Chapter 26 Managing Logs

Each instance of Netscape Certificate Management System (CMS) maintains its own system, error, and audit log files. These files record events related to various CMS activities. By configuring logs, you can customize the contents in the log files.

• Management of Logs
• Configuring Logs
• Monitoring Logs
• Signing Log Files

• By making changes to logging-specific configuration parameters from the CMS window and monitoring the resulting messages in the CMS window. See "Log Management From the CMS Window".
• By editing the configuration parameters in the configuration file. See "Log Parameters in the Configuration File".

The CMS window supports the configuration and monitoring of various CMS logs. In this window, you will find the Logs object in two places--in the navigation tree of the Configuration tab and in the navigation tree of the Status tab (see Figure 26.1).

The sample configuration file on page 102 illustrates how information specific to logs appears in the configuration file, CMS.cfg. If you intend to change the configuration by editing the configuration file, be sure to follow the instructions provided in "Changing the Configuration by Editing the Configuration File".

• Configuring System Logs
• Configuring Error Logs
• Configuring Audit Logs

To configure the system log for a CMS instance:

1. Log in to the CMS window (see "Logging In to the CMS Window").
2. In the navigation tree, select Logs.

The System tab appears in the right pane. It shows the current configuration for the system log.



3. Check the "Enable logging" box if you want the server to log system-level messages to the appropriate CMS log file (see "Log File Locations"). All the associated fields become available for you to enter information. Leave the box unchecked if you do not want the server to log messages of this type.
4. In the "Log options" section, specify information as appropriate:

Rotation frequency. From the drop-down list, select the interval at which the server should rotate the active system log file. The available choices are Hourly, Daily, Weekly, Monthly, and Yearly. The default rotation interval is Monthly. For more information, see "Rotation of Log Files".

Maximum size. Type the file size in kilobytes (KB) for the system log. The default file size is 100 KB. For more information, see "Rotation of Log Files".

Buffer size. Type the buffer size in kilobytes (KB) for the system log. The default size for the buffer is 512 KB. For more information, see "Buffered Versus Unbuffered Logging".

Log level. From the drop-down list, select a log level. The choices are Debug, Info, Warning, Failure, Misconfiguration, Catastrophe, and Security. The default selection is Failure. For more information, see "Log Levels (Message Categories)".

5. This step is applicable to Windows NT system only.

On a Windows NT system, check the "NT Event logging" box if you want the server to log system-level messages to the Event Log maintained by the system. All the associated fields become available for you to enter information. Leave the box unchecked if you do not want the server to log messages of this type to the Event Log.

Event source. Specifies the CMS instance ID for which the system messages are to be logged. For example, the instance ID could be
cert-test CA.

Log level. From the drop-down list, select a log level. The choices are Debug, Info, Warning, Failure, Misconfiguration, Catastrophe, and Security. The default selection is Warning. For more information, see "Log Levels (Message Categories)".

6. To save your changes, click Save.

The CMS configuration is modified. If the changes you made require you to restart the server, you will be prompted accordingly. In that case, restart the server.

To configure the error log for a CMS instance:

1. Log in to the CMS window (see "Logging In to the CMS Window").
2. In the navigation tree, select Logs, and then in the right pane, select the Error tab.

   

3. If you want the server to log error messages, check the "Enable logging" box. All the associated fields become available for you to enter information. Leave the box unchecked if you do not want the server to log messages of this type.
4. In the "Log options" section, specify information as appropriate:

Rotation frequency. From the drop-down list, select the interval at which the server should rotate the active error log file. The available choices are Hourly, Daily, Weekly, Monthly, and Yearly. The default selection is Monthly. For more information, see "Rotation of Log Files".

Maximum size. Type the file size in kilobytes (KB) for the error log. The default file size is 100 KB. For more information, see "Rotation of Log Files".

Buffer size. Type the buffer size in kilobytes (KB) for the error log. The default size for the buffer is 512 KB. For more information, see "Buffered Versus Unbuffered Logging".

Log level. From the drop-down list, select a log level. The choices are Debug, Info, Warning, Failure, Misconfiguration, Catastrophe, and Security. The default selection is Failure. For more information, see "Log Levels (Message Categories)".

5. To save your changes, click Save.

The CMS configuration is modified. If the changes you made require you to restart the server, you will be prompted accordingly. In that case, restart the server.

To configure the audit log for a CMS instance:

1. Log in to the CMS window (see "Logging In to the CMS Window").
2. In the navigation tree, click Logs, and then in the right pane, select the Audit tab.

   

3. If you want the server to log system-level messages, check the "Enable logging" box. All the associated fields become available for you to enter information. Leave the box unchecked if you do not want the server to log messages of this type.
4. In the "Log options" section, specify information as appropriate:

Rotation frequency. From the drop-down list, select the interval at which the server should rotate the active audit log file. The available choices are Hourly, Daily, Weekly, Monthly, and Yearly. The default selection is Monthly. For more information, see "Rotation of Log Files".

Maximum size. Type the file size in kilobytes (KB) for the audit log. The default file size is 100 KB. For more information, see "Rotation of Log Files".

Buffer size. Type the buffer size in kilobytes (KB) for the audit log. The default size for the buffer is 512 KB. For more information, see "Buffered Versus Unbuffered Logging".

Log level. From the drop-down list, select a log level. The choices are Debug, Info, Warning, Failure, Misconfiguration, Catastrophe, and Security. The default selection is Info. For more information, see "Log Levels (Message Categories)".

5. This step is applicable to Windows NT system only.

On a Windows NT system, check the "NT Event logging" box if you want the server to log audit messages to the Event Log maintained by the system. All the associated fields become available for you to enter information. Leave the box unchecked if you do not want the server to log messages of this type to the Event Log.

Event source. Specifies the CMS instance ID for which the audit messages are to be logged. For example, the instance ID could be cert-test CA.

Log level. From the drop-down list, select a log level. The choices are Debug, Info, Warning, Failure, Misconfiguration, Catastrophe, and Security. The default selection is Info. For more information, see "Log Levels (Message Categories)".

6. To save your changes, click Save.

The CMS configuration is modified. If the changes you made require you to restart the server, you will be prompted accordingly. In that case, restart the server.

• Read log file contents partially (by specifying the number of entries to be displayed)
• Filter log entries for specific services (by specifying the source)

• Monitoring System Logs
• Monitoring Error Logs
• Monitoring Audit Logs
• Using System Tools for Monitoring the Server (Windows NT Only)

Certificate Management System maintains extensive system logs. These logs record various events and system errors for system monitoring and debugging. A system log records details such as the following:

• Each HTTP access invoked on the server
• Errors encountered, such as authentication failures, malformed universal resource indicators (URIs), invalid database password indications, and server start-up and shut-down messages
• Messages related to the status of certificate issuance or revocation, authentication failures for issuing-agent connections, and any errors related to the formatting of requests

1. Log in to the CMS window (see "Logging In to the CMS Window").
2. Select the Status tab.
3. In the navigation tree, under Logs, select System.
4. In the Display Options section, specify your viewing preferences:

Entries. Type the maximum number of entries to be displayed. When this limit is reached, Certificate Management System returns any entries it has located that match the search request. If you enter zero (0), no messages are returned. If you leave the field blank, the server returns every matching entry (no limit) regardless of the number found.

Source. Select the CMS component (or service) for which log messages are to be displayed. Depending on the components that write to this log file, the drop-down list shows one or more of the following: All, Registration Authority, Certificate Authority, Key Recovery Authority, HTTP, Internal Database, Authentication, Administration, LDAP, Request Queue, ACLs, User and Group, and Others. If you choose All, messages logged by all components that log to this file are displayed. For more information, see "Services That Are Logged".

Level. Select a message category that represents the log level for filtering messages. For more information on log levels, see "Log Levels (Message Categories)".

Filename. Select the log file you want to view. Choose Current to view the currently active system log file. For more information, see "Log File Naming Conventions".

5. Click Refresh.

The table displays the system log entries. The entries are in reverse chronological order, with the most current entry placed at the top. Use the scroll arrows on the right edge of the panel to scroll through the log entries.

For each entry you see the following details:

Source. Indicates the CMS component or resource that logged the message.

Level. Indicates the severity of the corresponding entry (explained Table 25.3).

Date. Indicates the date on which the entry was logged.

Time. Indicates the time at which the entry was logged.

Details. Provides a brief description of the log.

6. To view an entry in its entirety, either double-click it or select the entry and click View.

The error log file contains errors the server has encountered since the log file was created; it also contains informational messages about the server, such as when the server was started. Incorrect user authentication is also recorded in the error log. Use the error log to find broken URL paths or missing files.

1. Log in to the CMS window (see "Logging In to the CMS Window").
2. Select the Status tab.
3. In the navigation tree, under Logs, click Error.
4. In the Display Options section, specify your viewing preferences:

Entries. Type the maximum number of entries to be displayed. When this limit is reached, Certificate Management System returns any entries it has located that match the search request. If you enter zero (0), no messages are returned. If you leave the field blank, the server returns every matching entry (no limit) to the client regardless of the number found.

Source. Select the CMS component (or services) for which log messages are to be displayed. Depending on the components that write to this log file, the drop-down list shows one or more of the following: All, Registration Authority, Certificate Authority, Key Recovery Authority, HTTP, Internal Database, Authentication, Administration, LDAP, Request Queue, ACLs, User and Group, and Others. If you choose All, messages logged by all components that log to this file are displayed. For more information, see "Services That Are Logged".

Level. Select a message category that represents the level of logging to filter messages. For more information, see "Log Levels (Message Categories)".

Filename. Select the log file you want to view. Choose Current to view the currently active error log file. For more information, see "Log File Naming Conventions".

5. Click Refresh.

The table displays the error log entries. The entries are in reverse chronological order, with the most current log placed at the top. Use the scroll arrows on the right edge of the panel to scroll through the log entries.

For each entry you see the following details:

Source. Indicates CMS component or resource that logged the message.

Level. Indicates the severity of the corresponding entry (explained in Table 25.3).

Date. Indicates the date on which the entry was logged.

Time. Indicates the time at which the entry was logged.

Details. Provides a brief description of the log.

6. To view an entry in its entirety, either double-click it or select the entry and click View.

Certificate Management System maintains audit trails for all events--certificate requests, certificate renewal and revocation requests, CRL publication, and so on. These trails enable you to detect any unauthorized access or activity. The audit trails are logged and maintained in a file in your local file system.

You can view the contents of currently active as well as rotated audit log files from the CMS window (see Figure 26.4).

1. Log in to the CMS window (see "Logging In to the CMS Window").
2. Select the Status tab.
3. In the navigation tree, under Logs, select Audit.
4. In the Display Options section, specify your viewing preferences:

Entries. Type the maximum number of entries to be displayed. When this limit is reached, Certificate Management System returns any entries it has located that match the search request. If you enter zero (0), no messages are returned. If you leave the field blank, the server returns every matching entry (no limit) regardless of the number it finds.

Source. Select the CMS component (or resource) for which log messages are to be displayed. Depending on the components that write to this log file, the drop-down list shows one or more of the following: All, Registration Authority, Certificate Authority, Key Recovery Authority, HTTP, Internal Database, Authentication, Administration, LDAP, Request Queue, ACLs, User and Group, and Others. If you choose All, messages logged by all components that log to this file are displayed. For more information, see "Services That Are Logged".

Level. Select a message category that represents the level of logging to filter messages. For more information, see "Log Levels (Message Categories)".

Filename. Select the log file you want to view. Choose Current to view the currently active audit log file. For more information, see "Log File Naming Conventions".

5. Click Refresh.

The table displays the audit log entries. The entries are in reverse chronological order, with the most current log placed at the top. Use the scroll arrows on the right edge of the panel to scroll through the log entries.

For each entry you see the following details:

Source. Indicates the CMS component or resource that wrote to the log file.

Level. Indicates the severity of the corresponding entry (explained in Table 25.3).

Date. Indicates the date on which this entry was logged.

Time. Indicates the time at which this entry was logged.

Details. Provides a brief description of the log.

6. To view an entry in its entirety, either double-click it or select the entry and then click View.

If you have installed Certificate Management System on a Windows NT system, you can monitor the server with the system tools provided by Windows NT. This section explains how you can use the system tools.

• Logging to Windows NT Event Log
• Using Event Viewer
• Avoiding Event Log From Getting Filled

You can also configure Certificate Management System to write both audit and system logs to the event log of a Windows NT system. If you've installed Certificate Management System on a Windows NT system, the CMS window allows you to turn this feature on or off and to specify the levels for logging. For information on turning on or off to Windows NT Event Log, see "Configuring System Logs" and "Configuring Audit Logs".

In addition to logging messages to the log files maintained in your local file system, Certificate Management System can also log audit messages and system errors to the Windows NT Event log. To configure the server to log messages to Windows NT event log, see "Logging to Windows NT Event Log". If you configure the server to do so, you can use the system's tool called Event Viewer to monitor events related to your server.

1. In the Administrative Tools program group, double-click the Event Viewer icon.
2. From the Log menu, select Application.

The Application log appears in Event Viewer. In this log, the source of any messages from Netscape Certificate Management System is the server's instance ID (if you didn't change the default values assigned to the logNTAudit.NTEventSourceName and logNTSystem.NTEventSourceName parameters).

3. From the View menu, choose Find to search for one of the Netscape labels in the log; use Refresh to see updated log entries.
4. Double-click a log entry to see additional information.

The mapping between the CMS log levels and the Windows NT event type is shown in Table 26.1.

When running Certificate Management System on a Windows NT system, if you don't configure the NT Event Log properly, the event log will get full. When this happens, you'll see an error message (see Figure 26.5) stating that the application log file is full.

1. From the Start menu on your desktop, select Programs, Administrative Tools (Common), and Event Viewer, in that order.

This opens the Event Viewer window for the system.

2. From the Log menu, select Application.

A checkmark to the left indicates it is selected.

3. From the Log menu, select Log Settings.

This opens the Event Log Settings window.



4. Enter the appropriate values:

Change Settings for. Make sure that the Application log is selected in this box.

Maximum Log Size. Select a reasonable size so that the event log doesn't get full in a short period of time.

Event Log Wrapping. Select the "Overwrite Events as Needed" option.

5. Click OK.
6. Close the Event Viewer window.

• Determine the key pair you want to use for signing the log directory. Typically, you should use the Certificate Manager's (the CA's) signing key pair. Also find out the nickname of the certificate that corresponds to this key pair.
• If you have deployed many CAs, locate the CMS instance in which the CA you want to use is installed.
• Find out whether the key pair is in an internal or external token. If it is in an external token, make sure the token is currently installed. You will also need to know the password for the token.
• Determine which log files need to be signed. Put all the files that need to be signed in one or more directories. (The utility can sign a directory containing files; it cannot sign individual files.) Make sure these directories are in the host machine in which the CA is installed.
• Determine names for the output files; the output you receive will be a JAR file (which is a signed zip file). You may want to give names that will help you identify these JAR files easily in the future.

1. Go to the CMS instance in which the CA whose key pair you want to use for signing is installed.
2. Copy the security module database (secmod.db file) from the Administration Server configuration directory to the CMS configuration directory.

The security module database is in this directory:

<server_root>/admin-serv/config

Copy it to this directory:

<server_root>/cert-<instance_id>/config

3. Open a terminal window.
4. At the command prompt, run the following command with the appropriate information:

signtool -d <secdb_dir> -k <cert_nickname> -Z <output> <input>

<secdb_dir> specifies the path to the directory that contains the certificate, key, and security module databases for the CA. This must be the same path you used to copy the security module database in step 2.

<cert_nickname> specifies the nickname of the certificate you want the utility to use for signing.

<output> specifies the name of the JAR file (a signed zip file).

<input> specifies the path to the directory that contains the log files.

For example, in a Windows NT system, your command might look like this:

signtool -d c:\netscape\server4\cert-testCA\config -k testCAsigningcertificate -Z log_err_02_99.jar c:\archive\logs

where c:\netscape\server4\cert-testCA\config is the path to the certificate, key, and security module databases (secdb_dir).

testCAsigningcertificate is the certificate nickname (cert_nickname).

log_err_02_99.jar is the name of the JAR file (output).

(input) is c:\archive\logs is the directory to be signed.