Auditing individual object operations as multiple file system operations
Techniques are provided for auditing individual object operations as multiple file system operations. In an example, a client computer sends an object storage operation to a server that is configured to store data in a file system. The server receives the object storage operation, and converts it to one or more corresponding file system operations. The server opens an audit file context that identifies the object storage operation. As a file system driver reports that it has completed various file system operations corresponding to the object storage operation, the server appends an identification of the object storage operation, as determined from the audit file context, to an audit log entry for that file system operation.
1. A system, comprising:
a processor; and
a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
receiving, by a protocol stack, a first request to perform an object storage operation according to an object storage protocol that is configured to operate on data as objects;
sending, by the protocol stack to a file system driver of a file system, a second request to perform a file system open operation to open a first file, the second request identifying the object storage operation, and wherein the file system driver is configured to operate on data that is represented as one or more files in a hierarchical directory;
storing, by an audit component, a first indication of the object storage operation in an audit file context, the object storage operation being identified from the second request;
in response to determining that the file system driver has processed at least part of the object storage operation by implementing the file system open operation to open the first file, identifying, by the audit component, the object storage operation from the audit file context; and
storing, by the audit component, a second indication of the object storage operation in an audit file log for the file system open operation.
2. The system of claim 1 , wherein the operations further comprise:
converting, by the protocol stack, the object storage operation into at least a first file system operation that comprises the file system open operation and a second file system operation to open a second file.
3. The system of claim 2 , wherein the operations further comprise:
receiving, by the protocol stack, a file system handle that identifies the first file from the file system driver; and
sending, by the protocol stack, a third request to perform the second file system operation on the file system handle to the file system driver, the third request identifying the object storage operation.
4. The system of claim 3 , wherein the operations further comprise:
in response to determining that the file system driver has performed the second file system operation, identifying, by the audit component, the object storage operation from the audit file context; and
storing, by the audit component, a third indication of the object storage operation in a second audit file log for the second file system operation, the object storage operation being identified from the audit file context.
5. The system of claim 1 , wherein the second request comprises an input/output request packet, and wherein the object storage operation is identified in an extended attribute of the input/output request packet.
6. The system of claim 1 , wherein the operations further comprise:
saving the audit file context in response to the determining that the file system driver has opened the first file; and
deleting the audit file context in response to determining that the first file has been closed.
7. The system of claim 1 , wherein the determining that the file system driver has opened the first file comprises:
intercepting, by the audit component, a first message indicative of the first file being opened that is originated by the file system driver and sent to the protocol stack.
8. The system of claim 1 , wherein the operations further comprise:
in response to performing a file system close operation that corresponds to the file system open operation,
storing, by the audit component, a third indication of the file system close operation with the first indication of the object storage operation in the audit file context, and
releasing, by the audit component, the audit file context.
9. The system of claim 1 , wherein the object storage operation is a first object storage operation, wherein the file system open operation references a first file handle, wherein a group of object storage operations comprises the first object storage operation, and wherein respective object storage operations of the group of object storage operations reference respective different file handles.
10. The system of claim 1 , wherein the storing, by the audit component, of the second indication of the object storage operation in the audit file log for the file system open operation comprises:
identifying an audit log entry of the audit file log that identifies the file system open operation; and
adding the second indication of the object storage operation to the audit file log.
11. A method, comprising:
receiving, by a protocol stack of a system comprising a processor, a first request to perform an object storage operation according to an object storage protocol that is configured to operate on data as objects;
sending, by the protocol stack to a file system driver of a file system, a second request to perform a file system open operation to open a first file, the second request identifying the object storage operation, and wherein the file system driver is configured to operate on data that is represented as one or more files in a hierarchical directory;
storing, by an audit component of the system, the object storage operation in an audit file context, the object storage operation being identified from the second request; and
after the file system driver has processed at least part of the object storage operation by implementing the file system open operation to open the first file, storing, by the audit component, an indication of the object storage operation in an audit file log for the file system open operation, the object storage operation being identified from the audit file context.
12. The method of claim 11 , wherein the storing the indication of the object storage operation in the audit file log comprises:
appending, by the audit component, the indication of the object storage operation to the audit file log for the file system open operation.
13. The method of claim 11 , further comprising:
sending, by the file system driver, a file system handle to the protocol stack, the file system handle identifying the first file.
14. The method of claim 13 , wherein the object storage operation corresponds to the file system open operation and to a second file system operation to open a second file, and further comprising:
sending, by the protocol stack, a third request to perform the second file system operation to the file system driver, the third request identifying the file system handle.
15. The method of claim 14 , further comprising:
after the file system driver has performed the second file system operation, storing, by the audit component, the indication of the object storage operation in the audit file log for the second file system operation, the object storage operation being identified from the audit file context.
16. The method of claim 11 , further comprising:
in response to receiving, by the protocol stack, a third request to perform a second object storage operation that corresponds to the first file, opening a second file handle for the first file.
17. A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:
in response to receiving a first request to perform an object storage operation according to an object storage protocol that is configured to operate on data as objects, sending, by a protocol stack to a file system driver of a file system, a second request to perform a file system open operation to open a file, the second request identifying the object storage operation, and wherein the file system driver is configured to operate on data that is represented as one or more files in a hierarchical directory;
storing, by an audit component, the object storage operation in an audit file context, the object storage operation being identified from the second request; and
after the file system driver has processed at least part of the object storage operation by implementing the file system open operation to open the file, storing, by the audit component, an indication of the object storage operation in an audit file log for the file system open operation, the object storage operation being identified from the audit file context.
18. The non-transitory computer-readable medium of claim 17 , wherein the operations further comprise:
intercepting, by the audit component, the second request as the second request is sent by the protocol stack and to the file system driver.
19. The non-transitory computer-readable medium of claim 17 , wherein the object storage operation is configured to operate on object storage, and wherein the object storage is configured to manage data in the form of objects.
20. The non-transitory computer-readable medium of claim 17 , wherein a first file handle is opened in response to the file being opened, and wherein the operations further comprise:
opening a second audit file context in response to a second file handle being opened as part of carrying out a second object storage operation.