The first time a complaint was processed from WiFi, a hotel that came from the legal department of the hotel group and targeted equipment suppliers. The core issue was that the Public Security Bureau came to check out, took an Internet log for some time on a given day, the hotel party found a supplier, overtled it for two days, gave the log fields incomplete, and the time stamped them were not matched with PMS records, and could not prove effective retention. This matter was later re-settled by the supplier.
What are the statutory requirements for a log to be retained?
Article 21 of the Cybersecurity Act requires network operators to take technical measures to retain web logs for a period not less than six months. Ministry of Public Security Decree No. 82 (provisions on technical measures for Internet security protection) imposes more specific requirements on ISPs: to keep user registration information, user logs, including time spent online, hours connected to the Internet, allocated IP addresses, Internet addresses or domain names accessed by users.
These requirements appear to be specific, but one key question in actual implementation is what counts."Validity"logbook? Some hotels were checked for logs, but the fields were missing, time was not allowed, storage was interrupted——The log is also considered non-compliant at the enforcement level."Who's on the net with what time?"That's the problem.
Which fields must be recorded
The most basic log fields should include: user identification (identity or authentication account number), equipment identification (MAC address), assigned IP addresses (including ports, if NAT has been performed), validation of online time, certification downtime, upstream traffic, downflow.
A more complete log should also include: authentication methods (text message, PMS connection, passwords, etc.), certification results (success/failure), client device types (optional, extrapolated by User-Agent) and session ID (used to connect multiple authentications with the same guest).
If the hotel is in a position to do DNS logs, it can also record domain names that users visit. This part is not mandatory, but some high-security locations are extra itemized.
A easily overlooked field is the NAS-Port or AP logo——Recording which AP accesss the user. This field is useful when positioning signal problems and location connections, but it is not used much in verification."Better or worse."The level.
Selection of storage methods
The log storage is organized around three categories: local storage, private cloud (self-built server), and third party SaaS.
Local storage is the simplest option, with logs stored directly on aAC or NATSHEL_AUTH_GATEWAY. The problem is that equipment has limited storage capacity and either covers old logs or stops recording by mistake after it is exceeded; the equipment failure leads to loss of logs; there is no backup off-site, and data cannot be restored in case of fire or theft.
Private cloud programs are common options for hotel groups or larger single-body hotels: they deploy log reception services on machine rooms or cloud servers, and each NATSHEL_AUTH_GATEWAY delivers logs in real time. The program is controlled and data is in its own hands, but requires a capability to maintain servers and storage.
The third-party SaaS programme is suitable for small and medium hotels: direct use of cloud log services provided by the certification system provider, automatic uploading of logs and search on demand. The advantage is zero lift dimensions, the disadvantage is that there are third parties to the data, and a supplier ' s data security qualification and contract terms need to be confirmed (especially how the data will be treated after termination).
The clock synchronisation is the foundation of the foundation.
The accuracy of the log time stamp is a fundamental problem that many people ignore. If Authentication Gateway 's system clock is half an hour off, all times in the log are wrong. When checking, the regulatory gets the log time and PMS time to stay, it does."Whether the log is true"Question.
The solution is simple: to configure NTPs and synchronize the device clock automatically with the standard clock server. But the reality is that many hotels have no default opening of the NTP, or that the network environment limits access to the NTP server, which is always moving slowly. Periodic checking the equipment clock is one that should not be omitted from the transport work.
Actual operation of log queries
Once the log is retained, it also needs to be efficient."Please provide an Internet access record of the IP address x.x.x.x.x on 1 December 2025 between 14:00 and 16:00 p.m."The results are needed in a relatively short time.
If the log system does not have a search function or is poorly retrieved, it is unrealistic to look manually at millions of original logs. It is suggested that when a log system is selected, it is explicitly required to: support retrieval by time range, IP address, MAC address, user identification; query response time is acceptable; and can export queries from standard formats (CSV or PDF).
Some suppliers’ systems, logs can be written but have no interface to access the database. This is not technically feasible, but in reality hotel operators do not usually have this capability, and when they do, a supplier does not cooperate or respond slowly, it starts with the article.
Periodic audits and tests
The log system is not installed. Hotels are advised to establish a simple, periodic self-checking mechanism: randomly extract several logs from the Internet every month to verify that the corresponding log exists in its entirety; check the total log volume quarterly to confirm that no staggered; and perform semi-annual simulation checks and complete the process"Requested for queries→Export results from system→Confirm field integrity"is the complete process.
This self-checking mechanism does not need to be complex, but it requires accountability and documentation.