Red Hat CERTIFICATE SYSTEM 7.3 - ADMINISTRATION, Руководство администратора

Страница: 108 / 554

Chapter 3. Administrative Basics
86
•
Source
. Select the Certificate System component or service for which log messages are to
be displayed. Choosing
All
means messages logged by all components that log to this file are
displayed. For more information, see
Section 3.9.2, “Services That Are Logged”
.
•
Level
. Select a message category that represents the log level for filtering messages. For more
information on log levels, see
Section 3.9.3, “Log Levels (Message Categories)”
.
•
Filename
. Select the log file to view. Choose
Current
to view the currently active system log
file.
5. Click
Refresh
.
The table displays the system log entries. The entries are in reverse chronological order, with the
most current entry placed at the top. Use the scroll arrows on the right edge of the panel to scroll
through the log entries.
Each entry has the following information shown:
•
Source
. The component or resource that logged the message.
•
Level
. The severity of the corresponding entry; see
Table 3.9, “Log Levels and Corresponding
Log Messages”
for more information.
•
Date
. The date on which the entry was logged.
•
Time
. The time at which the entry was logged.
•
Details
. A brief description of the log.
6. To view a full entry, double-click it, or select the entry, and click
View
.
3.9.10. Signing Log Files
The Certificate System can digitally sign log files before they are archived or distributed for audit
purposes. This feature allows files to be checked for tampering.
This is an alternative to the signed audit logs feature. The signed audit log feature creates audit logs
that are automatically signed; this tool manually signs archived logs. See
Section 3.9.1.6, “Signed
Audit Log”
for details about signed audit logs.
For signing log files, use a command-line utility called the Signing Tool (
signtool
). For details about
this utility, see
http://www.mozilla.org/projects/security/pki/nss/tools/
.
The utility uses information in the certificate, key, and security module databases of the subsystem
instance.
To sign the log directories, use the following command with the appropriate information:
signtool -d secdb_dir -k cert_nickname -Z output input
•
secdb_dir
specifies the path to the directory that contains the certificate, key, and security module
databases for the CA.
•
cert_nickname
specifies the nickname of the certificate to use for signing.