This problem often arises when hotels are making WiFi certifications. The authentication system itself records the certification log, and there is no need to deploy a single log server. What is the division of labour between these two things?
First, it is concluded that the certification log and the web-based log of conduct are two different data types, both of which are required for hotels with compliance requirements and all of which are not met by the logs in the accreditation system.
What does the authentication system say?
The certification system logs mainly record authentication events: when this mobile phone number has been certified, which IP, which SSID is linked, whether the authentication has succeeded or failed and when the account number expires.
These are authentication records. The answer to the question is:"Who's on the net?"、"When did you get it?"、"What identity?"。
What does the log server write?
The log server collects the Internet Behaviour Log, which is recorded through authentication. After certification, the device visits what addresses, how much traffic it generates, and what time period it has visited.
Public security compliance requires logs to be such data, not just certified records."Who certified it?"This one.
The division of labour between the two
Simply put: the certification system is responsible"Who can get online?";Log server responsible"What did you do when you got on the net?"。
Only the authentication system, you know a cell phone number is connected to the Internet at some point in time, but you can't answer it."Which sites have this device visited?". Only this latter half of the data can be used to trace behaviour in the event of a security incident.
From a compliance perspective, the IMS needs complete Internet behavioural records and if only certification logs do not have a behaviour log, they are not compliant during inspections.
What difference does it make between the audit gateway and the log server in light-quantization programmes?
For small hotels (within 50 rooms), a log server will not normally be deployed separately, but rather replaced by a lightly quantified audit gateway that would concentrate the authentication and log functions on one device.
The audit gateway works by connecting the mirror portal of the main switchboard, pulling down the traffic and generating logs and reporting to the web-based system. This approach does not require a change in the flow course of existing networks, with little impact on already existing networks, but the depth and data integrity of collection is less than that of specialized log servers.
For medium-sized hotels with more than 100 rooms, it is recommended that the certification system and log server be deployed separately because logs cannot stop together when the authentication system fails. If two functions are concentrated on one device, the equipment failure affects both authentication and logs, problems at the accreditation level prevent customers from accessing the network, problems at the log level cause gaps in compliance and two risks to be added together. After separate deployment, there are problems with the certification system, which still captures the log servers; and problems with the log server and the authentication process are not affected.
How long does the logs last? Where do they exist?
The regulations require no less than six months.
The benefits of local storage are that data are more manageable than the hotel in-house network, and that they are responsive. The worst is that there is a need to purchase and maintain stored hardware, capacity planning is done well ahead of time, and there are problems with log coverage when there is insufficient capacity.
Cloud storage does not require local hardware, capacity elasticity, and costs are measured in real terms. The bad news is that log transfers depend on networks, which may not be uploaded in time by logs generated during the breakup if the network is broken.
The chain hotel usually stores in cloud-based concentrations, all the door office logs are consolidated to cloud-side and can be searched by headquarters in a uniform manner, without requiring each door shop to maintain local hardware, and the cost of carrying the service is significantly lower than that for decentralized storage.
Who's gonna guarantee the integrity of the log?
One case is common: the certification system runs and the log server runs, but the log server has a full disk that is quietly written, new logs are not accessible and nobody knows. In this case, the hotel thinks the log is still in writing, but it's been cut off for some time until there is a real need to retweet the log.
Log server needs to configure storage alarms: A warning is sent to the administrator when capacity exceeds a threshold (e.g. 80%) and time is set for extended or cleaned-up of old data before log cover. This warning mechanism is not optional, but necessary.
In addition to capacity, the log writing status needs to be confirmed regularly. It is recommended that a random check of a log for a given time on a given day should be made every month; it is recommended that the logs be taken at random and the records maintained in consecutive and complete fields. If a period of log space is found, check whether the equipment is faulty, network interruption or configuration problem, fix it as soon as possible or file a description.
How to connect the cloud logs and the webmaster.
The log is a separate and independent matter from the logs.
The interfaces reported by the network monitor vary slightly from place to place, but are largely standardized. A certification system or log server needs to support docking of local web monitoring systems and periodic or real-time transmission of data.
In some areas, the network monitoring system requires suppliers to complete pre-accreditation and access only through certified products.