Audit Trail Logging - how?

Reshef Roy (rreshef@math.tau.ac.il)
Tue, 14 Jan 1997 22:05:19 +0200 (GMT+0200)

Date: Tue, 14 Jan 1997 22:05:19 +0200 (GMT+0200)
From: Reshef Roy <rreshef@math.tau.ac.il>
To: Li Gong <gong@games.eng.sun.com>
Subject: Audit Trail Logging - how?
In-Reply-To: <199701132053.MAA17711@games.eng.sun.com>
Message-Id: <Pine.SUN.3.95.970114212836.20441B-100000@libra.math.tau.ac.il>

Dear Li,

Thank you for your reply. I am aware to the fact that specifying
_what_ should be audited is quite difficult, but another question which
bothers me no less is _how_.

Suppose the audit trail package is auditing the construction of new class
instances. A typical implementation would be as follows:

When the operator "new" (or Class::newInstance()) is called, it is checked
(using some method such as SecurityManager::isNewInstanceAudited(), for
example) if the event should be logged. If so, it is written to the
appropriate log and the new class instance is being created.

The straight-forward way to implement it requires access to the source
code of classes such as Class, SecurityManager and other classes which are
part of the Java language, and maybe also access to the code of the Java
Virtual Machine (becuase: i) I assume that an operator like "new" is
implemented by the JVM source; ii) The whole idea is to enforce the Audit
Trail policy on all applications and applets, not to depend on their good
will to comply with it ...)

Unfortunately, I do not have access to this code (I understand that the
non-commercial licence for the JDK source applies only for the
platform-dependent part of it).

My question is: is it possible to have the capability of monitoring events
such as new class instances, file access, exceptions and so on without
having access to the source code of the JVM and the language internal
classes (Object, Class, SecurityManager, File, Throwable etc.)?
If it is possible - how can I do it? If it is not - is there some way to
be granted with access to the above mentioned code (internal classes & JVM
source code)?

Thanks again,

Roy

---

+-----------------------+---------------------------------------+ | Roy Reshef | Phone: +972-3-6936869 | | 41 Einstein St., | Fax: +972-3-6936889 | | 69101 Tel-Aviv | Home Page: www.math.tau.ac.il/~rreshef| | Israel | E-mail: rreshef@math.tau.ac.il | +-----------------------+---------------------------------------+