Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Administration Manual

Page: 98 / 554

Chapter 3. Administrative Basics
76
•
Section 3.9.11, “Registering a Log Module”
•
Section 3.9.12, “Deleting a Log Module”
3.9.1. About Logs
The Certificate System subsystems create log files that record events related to activities, such as
administration, communications using any of the protocols the server supports, and various other
processes employed by the subsystems. While a subsystem instance is running, it keeps a log of
information and error messages on all the components it manages. Additionally, the Apache and
Tomcat web servers generate error and access logs.
Log plug-in modules are listeners which are implemented as Java
™
classes and are registered in the
configuration framework.
Each subsystem instance maintains its own log files.
All the log files and rotated log files, except for audit logs, are located in the
/var/lib/
instance_id
/
logs
directory.
Audit logs, signed and regular, are located in the
/var/lib/
instance_id
/logs/signedAudit
directory. The default location for logs can be changed by modifying the configuration.
3.9.1.1. System Log
This log,
system
, records information about requests to the server (all HTTP and HTTPS requests)
and the responses from the server. Information recorded in this log includes the IP address of the
client machine that accessed the server; operations performed, such as search, add, and edit; and the
result of the access, such as the number of entries returned. This log is on by default.
3.9.1.2. Transactions Log
This log,
transactions
, records messages specific to the certificate service, such as certificate
requests, revocation requests, and CRL publication, and can detect any unauthorized access or
activity. This log is on by default.
3.9.1.3. Debug Logs
Debug logs for each subsystem record much more detailed information than system, transaction,
and access logs. Debug logs contain very specific information for every operation performed by the
subsystem, including plug-ins and servlets which are run, connection information, and server request
and response messages.
The general types of services which are recorded to the debug log are briefly discussed in
Section 3.9.2, “Services That Are Logged”
. These services include authorization requests, processing
certificate requests, certificate status checks, and archiving and recovering keys, and access to web
services.
For example, the CA contains certificate request information:
[06/Jun/2008:14:59:38][http-9443-Processor24]: ProfileSubmitServlet: key=
$request.profileapprovedby$ value=admin
[06/Jun/2008:14:59:38][http-9443-Processor24]: ProfileSubmitServlet: key=$request.cert_request
$
value=MIIBozCCAZ8wggEFAgQqTfoHMIHHgAECpQ4wDDEKMAgGA1UEAxMBeKaBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA63rhLAVqvVrmdjGgcLTWMb5Czx3DdHLrGO4MS8wfl8EP1bFhKDmxpXYOlsCTznAXby4iinwutOcBXcp2xICrNHwoVZPR2A4ZifIV
+vj2qrohbTrIWZAnzAW8scKynfMmeRuSPtoBPT1M58SWjB05pTqpuB8Bcc8tEUUCAwEAAakQMA4GA1UdDwEB/