Configuring Tps Signed Audit Logging - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Event
CONFIG_SIGNED_AUDIT
CONFIG_ENCRYPTION
CONFIG_TRUSTED_PUBLIC_KEY
CONFIG_DRM
SELFTESTS_EXECUTION
1
AUDIT_LOG_DELETE
2
LOG_PATH_CHANGE
PRIVATE_KEY_ARCHIVE
PRIVATE_KEY_ARCHIVE_PROCESSED
KEY_RECOVERY_REQUEST Shows when a request is made to recover a private encryption key stored in the D
KEY_RECOVERY_AGENT_LOGIN
KEY_RECOVERY_PROCESSED Shows when a key recovery has been processed.
KEY_GEN_ASYMMETRIC
NON_PROFILE_CERT_REQUEST
PROFILE_CERT_REQUEST
CERT_REQUEST_PROCESSED Shows when a certificate request is being processed.
CERT_STATUS_CHANGE_REQUEST
CERT_STATUS_CHANGE_REQUEST_PROCESSED
AUTHZ_SUCCESS
AUTHZ_FAIL
INTER_BOUNDARY
AUTH_FAIL
AUTH_SUCCESS
CERT_PROFILE_APPROVAL Shows when a certificate profile sent by an administrator is approved by an agent
PROOF_OF_POSSESSION
CRL_RETRIEVAL
CRL_VALIDATION
CMC_SIGNED_REQUEST_SIG_VERIFY
AUDIT_LOG_SIGNING
The authorization system should not allow a signed audit log to be deleted.
The authorization system should not allow the log path or name to be changed.
Table 15.9. Signed Audit Log Events

15.5.2. Configuring TPS Signed Audit Logging

There are two locations for the audit logs. Regular audit logs are in /var/log/subsystem_name/
tps-audit.log. If signed audit logging is enabled, then the signed audit log is written to /var/
log/subsystem_name/signedAudit/tps-audit.log.
Log Messages
A change is made to the configuration settings for the signed audit feature.
A change is made to the encryption settings, including certificate settings and SSL
The Certificate Setup Wizard is used to import certificates into the certificate datab
The configuration associated with a DRM changes.
The self-tests are executed.
The signed audit log expires or is deleted.
The path or name for the signed audit, system, transaction or any customized log
Shows when an encryption private key is requested during enrollment.
Shows when a private encryption key is archived in the DRM.
Shows when DRM agents log in as recovery agents to approve key recovery requ
Shows when asymmetric keys are generated.
Shows when a certificate request is made outside the certificate profile framework
Shows when a certificate request is made through the certificate profile framework
Shows when the request is made to change the status of a certificate.
Shows when a certificate status change is processed.
Shows when a user is successfully processed by the authorization servlets.
Shows when a user is not successfully processed by the authorization servlets.
Records stat transfer between different subsystems.
Shows when a user does not successfully authenticate.
Shows when a user successfully authenticates.
Shows when proof of possession is checked during certificate enrollment.
Shows when a CRL is retrieved by the OCSP.
Shows when a CRL is retrieved and the validation process occurs.
Used when CMC (agent pre-signed) certificate requests or revocation requests ar
Shows when the audit buffer is signed and flushed to disk.
Configuring TPS Signed Audit Logging
379