Logging in the Age of Web Services

Here is the paper I co-wrote with Anton Chuvakin for IEEE Security & Privacy Journal. Among other things we look at the impact of the eventually consistent model's impact on our ability to record and review audit log events. We also use some of Anton's work on event logs and apply them to how to think about security events in Web services. Hopefully there are some ideas that you can apply to building an audit log system for your Web services.

It was a lot of fun to work with someone with thinks as strategically and futuristically as Anton.

Comments

[Dave]

One aspect I dislike about the http level logs is that they are hard to tie to any data you audit/log for the transaction that follows. The application has no way to put an identifier into the web log (or get one out) to tie the weblog entry to other logs.

[web designer]

Thanks u r information