Multi-system operation audit log

Patent metadata

Field	Value
Publication number	US-11354301-B2
Application number	US-201816231918-A
Country	US
Kind code	B2
Filing date	Dec 24, 2018
Priority date	Nov 13, 2017
Publication date	Jun 7, 2022
Grant date	Jun 7, 2022

Abstract

Techniques are provided for recording, in an audit log data store, log records that satisfy one or more audit log rules. Audit log rules may be associated with one or more context attributes. Specifically, based on the context attribute of a given rule, embodiments store, in the audit log data store, additional log records that are associated with the context attribute value from log records that satisfied the rule. Because a context attribute may span multiple systems that implement a multi-system operation, the information in the audit log data store may include cross-system contextual information for changes that are of interest to administrators. The audit log data store may be efficiently queried to provide information regarding multi-system operations because of the targeted nature of the audit log data gathering techniques. Automatically-generated indexes on audit log data provide additional efficiency gains for executing queries over the audit log data.

First claim

What is claimed is:

1. A computer-executed method, comprising:
causing each system, of a plurality of systems involved in executing a particular multi-system operation instance of a multi-system operation, to generate log records that reflect work done by said each system as part of executing a respective portion of a plurality of portions of the particular multi-system operation instance;
wherein the work done by each system of the plurality of systems includes storing, as part of its respective portion of the particular multi-system operation instance, a respective correlation context;
wherein the correlation context, stored by each system of the plurality of systems, (a) comprises values, of a set of context attributes, that describe a state of the particular multi-system operation instance, and (b) is associated with the log records that reflect work done by said each system as part of executing the particular multi-system operation instance;
determining that one or more log records, generated by particular one or more systems of the plurality of systems, satisfy a particular audit log rule;
wherein the particular audit log rule is associated with a particular context attribute of the set of context attributes;
in response to determining that the one or more log records satisfy the particular audit log rule:
determining a particular value, for the particular context attribute, associated with the one or more log records;
automatically storing the one or more log records into an audit log data store,
identifying one or more additional log records that are associated with the particular value for the particular context attribute, and
automatically storing the one or more additional log records in the audit log data store;

receiving, from a user, a query over the audit log data store; and
returning query results for the query to the user;
wherein the method is performed by one or more computing devices.

2. The computer-executed method of claim 1 , wherein: the one or more additional log records were generated from one or more other systems, of the plurality of systems, other than the particular one or more systems.

3. The computer-executed method of claim 2 , wherein:
the particular one or more systems comprises a particular system that maintains a database of a first type, and at least one of the one or more other systems maintains a database of a second type; and
the first type is different than the second type.

4. The computer-executed method of claim 1 , wherein:
the correlation context stored by each system of the plurality of systems includes at least a particular correlation identifier that uniquely identifies the particular multi-system operation instance; and
the particular context attribute is one or more of: a common correlation identifier, a common user identifier, a common timestamp, a timestamp within a particular range of timestamps, or a common service identifier.

5. The computer-executed method of claim 1 , further comprising:
automatically generating particular index data that associates the particular value of the particular context attribute with both of the one or more log records and the one or more additional log records; and
after receiving the query over the audit log data store, automatically generating the query results based on an index data structure that stores the particular index data.

6. The method of claim 1 , wherein:
the one or more log records are published in one or more event streams;
an auditor service detects event records from the one or more event streams; and
automatically storing the one or more log records into the audit log data store comprises:
automatically detecting one or more event records containing the one or more log records,
automatically extracting, from the one or more event records, information for the one or more log records, and
storing the one or more log records in the audit log data store based on the extracted information.

7. The method of claim 1 , wherein:
the correlation context stored by each system of the plurality of systems includes at least a particular correlation identifier that uniquely identifies the particular multi-system operation instance;
the particular context attribute is a common correlation identifier; and
the one or more log records record one or more changes that were (a) caused by the particular multi-system operation instance, and (b) made to a particular database that is maintained by a particular system of the plurality of systems;
the method further comprises:
identifying one or more associated log records, which record changes made to the particular database, and which are associated with the one or more log records,
wherein the one or more associated log records include information for a particular correlation context for the particular multi-system operation instance, that includes the particular correlation identifier, and
identifying the particular value for the particular context attribute to be the particular correlation identifier in the information for the particular correlation context.

8. The method of claim 7 wherein the one or more associated log records are associated with the one or more log records based on having a common transaction identifier with the one or more log records.

9. The method of claim 1 wherein:
the audit log data store is maintained by a database management system;
a set of rules for the audit log data store, which includes the particular audit log rule, is stored in a rules table maintained by the database management system;
the method further comprises updating the set of rules for the audit log data store by causing the database management system to update the rules table.

10. A computer-executed method, comprising:
causing each system, of a plurality of systems involved in executing a particular multi-system operation instance of a multi-system operation, to generate operation log records that reflect work done by said each system as part of executing a respective portion of a plurality of portions of the particular multi-system operation instance;
wherein the work done by each system of the plurality of systems includes storing, as part of its respective portion of the particular multi-system operation instance, a respective correlation context;
wherein the correlation context, stored by each system of the plurality of systems, comprises values, of a set of context attributes, describing a state of the particular multi-system operation instance;
wherein the correlation context, stored by each system of the plurality of systems, includes at least a particular correlation identifier that uniquely identifies the particular multi-system operation instance;
wherein the correlation context, stored by each system of the plurality of systems, is associated with the operation log records that reflect work done by said each system as part of executing the particular multi-system operation instance;
determining that a set of operation log records, all of which are associated with the particular correlation identifier, satisfies a particular audit log rule based on evidence of anomalous behavior associated with the particular multi-system operation instance;
in response to determining that the set of operation log records satisfies the particular audit log rule, automatically storing the set of operation log records into an audit log data store;
receiving, from a user, a query over the audit log data store; and
returning query results for the query to the user;
wherein the method is performed by one or more computing devices.

11. The computer-executed method of claim 10 , further comprising identifying evidenc

Assignees

• Lendingclub Corp
• Lendingclub Bank Nat Association

Inventors

• Demla Prateek
• Petrunya Igor
• Kondratenko Dmitry

Classifications

• G06F16/2365

  Ensuring data consistency and integrity · CPC title

• G06F16/2358 Primary

  Change logging, detection, and notification (replication G06F16/27) · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F16/2379 Primary

  Updates performed during online database operations; commit processing · CPC title