Sun Java System Access Manager 7.1 Technical Overview

Log Files

The following sections contain information about Access Manager log files:

Log File Formats

Access Manager can record events in either of the following formats:

Flat File Format

The default flat file format is the W3C Extended Log Format (ELF). Access Manager uses this format to record the default fields in each log record. See Recorded Events for a list of default fields and their descriptions. The following example illustrates an authentication log record formatted for a flat file. The fields are in this order: Time, Data, ModuleName, MessageID, Domain, ContextID, LogLevel, LoginID, IPAddr, LoggedBy, and HostName.

Example 6–1 Flat File Record From `amAuthentication.access`

"2005-08-01 16:20:28"   "Login Success" LDAP    AUTHENTICATION-100 
   dc=example,dc=com       e7aac4e717dda1bd01      INFO 
uid=amAdmin,ou=People,dc=example,dc=com 192.18.187.152 
"cn=exampleuser,ou=Example Users,dc=example,dc=com" exampleHost

Relational Database Format

When Access Manager uses a relational database to log messages, the messages are stored in a database table. Access Manager uses Java Database Connectivity (JDBC) to access the database table. JDBC provides connectivity to a wide range of SQL databases. JDBC also provides access to other tabular data sources such as spreadsheets or flat files. Oracle® and MySQL databases are currently supported.

For log records generated by Access Manager, the Data and MessageID fields are used slightly differently than in previous versions of Access Manager. Starting with this version of Access Manager, the MessageID field is introduced as a template for types of log messages. For example, in previous versions, Access Manager would generate the following message in the Data field:

Data: "Created group
cn=agroupSubscription1,ou=Groups,dc=iplanet,dc=com"

In this version of Access Manager, two log records are recorded for the one event:

Data:	 agroupSubscription1|group|/
MessageID:	CONSOLE-1

and

Data:	agroupSubscription1|group|/
MessageID:	CONSOLE-2

These log records reflect the use of identities and realms. In this example, CONSOLE-1 indicates an attempt to create an identity object, and CONSOLE-2 indicates the attempt to create an identity object was successful. The root organization notation (dc=iplanet,dc=com) is replaced with a forward slash (/). The variable parts of the messages (agroupSubscription1, group, and /) are separated by a pipe character (|), and continue to go into the Data field of each log record. The MessagID string is not internationalized in order to facilitate machine-readable analysis of the log records in any locale.

The following table summarizes the schema for a relational database.

Table 6–2 Relational Database Log Format


Column Name	Data Type	Description
TIME	VARCHAR(30)	Date of the log in the format `YYYY-MM-DD` `HH:MM:SS`.
DATA	VARCHAR(1024)	The variable data part of the log record pertaining to the MESSAGE ID. For MySQL, the Data Type is VARCHAR(255).
MODULENAME	VARCHAR(255)	Name of the Access Manager component invoking the log record.
DOMAIN	VARCHAR(255)	Access Manager domain of the user.
LOGLEVEL	VARCHAR(255)	JDK 1.4 log level of the log record.
LOGINID	VARCHAR(255)	Login ID of the user who performed the logged operation.
IPADDR	VARCHAR(255)	IP Address of the machine from which the logged operation was performed.
LOGGEDBY	VARCHAR(255)	Login ID of the user who writes the log record.
HOSTNAME	VARCHAR(255)	Host name of machine from which the logged operation was performed.
MESSAGE ID	VARCHAR(255)	Non-internationalized message identifier for this log record's message.
CONTEXT ID	VARCHAR(255)	Identifier associated with a particular login session.

Error and Access Logs

There are two types of Access Manager log files:

Access log files
Error log files

Access log files record general auditing information concerning the Access Manager deployment. An access log may contain a single record for an event such as a successful authentication, or multiple records for the same event. For example, when an administrator uses the console to change an attribute value, the Logging Service logs the attempt to change in one record but, the Logging Service also logs the results of the execution of the change in a second record. Error log files record errors that occur within the application. While an operation error is recorded in the error log, the operation attempt is recorded in the access log file.

Flat log files are appended with the .error or .access extension. Database column names end with _ERROR or _ACCESS. For example, a flat file logging console events is named amConsole.access while a database column logging the same events is named AMCONSOLE_ACCESS or amConsole_access.

Note –

The period (.) separator in a log filename is converted to an underscore (_) in database formats. Also in databases, table names may be converted to all upper case. For example, amConsole.access may be converted to AMCONSOLE_ACCESS, or it may be converted to amConsole_access.