Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION, Руководство администратора

Страница: 404 / 564

Chapter 15. Configuring Subsystem Logs
382
when the file permissions for the log file are accidentally changed. If audit logging fails, the Certificate
System instance shuts down in the following manner.
• Servlets are disabled and will not process new requests.
• All pending and new requests are killed.
• The subsystem is shut down.
When this happens, administrators and auditors should work together with the operating system
administrator to resolve the disk space or file permission issues. When the IT problem is resolved, the
auditor should make sure that the last audit log entries are signed. If not, they should be preserved
by manual signing (
Section 15.5.4, “Signing Log Files”
), archived, and removed to prevent audit
verification failures in the future. When this is completed, the administrators can restart the Certificate
System.
15.5.4. Signing Log Files
The Certificate System can digitally sign log files before they are archived or distributed for audit
purposes. This feature allows files to be checked for tampering.
This is an alternative to the signed audit logs feature. The signed audit log feature creates audit logs
that are automatically signed; this tool manually signs archived logs. See
Section 15.5.1, “Configuring
a Signed Audit Log for a CA, OCSP, DRM, or TKS”
for details about signed audit logs.
For signing log files, use a command-line utility called the Signing Tool (
signtool
). For details about
this utility, see
http://www.mozilla.org/projects/security/pki/nss/tools/
.
The utility uses information in the certificate, key, and security module databases of the subsystem
instance.
To sign the log directories, use the following command with the appropriate information:
signtool -d secdb_dir -k cert_nickname -Z output input
•
secdb_dir
specifies the path to the directory that contains the certificate, key, and security module
databases for the CA.
•
cert_nickname
specifies the nickname of the certificate to use for signing.
•
output
specifies the name of the JAR file (a signed zip file).
•
input
specifies the path to the directory that contains the log files.
15.6. Viewing Logs
To troubleshoot the subsystem, check the error or informational messages that the server has logged.
Examining the log files can also monitor many aspects of the server's operation. Some log files can
be viewed through the Console or by opening the files directly. See
Section 15.1, “An Overview of Log
Settings”
for information on the location of logs and the log files available.
To view the contents of an active or rotated system log file:
1. Log into the Console.