Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual page 304

Chapter 12. Editing Configuration in the CS.cfg File
For example, the CA has this entry for transaction logs, which allows log rotation, buffered logging,
and log levels, among other settings:
log.instance.Transactions._000=##
log.instance.Transactions._001=## Transaction Logging
log.instance.Transactions._002=##
log.instance.Transactions.bufferSize=512
log.instance.Transactions.enable=true
log.instance.Transactions.expirationTime=0
log.instance.Transactions.fileName=/var/log/pki-ca/transactions
log.instance.Transactions.flushInterval=5
log.instance.Transactions.level=1
log.instance.Transactions.maxFileSize=2000
log.instance.Transactions.pluginName=file
log.instance.Transactions.rolloverInterval=2592000
log.instance.Transactions.type=transaction
The RA has much simpler logging configuration for its logs. For example:
logging.error.enable=true
logging.error.filename=/var/log/pki-ra/ra-error.log
logging.error.level=10
Chapter 15, Configuring Subsystem Logs.
Logging is covered in
12.2.2.3. Authorization and Authentication Settings
The CS.cfg file sets how users are approved to access a subsystem instance (authorization) and
how requests to a subsystem are approved (authentication).
The CA, OCSP, TKS, and DRM use authorization plug-ins to define the settings for logging into the
subsystem. For some authorization settings, that is all that is required. It is also possible to select an
authorization method that uses an LDAP database to store user entries, in which case the database
settings are configured along with the plug-in.
authz.impl.DirAclAuthz.class=com.netscape.cms.authorization.DirAclAuthz
authz.instance.DirAclAuthz.ldap=internaldb
authz.instance.DirAclAuthz.pluginName=DirAclAuthz
authz.instance.DirAclAuthz.ldap._000=##
authz.instance.DirAclAuthz.ldap._001=## Internal Database
authz.instance.DirAclAuthz.ldap._002=##
authz.instance.DirAclAuthz.ldap.basedn=dc=server.example.com-pki-ca
authz.instance.DirAclAuthz.ldap.database=server.example.com-pki-ca
authz.instance.DirAclAuthz.ldap.maxConns=15
authz.instance.DirAclAuthz.ldap.minConns=3
authz.instance.DirAclAuthz.ldap.ldapauth.authtype=BasicAuth
authz.instance.DirAclAuthz.ldap.ldapauth.bindDN=cn=Directory Manager
authz.instance.DirAclAuthz.ldap.ldapauth.bindPWPrompt=Internal LDAP Database
authz.instance.DirAclAuthz.ldap.ldapauth.clientCertNickname=
authz.instance.DirAclAuthz.ldap.ldapconn.host=localhost
authz.instance.DirAclAuthz.ldap.ldapconn.port=389
authz.instance.DirAclAuthz.ldap.ldapconn.secureConn=false
authz.instance.DirAclAuthz.ldap.multipleSuffix.enable=false
The TPS, for example, uses the auth.instance settings to configure the user directory it uses to
authenticate users who try to access the TPS.
auth.instance.0.SSLOn=false
282