From ONT to Cloud: The Complete Log Pipeline of Carrier Cloud Audit

Carriers deliver full network deployment: ONTs installed, circuits activated and Wi-Fi ready. Yet log auditing is never included in the standard service scope.

This is not an isolated issue. Carriers only provide broadband access and networking solutions for venue customers. Portal authentication and log retention have long been out of the delivery scope. Since the enforcement of Ministry of Public Security Order No.176, this gap has evolved from an industry practice into a serious compliance risk. Article 7 mandates strict inspections: providers must record and retain user registration data and internet access logs by law.

Cloud Audit adopts plug-in integration: no ONT replacement, no rewiring. Log collection is moved forward to the network egress, while log storage and querying are moved entirely to the cloud.
For carrier-managed venue networks, user activity logs travel from end devices to cloud reports via four key stages: collection, transmission, aggregation and retention. Each stage has distinct engineering requirements.

1. Collection Layer: Full Data Capture at the Egress

The collector is deployed at the network egress — the point with complete authentication session data, where Cloud Portal grants access permissions after identity verification.
Once authenticated, the system writes the four-tuple: account number, terminal MAC address, IP address and login time, and generates a unique Session ID. All subsequent traffic records carry this identical Session ID. The binding between user identity and online behavior is completed right at the collection point.

A core rule: minimize the number of collection points.
The top cause of broken traceability is fragmented logs scattered across APs, switches and routers, which forces administrators to match records only by timestamps. The ideal architecture uses a single egress collector to capture all network logs, with identity correlation handled in the cloud via Session ID.

2. Transmission Layer: Local Buffering & Resumable Upload

Log forwarding from egress to cloud cannot be fire-and-forget. The engineering design must handle network jitters and temporary outages:

• The collector keeps a local buffer; failed uploads enter a retransmission queue. Once connectivity recovers, logs are uploaded sequentially by serial number.
• The cloud platform verifies serial numbers and actively pulls missing records to fill data gaps.

This mechanism directly controls log integrity in the cloud, ensuring exported inspection reports can withstand line-by-line verification.

3. Aggregation Layer: NTP Time Synchronization & Field Normalization

After multi-site logs converge on the cloud, two steps are mandatory:

1. Unified NTP time synchronization: Clock drift on local devices will mess up event sequencing across venues. Misaligned timestamps make even long-term stored logs untraceable.
2. Field normalization: Logs from different batches of devices must be mapped to a unified schema before database ingestion; otherwise, endless patches will be required for report generation.

Cloud Audit enforces a fixed set of six mandatory fields: mobile number/ID number, terminal MAC, IP address, login timestamp, visited URL, uplink & downlink traffic. Capturing all required fields at the edge is far more cost-effective than field supplementation on the backend.

4. Retention & Query Layer: 180-Day Rolling Cloud Storage

Logs are kept with rolling storage for a minimum of 180 days. The retention window follows local public security requirements; longer storage periods apply if required by local regulators.
Raw detail records must be retrievable for any day within the retention period — aggregated statistics alone cannot meet traceability requirements.
Queries are identity-oriented: enter a mobile number or time range, and the system returns the user’s full online activity history without cross-system data splicing.

Two Deployment Paths

Carrier-managed Networks

ONTs lack native real-name authentication and log storage capabilities. The Cloud Portal (authentication layer) + Cloud Audit (log layer) plug-ins connect to existing ONTs. No local log server is required on-site; all reports are generated from the cloud.

Self-built Networks

AINOPOL’s Integrated Access & Security Solution combines all-optical network infrastructure, audio-video convergence engine and network security protection. The Dream Gateway performs egress collection and local log retention. The EaaS Cloud Management Platform centralizes log aggregation, time calibration and report export across multiple venues.

Acceptance Tip for Engineering Teams

Run a short network outage drill after go-live. Verify whether the cloud platform can fully recover logs generated during the outage by Session ID. A practical test is more valuable than pages of design documents.

FAQ

Q1: Where should the log collector be deployed?
A1: Deploy it at the network egress to share the same session source as authentication. A Session ID is generated upon successful login. Too many collection points split log data and break the traceability chain.

Q2: Will logs be lost during temporary outages at the egress?
A2: Properly designed systems prevent data loss. Local buffering plus a retransmission queue covers offline periods, and the cloud actively fills missing records by serial number validation.

Q3: How to verify valid 180-day cloud retention?
A3: Randomly pick a date within the retention window. Search by mobile number; full user activity history must be exported completely to prove valid retention.