Skip to main content

Log Management Architecture

Cloudaware Log Management (Conflux) uses Cloudaware CMDB inventory to identify log-producing resources, ingest and enrich their events, and make log data available for search, dashboards, alerts, and downstream analytics.

At a high level, the architecture consists of:

  • Log sources – cloud services (for example, AWS CloudTrail and VPC Flow Logs, Azure network logs, Google Cloud audit logs), operating systems (Metricbeat, Filebeat, Winlogbeat), applications, and network/security appliances.
  • Discovery & inventory (CMDB) – Cloudaware CMDB continuously discovers resources and their relationships, and tracks which objects should produce logs.
  • Collection & transport – cloud‑native logging services and syslog forwarders that send logs into Conflux.
  • Conflux processing layer – pipelines that normalize, enrich, index, and route log events, built on open standards (Lucene/Elasticsearch‑style query semantics).
  • Storage & retention – hot storage for recent data and archive tiers for long‑term retention (with typical defaults of two months plus current month in hot, and optional multi‑year archive).
  • Consumers – search and dashboards, anomaly detection, other Cloudaware modules, and external SIEM/SOAR and analytics tools.

Discovery vs. Push Pipelines​

Traditional log tools rely on manually configured “push” pipelines from each service or component. In Cloudaware Log Management:

  • Cloudaware CMDB discovery detects new buckets, databases, load balancers, accounts, and other resources across AWS, Azure, and Google Cloud.
  • Conflux uses this inventory to determine which logs should be collected for each resource type.
  • Where possible, tags and relationships from CMDB are used to locate and classify log destinations.

This model reduces the risk of missing log sources and minimizes per‑resource manual setup.

Data Flow​

At a high level:

  1. Conflux discovers and ingests log data from ingestion endpoints, such as S3 buckets or CloudWatch groups.
  2. Conflux normalizes and enriches events with CMDB metadata and security context.
  3. Events are indexed for search, dashboards, anomaly detection, and findings in other modules.
  4. Older data is archived according to your retention policy while remaining accessible for investigations and audits.

Security and Isolation​

Conflux is operated as a multi‑tenant, logically isolated service:

  • Log data is encrypted in transit (TLS/SSL) and at rest.
  • Each customer’s environment is logically segmented, and access is governed by Cloudaware RBAC and SSO integrations (SAML and other supported identity providers).
  • Operational access follows least‑privilege principles and is consistent with Cloudaware’s broader security program.