Pre-WS GRAM includes mechanisms to provide access to audit and accounting information associated with jobs that Pre-WS GRAM submits to a local resource manager (LRM) such as PBS, LSF, or Condor.

	Note
	Remember, GRAM is not a local resource manager but rather a protocol engine for communicating with a range of different local resource managers using a standard message format.

In some scenarios, it is desirable to get general information about the usage of the underlying LRM, such as:

The following three use cases give a better overview of the meaning and purpose of auditing and accounting:

The audit record of a job is stored at the end of the processing cycle of a job - either when it is completely processed or failed.

While audit and accounting records may be generated and stored by different entities in different contexts, we make the following assumptions in this chapter:

The audit record of each job contains the following data:

The Pre-WS GRAM service returns a "job contact" that is used to control the job. The job contact, by default, is already in an acceptable GJID format; therefore, the Pre-WS GRAM client and service do not need to convert it in any way.

To connect the two sets of records, both audit and accounting, we require that GRAM records the JID in each audit record that it generates. It is then straightforward for an audit service to respond to requests such as "Give me the charge of the job with JID x" by:

We propose a Web Service interface for accessing audit and accounting information. OGSA-DAI is a WSRF service that can create a single virtual database from two or more remote databases. In the future, other per-job information such as job performance data could be stored using the GJID or local JID as an index, and then made available in the same virtual database.

The rest of this chapter focuses on how to configure Pre-WS GRAM to enable Audit Logging. A case study for TeraGrid can be read here, which also includes more information about how to use this data to get accounting information of a job, query the audit database for information via a Web Services interface, etc.

Audit logging in Pre-WS GRAM is realized in the following way:

Here's an example on how a crontab entry must look like in order to run the script every 15 minutes:

0,15,30,45 * * * * ${GLOBUS_LOCATION}/libexec/globus-gram-audit

The script gets the necessary parameters to connect to the database from the configuration file ${GLOBUS_LOCATION}/etc/globus-job-manager-audit.conf, which is described below.

You may notice that this method is different than that used for WS GRAM. WS GRAM writes audit records directly to the audit database. This is done because only a single account (the container account) may be given access to the DB. The container account is already trusted, so this is reasonable for WS GRAM.

In Pre-WS GRAM, the Job Manager process writes the audit records. However, this process runs under the user's account; opening up access to the audit database for each user is not acceptable.

Therefore, the Job Manager writes the audit record to a file. Then a single database upload program, running under the same WS GRAM container account (e.g. globus), can first verify that the owner of the Pre-WS GRAM audit file and the username field in the audit record match. This prevents users from interfering with other users' audit records.

Audit logging is turned off by default. To turn on Audit Logging, follow these steps:

 -audit-directory <your desired audit record directory>

rws-wsrwx

DRIVERCLASS:com.mysql.jdbc.Driver
USERNAME:john
PASSWORD:foo
URL:jdbc:mysql://myhost/auditDatabase

host:~ feller$ mysql -u root -p
Enter password: 
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 16
Server version: 5.0.37 MySQL Community Server (GPL)

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> create database auditDatabase;
Query OK, 1 row affected (0.09 sec)

mysql> GRANT ALL ON auditDatabase.* to globus@localhost identified by "foo";
Query OK, 0 rows affected (0.32 sec)

mysql> exit
Bye
host:~ feller$ mysql -u globus -p auditDatabase < ${GLOBUS_LOCATION}/share/gram-service/gram_audit_schema_mysql.sql 
Enter password: 
host:~ feller$

# Connect as postgres admin
create database auditDatabase\g
create user globus with encrypted password '<password1>'\g
\c auditDatabase
\i gram_audit_schema_postgres-8.0.sql
grant insert on gram_audit_table to globus\g
grant update on gram_audit_table to globus\g
\q

hostssl   auditDatabase  globus   <containerhostip> 255.255.255.255 md5
host      auditDatabase  globus   <containerhostip> 255.255.255.255 md5

log4j.rootCategory=ERROR, A1

# A1 is set to be a ConsoleAppender.
log4j.appender.A1=org.apache.log4j.ConsoleAppender

# A1 uses PatternLayout.
log4j.appender.A1.layout=org.apache.log4j.PatternLayout
log4j.appender.A1.layout.ConversionPattern=%d{ISO8601} %-5p %c{2} [%t,%M:%L] %m%n

# Display any warnings generated by our code
log4j.category.org.globus=WARN

# AUDIT
log4j.appender.AUDIT=org.globus.exec.utils.audit.AuditDatabaseAppender
log4j.appender.AUDIT.layout=org.apache.log4j.PatternLayout
log4j.category.org.globus.exec.utils.audit.AuditDatabaseAppender.audit=DEBUG, AUDIT
log4j.additivity.org.globus.exec.utils.audit.AuditDatabaseAppender.audit=false