You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by GitBox <gi...@apache.org> on 2019/03/22 23:00:08 UTC
[GitHub] [cloudstack] ndalezios opened a new pull request #3232: Cadf events
ndalezios opened a new pull request #3232: Cadf events
URL: https://github.com/apache/cloudstack/pull/3232
## Description
<!--- Describe your changes in detail -->
1. Implemented DMTF's CADF event model for event logging. [https://www.dmtf.org/standards/cadf](url)
2. Deleting events from CScontrol panel is now an event itself
3. Proposed a naming convention for the events in order to follow the pattern Resource.Action
No database changes were made. No functionality of any existing feature is touched. A config option would be nice to be added in the feature in order to enable or disable cadf logging.
replace.properties files where touched to set the event log filename ("event.log") and client/log4j-cloud.xml.in was configured to append logs to the correct file.
CADF was implemented as part of my Msc thesis on Cloud Forensics - Log Unification - the CADF Case
CADF model is a forensics-friendly model that stores event data without providing any information about the underlying hardware or platform. In addition to the existing models that answer 4 Ws
(Who, What, Where, When ) CADF also answers FromWhere, OnWhat, ToWhere.
Being a standard (cadf) makes building consumer and carver forensic tools easy as the developer only cares about the event model and not the platform that provided the events.
I created two top level classes (CADF which is the event record and Resource which represents the CS Resource). Resource mappings were made where necessary.
All the required data were collected from the EventVO in ActionEventUtils.java and ApiServlet.java.
The full model implementation would require to touch 352 events (if I counted the correctly)
<!-- For new features, provide link to FS, dev ML discussion etc. -->
<!-- In case of bug fix, the expected and actual behaviours, steps to reproduce. -->
<!-- When "Fixes: #<id>" is specified, the issue/PR will automatically be closed when this PR gets merged -->
<!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" -->
<!-- Fixes: # -->
## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
## Screenshots (if appropriate):
## How Has This Been Tested?
<!-- Please describe in detail how you tested your changes. -->
<!-- Include details of your testing environment, and the tests you ran to -->
<!-- see how your change affects other areas of the code, etc. -->
All the changes made do not affect CloudStack's functionality. All the existing tests were successfully passed.
<!-- Please read the [CONTRIBUTING](https://github.com/apache/cloudstack/blob/master/CONTRIBUTING.md) document -->
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
With regards,
Apache Git Services