Handling Audit Logging Failures - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

logging.audit.logSigning=true
logging.audit.nonselectable.events=AUDIT_LOG_STARTUP,AUDIT_LOG_SHUTDOWN,LOGGING_SIGNED_AUDIT_SIGNING
logging.audit.selectable.events=optional events
logging.audit.selected.events=selected events
logging.audit.signedAuditCertNickname=auditSigningCert cert-pki-tps
logging.audit.signedAuditFilename=/var/log/pki-tps/signedAudit/tps_audit/audit
Example 15.9. TPS Audit Logging Config
3. Start the TPS instance.
service pki-tps start
Event
logging.audit.logSigning
logging.audit.signedAuditCertNickname
logging.audit.signedAuditFilename Gives the full path and filename of the file to use for the signed audit log file. This
Table 15.10. TPS Signed Audit Log Parameters
Many events can be or are required to be recorded to the audit log. Some events (such as
the system startup) are listed in the logging.audit.nonselectable.events parameter
as required events, and they are always recorded in the audit log. A list of other events in the
logging.audit.selectable.events parameter provide additional options that can be recorded
in the audit log. All loggable events, both required and optional, are listed in
Recorded to the TPS Audit
Event
AUDIT_LOG_STARTUP
AUDIT_LOG_SHUTDOWN
LOGGING_SIGNED_AUDIT_SIGNING
AUTHZ_SUCCESS
AUTH_SUCCESS
ENROLLMENT
UPGRADE
AUTHZ_FAIL
ROLE_ASSUME
PIN_RESET
AUTH_FAIL
CONFIG_SIGNED_AUDIT
FORMAT
Table 15.11. Events Recorded to the TPS Audit Log

15.5.3. Handling Audit Logging Failures

There are events that could cause the audit logging function to fail, so events cannot be written to
the log. For example, audit logging can fail when the filesystem containing the audit log file is full or
Description
Sets whether to sign the audit log. The default value is false.
Gives the nickname of the certificate in the TPS database to use to sign the audit
parameter for the regular audit log file location.
Log".
Description
The start of the subsystem, and thus the start of the audit function.
The shutdown of the subsystem, and thus the shutdown of the audit function.
Shows changes in whether the audit log is signed.
Shows when a user is successfully processed by the authorization servlets.
Shows when a user successfully authenticates.
Shows when a token is enrolled through the TPS.
Shows when the applet on the token is upgraded.
Shows when a user is not successfully processed by the authorization servlets.
A user assuming a role. A user assumes a role after passing through authenticatio
of administrator, auditor, and agent are tracked. Custom roles are not tracked.
Shows when the password used to access the token is reset.
Shows when a user does not successfully authenticate.
Records when any change is made to the configuration settings for the signed aud
Records when a token is formatted.
Handling Audit Logging Failures
Table 15.11, "Events
381