Full List of Internet Access Log Fields: Missing Any Field Breaks Traceability

When discussing log retention, most people focus only on retention duration, while overlooking a more fundamental question: what exact fields are saved in each log entry. No matter how long logs are stored, missing even one field will render the record untraceable.

Article 7 of Ministry of Public Security Order No.176 clearly mandates two parallel requirements: recording and retaining user registration data AND internet access logs. Recording and retention are equally important.

1. Distinguish Two Types of Logs: Authentication Records vs. Access Behavior Logs

Many venue operators only implement half of the logging requirement.

• Authentication records answer: Who completed real-name verification?
• Access behavior logs answer: What websites did this user visit during the online session?

Inspectors require full correlation between the two datasets. Authentication records alone cannot reconstruct browsing activity; raw access logs cannot be tied to a specific person.

AINOPOL Cloud Audit links authentication records with traffic logs on the cloud, binding both records to the same unique Session ID.

2. Six Mandatory Fields with Clear Purposes

Cloud Audit captures six core log fields:
Mobile number / ID number, terminal MAC address, terminal IP address, login timestamp, accessed URL, uplink & downlink traffic volume.

Field breakdown:

1. Mobile number / ID number: Binds traffic to a natural person; this is the user identifier in the 4-tuple.
2. Terminal MAC address: Differentiates multiple devices under one account and detects terminal changes.
3. Terminal IP address: Pinpoints the network location, combined with the login time to define the IP occupancy window.
4. Login timestamp: The baseline for all time-range queries; also marks the start of the log retention period.
5. Accessed URL: The core evidence to reconstruct browsing history.
6. Uplink & downlink traffic: Verifies whether the access actually occurred and flags abnormal traffic volume.

URL and traffic statistics are the most frequently cut fields to save storage space. Removing them leaves only login records. You can prove the user authenticated, but cannot prove what online activity took place.

3. Top Three Missing Fields & Root Causes

Field incompleteness rarely triggers system errors, so gaps only surface during on-site inspection. The three most common omissions:

1. Missing ID numbers: Only mobile numbers are collected. Foreign and HK/Mac/TW visitors using document authentication will have incomplete 4-tuple data.
2. Missing MAC addresses: Collection fails after device replacement or system upgrades, mixing logs from multiple terminals under the same account.
3. Truncated URL entries: Only the domain name is saved without the full path, making it impossible to identify the exact web page visited.

4. Two Practical Tests to Verify Field Completeness

Do not wait until official inspection to validate logs.

1. Random traceback test: Pick a mobile number at random, export the full access history within a set time window, and verify every required field is populated.
2. Null-value statistics: Calculate the blank rate for each field across all logs. Abnormally high empty values indicate collection failures.

Add these two test items to the acceptance checklist, instead of simply signing off on “log retention function normal”.

5. Collection Boundaries Differ by Deployment Scenario

Carrier-managed Networks

Log collection and storage are handled by Cloud Audit plug-ins. No local log server is deployed on-site.
Clear accountability: the plug-in is responsible for field collection; the cloud takes care of data aggregation and correlation. Confirm no fields are truncated during data transmission.

Self-built Networks

Field collection and local log storage run on AINOPOL Dream Gateways under the Integrated Access & Security Solution.
Both scenarios share the same field checklist for acceptance; the only difference is where the logging capability is hosted.

FAQ

Q1: What mandatory fields must be included in internet access logs?
A1: Six core fields: user ID (mobile number or ID number), terminal MAC, terminal IP, login time, accessed URL, uplink & downlink traffic. All logs must be correlated with authentication records via Session ID.

Q2: Is it acceptable to retain only authentication records without access behavior logs?
A2: No. Article 7 of Order No.176 requires both user registration records AND internet access logs. Without behavior logs, you cannot reconstruct online activity or support law enforcement traceability.

Q3: Can we cut URL and traffic fields to reduce storage consumption?
A3: Not recommended. Removing these fields leaves only login records. You can prove authentication happened, but cannot provide evidence of actual internet behavior.