, so that the object name of the audit object and the corresponding version identification field can be obtained. , obtain the complete historical version data of the audit object from the data storage center.

Step S104: Generate a version acquisition request based on the object name and version identification fields to obtain the original version information of the audit object.

As above, by generating a version acquisition request based on the object name and version identification fields, the original version information of the audit object is obtained, which provides necessary conditions for backtracking the historical version information of the audit object.

In some optional implementations, the object name and the version identification field can be spliced to obtain a version acquisition request; and then the version information corresponding to the version acquisition request in the original version set is identified to obtain the original version information of the audit object. Similarly, each original version information in the original version set also includes a string concatenated between the object name and the version identification field, as well as the corresponding version data.

The audit log data processing method provided in this embodiment first obtains the object change request initiated for any audit object in the target cluster so as to change the original version information of the audit object based on the object change request. Request the original version copy information corresponding to the original version information so that the version data of the audit object can be changed based on the original version copy information to avoid the inability to backtrack the version of the audit object if the cluster fails after the version data is updated directly based on the original version information. Status; by generating audit logs based on object change requests to facilitate version backtracking of audit objects, and by updating the original version copy information based on object change requests to update the original version copy information to the target version information; by parsing the audit logs , obtain the object name of the audit object and the corresponding version identification field, so as to obtain the complete historical version data of the audit object from the data storage center based on the object name and corresponding version identification field of the audit object; by based on the object name and the corresponding version identification field The version identification field generates a version acquisition request to obtain the original version information of the audit object, providing necessary conditions for backtracking the historical version information of the audit object. Therefore, the present invention can store the historical version data of each audit object in the data storage center, and change the copy information of the historical version information when each audit object in the cluster changes the object, so that when the cluster fails, the audit log can be updated according to the audit log. Obtain the historical version information of each audit object and restore the cluster to its original state.

In this embodiment, a data processing method for audit logs is provided, which is applied to the data storage center of a target cluster. The target cluster includes a data storage center and an information processing center. The data storage center stores an original version set. The original version set Including multiple original version information; the information processing center is responsible for processing user requests, such as object change requests, and after the processing is completed, according to the configured audit policy, generate audit logs and send them to the designated audit log backend; the data storage center is responsible for It stores and updates the data of audit objects in the K8s cluster. It has multi-version data management functions, supports users to access specified versions of data, and can automatically clean historical data according to configured cleaning parameters. Figure 2 is a flow chart of an audit log data processing method according to an embodiment of the present invention. As shown in Figure 2, the process includes the following steps:

Step S201: Obtain the object change request initiated for any audit object in the target cluster and the original version copy information corresponding to the original version information.

As above, by obtaining the object change request initiated for any audit object in the target cluster so that the original version information of the audit object can be changed based on the object change request, and through the original version copy information corresponding to the original version information based on the object change request, In order to facilitate the version data change of the audit object based on the original version copy information, and avoid the situation where the version data of the audit object cannot be traced back if the cluster fails after the version data is updated directly based on the original version information.

For details, please refer to step S101 in the embodiment shown in Figure 1, which will not be described again here.

Step S202: Generate an audit log based on the object change request, and update the original version copy information based on the object change request to update the original version copy information to the target version information.

As above, the audit log is generated based on the object change request to facilitate version backtracking of the audit object, and the original version copy information is updated based on the object change request to update the original version copy information to the target version information.

Specifically, the above step S202 includes:

Step S2021: Obtain the request information of the object change request.

As above, by obtaining the request information of the object change request, it is possible to determine whether the object change request is valid based on the request information of the object change request.

Step S2022: Compare the first information length of the request information with the second information length of the original version copy information to obtain a length comparison result.

As above, by comparing the first information length of the request information with the second information length of the original version copy information, a length comparison result is obtained, so as to determine whether to update the original version copy information based on the length comparison result.

In some optional implementations, when comparing the first information length of the request information with the second information length of the original version copy information, the number of characters of the request information may be compared with the number of characters of the original version copy information. Yes, when the number of characters of the request information is the same as the number of characters of the original version copy information, it means that the first information length of the request information is the same as the second information length of the original version copy information; when the number of characters of the request information is the same as the original version copy information When the number of characters of the information is different, it means that the first information length of the request information is different from the second information length of the original version copy information.

Step S2023: When the comparison result indicates that the first information length and the second information length are different, the original version copy information is updated based on the request information to update the original version copy information to the target version information.

As above, when the comparison result indicates that the first information length and the second information length are different, the original version copy information is updated based on the request information to update the original version copy information to the target version information, thereby realizing the audit object version. Valid update.

In some optional implementations, when the comparison result indicates that the length of the first information and the length of the second information are the same, the first request information with a preset step size is intercepted from both ends of the request information and combined to obtain the first request information. Combine the request information, where the preset step size can be two characters or other numerical characters; intercept the second request information of the preset step size from both ends of the original version copy information, and combine them to obtain the second combination request Information, where the preset step size can be two characters, or other numerical characters; when both ends of the requested information are less than the preset step size, the two ends of the requested information will be filled in, for example, the preset step size is two characters, but there is only one character at both ends of the request information, you need to intercept one character at both ends of the request information and fill in the characters so that both ends of the request information reach the preset step size; when both ends of the original version of the copy information are smaller than When the step size is preset, the two ends of the original version copy information are padded so that the two ends of the original version copy information reach the preset step size. For example, the preset step size is two characters, but the two ends of the original version copy information are only One character, you need to intercept one character at both ends of the original version of the copy information and fill in the characters; compare the content of the first combination of request information with the content of the second combination of request information to obtain the content comparison result; when the content comparison When the result represents that the content of the first combination request information is different from the content of the second combination request information, the original version copy information is updated based on the request information; when the content comparison result represents the content of the first combination request information and the second combination request information When the contents are the same, obtain the first remaining request information excluding the first combination request information in the request information, and the second remaining request information excluding the second combination request information in the original version copy information; compare the content of the first remaining request information with The second content of the remaining request information is updated, and the original version copy information is updated based on the comparison result.

In some optional implementations, when comparing the content of the first combined request information with the content of the second combined request information, and obtaining the content comparison result, the character value of each character in the first combined request information can be obtained; The character value of each character in the combined request information is compared with the character value of the corresponding character in the second combined request information; when the character value of each character in the first combined request information and the character value of the corresponding character in the second combined request information are equal The same, generating a content comparison result indicating that the content of the first combination request information is the same as the content of the second combination request information; when the character value of each character in the first combination request information is consistent with any corresponding character in the second combination request information The character values are different, and a content comparison result indicating that the content of the first combination request information is different from the content of the second combination request information is generated.

Step S203, parse the audit log to obtain the object name of the audit object and the corresponding version identification field.

As above, by parsing the audit log, the object name of the audit object and the corresponding version identification field are obtained, so that the complete history of the audit object can be obtained from the data storage center based on the object name and the corresponding version identification field of the audit object. Version data.

Please refer to step S103 in the embodiment shown in Figure 1 for details, which will not be described again here.

Step S204: Generate a version acquisition request based on the object name and version identification fields to obtain the original version information of the audit object.

As above, by generating a version acquisition request based on the object name and version identification fields, the original version information of the audit object is obtained, which provides necessary conditions for backtracking the historical version information of the audit object.

Please refer to step S104 in the embodiment shown in Figure 1 for details, which will not be described again here.

The audit log data processing method provided in this embodiment first obtains the object change request initiated for any audit object in the target cluster so as to change the original version information of the audit object based on the object change request. Request the original version copy information corresponding to the original version information so that the version data of the audit object can be changed based on the original version copy information to avoid the inability to backtrack the version of the audit object if the cluster fails after the version data is updated directly based on the original version information. Status; by generating audit logs based on object change requests to facilitate version backtracking of audit objects, and by updating the original version copy information based on object change requests to update the original version copy information to the target version information; by parsing the audit logs , obtain the object name of the audit object and the corresponding version identification field, so as to obtain the complete historical version data of the audit object from the data storage center based on the object name and corresponding version identification field of the audit object; by based on the object name and the corresponding version identification field The version identification field generates a version acquisition request to obtain the original version information of the audit object, providing necessary conditions for backtracking the historical version information of the audit object. Therefore, the present invention can store the historical version data of each audit object in the data storage center, and change the copy information of the historical version information when each audit object in the cluster changes the object, so that when the cluster fails, the audit log can be updated according to the audit log. Obtain the historical version information of each audit object and restore the cluster to its original state.

In this embodiment, a data processing method for audit logs is provided, which is applied to the data storage center of a target cluster. The target cluster includes a data storage center and an information processing center. The data storage center stores an original version set. The original version set Including multiple original version information; the information processing center is responsible for processing user requests, such as object change requests, and after the processing is completed, according to the configured audit policy, generate audit logs and send them to the designated audit log backend; the data storage center is responsible for It stores and updates the data of audit objects in the K8s cluster. It has multi-version data management functions, supports users to access specified versions of data, and can automatically clean historical data according to configured cleaning parameters. Figure 3 is a flow chart of an audit log data processing method according to an embodiment of the present invention. As shown in Figure 3, the process includes the following steps:

Step S301: Obtain the object change request initiated for any audit object in the target cluster and the original version copy information corresponding to the original version information.

For details, please refer to step S101 in the embodiment shown in Figure 1, which will not be described again here.

Step S302: Generate an audit log based on the object change request, and update the original version copy information based on the object change request to update the original version copy information to the target version information.

Please refer to step S202 in the embodiment shown in Figure 2 for details, which will not be described again here.

Step S303: Analyze the audit log to obtain the object name of the audit object and the corresponding version identification field.

For details, please refer to step S303 in the embodiment shown in Figure 3, which will not be described again here.

Step S304, concatenate the object name and the version identification field to obtain a version acquisition request.

As above, by splicing the object name and the version identification field, a version acquisition request is obtained, so as to obtain the historical version information of the audit object based on the version acquisition request, and provide necessary conditions for the acquisition and backtracking of the historical version information of the audit object.

Step S305: Identify the version information corresponding to the version acquisition request in the original version set to obtain the original version information of the audit object.

As above, identify the version information corresponding to the version acquisition request in the original version set to obtain the original version information of the audit object

In some optional implementations, each original version information in the original version set also includes a string concatenated by the object name and the version identification field, as well as the corresponding version data. When obtaining the historical version information of the audit object, it can be based on the object The version acquisition request obtained by splicing the name and version identification fields identifies the version information corresponding to the version acquisition request in the original version set to obtain the original version information of the audit object.

The audit log data processing method provided in this embodiment first obtains the object change request initiated for any audit object in the target cluster so as to change the original version information of the audit object based on the object change request. Request the original version copy information corresponding to the original version information so that the version data of the audit object can be changed based on the original version copy information to avoid the inability to backtrack the version of the audit object if the cluster fails after the version data is updated directly based on the original version information. Status; by generating audit logs based on object change requests to facilitate version backtracking of audit objects, and by updating the original version copy information based on object change requests to update the original version copy information to the target version information; by parsing the audit logs , obtain the object name of the audit object and the corresponding version identification field, so as to obtain the complete historical version data of the audit object from the data storage center based on the object name and corresponding version identification field of the audit object; by based on the object name and the corresponding version identification field The version identification field generates a version acquisition request to obtain the original version information of the audit object, providing necessary conditions for backtracking the historical version information of the audit object. Therefore, the present invention can store the historical version data of each audit object in the data storage center, and change the copy information of the historical version information when each audit object in the cluster changes the object, so that when the cluster fails, the audit log can be updated according to the audit log. Obtain the historical version information of each audit object and restore the cluster to its original state.

In this embodiment, a data processing method for audit logs is provided, which is applied to the data storage center of a target cluster. The target cluster includes a data storage center and an information processing center. The data storage center stores an original version set. The original version set Including multiple original version information; the information processing center is responsible for processing user requests, such as object change requests, and after the processing is completed, according to the configured audit policy, generate audit logs and send them to the designated audit log backend; the data storage center is responsible for It stores and updates the data of audit objects in the K8s cluster. It has multi-version data management functions, supports users to access specified versions of data, and can automatically clean historical data according to configured cleaning parameters. Figure 4 is a flow chart of an audit log data processing method according to an embodiment of the present invention. As shown in Figure 4, the process includes the following steps:

Step S401: Obtain the object change request initiated for any audit object in the target cluster and the original version copy information corresponding to the original version information.

For details, please refer to step S101 in the embodiment shown in Figure 1, which will not be described again here.

Step S402: Generate an audit log based on the object change request, and update the original version copy information based on the object change request to update the original version copy information to the target version information.

Please refer to step S202 in the embodiment shown in Figure 2 for details, which will not be described again here.

Step S403, parse the audit log to obtain the object name of the audit object and the corresponding version identification field.

Please refer to step S103 in the embodiment shown in Figure 1 for details, which will not be described again here.

Step S404: Convert the version identification field into a version number.

As above, by converting the version identification field into a version number, the storage path corresponding to the original version information in the original version set can be obtained based on the version number and object name.

Step S405: Based on the version number and object name, obtain the storage path corresponding to the original version information in the original version set.

As above, the storage path corresponding to the original version information in the original version set is obtained based on the version number and object name, so that the original version information of the audit object can be obtained based on the storage path.

Step S406: Obtain the original version information of the audit object based on the storage path.

As above, by obtaining the original version information of the audit object based on the storage path, necessary conditions are provided for the backtracking of historical version information of the audit object.

In some optional implementations, the version identification field and object name parsed by the audit log component can be received through the data storage center interactive component, the version identification field and the object name can be converted into a version number, and the object name can be converted into storage in the data storage center. path. If you want to obtain the etcd storage information of the data storage center of the POD (backend container) under the kube-system namespace with the object name etcd-2, you need to convert it to registry/pods/kube-system/etcd-2, and use this Path to obtain data from the data storage center. To obtain the data of a specified version, you need to add additional parameters when obtaining the data, withModRevision (version number) = resource version (version identification field). Then use the parameters such as the storage path and version number of the data storage center converted from the object name to request data from the data storage center, so that the data storage center can obtain the original version information of the audit object after decoding the response data covering the request data through the decoding component.

In some optional implementations, please refer to Figure 5. When the user modifies the number of object copies with the object name test1 in the target cluster to 3, the information processing center modifies the number of object copies to 3 after receiving the request. And store it in the data storage center; the data storage center receives the data modification request and does not directly modify it based on the source data. Instead, it creates a new data with the same name and modifies the ModRevision (version number). After the information processing center completes the storage in the data storage center, it will obtain ModRevision as the resource version (version identification field) of the audit object and return it to the user. At this time, the user can directly obtain the pre-modified data copy from the data storage center based on the resource version (version identification field) in the audit object recorded in the audit log, and obtain the pre-modified copy number as 1. That is, using the resource version (version identification field) of the audit object carried in the audit log, go to the data storage center to obtain the historical version of the object, and obtain the value before the modified field. Therefore, users can easily track and manage historical versions of Kubernetes objects for fault recovery or debugging operations, and can quickly restore the historical state of objects. At the same time, this method also supports fast data rollback operations to quickly restore data when an error occurs, improving the reliability and availability of the Kubernetes cluster. And because it acts on k8s after it processes the user's request, it does not affect k8s's normal processing flow of the request and will not affect the response speed of the cluster.

Some optional implementations, please refer to Figure 6, include api server: the information processing center of the k8s cluster, which is responsible for processing user requests and after the processing is completed, according to the configured audit policy, generate audit logs and send them to the designated audit logs rear end. etcd: The data storage center of the k8s cluster. It is responsible for storing the object data of the k8s cluster. It has multi-version data management functions and supports users to access specified versions of data. And can clean historical data according to the configured automatic cleaning parameters. Audit log receiving component: The audit log receiving component is a webhook that will serve as the receiving end of the audit log, receiving the audit log from the API server, and extracting the object and resource version numbers. Data storage center interactive component: It is a function that concurrently interacts with the data storage center etcd, and concurrently obtains the historical version of the object from the data storage center based on the object and resource version number. Decoding component: The decoding component Protobuf is a tool for decoding Protobuf format data into the original yaml format, that is, using the Protobuf decoder to decode the object historical version data obtained from the data storage center in order to obtain the field value before change . The specific implementation process is as follows:

First, configure the information processing center api server startup parameters, and configure the audit log receiving component as the audit log backend of apiserver; when the k8s cluster has object changes, the api server information processing center generates audit logs and sends them to the audit log receiving component; audit log After receiving the audit log, the receiving component parses the object to be modified and the resource version (version identification field), and sends it to the data storage center interactive component according to the object name and resource version (version identification field) as parameters; deploys the data storage center interactive component , which is located in the same stateless load as the audit log component. For each pair of object name and resource version (version identification field) received, a new process is opened for concurrent processing, and the object name is converted into the storage path of the data storage center. Convert resourceversion (version identification field) into ModRevision (version number); use the object name to be converted into the storage path of the data storage center and the ModRevision (version number) parameter to request data from the data storage center. The data storage center sends the returned data to the decoding component. Deploy the data storage center interaction component, which is located in the same stateless load as the audit log component; use the data storage center interaction component to decode the data returned by the data storage center into the form of yaml, and parse the yaml to obtain the field values before the change.

By using the resource version of the audit object carried in the audit log, go to the data storage center to obtain the historical version of the object, and obtain the value before the modified field, which is used for auditing and Kubernetes cluster error recovery. It can also realize the historical version of the audit object. Accurate tracking and operation, and can facilitate users to track and manage historical versions of audit objects for auditing; at the same time, it facilitates operation and maintenance personnel to troubleshoot and restore the historical status of objects, improving the reliability and availability of Kubernetes clusters.

The audit log data processing method provided in this embodiment first obtains the object change request initiated for any audit object in the target cluster so as to change the original version information of the audit object based on the object change request. Request the original version copy information corresponding to the original version information so that the version data of the audit object can be changed based on the original version copy information to avoid the inability to backtrack the version of the audit object if the cluster fails after the version data is updated directly based on the original version information. Status; by generating audit logs based on object change requests to facilitate version backtracking of audit objects, and by updating the original version copy information based on object change requests to update the original version copy information to the target version information; by parsing the audit logs , obtain the object name of the audit object and the corresponding version identification field, so as to obtain the complete historical version data of the audit object from the data storage center based on the object name and corresponding version identification field of the audit object; by based on the object name and the corresponding version identification field The version identification field generates a version acquisition request to obtain the original version information of the audit object, providing necessary conditions for backtracking the historical version information of the audit object. Therefore, the present invention can store the historical version data of each audit object in the data storage center, and change the copy information of the historical version information when each audit object in the cluster changes the object, so that when the cluster fails, the audit log can be updated according to the audit log. Obtain the historical version information of each audit object and restore the cluster to its original state.

This embodiment also provides a data processing device for audit logs. The device is used to implement the above embodiments and preferred implementations. What has already been described will not be described again. As used below, the term "module" may be a combination of software and/or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.

This embodiment provides a data processing device for audit logs, as shown in Figure 7, including:

The information acquisition module 701 is used to acquire the object change request initiated for any audit object in the target cluster and the original version copy information corresponding to the original version information;

The information update module 702 is configured to generate an audit log based on the object change request, and update the original version copy information based on the object change request, so as to update the original version copy information to the target version information;

The log parsing module 703 is used to parse the audit log to obtain the object name of the audit object and the corresponding version identification field;

The request generation module 704 is used to generate a version acquisition request based on the object name and version identification field to obtain the original version information of the audit object.

In some optional implementations, the information acquisition module 701 includes:

The object acquisition unit is used to acquire one or more audit objects to be audited in the target cluster;

The information acquisition unit is used for obtaining the latest original version information in the original version set based on the object change request for any audit object when receiving an object change request;

The information update unit is used to update the latest original version information to the information copy to obtain the original version copy information.

In some optional implementations, the information update module 702 includes:

The information acquisition unit is used to obtain the request information of the object change request;

A length comparison unit, configured to compare the first information length of the request information with the second information length of the original version copy information to obtain a length comparison result;

A version update unit, configured to update the original version copy information based on the request information when the comparison result indicates that the first information length and the second information length are different, so as to update the original version copy information to the target version information.

In some optional implementations, the version update unit is also configured to intercept the first request information with a preset step size from both ends of the request information when the comparison result indicates that the length of the first information and the length of the second information are the same. , and combine to obtain the first combination of request information;

Intercept the second request information of the preset step size from both ends of the original version copy information, and combine them to obtain the second combined request information;

When both ends of the request information are smaller than the preset step size, both ends of the request information are padded so that both ends of the request information reach the preset step size;

When both ends of the original version copy information are smaller than the preset step size, the two ends of the original version copy information are padded so that both ends of the original version copy information reach the preset step size;

Compare the content of the first combination request information with the content of the second combination request information to obtain a content comparison result;

When the content comparison result indicates that the content of the first combination request information is different from the content of the second combination request information, update the original version copy information based on the request information;

When the content comparison result indicates that the content of the first combination request information is the same as the content of the second combination request information, obtain the first remaining request information excluding the first combination request information in the request information, and the original version copy information excluding the second combining the second remaining request information of the request information;

Compare the content of the first remaining request information with the content of the second remaining request information, and update the original version copy information based on the comparison result.

Specifically, compare the content of the first combined request information with the content of the second combined request information to obtain a content comparison result, including:

Obtain the character value of each character in the first combination of request information;

Compare the character value of each character in the first combination request information with the character value of the corresponding character in the second combination request information;

When the character value of each character in the first combination request information is the same as the character value of the corresponding character in the second combination request information, a content comparison result indicating that the content of the first combination request information and the content of the second combination request information are the same is generated. ;

When the character value of each character in the first combination request information is different from the character value of any corresponding character in the second combination request information, a content ratio indicating that the content of the first combination request information is different from the content of the second combination request information is generated. to the results.

In some optional implementations, the request generation module 704 includes:

The first version information acquisition unit is used to splice the object name and the version identification field to obtain a version acquisition request; identify the version information corresponding to the version acquisition request in the original version set to obtain the original version information of the audit object;

The second version information acquisition unit is used to convert the version identification field into a version number; obtain the storage path corresponding to the original version information in the original version set based on the version number and object name; obtain the original version information of the audit object based on the storage path.

Further functional descriptions of the above-mentioned modules and units are the same as those in the above-mentioned corresponding embodiments, and will not be described again here.

The data processing device of the audit log in this embodiment is presented in the form of a functional unit. The unit here refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and a memory that executes one or more software or fixed programs. and/or other devices that can provide the above functions.

An embodiment of the present invention also provides a computer device having the data processing device for the audit log shown in FIG. 7 .

Please refer to Figure 8. Figure 8 is a schematic structural diagram of a computer device provided by an optional embodiment of the present invention. As shown in Figure 8, the computer device includes: one or more processors 10, a memory 20, and a device for connecting The interfaces of each component include high-speed interfaces and low-speed interfaces. Various components communicate with each other using different buses and can be installed on a common motherboard or in other ways as needed. The processor may process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of the GUI on an external input/output device, such as a display device coupled to the interface. In some alternative implementations, multiple processors and/or multiple buses may be used with multiple memories and multiple memories, if desired. Likewise, multiple computer devices may be connected, each device providing part of the necessary operations (eg, as an array of storage servers, a set of blade storage servers, or a multi-processor system). Figure 8 takes a processor 10 as an example.

The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The above-mentioned hardware chip can be an application-specific integrated circuit, a programmable logic device or a combination thereof. The above-mentioned programmable logic device may be a complex programmable logic device, a field programmable logic gate array, a general array logic or any combination thereof.

The memory 20 stores instructions that can be executed by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

The memory 20 may include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required for at least one function; the stored data area may store the use of the computer device according to the presentation of a small program landing page. The data created etc. In addition, the memory 20 may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage device. In some optional implementations, the memory 20 may optionally include memories remotely located relative to the processor 10 , and these remote memories may be connected to the computer device through a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, server clusters, mobile communication networks, and combinations thereof.

The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memories.

The computer device also includes a communication interface 30 for the computer device to communicate with other devices or communication networks.

Embodiments of the present invention also provide a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware or firmware, or can be recorded in a storage medium, or can be implemented as original storage downloaded through the network. Computer code in a remote storage medium or a non-transitory machine-readable storage medium and to be stored in a local storage medium such that the methods described herein may be stored on a computer using a general purpose computer, a special purpose processor, or programmable or special purpose hardware Such software processing on storage media. The storage medium may be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk or a solid state drive, etc.; further, the storage medium may also include a combination of the above types of memories. It can be understood that a computer, processor, microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by the computer, processor or hardware, the above implementations are implemented. The method illustrated.

Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations fall within the scope of the appended rights. within the scope of the requirements.

Claims (10)

1. A data processing method of an audit log, applied to a data storage center of a target cluster, wherein an original version set is stored in the data storage center, and the original version set includes a plurality of original version information, the method comprising:

acquiring an object change request initiated for any one of the audit objects in the target cluster and original version copy information corresponding to the original version information;

generating an audit log based on the object change request, and updating the original version copy information based on the object change request so as to update the original version copy information into target version information;

analyzing the audit log to obtain the object name of the audit object and a corresponding version identification field;

and generating a version acquisition request based on the object name and the version identification field to acquire the original version information of the audit object.

2. The method of claim 1, wherein the obtaining the object change request initiated for any one of the audit objects in the target cluster and the original version copy information corresponding to the original version information comprises:

acquiring one or more audit objects to be audited in the target cluster;

for any audit object, when an object change request is received, acquiring the latest original version information in the original version set based on the object change request;

and updating the latest original version information into an information copy to obtain the original version copy information.

3. The method of claim 2, wherein updating the original version copy information based on the object change request comprises:

acquiring request information of the object change request;

comparing the first information length of the request information with the second information length of the original version copy information to obtain a length comparison result;

and updating the original version copy information based on the request information when the comparison result characterizes that the first information length is different from the second information length, so as to update the original version copy information into the target version information.

4. A method according to claim 3, characterized in that the method further comprises:

when the comparison result represents that the first information length is the same as the second information length, intercepting first request information with preset step length from two ends of the request information respectively, and combining to obtain first combined request information;

intercepting second request information with preset step length from two ends of the original version copy information respectively, and combining to obtain second combined request information;

when the two ends of the request information are smaller than the preset step length, the two ends of the request information are subjected to bit filling so that the two ends of the request information reach the preset step length;

when the two ends of the original version copy information are smaller than the preset step length, the two ends of the original version copy information are subjected to bit filling so that the two ends of the original version copy information reach the preset step length;

comparing the content of the first combination request information with the content of the second combination request information to obtain a content comparison result;

updating the original version copy information based on the request information when the content comparison result represents that the content of the first combination request information is different from the content of the second combination request information;

When the content comparison result shows that the content of the first combined request information is the same as the content of the second combined request information, acquiring first residual request information excluding the first combined request information in the request information and second residual request information excluding the second combined request information in the original version copy information;

and comparing the content of the first residual request information with the content of the second residual request information, and updating the original version copy information based on the comparison result.

5. The method of claim 4, wherein comparing the content of the first combined request message with the content of the second combined request message to obtain a content comparison result comprises:

acquiring character values of all characters in the first combination request information;

comparing the character value of each character in the first combination request information with the character value of the corresponding character in the second combination request information;

when the character values of the characters in the first combination request information are the same as the character values of the corresponding characters in the second combination request information, generating a content comparison result representing that the content of the first combination request information is the same as the content of the second combination request information;

And when the character value of each character in the first combination request information is different from the character value of any corresponding character in the second combination request information, generating a content comparison result representing that the content of the first combination request information is different from the content of the second combination request information.

6. The method of any one of claims 1 to 5, wherein the obtaining the original version information of the audit object comprises:

splicing the object name and the version identification field to obtain the version acquisition request;

and identifying version information corresponding to the version acquisition request in the original version set to obtain the original version information of the audit object.

7. The method of claim 6, wherein the obtaining the original version information of the audit object further comprises:

converting the version identification field into a version number;

acquiring a storage path of corresponding original version information in the original version set based on the version number and the object name;

and acquiring the original version information of the audit object based on the storage path.

8. A data processing apparatus for audit logs, applied to a data storage center of a target cluster, wherein an original version set is stored in the data storage center, and the original version set includes a plurality of original version information, the apparatus comprising:

The information acquisition module is used for acquiring an object change request initiated for any one of the audit objects in the target cluster and original version copy information corresponding to the original version information;

the information updating module is used for generating an audit log based on the object change request and updating the original version copy information based on the object change request so as to update the original version copy information into target version information;

the log analysis module is used for analyzing the audit log to obtain the object name of the audit object and the corresponding version identification field;

and the request generation module is used for generating a version acquisition request based on the object name and the version identification field so as to acquire the original version information of the audit object.

9. A computer device, comprising:

a memory and a processor in communication with each other, the memory having stored therein computer instructions which, upon execution, cause the processor to perform the method of any of claims 1 to 7.

10. A computer readable storage medium having stored thereon computer instructions for causing a computer to perform the method of any one of claims 1 to 7.