File Based Authorization Log Publishers are used for recording information about actions performed by the Identity Broker policy engine and OAuth2 service.
↓Parent Component
↓Relations from This Component
↓Properties
↓dsconfig Usage
The File Based Authorization Log Publisher component inherits from the Writer Based Authorization Log Publisher
The following components have a direct aggregation relation from File Based Authorization Log Publishers:
The properties supported by this managed object are as follows:
| Basic Properties: | Advanced Properties: |
|---|---|
| ↓ description | ↓ auto-flush |
| ↓ enabled | ↓ asynchronous |
| ↓ logged-message-type | ↓ queue-size |
| ↓ timestamp-precision | ↓ max-string-length |
| ↓ log-file | ↓ time-interval |
| ↓ log-file-permissions | ↓ buffer-size |
| ↓ append | ↓ compression-mechanism |
| ↓ rotation-policy | |
| ↓ retention-policy | |
| ↓ sign-log |
| Description | A description for this Log Publisher |
| Default Value | None |
| Allowed Values | A string |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
| Description | Indicates whether the Log Publisher is enabled for use. |
| Default Value | None |
| Allowed Values | true false |
| Multi-Valued | No |
| Required | Yes |
| Admin Action Required | None. Modification requires no further action |
| Description | Specifies the message types which can be logged. |
| Default Value | All messages are logged except for decision-trace. |
| Allowed Values | policy-decision - Indicates that policy decisions will be logged. decision-trace - For debugging of XACML policies. Indicates that decision trace messages will be logged. Can generate a lot of output and could impact performance. add-consent - Indicates that capture of consent will be logged. delete-consent - Indicates that revocation of consent will be logged. oauth-code-granted - Indicates that information on OAuth 2 authorization codes will be logged. oauth-code-consumed - Indicates that OAuth 2 authorization codes being converted to a token will be logged. oauth-token-granted - Indicates that information on OAuth 2 access tokens will be logged. oauth-token-revoked - Indicates that OAuth 2 access tokens being revoked will be logged. oauth-token-validation - Indicates that OAuth 2 access token validation results will be logged. oauth-consent-denied - Indicates that information will be logged when a user implicitly or explicitly denies OAuth 2 consent. oauth-consent-permitted - Indicates that information will be logged when an user implicitly or explicitly approves OAuth 2 consent. oauth-consent-requested - Indicates that information will be logged when an application requests OAuth 2 consent from a user. oauth-exception - Indicates that information will be logged when there is an exception in an OAuth 2 flow. id-token-granted - Indicates that information on OpenID Connect ID tokens will be logged. external-identity-token - Indicates that information on External Identity Provider token requests and responses will be logged. external-identity-attributes - Indicates that information on External Identity Provider attribute requests and responses will be logged. |
| Multi-Valued | Yes |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
| Description | Specifies the smallest time unit to be included in timestamps. |
| Default Value | milliseconds |
| Allowed Values | seconds - Timestamps will be precise to the nearest second. milliseconds - Timestamps will be precise to the nearest millisecond. |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
| Description | The file name to use for the log files generated by the File Based Authorization Log Publisher. The path to the file can be specified either as relative to the server root or as an absolute path. |
| Default Value | None |
| Allowed Values | Unknown |
| Multi-Valued | No |
| Required | Yes |
| Admin Action Required | The File Based Authorization Log Publisher must be disabled and re-enabled for changes to this setting to take effect. In order for this modification to take effect, the component must be restarted, either by disabling and re-enabling it, or by restarting the server |
| Description | The UNIX permissions of the log files created by this File Based Authorization Log Publisher. |
| Default Value | 640 |
| Allowed Values | A valid UNIX mode string. The mode string must contain three digits between zero and seven. |
| Multi-Valued | No |
| Required | Yes |
| Admin Action Required | None. Modification requires no further action |
| Description | Specifies whether to append to existing log files. |
| Default Value | true |
| Allowed Values | true false |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
| Description | The rotation policy to use for the File Based Authorization Log Publisher . When multiple policies are used, rotation will occur if any policy's conditions are met. |
| Default Value | No rotation policy is used and log rotation will not occur. |
| Allowed Values | The DN of any Log Rotation Policy. |
| Multi-Valued | Yes |
| Required | Yes |
| Admin Action Required | None. Modification requires no further action |
| Description | The retention policy to use for the File Based Authorization Log Publisher . When multiple policies are used, log files are cleaned when any of the policy's conditions are met. |
| Default Value | No retention policy is used and log files are never cleaned. |
| Allowed Values | The DN of any Log Retention Policy. |
| Multi-Valued | Yes |
| Required | Yes |
| Admin Action Required | None. Modification requires no further action |
| Description | Indicates whether the log should be cryptographically signed so that the log content cannot be altered in an undetectable manner. Log file signatures can be validated using the validate-file-signature tool provided with the server. Note that when enabling signing for a logger that already exists and was enabled without signing, the first log file will not be completely verifiable because it will still contain unsigned content from before signing was enabled. Only log files whose entire content was written with signing enabled will be considered completely valid. For the same reason, if a log file is still open for writing, then signature validation will not indicate that the log is completely valid because the log will not include the necessary "end signed content" indicator at the end of the file. |
| Default Value | false |
| Allowed Values | true false |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | The File Based Authorization Log Publisher must be disabled and re-enabled for changes to this setting to take effect. In order for this modification to take effect, the component must be restarted, either by disabling and re-enabling it, or by restarting the server |
auto-flush (Advanced Property)
| Description | Specifies whether to flush the writer after every log record. If the asynchronous writes option is used, the writer is flushed after all the log records in the queue are written. |
| Default Value | true |
| Allowed Values | true false |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
asynchronous (Advanced Property)
| Description | Indicates whether the Writer Based Authorization Log Publisher will publish records asynchronously. |
| Default Value | true |
| Allowed Values | true false |
| Multi-Valued | No |
| Required | Yes |
| Admin Action Required | None. Modification requires no further action |
queue-size (Advanced Property)
| Description | The maximum number of log records that can be stored in the asynchronous queue. The server will continuously flush messages from the queue to the log. That is, it does not wait for the queue to fill up before flushing to the log. Lowering this value can impact performance. |
| Default Value | 10000 |
| Allowed Values | An integer value. Lower limit is 1000. Upper limit is 100000 . |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | The Writer Based Authorization Log Publisher must be restarted if this property is changed and the asynchronous property is set to true. |
max-string-length (Advanced Property)
| Description | Specifies the maximum number of characters that may be included in any string in a log message before that string is truncated and replaced with a placeholder indicating the number of characters that were omitted. This can help prevent extremely long log messages from being written. A value of zero indicates that no limit will be imposed. |
| Default Value | 2000 |
| Allowed Values | An integer value. Lower limit is 0. |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
time-interval (Advanced Property)
| Description | Specifies the interval at which to check whether the log files need to be rotated. |
| Default Value | 5s |
| Allowed Values | A duration. Lower limit is 1 milliseconds. |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
buffer-size (Advanced Property)
| Description | Specifies the log file buffer size. |
| Default Value | 64kb |
| Allowed Values | A positive integer representing a size. Lower limit is 1. |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
compression-mechanism (Advanced Property, Read-Only)
| Description | Specifies the type of compression (if any) to use for log files that are written. Note that this setting cannot be changed once the logger has been created, because of the possibility of mixing compressed and uncompressed data in the same file. Further, because it is difficult to append to a compressed file, any existing active log file will automatically be rotated when the server is started. If compressed logging is used, it may also be desirable to have another logger enabled that does not use compression. The rotation and retention policies for the uncompressed logger can be configured to minimize the amount of space it consumes, but having ready access to information about recent operations in uncompressed form may be convenient for debugging purposes. Alternately, you could consider having the uncompressed logger defined but not enabled so that it can be turned on as needed for debugging such problems. |
| Default Value | none |
| Allowed Values | none - No compression will be performed. gzip - Compress file data using gzip with the default compression level. If this compression level is specified, then files will automatically be given a ".gz" extension. |
| Multi-Valued | No |
| Required | No |
| Admin Action Required | None. Modification requires no further action |
To list the configured Log Publishers:
dsconfig list-log-publishers
[--property {propertyName}] ...
To view the configuration for an existing Log Publisher:
dsconfig get-log-publisher-prop
--publisher-name {name}
[--tab-delimited]
[--script-friendly]
[--property {propertyName}] ...
To update the configuration for an existing Log Publisher:
dsconfig set-log-publisher-prop
--publisher-name {name}
(--set|--add|--remove) {propertyName}:{propertyValue}
[(--set|--add|--remove) {propertyName}:{propertyValue}] ...
To create a new File Based Authorization Log Publisher:
dsconfig create-log-publisher
--publisher-name {name}
--type {type}
--set enabled:{propertyValue}
--set log-file:{propertyValue}
[--set {propertyName}:{propertyValue}] ...
To delete an existing Log Publisher:
dsconfig delete-log-publisher
--publisher-name {name}