Method for dynamic adjustment of a level of verbosity of a component of a communications network
A method for dynamic management of a first level of verbosity of a component defined in a data network, the data network having a control center, each component allowing the execution of tasks and including a security management configuration associating a status message, forming a log, with the execution of a task of the component, each log associated with a task indicating an event and having a local level, the control center allowing the collection of a set of logs to supervise the network, the method including: detecting a stimulus by a control center; determining a component associated with the stimulus detected by the control center; modifying the first level of verbosity of the component to a second level of verbosity during a first given period, the modification being launched by generating a supervision command by the control center, the second level of verbosity being defined according to the stimulus.
1. A method for dynamic management of at least a first verbosity level of at least one component defined in a data network, wherein said data network has a control centre, and wherein each component allows execution of a set of tasks, and has a security management configuration associating a status message forming a log, with execution of a task of said component, wherein each log associated with a task indicates at least one event, and has a local level, wherein the control centre collects a set of logs for supervision of said network, said method comprising:
detecting a stimulus by a control centre;
determining at least one component associated with the stimulus detected by the control centre; and
performing a first change of the first verbosity level of said component to a second verbosity level during a first given period, wherein said first change is effected by the control centre generating a supervision command, and wherein the second verbosity level is defined according to the detected stimulus.
2. The method for dynamic management of at least a first supervision level according to claim 1 , wherein after the first period has elapsed the method includes:
performing a second change of the second verbosity level of the first component, to return to the first verbosity level.
3. The method for dynamic management of at least a first verbosity level according to claim 1 , wherein the control centre includes a memory in which the following are stored:
a set of components in the network, and for each component a first premier verbosity level associated with it;
a set of investigation scenarios including predefined stimuli, wherein each predefined stimulus is associated with a recommended verbosity level.
4. The method for dynamic management of at least a first verbosity level according to claim 3 , wherein the value of the second verbosity level is generated according to:
an investigation scenario identified according to a determined stimulus, wherein a determined stimulus includes at least one event identified by a received log;
a performance value of a component associated with a log used in determining the stimulus.
5. The method for dynamic management of at least a first verbosity level according to claim 3 , wherein the stimulus is the result of:
at least one operation to correlate a set of events occurring in a given time window, reported by generating a set of logs of at least one component;
a comparison of the result of the operation to correlate collected logs with all the investigation scenarios stored in the control centre.
6. The method for dynamic management of at least a first verbosity level according to claim 3 , wherein an investigation scenario and a correlation operation leading to the determination of a stimulus take the following into account:
a plurality of events identified by logs occurring over a given period;
one or a plurality of component(s) associated with at least one event;
an identification of at least one device.
7. The method for dynamic management of at least a first verbosity level according to claim 1 , wherein at least one agent storing a set of components is configured to collect the logs generated from a plurality of components, wherein the agent transmits the collected logs to the control centre.
8. The method for dynamic management of at least a first verbosity level according to claim 1 , wherein a log includes at least one of the following elements:
a date when an event relating to the executed task occurred;
an identifier of at least one user;
an identifier of at least one component;
a category or criticality.
9. The method for dynamic management of at least a first verbosity level according to claim 1 , wherein a log is sent to the control centre by a task when its local level is higher than the component's verbosity level.
10. The method for dynamic management of at least a first verbosity level according to claim 9 , wherein each generated log is stored in a local file of the component or transmitted to an agent or transmitted to the network's control centre.
11. The method for dynamic management of at least a first verbosity level according to claim 1 , wherein the second verbosity level of the component is between the first verbosity level of the component and the maximum possible verbosity level of a component, wherein the second verbosity level depends on the determined stimulus.
12. The method for dynamic management of at least a first verbosity level according to claim 1 , wherein a component is an application component from the following list:
a driver;
a local agent of a computer hardware device;
a database;
a business application;
an operating system;
a network application;
a firmware module;
an anti-virus module;
a firewall;
an agent of a hardware component.
13. The method for dynamic management of at least a first verbosity level according to claim 1 , wherein an event which may occur and generate a log is in the following list:
a command given by a function of a given component;
generation of a result of a function executed following a command;
access to, opening, closure or modification of a given file or folder;
a determined number of simultaneous connections to a component;
a given query with a given IP address;
access to a given interface of the component;
a reboot of the component;
disconnection of the component.
14. A control centre for dynamic management of at least one verbosity level of at least one component of a data network, the control center comprising:
a network interface to log into a data network and to collect data transmitted by at least one component in the network;
a memory allowing storage of:
a set of stored components in the data network, wherein each component enables execution of a set of tasks, wherein each task may generate a log in the network, wherein each log corresponds to a given event;
predefined stimuli, wherein each stimulus corresponds to a least one event, or to the result of correlations of events occurring within a time window;
investigation scenarios corresponding to a set of necessary data to be collected from at least one component when a stimulus is detected, wherein the collection of a set of necessary data from at least one component implies that a verbosity level of said at least one component is configured;
a computer enabling operations to be made on data from logs transmitted by a plurality of components in a data network, including:
at least one operation to correlate the events included in the logs generated by at least one component in a given time window, in order to deduce at least one stimulus from them;
at least one operation to compare at least one deduced stimulus with a predefined stimulus;
at least one deduction of an instruction to be sent to a component intended to modify its verbosity level in accordance with the result of the comparison and of the investigation scenario associated with the predefined stimulus.