Ping Identity Data Governance Server - File Based Audit Log Publisher

Data Governance Server Documentation Index
Configuration Reference Home

File Based Audit Log Publisher

Note: this component is designated "advanced", which means that objects of this type are not expected to be created or altered in most environments. If you believe that such a change is necessary, you may want to contact support in order to understand the potential impact of that change.

File Based Audit Log Publishers publish audit messages to the file system.

↓Parent Component
↓Relations from This Component
↓Properties
↓dsconfig Usage

Parent Component

The File Based Audit Log Publisher component inherits from the Access Log Publisher

Relations from This Component

The following components have a direct aggregation relation from File Based Audit Log Publishers:

Log File Rotation Listener

Log Retention Policy

Log Rotation Policy

Properties

The properties supported by this managed object are as follows:

General Configuration Basic Properties:	Advanced Properties:
↓ description	None
↓ enabled
↓ logging-error-behavior
Log File Management Basic Properties:	Advanced Properties:
↓ log-file	↓ compression-mechanism
↓ log-file-permissions
↓ rotation-policy
↓ rotation-listener
↓ retention-policy
↓ sign-log
↓ encrypt-log
↓ encryption-settings-definition-id
↓ append
Log Messages To Include Basic Properties:	Advanced Properties:
↓ log-security-negotiation	None
↓ log-intermediate-responses
↓ suppress-internal-operations
↓ suppress-replication-operations
Log Message Elements To Include Basic Properties:	Advanced Properties:
↓ include-product-name	↓ include-thread-id
↓ include-instance-name
↓ include-startup-id
↓ include-requester-ip-address
↓ include-requester-dn
↓ use-reversible-form
↓ include-request-controls
↓ obscure-attribute
↓ exclude-attribute
Other Configuration Basic Properties:	Advanced Properties:
↓ timestamp-precision	↓ asynchronous
	↓ auto-flush
	↓ buffer-size
	↓ queue-size
	↓ time-interval

Basic Properties

description

Property Group	General Configuration
Description	A description for this Log Publisher
Default Value	None
Allowed Values	A string
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

enabled

Property Group	General Configuration
Description	Indicates whether the Log Publisher is enabled for use.
Default Value	None
Allowed Values	true false
Multi-Valued	No
Required	Yes
Admin Action Required	None. Modification requires no further action

logging-error-behavior

Property Group	General Configuration
Description	Specifies the behavior that the server should exhibit if an error occurs during logging processing.
Default Value	standard-error
Allowed Values	standard-error - Write a message to standard error in the event of a logging failure. lockdown-mode - Place the server in lockdown mode in the event of a logging failure.
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

log-file

Property Group	Log File Management
Description	The file name to use for the log files generated by the File Based Audit Log Publisher. The path to the file can be specified either as relative to the server root or as an absolute path.
Default Value	None
Allowed Values	A filesystem path
Multi-Valued	No
Required	Yes
Admin Action Required	The File Based Audit Log Publisher must be disabled and re-enabled for changes to this setting to take effect. In order for this modification to take effect, the component must be restarted, either by disabling and re-enabling it, or by restarting the server

log-file-permissions

Property Group	Log File Management
Description	The UNIX permissions of the log files created by this File Based Audit Log Publisher.
Default Value	600
Allowed Values	A valid UNIX mode string. The mode string must contain three digits between zero and seven.
Multi-Valued	No
Required	Yes
Admin Action Required	None. Modification requires no further action

rotation-policy

Property Group	Log File Management
Description	The rotation policy to use for the File Based Audit Log Publisher . When multiple policies are used, rotation will occur if any policy's conditions are met.
Default Value	No rotation policy is used and log rotation will not occur.
Allowed Values	The DN of any Log Rotation Policy.
Multi-Valued	Yes
Required	Yes
Admin Action Required	None. Modification requires no further action

rotation-listener

Property Group	Log File Management
Description	A listener that should be notified whenever a log file is rotated out of service.
Default Value	None
Allowed Values	The DN of any Log File Rotation Listener. If this File Based Audit Log Publisher is enabled, then the associated log file rotation listener must also be enabled.
Multi-Valued	Yes
Required	No
Admin Action Required	None. Modification requires no further action

retention-policy

Property Group	Log File Management
Description	The retention policy to use for the File Based Audit Log Publisher . When multiple policies are used, log files are cleaned when any of the policy's conditions are met.
Default Value	No retention policy is used and log files are never cleaned.
Allowed Values	The DN of any Log Retention Policy.
Multi-Valued	Yes
Required	Yes
Admin Action Required	None. Modification requires no further action

sign-log

Property Group	Log File Management
Description	Indicates whether the log should be cryptographically signed so that the log content cannot be altered in an undetectable manner. Log file signatures can be validated using the validate-file-signature tool provided with the server. Note that when enabling signing for a logger that already exists and was enabled without signing, the first log file will not be completely verifiable because it will still contain unsigned content from before signing was enabled. Only log files whose entire content was written with signing enabled will be considered completely valid. For the same reason, if a log file is still open for writing, then signature validation will not indicate that the log is completely valid because the log will not include the necessary "end signed content" indicator at the end of the file.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	The File Based Audit Log Publisher must be disabled and re-enabled for changes to this setting to take effect. In order for this modification to take effect, the component must be restarted, either by disabling and re-enabling it, or by restarting the server

encrypt-log (Read-Only)

Property Group	Log File Management
Description	Indicates whether log files should be encrypted so that their content is not available to unauthorized users. If this property is configured with a value of true, then log data will be encrypted using a key generated from an encryption settings definition. If the encryption-settings-definition-id property has a value, then the specified encryption settings definition will be used; otherwise, the server's preferred encryption settings definition will be used. For best compatibility, you should use an encryption settings definition that was created from a user-supplied passphrase, so that passphrase can be used to decrypt its content. If this property is configured with a value of false, then log data will not be encrypted. Encrypted log files can be decrypted on the command line with the encrypt-file tool (using the --decrypt argument). Encrypted log files can be accessed programmatically using the com.unboundid.util.PassphraseEncryptedInputStream class in the UnboundID LDAP SDK for Java. If a log file is to be encrypted, then you will also likely want to enable compression (by giving the compression-mechanism property a value of 'gzip'). This will reduce the amount of data that needs to be encrypted, and will also dramatically reduce the size of the log files that are generated.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	The File Based Audit Log Publisher must be disabled and re-enabled for changes to this setting to take effect. In order for this modification to take effect, the component must be restarted, either by disabling and re-enabling it, or by restarting the server

encryption-settings-definition-id

Property Group	Log File Management
Description	Specifies the ID of the encryption settings definition that should be used to encrypt the data. If this is not provided, the server's preferred encryption settings definition will be used. The "encryption-settings list" command can be used to obtain a list of the encryption settings definitions available in the server.
Default Value	None
Allowed Values	A string
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

append

Property Group	Log File Management
Description	Specifies whether to append to existing log files.
Default Value	true
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

log-security-negotiation

Property Group	Log Messages To Include
Description	Indicates whether to log information about the result of any security negotiation (e.g., SSL handshake) processing that has been performed.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

log-intermediate-responses

Property Group	Log Messages To Include
Description	Indicates whether to log information about intermediate responses sent to the client.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

suppress-internal-operations

Property Group	Log Messages To Include
Description	Indicates whether internal operations (for example, operations that are initiated by plugins) should be logged along with the operations that are requested by users.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

suppress-replication-operations

Property Group	Log Messages To Include
Description	Indicates whether access messages that are generated by replication operations should be suppressed.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

include-product-name

Property Group	Log Message Elements To Include
Description	Indicates whether log messages should include the product name for the Data Governance Server.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

include-instance-name

Property Group	Log Message Elements To Include
Description	Indicates whether log messages should include the instance name for the Data Governance Server.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

include-startup-id

Property Group	Log Message Elements To Include
Description	Indicates whether log messages should include the startup ID for the Data Governance Server, which is a value assigned to the server instance at startup and may be used to identify when the server has been restarted.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

include-requester-ip-address

Property Group	Log Message Elements To Include
Description	Indicates whether log messages for operation requests should include the IP address of the client that requested the operation.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

include-requester-dn

Property Group	Log Message Elements To Include
Description	Indicates whether log messages for operation requests should include the DN of the authenticated user for the client connection on which the operation was requested.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

use-reversible-form

Property Group	Log Message Elements To Include
Description	Indicates whether the audit log should be written in reversible form so that it is possible to revert the changes if desired. If this property is set true then the audit log is written in reversible form. For delete operations there will be comments with the contents of the entry. For modify operations the changes will only contain delete of the previous values and add of the new values (omitting those that didn't change). For modify DN operations there will be comments with the attribute additions or deletions, if any, caused by the RDN change.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

include-request-controls

Property Group	Log Message Elements To Include
Description	Indicates whether log messages for operation requests should include a list of the OIDs of any controls included in the request.
Default Value	false
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

obscure-attribute

Property Group	Log Message Elements To Include
Description	Specifies the names of any attribute types that should have their values obscured in the audit log because they may be considered sensitive. Note that values are not obscured from any DN.
Default Value	ds-broker-external-identity
Allowed Values	A string
Multi-Valued	Yes
Required	No
Admin Action Required	None. Modification requires no further action

exclude-attribute

Property Group	Log Message Elements To Include
Description	Specifies the names of any attribute types that should be excluded from the audit log.
Default Value	ds-sync-hist
Allowed Values	The name or OID of an attribute type defined in the server schema.
Multi-Valued	Yes
Required	No
Admin Action Required	None. Modification requires no further action

timestamp-precision

Property Group	Other Configuration
Description	Specifies the smallest time unit to be included in timestamps.
Default Value	milliseconds
Allowed Values	seconds - Timestamps will be precise to the nearest second. milliseconds - Timestamps will be precise to the nearest millisecond.
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

Advanced Properties

compression-mechanism (Advanced Property, Read-Only)

Property Group	Log File Management
Description	Specifies the type of compression (if any) to use for log files that are written. Note that this setting cannot be changed once the logger has been created, because of the possibility of mixing compressed and uncompressed data in the same file. Further, because it is difficult to append to a compressed file, any existing active log file will automatically be rotated when the server is started. If compressed logging is used, it may also be desirable to have another logger enabled that does not use compression. The rotation and retention policies for the uncompressed logger can be configured to minimize the amount of space it consumes, but having ready access to information about recent operations in uncompressed form may be convenient for debugging purposes. Alternately, you could consider having the uncompressed logger defined but not enabled so that it can be turned on as needed for debugging such problems.
Default Value	none
Allowed Values	none - No compression will be performed. gzip - Compress file data using gzip with the default compression level. If this compression level is specified, then files will automatically be given a ".gz" extension.
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

include-thread-id (Advanced Property)

Property Group	Log Message Elements To Include
Description	Indicates whether log messages should include the thread ID for the Data Governance Server in each log message. This ID can be used to correlate log messages from the same thread within a single log as well as generated by the same thread across different types of log files. More information about the thread with a specific ID can be obtained using the cn=JVM Stack Trace,cn=monitor entry.
Default Value	true
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

asynchronous (Advanced Property)

Property Group	Other Configuration
Description	Indicates whether the File Based Audit Log Publisher will publish records asynchronously.
Default Value	true
Allowed Values	true false
Multi-Valued	No
Required	Yes
Admin Action Required	None. Modification requires no further action

auto-flush (Advanced Property)

Property Group	Other Configuration
Description	Specifies whether to flush the writer after every log record. If the asynchronous writes option is used, the writer is flushed after all the log records in the queue are written.
Default Value	true
Allowed Values	true false
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

buffer-size (Advanced Property)

Property Group	Other Configuration
Description	Specifies the log file buffer size.
Default Value	64kb
Allowed Values	A positive integer representing a size. Lower limit is 1.
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

queue-size (Advanced Property)

Property Group	Other Configuration
Description	The maximum number of log records that can be stored in the asynchronous queue. The server will continuously flush messages from the queue to the log. That is, it does not wait for the queue to fill up before flushing to the log. Lowering this value can impact performance.
Default Value	10000
Allowed Values	An integer value. Lower limit is 1000. Upper limit is 100000 .
Multi-Valued	No
Required	No
Admin Action Required	The File Based Audit Log Publisher must be restarted if this property is changed and the asynchronous property is set to true.

time-interval (Advanced Property)

Property Group	Other Configuration
Description	Specifies the interval at which to check whether the log files need to be rotated.
Default Value	5s
Allowed Values	A duration. Lower limit is 1 milliseconds.
Multi-Valued	No
Required	No
Admin Action Required	None. Modification requires no further action

dsconfig Usage

To list the configured Log Publishers:

dsconfig list-log-publishers
     [--property {propertyName}] ...

To view the configuration for an existing Log Publisher:

dsconfig get-log-publisher-prop
     --publisher-name {name}
     [--tab-delimited]
     [--script-friendly]
     [--property {propertyName}] ...

To update the configuration for an existing Log Publisher:

dsconfig set-log-publisher-prop
     --publisher-name {name}
     (--set|--add|--remove) {propertyName}:{propertyValue}
     [(--set|--add|--remove) {propertyName}:{propertyValue}] ...

To create a new File Based Audit Log Publisher:

dsconfig create-log-publisher
     --publisher-name {name}
     --type {type}
     --set enabled:{propertyValue}
     --set log-file:{propertyValue}
     [--set {propertyName}:{propertyValue}] ...

To delete an existing Log Publisher:

dsconfig delete-log-publisher
     --publisher-name {name}