AI-Infra-Guard Logging and Auditing Capabilities: A Complete Technical Guide

AI-Infra-Guard provides a centralized, multi-layered logging and auditing framework that captures everything from HTTP request metadata to scan task lifecycles using a custom gologger wrapper around logrus, with full persistence to SQLite for compliance reporting.

Tencent's AI-Infra-Guard embeds comprehensive logging and auditing capabilities across its entire architecture. The system implements structured logging at the utility layer, request tracking via middleware, and persistent audit trails for every scan operation. This design ensures operators can trace security events from initial API request through final vulnerability report generation.

Core Logging Infrastructure

At the foundation of AI-Infra-Guard's observability stack sits a custom logging package that wraps industry-standard libraries with contextual enhancements.

Structured Logging with Gologger

The internal/gologger package provides level-aware logging from Trace through Fatal severity. In internal/gologger/gologger.go, the implementation wraps logrus and injects a custom LogFormatter alongside a ContextHook that automatically appends request IDs, user agents, and other contextual fields to every entry.

This centralized logger supports field injection through WithField() and WithError() methods, allowing components to create specialized loggers without losing the global configuration. The hook architecture ensures that distributed trace contexts propagate through asynchronous scan operations.

Request and Task Auditing Layers

AI-Infra-Guard captures audit data at the network boundary and throughout business logic execution, creating a complete chain of custody for security scans.

HTTP Request Logging Middleware

Every incoming HTTP and WebSocket request passes through the middleware defined in common/middleware/request_logger.go. This interceptor creates a per-request logger instance using gologger.WithField("request_id", ...) and records the path, method, status code, latency, and error details after response completion.

The middleware attaches the configured logger to the request context, making it available to downstream handlers without requiring global state access. This approach ensures that concurrent scan operations maintain isolated audit trails even when processing multiple requests simultaneously.

Task Lifecycle Auditing

The common/websocket/task_manager.go file implements comprehensive task-level auditing by maintaining an in-memory map of active scan tasks. Each task stores a dedicated gologger.Logger instance that captures creation timestamps, progress updates, completion states, and error conditions.

When a task transitions to a terminal state (finished, failed, or canceled), the manager persists the complete audit record through the database layer. This captures not just the final result, but the full execution timeline including intermediate progress events emitted during the scan.

Data Persistence and Plugin Observability

Beyond runtime logging, AI-Infra-Guard commits audit records to durable storage and extends logging capabilities to its plugin architecture.

Database Audit Records

The pkg/database/task.go file implements the persistence layer for audit information, storing task metadata, scan results, and vulnerability entries in a SQLite database. The Task model defined here includes fields for start time, end time, status transitions, and result statistics, creating an immutable compliance record.

Database operations themselves generate log entries through the same gologger interface, ensuring that persistence failures or corruption attempts appear in the audit trail. This dual-write pattern (logs plus database rows) provides redundancy for critical security events.

Plugin-Level Tracing

Individual scan plugins receive dedicated logger instances via the constructor pattern shown in internal/mcp/scanner.go. The NewScanner function accepts a *gologger.Logger parameter, which plugins use to emit configuration errors, runtime diagnostics, and vulnerability discovery events.

This design isolates plugin output from core system logs while maintaining consistent formatting and severity levels. Security researchers auditing scan behavior can filter logs by plugin type without parsing unstructured text output.

Real-Time Audit Streams via WebSocket

The WebSocket handlers in common/websocket/knowledge_api.go and related files echo significant audit events back to connected clients in real-time. Before transmitting JSON messages to the frontend, these handlers invoke gologger methods to record the outbound event.

This bidirectional logging ensures that both the server-side audit trail and client-side display reflect identical state transitions. Operators monitoring the web interface receive immediate visibility into task progress, while the backend maintains the definitive record for forensic analysis.

Summary

• Centralized logging: The gologger package in internal/gologger/gologger.go provides structured, level-aware logging with automatic context injection via ContextHook.
• Request tracking: Middleware in common/middleware/request_logger.go captures HTTP method, path, latency, and status for every API call.
• Task auditing: common/websocket/task_manager.go maintains per-task loggers that persist lifecycle events to the database upon completion.
• Compliance storage: pkg/database/task.go stores immutable audit records in SQLite, including timestamps, status changes, and scan results.
• Plugin observability: Scan plugins receive isolated logger instances through internal/mcp/scanner.go, enabling granular tracing of security check execution.

Frequently Asked Questions

How does AI-Infra-Guard correlate logs across distributed components?

AI-Infra-Guard uses the ContextHook mechanism in internal/gologger/gologger.go to inject request IDs into every log entry. When the request logger middleware creates a per-request logger instance, it attaches a unique identifier that propagates through the task manager to database operations, allowing operators to trace a single scan from HTTP request through final database persistence.

What database does AI-Infra-Guard use for audit record storage?

The system uses SQLite for audit persistence, implemented in pkg/database/task.go. The Task model stores scan metadata, timestamps, status transitions, and result statistics, providing a lightweight but durable audit trail suitable for compliance reporting without requiring external database infrastructure.

Can plugin developers access the logging framework?

Yes, plugin developers receive a *gologger.Logger instance through the constructor pattern demonstrated in internal/mcp/scanner.go. The NewScanner function accepts a logger parameter that plugins use to emit structured events, ensuring plugin-specific errors and findings appear in the centralized audit trail with appropriate severity levels and contextual fields.

How are real-time audit events delivered to the frontend?

WebSocket handlers in files like common/websocket/knowledge_api.go emit audit events to connected clients after logging them via gologger. This creates a real-time audit stream where the frontend displays task progress, errors, and completion states while the backend simultaneously records these events to both log files and the SQLite database for permanent retention.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}