# AI-Infra-Guard Logging and Auditing Capabilities: A Complete Technical Guide

> Explore AI-Infra-Guard logging and auditing. Discover its centralized framework capturing HTTP metadata and task lifecycles. Learn about SQLite persistence for compliance.

- Repository: [Tencent/AI-Infra-Guard](https://github.com/tencent/AI-Infra-Guard)
- Tags: how-to-guide
- Published: 2026-08-26

---

**AI-Infra-Guard provides a centralized, multi-layered logging and auditing framework that captures everything from HTTP request metadata to scan task lifecycles using a custom `gologger` wrapper around logrus, with full persistence to SQLite for compliance reporting.**

Tencent's AI-Infra-Guard embeds comprehensive **logging and auditing capabilities** across its entire architecture. The system implements structured logging at the utility layer, request tracking via middleware, and persistent audit trails for every scan operation. This design ensures operators can trace security events from initial API request through final vulnerability report generation.

## Core Logging Infrastructure

At the foundation of AI-Infra-Guard's observability stack sits a custom logging package that wraps industry-standard libraries with contextual enhancements.

### Structured Logging with Gologger

The `internal/gologger` package provides level-aware logging from Trace through Fatal severity. In [`internal/gologger/gologger.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/gologger/gologger.go), the implementation wraps **logrus** and injects a custom `LogFormatter` alongside a `ContextHook` that automatically appends request IDs, user agents, and other contextual fields to every entry.

This centralized logger supports field injection through `WithField()` and `WithError()` methods, allowing components to create specialized loggers without losing the global configuration. The hook architecture ensures that distributed trace contexts propagate through asynchronous scan operations.

## Request and Task Auditing Layers

AI-Infra-Guard captures audit data at the network boundary and throughout business logic execution, creating a complete chain of custody for security scans.

### HTTP Request Logging Middleware

Every incoming HTTP and WebSocket request passes through the middleware defined in [`common/middleware/request_logger.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/middleware/request_logger.go). This interceptor creates a per-request logger instance using `gologger.WithField("request_id", ...)` and records the path, method, status code, latency, and error details after response completion.

The middleware attaches the configured logger to the request context, making it available to downstream handlers without requiring global state access. This approach ensures that concurrent scan operations maintain isolated audit trails even when processing multiple requests simultaneously.

### Task Lifecycle Auditing

The [`common/websocket/task_manager.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/websocket/task_manager.go) file implements comprehensive task-level auditing by maintaining an in-memory map of active scan tasks. Each task stores a dedicated `gologger.Logger` instance that captures creation timestamps, progress updates, completion states, and error conditions.

When a task transitions to a terminal state (finished, failed, or canceled), the manager persists the complete audit record through the database layer. This captures not just the final result, but the full execution timeline including intermediate progress events emitted during the scan.

## Data Persistence and Plugin Observability

Beyond runtime logging, AI-Infra-Guard commits audit records to durable storage and extends logging capabilities to its plugin architecture.

### Database Audit Records

The [`pkg/database/task.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/pkg/database/task.go) file implements the persistence layer for audit information, storing task metadata, scan results, and vulnerability entries in a SQLite database. The `Task` model defined here includes fields for start time, end time, status transitions, and result statistics, creating an immutable compliance record.

Database operations themselves generate log entries through the same `gologger` interface, ensuring that persistence failures or corruption attempts appear in the audit trail. This dual-write pattern (logs plus database rows) provides redundancy for critical security events.

### Plugin-Level Tracing

Individual scan plugins receive dedicated logger instances via the constructor pattern shown in [`internal/mcp/scanner.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/mcp/scanner.go). The `NewScanner` function accepts a `*gologger.Logger` parameter, which plugins use to emit configuration errors, runtime diagnostics, and vulnerability discovery events.

This design isolates plugin output from core system logs while maintaining consistent formatting and severity levels. Security researchers auditing scan behavior can filter logs by plugin type without parsing unstructured text output.

## Real-Time Audit Streams via WebSocket

The WebSocket handlers in [`common/websocket/knowledge_api.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/websocket/knowledge_api.go) and related files echo significant audit events back to connected clients in real-time. Before transmitting JSON messages to the frontend, these handlers invoke `gologger` methods to record the outbound event.

This bidirectional logging ensures that both the server-side audit trail and client-side display reflect identical state transitions. Operators monitoring the web interface receive immediate visibility into task progress, while the backend maintains the definitive record for forensic analysis.

## Summary

- **Centralized logging**: The `gologger` package in [`internal/gologger/gologger.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/gologger/gologger.go) provides structured, level-aware logging with automatic context injection via `ContextHook`.
- **Request tracking**: Middleware in [`common/middleware/request_logger.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/middleware/request_logger.go) captures HTTP method, path, latency, and status for every API call.
- **Task auditing**: [`common/websocket/task_manager.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/websocket/task_manager.go) maintains per-task loggers that persist lifecycle events to the database upon completion.
- **Compliance storage**: [`pkg/database/task.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/pkg/database/task.go) stores immutable audit records in SQLite, including timestamps, status changes, and scan results.
- **Plugin observability**: Scan plugins receive isolated logger instances through [`internal/mcp/scanner.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/mcp/scanner.go), enabling granular tracing of security check execution.

## Frequently Asked Questions

### How does AI-Infra-Guard correlate logs across distributed components?

AI-Infra-Guard uses the `ContextHook` mechanism in [`internal/gologger/gologger.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/gologger/gologger.go) to inject request IDs into every log entry. When the request logger middleware creates a per-request logger instance, it attaches a unique identifier that propagates through the task manager to database operations, allowing operators to trace a single scan from HTTP request through final database persistence.

### What database does AI-Infra-Guard use for audit record storage?

The system uses SQLite for audit persistence, implemented in [`pkg/database/task.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/pkg/database/task.go). The `Task` model stores scan metadata, timestamps, status transitions, and result statistics, providing a lightweight but durable audit trail suitable for compliance reporting without requiring external database infrastructure.

### Can plugin developers access the logging framework?

Yes, plugin developers receive a `*gologger.Logger` instance through the constructor pattern demonstrated in [`internal/mcp/scanner.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/mcp/scanner.go). The `NewScanner` function accepts a logger parameter that plugins use to emit structured events, ensuring plugin-specific errors and findings appear in the centralized audit trail with appropriate severity levels and contextual fields.

### How are real-time audit events delivered to the frontend?

WebSocket handlers in files like [`common/websocket/knowledge_api.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/websocket/knowledge_api.go) emit audit events to connected clients after logging them via `gologger`. This creates a real-time audit stream where the frontend displays task progress, errors, and completion states while the backend simultaneously records these events to both log files and the SQLite database for permanent retention.