What Fields Must an Internet Access Log Contain? Item-by-Item Checklist Against Order No.176 Article 7

When venues are requested to “provide internet access logs”, network administrators sometimes export a sheet only containing IP addresses and timestamps. Does this count as valid log data?

Checked against Article 7 of Order No.176, the answer is usually no. Incomplete fields make it impossible to prove who accessed what online resources at what time.

1. What Is Inspected under Article 7

Article 7 of Order No.176 explicitly identifies user registration information and internet access log records as key inspection targets.
This covers two parts:

1. User registration / real-name identity information
2. Internet activity logs

Only when both sets of data are available can a complete online access trail be reconstructed. Missing either part breaks the evidence chain.

2. Mandatory Fields for a Valid Log

To meet inspection requirements, a qualified log entry must include the following categories of fields:

• Identity fields: Mobile number / document ID, MAC address, IP address, login time (the core identity tuple)
• Behaviour fields: Visited URL, uplink & downlink traffic, login and logout time
• Association field: Session ID, which links user identity to corresponding online activities

Without identity fields, the user cannot be identified. Without behaviour fields, their online actions cannot be tracked. Without the association field, identity and activity records cannot be matched together.

3. Two Optional Deployment Modes

Local Storage for Data Sovereignty

The AINOPOL Dream Gateway has a built-in audit module. Real-name authentication data and internet behaviour logs are stored locally. Identity and traffic records are bound by Session ID, with all required fields covered and 180-day rolling retention supported.
During audits, logs can be searched and exported directly from the gateway backend by mobile number or time range. Data stays within the venue’s internal network, ideal for projects requiring on-site data storage and no external data transmission.

Cloud-Based Audit for Simplified O&M

Real-name authentication is completed via AINOPOL Cloud Portal, where the core identity tuple is recorded. Cloud Audit binds identities and behaviours by Session ID in the cloud, capturing all required fields and retaining logs for a minimum of 180 days on a rolling basis.
Records can be retrieved by mobile number or time window during audits, with full fields and traceability guaranteed. No local log server is required at the premises; log storage and export are fully cloud-hosted.

Many venue operators mistakenly believe logs with only IP and time stamps satisfy retention obligations. They only discover broken evidence chains during on-site inspections and face rectification penalties. Whether adopting local storage or cloud audit, the core objective is to connect real-name identities and internet activities through Session ID, forming a complete, verifiable access trail.
Pre-configuring all standard fields and validating the search & export workflow in advance helps venues handle random cybersecurity inspections smoothly and avoid compliance risks under Order No.176.

FAQ

Q: What fields are mandatory for internet access logs?
A: At minimum: identity fields (mobile number / document ID, MAC, IP, login time), behaviour fields (visited URL, uplink/downlink traffic, login & logout time), and the association field (Session ID).

Q: What exactly is checked under Article 7?
A: Article 7 of Order No.176 focuses on user registration information and internet access logs, requiring both user identity and online behaviour to be traceable.

Q: Can full log fields be collected without an on-site local server?
A: Yes. Cloud Audit associates and stores all required fields by Session ID in the cloud, and no local log server is needed on-site.