Appendix E. Audit events This appendix contains two parts. The first part, Section E.1, "Required audit events and their examples" , contains a list of required audit events grouped by the requirement ID from the CA Protection Profile V2.1, where each audit event is accompanied by one or more examples. The second part, Section E.2, "Audit Event Descriptions" provides individual audit event and their parameter description and format. Every audit event in the log is accompanied by the following information: The Java identifier of the thread. For example: The time stamp the event occurred at. For example: The log source (14 is SIGNED_AUDIT): The current log level (6 is Security-related events. See 13.1.2 Log Levels (Message Categories) in the Planning, Installation and Deployment Guide (Common Criteria Edition) . For example: The information about the log event (which is log event specific; see Section E.2, "Audit Event Descriptions" for information about each field in a particular log event). For example: E.1. Required audit events and their examples This section contains all required audit events per Common Criteria CA Protection Profile v.2.1. For audit events descriptions, see Section E.2, "Audit Event Descriptions" . FAU_GEN.1 Start-up of the TSF audit functions AUDIT_LOG_STARTUP Test case: start up a CS instance. All administrative actions invoked through the TFS interface CONFIG_CERT_PROFILE Test case: modifying a profile via CLI or console. CERT_PROFILE_APPROVAL Test case: as a CA admin, enabling a profile (e.g. caUserCert ) via console or CLI. Then as a CA agent, approving the profile from the agent portal in the WebUI. CONFIG_OCSP_PROFILE Test case: changing OCSP parameters via console, e.g. includeNextUpdate (make sure you revert changes after each test). CONFIG_CRL_PROFILE Test case: in the console, selecting Certificate Manager > CRL Issuing Points > MasterCRL > Updates > and modifying the Update CRL every field as well as the update race period and update as this update extension fields. CONFIG_AUTH Test case: in the console, selecting Authentication > Authentication Instance > and adding a new authentication instance by entering a new Auth Instance ID. For example, AgentCertAuth and then entering AgentCertAuth2 for the instance name. CONFIG_ROLE(success) Test case: adding an user, e.g. # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n 'rsa_SubCA_AdminV' ca-user-add Test_UserV --fullName Testuser --password SECret.123. CONFIG_ROLE(Failure) Test case: adding an existing user, e.g. # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n 'rsa_SubCA_AdminV' ca-user-add Test_UserV --fullName Testuser --password SECret.123. CONFIG_ACL CA Test case: in the console, clicking Access Control List and removing a variable (adding it back afterwards). CONFIG_SIGNED_AUDIT ( FAU_SEL.1 ) CA Test case: disabling, e.g. # pki -U https://rhcs10.example.com:21443 -d /root/.dogtag/pki_ecc_bootstrap/certs_db -c SECret.123 -n ecc_SubCA_AdminV ca-audit-mod --action disable. Test case: reenabling, e.g. # pki -U https://rhcs10.example.com:21443 -d /root/.dogtag/pki_ecc_bootstrap/certs_db -c SECret.123 -n ecc_SubCA_AdminV ca-audit-mod --action enable. KRA Test case: disabling audit using the pki kra-audit-mod command: # pki -p 28443 -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -n "PKI KRA Administrator for RSA-KRA" kra-audit-mod --action disable. OCSP Test case: in the console, selecting Log > Log Event Listener Management tab > SignedAudit > Edit/View > and changing the flushInterval value. TKS Test case: disabling audit using the pki tps-audit-mod command, after importing the TKS admin cert into the db: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ client-cert-import --pkcs12 /opt/pki_rsa/rhcs10-RSA-TKS/tks_admin_cert.p12 --pkcs12-password SECret.123 then # pki -p 24443 -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -n "PKI TKS Administrator for RSA-TKS" tks-audit-mod --action disable. TPS Test case: disabling audit using the pki tps-audit-mod command, after importing the TPS admin cert into the db: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ client-cert-import --pkcs12 /opt/pki_rsa/rhcs10-RSA-TPS/tks_admin_cert.p12 --pkcs12-password SECret.123 then # pki -p 24443 -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -n "PKI TPS Administrator for RSA-TPS" tps-audit-mod --action disable. CONFIG_DRM Test case: in the console, clicking Configuration > Data Recovery Manager > General Settings > and setting the number of required recovery agents to 2. OCSP_ADD_CA_REQUEST_PROCESSED Success Test case: in the WebUI, clicking Agent Services > Add Certificate Authority > then entering a valid CA certificate in PEM format. Failure Test case: in the WebUI, clicking Agent Services > Add Certificate Authority > then not entering anything valid. OCSP_REMOVE_CA_REQUEST_PROCESSED Test case: in the WebUI, clicking Agent Services > List Certificate Authorities > then clicking Remove CA (Remember to add it back after the test). SECURITY_DOMAIN_UPDATE Operation: Issue_token Test case: checking the CA logs when other subsystems are added to or removed from the security domain. Operation: Add Test case: checking the CA logs when other subsystems are added to or removed from the security domain. CONFIG_SERIAL_NUMBER CA Test case: creating a RootCA subsystem clone. KRA Test case: creating a KRA subsystem clone. FDP_CER_EXT.1 (extended) Certificate generation CERT_REQUEST_PROCESSED (success) Test case: a successful CMC request using SharedSecret (with cmc.popLinkWitnessRequired=true ). FDP_CER_EXT.2 (extended) Linking of certificates to certificate requests Test case: a successful CMC request signed and issued by a CA agent (with cmc.popLinkWitnessRequired=false ): PROFILE_CERT_REQUEST CERT_REQUEST_PROCESSED (Success) Note In the success case, the ReqID field effectively links to the ReqID field of a successful CERT_REQUEST_PROCESSED event where the CertSerialNum field contains the certificate serial number. FFDP_CER_EXT.3 FDP_CER_EXT.2 (Failure) Failed certificate approvals A failed CMC request using SharedSecret (with cmc.popLinkWitnessRequired=true ) with wrong witness.sharedSecret CMC_REQUEST_RECEIVED CERT_REQUEST_PROCESSED (failure) Note The concurrent occurrence of CMC_REQUEST_RECEIVED and CERT_REQUEST_PROCESSED linked the request object with the failure. FIA_X509_EXT.1, FIA_X509_EXT.2 Failed certificate validations; failed authentications ACCESS_SESSION_ESTABLISH (failure) User with revoked cert trying to perform an operation. Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AgentR' ca-cert-find. User with expired cert trying to perform an operation. Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AgentE' ca-cert-find. CMC enrollment request submitted using a TLS client cert issued by an unknown CA. Test case: Adding a client cert issued by unknown CA to nssdb and running # HttpClient /root/.dogtag/pki_ecc_bootstrap/certs_db/HttpClient-cmc-p10.self.cfg. No common encryption algorithm(s). Test case: changing the ciphers in the ECC CA's server.xml to RSA ciphers, then running # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AdminV' ca-user-find. FIA_UIA_EXT.1 FIA_UAU_EXT.1 Privileged user identification and authentication ACCESS_SESSION_ESTABLISH -> The ClientIP field of the ACCESS_SESSION_ESTABLISH audit event contains the IP address of the client. The SubjectID field of the ACCESS_SESSION_ESTABLISH audit event contains the identity of the entity. CA Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AdminV' ca-user-find. TPS Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'TPS_AdminV' tps-user-find. AUTH The AuthMgr field contains the authentication mechanism in the AUTH audit event. CA Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -P https -p 31443 -n 'rsa_SubCA_AdminV'. TPS Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'PKI TPS Administrator for RSA-TPS' tps-user-find. AUTHZ CA Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -P https -p 31443 -n 'rsa_SubCA_AuditV' ca-audit-file-find. TPS Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'PKI TPS Administrator for RSA-TPS' tps-user-show tpsadmin. ROLE_ASSUME The Role field of the ROLE_ASSUME audit event contains the name of the role that the user is assuming. CA Test case: logging in to pkiconsole with valid credentials, e.g.: # pkiconsole -d /home/jgenie/.redhat-idm-console -n rsa_SubCA_AdminV. TPS Test case: accessing the TPS Web UI Agent page using the TPS_AgentV certificate. FMT_SMR.2 Modifications to the group of users that are part of a role CONFIG_ROLE See CONFIG_ROLE event above. FPT_FLS.1 Failure with preservation of secure state SELFTESTS_EXECUTION Test case: pointing the OCSP signing certificate to a non-existing certificate. E.g. ca.cert.ocsp_signing.nickname=NHSM-CONN-XC:non-existing certificate . CA CA_AUDIT SELFTESTS.LOG FPT_KST_EXT.2 Private/secret keys are stored by the HSM and the only operations to "access" those keys are through the TSF as signing operations. N/a: Under normal circumstances, HSM authentication is done at RHCS system startup time (server will not start if failed to authenticate), so once the system is up, there is no need to authenticate (no loggable cause of failure). FPT_RCV.1 The fact that a failure or service discontinuity occurred. Resumption of the regular operation. Failure: SELFTESTS_EXECUTION (failure) CA Test case: adding a bogus cert nickname in the config file and restarting the server, e.g.: ca.cert.sslserver.nickname=Bogus Server-Cert . TPS Test case: adding a bogus cert nickname in the config file and restarting the server, e.g.: selftests.plugin.TPSPresence.nickname=bogusCert . Self-test log, see "Configuring Self-Tests" in the Installation Guide. Resumption (e.g. fixing the bogus certificate nickname and restarting): AUDIT_LOG_STARTUP; SELFTESTS_EXECUTION (success) TPS CA FPT_STM.1 Changes to the time. Timestamps in the audit log for each event are provided by the Operational Environment, e.g.: Changes to the time on the OS level are audited. See Section 12.2.3.3, "Displaying time change events" . Test steps: following "Enable OS-level audit logs" in the post-installation section (Installation Guide) and executing # ausearch -k rhcs_audit_time_change . To change the timezone, run # timedatectl list-timezones to list the zones then set the desired zone using timedatectl set-timezone . E.g.: Running the time change audit command will result in similar logs: FPT_TUD_EXT.1 Initiation of update. See Section 12.2.3.4, "Displaying package update events" . Test case: assuming some prior package updates were done, use the # ausearch -m SOFTWARE_UPDATE | grep pki command: FTA_SSL.4 The termination of an interactive session. ACCESS_SESSION_TERMINATED CA Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AgentV' ca-cert-find. TPS Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'TPS_AdminV' tps-user-find. FTP_TRP.1 Initiation of the trusted channel. Termination of the trusted channel. Failures of the trusted path functions. ACCESS_SESSION_ESTABLISH CA Test case: adding client certificate issued by unknown CA to nssdb and use it for running # HttpClient /root/.dogtag/pki_ecc_bootstrap/certs_db/HttpClient-cmc-p10.self.cfg. TPS Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'PKI TPS Administrator for RSA-TPS' tps-token-find. ACCESS_SESSION_TERMINATED CA Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AgentV' ca-cert-find. Test case: logging in to the CA Agent page using the role user and closing the browser. TPS Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'TPS_AdminV' tps-user-find or login to the TPS Agent page using a role user and close the browser. FCS_CKM.1 and FCS_CKM.2 Not available. There are no TOE-related functions where a TOE subsystem generates (or requests the OE to generate) a non-ephemeral key. All system certificates are generated in the same manner as user keys during the installation, before the TOE is running and, thus, before it can audit. FCS_CKM_EXT.4 Not available FCS_COP.1(2) All occurrences of signature generation using a CA signing key. CERT_SIGNING_INFO records CA signing certificate key info at system startup CERT_REQUEST_PROCESSED (success) Test case: See CERT_REQUEST_PROCESSED (success) above. OCSP_SIGNING_INFO records OCSP signing certificate key info at system startup OCSP_GENERATION (success) Test case: following the procedure in TBD "Testing CRL publishing" to run OCSPClient in order to trigger an OCSP response. CRL_SIGNING_INFO records CRL signing certificate key info at system startup FULL_CRL_GENERATION (success) Test case: removing the filters log.instance.SignedAudit.filters.FULL_CRL_GENERATION=(Outcome=Failure) and setting the revocation buffer auths.revocationChecking.bufferSize to 0 and ca.crl.MasterCRL.alwaysUpdate to true . Then revoking a certificate and invoking the UpdateCRL endpoint as per the procedure in "Testing CRL publishing" in the Installation Guide. DELTA_CRL_GENERATION (success) Test case: following all the configuration of the case and enabling the DELTA CRL ( ca.crl.MasterCRL.extension.DeltaCRLIndicator.enable to true ). Then revoking a certificate and invoking the UpdateCRL endpoint as per the procedure in "Testing CRL publishing" in the Installation Guide. Failure in signature generation. CERT_REQUEST_PROCESSED (failure) Test case: follow the CMC enrollment procedure described above, but use the profile caCMCUserCert instead of caCMCECUserCert when composing the HttpClient configuration file. OCSP_GENERATION (failure) FCS_HTTPS_EXT.1 and FCS_TLSS_EXT.2 Failure to establish a HTTPS/TLS session. ACCESS_SESSION_ESTABLISH (failure) See FTP_TRP.1 Establishment/termination of a HTTPS/TLS session ACCESS_SESSION_TERMINATED See FIA_UIA_EXT.1 FCS_TLSC_EXT.2 Failure to establish a TLS session. CLIENT_ACCESS_SESSION_ESTABLISH (failure) When Server is not reachable by Client and Session ran into failures. In this scenario, CA acts as a client for KRA during Key Archival and KRA is not reachable by CA. Test case: disabling the KRA and perform a HttpClient request. E.g. following the procedure in "Test key archival" in the Installation Guide. When CA's subsystem cert is revoked and it tried to access KRA. Test case: revoking the CA system certificate and performing the KRA test. KRA Test case: marking the CA's subsystem certificate on-hold and performing the Key archival ( CA KRA ). HttpClient triggers the event in the KRA's audit logging file. CA Test case: revoking the CA System certificate and performing the KRA test. Establishment/termination of a TLS session. CLIENT_ACCESS_SESSION_TERMINATED Test case: attempting to sign into a PKI Console without setting up CA Admin cert. FDP_CRL_EXT.1 Failure to generate a CRL. FULL_CRL_GENERATION (failure) Test case: as an agent, logging in on a CA agent WebUI portal, clicking on Update Revocation List and under Signature algorithm, selecting SHA1withRSA . Counting on SHA1withRSA still being an option in the UI, although no longer allowed. FDP_OCSPG_EXT.1 (extended) Failure to generate certificate status information. OCSP_GENERATION (failure) Test case: setting ca.ocsp=false to disable OCSP service in the CA and run OCSPClient . FIA_AFL.1 The reaching of the threshold for the Unsuccessful Authentication Attempts. The action Taken. The re-enablement of disabled non-administrative accounts. Not available. For password authentication only. Certificate System provides certificate-based authentication only. FIA_CMCS_EXT.1 CMC requests (generated or received) containing certificate requests or revocation requests. CMC responses issued. CMC_SIGNED_REQUEST_SIG_VERIFY Test case: Removing the log.instance.SignedAudit.filters.CMC_SIGNED_REQUEST_SIG_VERIFY parameter from CS.cfg and restarting the CA. Then creating and submitting an agent-signed CMC request, e.g. the procedure for the issuance of user1 's certificate under "Testing CRL publishing" in the Installation Guide. CMC_USER_SIGNED_REQUEST_SIG_VERIFY Successful request: Test case: submitting a CMC (user-signed or self-signed) certificate enrollment or revocation request and verifying the signature. E.g: Removing the log.instance.SignedAudit.filters.CMC_SIGNED_REQUEST_SIG_VERIFY parameter from CS.cfg and restarting the CA. Then creating and submitting an user-signed (shared token) request, e.g. by following 7.8.4.3 "Test the CMC Shared Token" in the Installation Guide. CMC_REQUEST_RECEIVED Successful request: Test case: a successful CMC request using SharedSecret (with cmc.popLinkWitnessRequired=true ). PROOF_OF_POSSESSION (Enrollment Event) Test case: a successful CMC request using SharedSecret (with cmc.popLinkWitnessRequired=true ). PROFILE_CERT_REQUEST (Enrollment Event) Test case: a successful CMC request signed and issued by a CA agent (with cmc.popLinkWitnessRequired=false ). CERT_STATUS_CHANGE_REQUEST Success: Test case: following the example in "Testing CRL publishing" of the Installation Guide to issue and then revoke certificate for user2 . Failure: CERT_REQUEST_PROCESSED Successful request: Test case: compelting certificate status change (revoked, expired, on-hold, off-hold). CERT_STATUS_CHANGE_REQUEST_PROCESSED Successful request: Test case: completing certificate status change (revoked, expired, on-hold, off-hold). Failed request: Completing a revocation, shrTok not found. Test case: Completing a revocation, cert issuer and request issuer do not match. Test case: Completing a revocation, on-hold cert status update. Test case: following "Testing CRL publishing" in the Installation Guide to revoke a certificate as with user2 in the example, but instead of creating/revoking an actual certificate, just editing the CMC request file so that revRequest.serial is assigned a non-existent serial number, e.g. revRequest.serial=1111111 . CMC_RESPONSE_SENT Enrollment Successful response Test case: creating a CSR by following Section 5.2, "Creating certificate signing requests (CSR)" , then creating a CMCRequest config file by following Section 5.3.1, "The CMC enrollment process" then submitting the request using HttpClient . Revocation Successful revocation Test case: revoking a certificate, for example by following the procedure in Section 6.2.1.1, "Revoking a certificate using CMCRequest " . Failed revocation Revocation does not happen Test case: revoking a non-existing certificate, for example by following the procedure in Section 6.2.1.1, "Revoking a certificate using CMCRequest " . FPT_SKY_EXT.1(2)/OTH AUTHZ Failure: Agent user attempts to retrieve audit log: Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n 'rsa_SubCA_AdminV' ca-audit-file-find. Success: Auditor user retrieved audit log: Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n 'rsa_SubCA_AuditV' ca-audit-file-find. FTP_ITC.1 Initiation of the trusted channel. Termination of the trusted channel. Failure of the trusted channel functions. See FCS_HTTPS_EXT.1 See FCS_TLSC_EXT.2 E.2. Audit Event Descriptions This section provides descriptions to audit events. For required audit events and their examples, see Section E.1, "Required audit events and their examples" . E.2.1. TOE Environment audit events This section provides the format description of TOE (Target of Evaluation) Environment audit events. E.2.2. Operational Environment audit events For Operational Environment audit events format descriptions, please see https://access.redhat.com/articles/4409591 . In addition, for events relevant to RHCS, please reference "Enable OS-level audit logs" in the Installation Guide.

Commands:
0.localhost-startStop-1
[21/May/2023:17:53:00 IST]
[14]
[6]
[AuditEvent=AUDIT_LOG_STARTUP][SubjectID=USDSystemUSD][Outcome=Success] audit function startup
0.main - [17/Mar/2023:04:31:50 EDT] [14] [6] [AuditEvent=AUDIT_LOG_STARTUP][SubjectID=USDSystemUSD][Outcome=Success] audit function startup
0.https-jsse-nio-31443-exec-11 - [25/Apr/2023:05:59:44 EDT] [14] [6] [AuditEvent=CONFIG_CERT_PROFILE][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;rules+Operation;;OP_ADD+Resource;;caFullCMCUserCertFoobar+class_id;;caEnrollImpl] certificate profile configuration parameter(s) change
0.https-jsse-nio-31443-exec-1 - [28/Apr/2023:02:13:21 EDT] [14] [6] [AuditEvent=CERT_PROFILE_APPROVAL][SubjectID=rsa_SubCA_AgentV][Outcome=Success][ProfileID=caUserCert][Op=approve] certificate profile approval
0.https-jsse-nio-32443-exec-20 - [11/May/2023:18:32:39 EDT] [14] [6] [AuditEvent=CONFIG_OCSP_PROFILE][SubjectID=ocspadmin][Outcome=Success][ParamNameValPairs=Scope;;ocspStoresRules+Operation;;OP_MODIFY+Resource;;defStore+includeNextUpdate;;false+byName;;true+implName;;com.netscape.cms.ocsp.DefStore+notFoundAsGood;;true] OCSP profile configuration parameter(s) change
0.https-jsse-nio-31443-exec-17 - [11/May/2023:18:37:05 EDT] [14] [6] [AuditEvent=CONFIG_CRL_PROFILE][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;crl+Operation;;OP_MODIFY+Resource;;MasterCRL+enableCRLUpdates;;true+updateSchema;;1+extendedNextUpdate;;true+alwaysUpdate;;true+enableDailyUpdates;;true+dailyUpdates;;1:00+enableUpdateInterval;;true+autoUpdateInterval;;241+nextUpdateGracePeriod;;1+nextAsThisUpdateExtension;;1] CRL profile configuration parameter(s) change
0.https-jsse-nio-31443-exec-18 - [11/May/2023:19:13:09 EDT] [14] [6] [AuditEvent=CONFIG_AUTH][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;instance+Operation;;OP_ADD+Resource;;AgentCertAuth+implName;;AgentCertAuth] authentication configuration parameter(s) change
0.https-jsse-nio-31443-exec-24 - [26/Apr/2023:08:29:25 EDT] [14] [6] [AuditEvent=CONFIG_ROLE][SubjectID=rsa_SubCA_AdminV][Outcome=Success][ParamNameValPairs=Scope;;users+Operation;;OP_ADD+Resource;;Test_UserV+password;; **+phone;;<null>+fullname;;Testuser+state;;<null>+userType;;<null>+email;;<null>] role configuration parameter(s) change
0.https-jsse-nio-31443-exec-5 - [26/Apr/2023:08:31:53 EDT] [14] [6] [AuditEvent=CONFIG_ROLE][SubjectID=rsa_SubCA_AdminV][Outcome=Failure][ParamNameValPairs=Scope;;users+Operation;;OP_ADD+Resource;;Test_UserV+password;; **+phone;;<null>+fullname;;Testuser+state;;<null>+userType;;<null>+email;;<null>] role configuration parameter(s) change
0.https-jsse-nio-31443-exec-9 - [11/May/2023:18:13:52 EDT] [14] [6] [AuditEvent=CONFIG_ACL][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;acls+Operation;;OP_MODIFY+Resource;;certServer.ca.crl+aci;;allow (read,update) group="Certificate Manager Agents"+desc;;Certificate Manager agents may read or update crl+rights;;read] ACL configuration parameter(s) change
0.https-jsse-jss-nio-21443-exec-5 - [23/Oct/2023:04:38:52 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=ecc_SubCA_AdminV][Outcome=Success][ParamNameValPairs=Action;;disable] signed audit configuration parameter(s) change
0.https-jsse-jss-nio-21443-exec-10 - [23/Oct/2023:04:47:23 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=ecc_SubCA_AdminV][Outcome=Success][ParamNameValPairs=Action;;enable] signed audit configuration parameter(s) change
0.https-jsse-nio-28443-exec-17 - [15/May/2023:18:30:44 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=kraadmin][Outcome=Success][ParamNameValPairs=Action;;disable] signed audit configuration parameter(s) change
0.https-jsse-nio-31443-exec-15 - [11/May/2023:19:42:24 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;logRule+Operation;;OP_MODIFY+Resource;;SignedAudit+level;;Information+rolloverInterval;;Monthly+flushInterval;;5+mandatory.events;;<null>+bufferSize;;512+maxFileSize;;2000+fileName;;/var/lib/pki/rhcs10-RSA-SubCA/logs/ca/signedAudit/ca_audit+enable;;true+signedAuditCertNickname;;NHSM-CONN-XC:auditSigningCert cert-rhcs10-RSA-SubCA CA+implName;;file+type;;signedAudit+logSigning;;true+events;;ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,AUDIT_LOG_SIGNING,AUDIT_LOG_STARTUP,AUTH,AUTHORITY_CONFIG,AUTHZ,CERT_PROFILE_APPROVAL,CERT_REQUEST_PROCESSED,CERT_SIGNING_INFO,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,CLIENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CMC_REQUEST_RECEIVED,CMC_RESPONSE_SENT,CMC_SIGNED_REQUEST_SIG_VERIFY,CMC_USER_SIGNED_REQUEST_SIG_VERIFY,CONFIG_ACL,CONFIG_AUTH,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_ENCRYPTION,CONFIG_ROLE,CONFIG_SERIAL_NUMBER,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KEY,CRL_SIGNING_INFO,DELTA_CRL_GENERATION,FULL_CRL_GENERATION,KEY_GEN_ASYMMETRIC,LOG_PATH_CHANGE,OCSP_GENERATION,OCSP_SIGNING_INFO,PROFILE_CERT_REQUEST,PROOF_OF_POSSESSION,RANDOM_GENERATION,ROLE_ASSUME,SCHEDULE_CRL_GENERATION,SECURITY_DOMAIN_UPDATE,SELFTESTS_EXECUTION,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED] signed audit configuration parameter(s) change
0.https-jsse-nio-24443-exec-4 - [15/May/2023:18:23:02 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=tksadmin][Outcome=Success][ParamNameValPairs=Action;;disable] signed audit configuration parameter(s) change
0.https-jsse-nio-25443-exec-23 - [15/May/2023:18:39:02 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=tpsadmin][Outcome=Success][ParamNameValPairs=Action;;enable] signed audit configuration parameter(s) change
0.https-jsse-nio-28443-exec-19 - [20/Jun/2023:19:43:36 EDT] [14] [6] [AuditEvent=CONFIG_DRM][SubjectID=kraadmin][Outcome=Success][ParamNameValPairs=Scope;;general+Operation;;OP_MODIFY+Resource;;RS_ID_CONFIG+noOfRequiredRecoveryAgents;;8] DRM configuration parameter(s) change
0.https-jsse-jss-nio-22443-exec-8 - [08/Sep/2023:13:01:19 EDT] [14] [6] [AuditEvent=OCSP_ADD_CA_REQUEST_PROCESSED][SubjectID=OCSP_AgentV][Outcome=Success][CASubjectDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA] Add CA for OCSP Responder
0.https-jsse-jss-nio-22443-exec-14 - [08/Sep/2023:13:04:06 EDT] [14] [6] [AuditEvent=OCSP_ADD_CA_REQUEST_PROCESSED][SubjectID=OCSP_AgentV][Outcome=Failure][CASubjectDN=<null>] Add CA for OCSP Responder
0.https-jsse-jss-nio-22443-exec-21 - [08/Sep/2023:13:06:04 EDT] [14] [6] [AuditEvent=OCSP_REMOVE_CA_REQUEST_PROCESSED][SubjectID=OCSP_AgentV][Outcome=Success][CASubjectDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA] Remove CA for OCSP Responder is successful
0.https-jsse-nio-31443-exec-15 - [28/Apr/2023:09:52:30 EDT] [14] [6] [AuditEvent=SECURITY_DOMAIN_UPDATE][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=operation;;issue_token+token;;2094141712918570861+ip;;10.0.188.59+uid;;caadmin+groupname;;Enterprise TKS Administrators] security domain update
0.https-jsse-nio-31443-exec-15 - [28/Apr/2023:09:53:10 EDT] [14] [6] [AuditEvent=SECURITY_DOMAIN_UPDATE][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=host;;ccrsa-1.rhcs10.example.com+name;;TKS ccrsa-1.rhcs10.example.com 24443+sport;;24443+clone;;false+type;;TKS+operation;;add] security domain update
0.https-jsse-jss-nio-8443-exec-13 - [18/Sep/2023:08:11:13 EDT] [14] [6] [AuditEvent=CONFIG_SERIAL_NUMBER][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=source;;updateNumberRange+type;;request+beginNumber;;9990001+endNumber;;10000000] serial number range update
0.https-jsse-jss-nio-21443-exec-8 - [18/Sep/2023:11:04:18 EDT] [14] [6] [AuditEvent=CONFIG_SERIAL_NUMBER][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=source;;updateNumberRange+type;;request+beginNumber;;9990001+endNumber;;10000000] serial number range update
0.https-jsse-jss-nio-21443-exec-8 - [21/Nov/2023:16:49:57 EST] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=USDUnidentifiedUSD][Outcome=Success][ReqID=86][CertSerialNum=229508606] certificate request processed
0.https-jsse-jss-nio-21443-exec-3 - [21/Nov/2023:16:58:45 EST] [14] [6] [AuditEvent=PROFILE_CERT_REQUEST][SubjectID=caadmin][Outcome=Success][ReqID=87][ProfileID=caECFullCMCUserCert][CertSubject=CN=ecc test ecc-user1,UID=ecc-ecc-user1] certificate request made with certificate profiles
0.https-jsse-jss-nio-21443-exec-3 - [21/Nov/2023:16:58:45 EST] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=caadmin][Outcome=Success][ReqID=87][CertSerialNum=87161545] certificate request processed
0.https-jsse-jss-nio-21443-exec-9 - [21/Nov/2023:16:57:14 EST] [14] [6] [AuditEvent=CMC_REQUEST_RECEIVED][SubjectID=caadmin][Outcome=Success][CMCRequest=MIILQQYJKoZIhvcNAQcCoIILMjCCCy4CAQMxDzANBglghkgBZQ...] CMC request received
0.https-jsse-jss-nio-21443-exec-3 - [29/Nov/2023:16:32:16 PST] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=USDUnidentifiedUSD][Outcome=Failure][ReqID=USDUnidentifiedUSD][InfoName=rejectReason][InfoValue=Proof-of-Identification Verification Failed after verifyIdentityProofV2] certificate request processed
0.https-jsse-jss-nio-21443-exec-18 - [10/Jun/2024:08:48:13 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentR,UID=ecc_SubCA_AgentR][CertSerialNum=135246246][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Failure][Info=serverAlertSent: CERTIFICATE_REVOKED] access session establish failure
0.https-jsse-jss-nio-21443-exec-19 - [10/Jun/2024:08:49:54 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentE,UID=ecc_SubCA_AgentE][CertSerialNum=70705426][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Failure][Info=serverAlertSent: CERTIFICATE_EXPIRED] access session establish failure
0.https-jsse-jss-nio-21443-exec-20 - [10/Jun/2024:09:20:34 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=PKI Administrator,E=caadmin@example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org][CertSerialNum=233456275785924569566051339521314398673][IssuerDN=CN=CA Signing Certificate,OU=topology-02-CA,O=topology-02_Foobarmaster.org][Outcome=Failure][Info=serverAlertSent: UNKNOWN_CA] access session establish failure
0.https-jsse-jss-nio-21443-exec-1 - [10/Jun/2024:09:30:21 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Failure][Info=serverAlertSent: HANDSHAKE_FAILURE] access session establish failure
0.https-jsse-jss-nio-21443-exec-7 - [10/Jun/2024:10:11:19 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AdminV,UID=ecc_SubCA_AdminV][CertSerialNum=195854754][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success] access session establish success
0.https-jsse-jss-nio-25443-exec-1 - [11/Jun/2024:05:56:34 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=TPS_AdminV,UID=TPS_AdminV][CertSerialNum=190384736][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success] access session establish success
0.https-jsse-nio-31443-exec-9 - [28/Apr/2023:06:16:11 EDT] [14] [6] [AuditEvent=AUTH][SubjectID=rsa_SubCA_AdminV][Outcome=Success][AuthMgr=certUserDBAuthMgr] authentication success
0.https-jsse-nio-25443-exec-3 - [28/Apr/2023:06:13:46 EDT] [14] [6] [AuditEvent=AUTH][SubjectID=tpsadmin][Outcome=Success][AuthMgr=certUserDBAuthMgr] authentication success
0.https-jsse-nio-31443-exec-10 - [28/Apr/2023:06:43:30 EDT] [14] [6] [AuditEvent=AUTHZ][SubjectID=rsa_SubCA_AuditV][Outcome=Success][aclResource=certServer.log.content.signedAudit][Op=read][Info=AuditResource.findAuditFiles] authorization success
0.https-jsse-nio-25443-exec-20 - [28/Apr/2023:06:46:23 EDT] [14] [6] [AuditEvent=AUTHZ][SubjectID=tpsadmin][Outcome=Success][aclResource=certServer.tps.users][Op=execute][Info=UserResource.getUser] authorization success
0.https-jsse-nio-31443-exec-4 - [28/Apr/2023:06:59:18 EDT] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=rsa_SubCA_AdminV][Outcome=Success][Role=Administrators] assume privileged role
0.https-jsse-jss-nio-25443-exec-25 - [20/Sep/2023:06:32:56 EDT] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=TPS_AgentV][Outcome=Success][Role=TPS Agents] assume privileged role
0.main - [02/May/2023:05:04:54 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=USDSystemUSD][Outcome=Failure] self tests execution (see selftests.log for details)
0.main - [01/Dec/2023:12:55:07 EST] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=USDSystemUSD][Outcome=Failure] self tests execution (see selftests.log for details)
0.main - [01/Dec/2023:12:55:07 EST] [20] [1] SystemCertsVerification: system certs verification failure: Unable to validate certificate NHSM-CONN-XC:non-existing certificate not found: NHSM-CONN-XC:non-existing certificate
0.main - [01/Dec/2023:12:55:07 EST] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED!
0.main - [02/May/2023:05:04:54 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=USDSystemUSD][Outcome=Failure] self tests execution (see selftests.log for details)
0.main - [02/May/2023:05:11:04 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=USDSystemUSD][Outcome=Failure] self tests execution (see selftests.log for details)
0.main - [27/Apr/2023:09:38:36 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=USDSystemUSD][Outcome=Success] self tests execution (see selftests.log for details)
0.main - [11/May/2023:02:35:32 EDT] [14] [6] [AuditEvent=AUDIT_LOG_STARTUP][SubjectID=USDSystemUSD][Outcome=Success] audit function startup
0.main - [02/May/2023:05:20:27 EDT] [14] [6] [AuditEvent=AUDIT_LOG_STARTUP][SubjectID=USDSystemUSD][Outcome=Success] audit function startup
0.main - [25/Apr/2023:02:30:14 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=USDSystemUSD][Outcome=Success] self tests execution (see selftests.log for details)
date Wed Nov 29 17:31:28 PST 2023
timedatectl set-timezone America/Los_Angeles
ausearch -k rhcs_audit_time_change time->Tue Nov 21 17:05:52 2023 type=PROCTITLE msg=audit(1700615152.687:92865): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573 type=SYSCALL msg=audit(1700615152.687:92865): arch=c000003e syscall=44 success=yes exit=1080 a0=3 a1=7ffcba231970 a2=438 a3=0 items=0 ppid=1060472 pid=1060487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" subj=system_u:system_r:unconfined_service_t:s0 key=(null) type=CONFIG_CHANGE msg=audit(1700615152.687:92865): auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 op=add_rule key="rhcs_audit_time_change" list=4 res=1 ---- time->Tue Nov 21 17:05:52 2023 type=PROCTITLE msg=audit(1700615152.687:92866): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573 type=SOCKADDR msg=audit(1700615152.687:92866): saddr=100000000000000000000000 type=SYSCALL msg=audit(1700615152.687:92866): arch=c000003e syscall=44 success=yes exit=1080 a0=3 a1=7ffcba231970 a2=438 a3=0 items=0 ppid=1060472 pid=1060487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" subj=system_u:system_r:unconfined_service_t:s0 key=(null) type=CONFIG_CHANGE msg=audit(1700615152.687:92866): auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 op=add_rule key="rhcs_audit_time_change" list=4 res=1 ---- time->Tue Nov 21 17:05:52 2023 type=PROCTITLE msg=audit(1700615152.687:92867): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573 type=SOCKADDR msg=audit(1700615152.687:92867): saddr=100000000000000000000000 type=SYSCALL msg=audit(1700615152.687:92867): arch=c000003e syscall=44 success=yes exit=1080 a0=3 a1=7ffcba231970 a2=438 a3=0 items=0 ppid=1060472 pid=1060487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" subj=system_u:system_r:unconfined_service_t:s0 key=(null) type=CONFIG_CHANGE msg=audit(1700615152.687:92867): auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 op=add_rule key="rhcs_audit_time_change" list=4 res=1 ---- time->Tue Nov 21 17:05:52 2023 type=PROCTITLE msg=audit(1700615152.687:92868): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573 type=SOCKADDR msg=audit(1700615152.687:92868): saddr=100000000000000000000000 type=SYSCALL msg=audit(1700615152.687:92868): arch=c000003e syscall=44 success=yes exit=1080 a0=3 a1=7ffcba231970 a2=438 a3=0 items=0 ppid=1060472 pid=1060487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" subj=system_u:system_r:unconfined_service_t:s0 key=(null) type=CONFIG_CHANGE msg=audit(1700615152.687:92868): auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 op=add_rule key="rhcs_audit_time_change" list=4 res=1 ---- <skipping over the "op=add_rule key="rhcs_audit_time_change"" events> ---- time->Tue Nov 21 17:28:14 2023 type=PROCTITLE msg=audit(1700616494.023:92874): proctitle="/usr/sbin/timedatex" type=PATH msg=audit(1700616494.023:92874): item=4 name="/etc/localtime" inode=20037025 dev=fc:03 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:locale_t:s0 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1700616494.023:92874): item=3 name="/etc/localtime" inode=16798494 dev=fc:03 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:locale_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1700616494.023:92874): item=2 name="/etc/localtime.855775472" inode=20037025 dev=fc:03 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:locale_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1700616494.023:92874): item=1 name="/etc/" inode=16798305 dev=fc:03 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(1700616494.023:92874): item=0 name="/etc/" inode=16798305 dev=fc:03 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(1700616494.023:92874): cwd="/" type=SYSCALL msg=audit(1700616494.023:92874): arch=c000003e syscall=82 success=yes exit=0 a0=7ffcb72d7a20 a1=55b57b9dcdaf a2=55b57d40cc00 a3=0 items=5 ppid=1 pid=1060749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="timedatex" exe="/usr/sbin/timedatex" subj=system_u:system_r:timedatex_t:s0 key="rhcs_audit_time_change" ---- time->Tue Nov 21 17:28:14 2023 type=PROCTITLE msg=audit(1700616494.024:92875): proctitle="/usr/sbin/timedatex" type=SYSCALL msg=audit(1700616494.024:92875): arch=c000003e syscall=164 success=yes exit=0 a0=0 a1=7ffcb72d6a08 a2=fffffffffffffe1f a3=2ce33e6c02ce33e7 items=0 ppid=1 pid=1060749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="timedatex" exe="/usr/sbin/timedatex" subj=system_u:system_r:timedatex_t:s0 key="rhcs_audit_time_change"
ausearch -m SOFTWARE_UPDATE | grep pki 30 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1289): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="pki-servlet-engine-1:9.0.30-3.module+el8.5.0+11388+9e95fe00.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/plat form-python3.6" hostname=? addr=? terminal=? res=success' 31 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1290): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="tomcatjss-7.7.2-1.module+el8pki+14677+1ef79a68.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-python3. 6" hostname=? addr=? terminal=? res=success' 32 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1291): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-server-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platfor m-python3.6" hostname=? addr=? terminal=? res=success' 33 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1292): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-acme-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform- python3.6" hostname=? addr=? terminal=? res=success' 34 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1293): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-ca-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-py thon3.6" hostname=? addr=? terminal=? res=success' 35 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1294): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-est-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-p ython3.6" hostname=? addr=? terminal=? res=success' 36 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1295): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-kra-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-p ython3.6" hostname=? addr=? terminal=? res=success' 37 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1296): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-ocsp-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform- python3.6" hostname=? addr=? terminal=? res=success' 38 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1297): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-tks-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-p ython3.6" hostname=? addr=? terminal=? res=success' 39 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1298): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-tps-10.13.5-2.module+el8pki+17707+69a21d82.x86_64" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-p ython3.6" hostname=? addr=? terminal=? res=success' 40 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1299): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install sw="redhat-pki-10.13.5-2.module+el8pki+17707+69a21d82.x86_64" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-pytho n3.6" hostname=? addr=? terminal=? res=success
0.https-jsse-jss-nio-21443-exec-5 - [10/Jun/2024:13:18:54 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentV,UID=ecc_SubCA_AgentV][CertSerialNum=72118278][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
0.https-jsse-jss-nio-25443-exec-6 - [11/Jun/2024:05:56:36 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=TPS_AdminV,UID=TPS_AdminV][CertSerialNum=190384736][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
0.https-jsse-jss-nio-21443-exec-20 - [10/Jun/2024:09:20:34 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=PKI Administrator,E=caadmin@example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org][CertSerialNum=233456275785924569566051339521314398673][IssuerDN=CN=CA Signing Certificate,OU=topology-02-CA,O=topology-02_Foobarmaster.org][Outcome=Failure][Info=serverAlertSent: UNKNOWN_CA] access session establish failure
0.https-jsse-jss-nio-25443-exec-7 - [11/Jun/2024:06:00:52 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=PKI Administrator,E=tpsadmin@example.com,OU=rhcs10-RSA-TPS,O=Example-SubCA][CertSerialNum=32899047][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success] access session establish success
0.https-jsse-jss-nio-21443-exec-7 - [10/Jun/2024:10:36:08 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentV,UID=ecc_SubCA_AgentV][CertSerialNum=72118278][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
0.https-jsse-jss-nio-21443-exec-11 - [10/Jun/2024:13:35:09 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentV,UID=ecc_SubCA_AgentV][CertSerialNum=72118278][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
0.https-jsse-jss-nio-25443-exec-20 - [11/Jun/2024:06:03:06 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=TPS_AdminV,UID=TPS_AdminV][CertSerialNum=190384736][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
0.https-jsse-nio-8443-exec-5 - [25/Apr/2023:02:26:34 EDT] [14] [6] [AuditEvent=CERT_SIGNING_INFO][SubjectID=USDSystemUSD][Outcome=Success][SKI=96:44:A6:53:DB:AF:3D:C3:3D:A0:00:0A:84:CB:6E:0E:B5:3E:4E:10] certificate signing info
0.https-jsse-nio-8443-exec-3 - [25/Apr/2023:02:28:17 EDT] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=caadmin][Outcome=Success][ReqID=7][CertSerialNum=165675596] certificate request processed
0.main - [25/Apr/2023:02:28:39 EDT] [14] [6] [AuditEvent=OCSP_SIGNING_INFO][SubjectID=USDSystemUSD][Outcome=Success][SKI=A3:AB:71:4C:E0:C8:8B:E4:6D:08:5B:10:EC:F3:E4:6B:F3:70:EB:57] OCSP signing info
0.http-nio-32080-exec-1 - [25/Apr/2023:06:07:29 EDT] [14] [6] [AuditEvent=OCSP_GENERATION][SubjectID=USDNonRoleUserUSD][Outcome=Success] OCSP response generation
0.main - [25/Apr/2023:05:55:22 EDT] [14] [6] [AuditEvent=CRL_SIGNING_INFO][SubjectID=USDSystemUSD][Outcome=Success][SKI=2C:E1:7C:DB:B0:6E:62:36:70:67:B7:BF:19:80:4C:D0:8F:B5:80:02] CRL signing info
0.Thread-17 - [04/May/2023:05:46:26 EDT] [14] [6] [AuditEvent=FULL_CRL_GENERATION][SubjectID=USDUnidentifiedUSD][Outcome=Success][CRLnum=62] Full CRL generation
0.Thread-17 - [04/May/2023:06:29:03 EDT] [14] [6] [AuditEvent=DELTA_CRL_GENERATION][SubjectID=USDUnidentifiedUSD][Outcome=Success][CRLnum=63] Delta CRL generation
0.https-jsse-jss-nio-21443-exec-18 - [14/Sep/2023:13:44:35 EDT] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=USDNonRoleUserUSD][Outcome=Failure][ReqID=71][InfoName=rejectReason][InfoValue=Request 71 Rejected - Key Type RSA Not Matched] certificate request processed
0.http-nio-32080-exec-15 - [25/Apr/2023:02:47:47 EDT] [14] [6] [AuditEvent=OCSP_GENERATION][SubjectID=USDNonRoleUserUSD][Outcome=Failure][FailureReason=End-of-file reached while decoding ASN.1 header] OCSP response generation
0.https-jsse-jss-nio-21443-exec-15 - [10/Jun/2024:12:29:16 EDT] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=10.0.188.72][ServerHost=rhcs10.example.com][ServerPort=23443][SubjectID=SYSTEM][Outcome=Failure][Info=send:java.io.IOException: Socket has been closed, and cannot be reused.] access session failed to establish when Certificate System acts as client
0.https-jsse-jss-nio-23443-exec-1 - [10/Jun/2024:12:35:25 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=Subsystem Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][CertSerialNum=208481924][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Failure][Info=serverAlertSent: CERTIFICATE_REVOKED] access session establish failure
0.https-jsse-jss-nio-21443-exec-3 - [10/Jun/2024:12:35:25 EDT] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=10.0.188.72][ServerHost=rhcs10.example.com][ServerPort=23443][SubjectID=SYSTEM][Outcome=Failure][Info=send:java.io.IOException: Socket has been closed, and cannot be reused.] access session failed to establish when Certificate System acts as client
0.ConnectAsync - [10/Jun/2024:12:35:25 EDT] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=10.0.188.72][ServerHost=10.0.188.72][ServerPort=23443][SubjectID=CN=rhcs10.example.com,OU=rhcs10-ECC-KRA,O=Example-SubCA][CertSerialNum=42383494][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][Info=clientAlertReceived: CERTIFICATE_REVOKED] access session terminated when Certificate System acts as client
0.https-jsse-jss-nio-31443-exec-9 - [11/Jun/2024:09:31:47 EDT] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=10.0.188.72][ServerHost=10.0.188.64][ServerPort=7636][SubjectID=CN=rhds11-5.example.com][CertSerialNum=119813240][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client
0.CRLIssuingPoint-MasterCRL - [11/May/2023:00:09:42 EDT] [14] [6] [AuditEvent=FULL_CRL_GENERATION][SubjectID=USDUnidentifiedUSD][Outcome=Failure][FailureReason=Signing algorithm not supported: SHA1withRSA: Unable to create signing context: (-8011) Unknown error] Full CRL generation
0.http-nio-31080-exec-1 - [30/Nov/2023:18:50:51 EST] [14] [6] [AuditEvent=OCSP_GENERATION][SubjectID=USDNonRoleUserUSD][Outcome=Failure][FailureReason=OCSP service disabled] OCSP response generation
0.https-jsse-jss-nio-21443-exec-3 - [25/Nov/2023:16:47:47 PST] [14] [6] [AuditEvent=CMC_SIGNED_REQUEST_SIG_VERIFY][SubjectID=CN=PKI Administrator,E=example@redhat.com,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][ReqType=enrollment][CertSubject=CN=ecc test ecc-user1,UID=ecc-ecc-user1][SignerInfo=CN=PKI Administrator,E=example@redhat.com,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA] agent signed CMC request signature verification
0.https-jsse-jss-nio-21443-exec-6 - [25/Nov/2023:17:02:13 PST] [14] [6] [AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY][SubjectID=CN=PKI Administrator,E=example@redhat.com,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][ReqType=enrollment][CertSubject=CN=eccFooUser123,UID=eccFooUser123,OU=self-signed][SignerInfo=USDUnidentifiedUSD] User signed CMC request signature verification success
0.https-jsse-jss-nio-21443-exec-8 - [21/Nov/2023:16:49:57 EST] [14] [6] [AuditEvent=CMC_REQUEST_RECEIVED][SubjectID=USDUnidentifiedUSD][Outcome=Success][CMCRequest=MIIDYgYJKoZIhvcNAQcCoIIDUzCCA08CAQMxDzANBglghkgBZQMEAgEFA...] CMC request received
0.https-jsse-jss-nio-21443-exec-8 - [21/Nov/2023:16:49:57 EST] [14] [6] [AuditEvent=PROOF_OF_POSSESSION][SubjectID=eccFooUser123][Outcome=Success][Info=method=EnrollProfile: fillTaggedRequest: ] proof of possession
0.https-jsse-jss-nio-21443-exec-3 - [21/Nov/2023:16:58:45 EST] [14] [6] [AuditEvent=PROFILE_CERT_REQUEST][SubjectID=caadmin][Outcome=Success][ReqID=87][ProfileID=caECFullCMCUserCert][CertSubject=CN=ecc test ecc-user1,UID=ecc-ecc-user1] certificate request made with certificate profiles
[AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=CN=ecc test ecc-user2,UID=ecc-ecc-user2][Outcome=Success][ReqID=14][CertSerialNum=15390937][RequestType=revoke][RevokeReasonNum=Unspecified][Approval=complete] certificate status change request processed
0.https-jsse-nio-31443-exec-5 - [09/May/2023:16:42:56 EDT] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST][SubjectID=caadmin][Outcome=Failure][ReqID=<null>][CertSerialNum=0x2c192ac][RequestType=on-hold] certificate revocation/unrevocation request made
0.https-jsse-nio-31443-exec-24 - [28/Apr/2023:09:58:07 EDT] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=caadmin][Outcome=Success][ReqID=67][CertSerialNum=86198753] certificate request processed
0.https-jsse-nio-31443-exec-14 - [09/May/2023:17:29:35 EDT] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=rsa_SubCA_AgentV][Outcome=Success][ReqID=80][CertSerialNum=0x2c192ac][RequestType=<null>][RevokeReasonNum=6][Approval=complete] certificate status change request processed
0.http-bio-20443-exec-14 - [29/Jan/2019:07:15:27 EST] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=<null>][Outcome=Failure][ReqID=<null>][CertSerialNum=20][RequestType=revoke][RevokeReasonNum=Certificate_Hold][Approval=rejected][Info=CMCOutputTemplate: SharedSecret.getSharedToken(BigInteger serial): shrTok not found in metaInfo] certificate status change request processed
0.http-bio-20443-exec-20 - [29/Jan/2019:07:30:41 EST] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=UID=user1a,OU=People,DC=rhel76,DC=test][Outcome=Failure][ReqID=<null>][CertSerialNum=20][RequestType=revoke][RevokeReasonNum=Certificate_Hold][Approval=rejected][Info= certificate issuer DN and revocation request issuer DN do not match] certificate status change request processed
0.https-jsse-jss-nio-21443-exec-12 - [27/Nov/2023:11:34:53 PST] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=<null>][Outcome=Failure][ReqID=<null>][CertSerialNum=1111111][RequestType=revoke][RevokeReasonNum=Unspecified][Approval=rejected][Info= The certificate is not found] certificate status change request processed
0.https-jsse-nio-31443-exec-8 - [01/May/2023:23:37:50 EDT] [14] [6] [AuditEvent=CMC_RESPONSE_SENT][SubjectID=FooUser123][Outcome=Success][CMCResponse=MIIM+wYJkwWSE/] CMC response sent
0.http-bio-20443-exec-9 - [29/Jan/2019:07:43:36 EST] [14] [6] [AuditEvent=CMC_RESPONSE_SENT][SubjectID=USDUnidentifiedUSD][Outcome=Success][CMCResponse=MIIExgYJKoZ...] CMC response sent
0.https-jsse-nio-31443-exec-8 - [01/May/2023:23:37:50 EDT] [14] [6] [AuditEvent=CMC_RESPONSE_SENT][SubjectID=FooUser123][Outcome=Success][CMCResponse=MIIM+wYJKoZIh...] CMC response sent
0.https-jsse-nio-31443-exec-24 - [03/May/2023:08:30:38 EDT] [14] [6] [AuditEvent=AUTHZ][SubjectID=rsa_SubCA_AdminV][Outcome=Failure][aclResource=certServer.log.content.signedAudit][Op=read][Info=Authorization Error] authorization failure
0.https-jsse-nio-31443-exec-5 - [03/May/2023:08:31:11 EDT] [14] [6] [AuditEvent=AUTHZ][SubjectID=rsa_SubCA_AuditV][Outcome=Success][aclResource=certServer.log.content.signedAudit][Op=read][Info=AuditResource.findAuditFiles] authorization success
####################### SIGNED AUDIT EVENTS ############################# Common fields: - Outcome: "Success" or "Failure" - SubjectID: The UID of the user responsible for the operation "USDSystemUSD" or "SYSTEM" if system-initiated operation (e.g. log signing). # ######################################################################### Required Audit Events # Event: ACCESS_SESSION_ESTABLISH with [Outcome=Failure] Description: This event is used when access session failed to establish. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - ClientIP: Client IP address. - ServerIP: Server IP address. - SubjectID: Client certificate subject DN. - Outcome: Failure - Info: Failure reason. # LOGGING_SIGNED_AUDIT_ACCESS_SESSION_ESTABLISH_FAILURE= <type=ACCESS_SESSION_ESTABLISH>:[AuditEvent=ACCESS_SESSION_ESTABLISH]{0} access session establish failure # Event: ACCESS_SESSION_ESTABLISH with [Outcome=Success] Description: This event is used when access session was established successfully. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - ClientIP: Client IP address. - ServerIP: Server IP address. - SubjectID: Client certificate subject DN. - Outcome: Success # LOGGING_SIGNED_AUDIT_ACCESS_SESSION_ESTABLISH_SUCCESS= <type=ACCESS_SESSION_ESTABLISH>:[AuditEvent=ACCESS_SESSION_ESTABLISH]{0} access session establish success # Event: ACCESS_SESSION_TERMINATED Description: This event is used when access session was terminated. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - ClientIP: Client IP address. - ServerIP: Server IP address. - SubjectID: Client certificate subject DN. - Info: The TLS Alert received from NSS - Outcome: Success - Info: The TLS Alert received from NSS # LOGGING_SIGNED_AUDIT_ACCESS_SESSION_TERMINATED= <type=ACCESS_SESSION_TERMINATED>:[AuditEvent=ACCESS_SESSION_TERMINATED]{0} access session terminated # Event: AUDIT_LOG_SIGNING Description: This event is used when a signature on the audit log is generated (same as "flush" time). Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: Predefined to be "USDSystemUSD" because this operation associates with no user. - Outcome: Success - sig: The base-64 encoded signature of the buffer just flushed. # LOGGING_SIGNED_AUDIT_AUDIT_LOG_SIGNING_3=[AuditEvent=AUDIT_LOG_SIGNING][SubjectID={0}][Outcome={1}] signature of audit buffer just flushed: sig: {2} # Event: AUDIT_LOG_STARTUP Description: This event is used at audit function startup. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: USDSystemUSD - Outcome: # LOGGING_SIGNED_AUDIT_AUDIT_LOG_STARTUP_2=<type=AUDIT_LOG_STARTUP>:[AuditEvent=AUDIT_LOG_STARTUP][SubjectID={0}][Outcome={1}] audit function startup # Event: AUTH with [Outcome=Failure] Description: This event is used when authentication fails. In case of SSL-client auth, only webserver env can pick up the SSL violation. CS authMgr can pick up certificate mismatch, so this event is used. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: Failure (obviously, if authentication failed, you won't have a valid SubjectID, so in this case, SubjectID should be USDUnidentifiedUSD) - AuthMgr: The authentication manager instance name that did this authentication. - AttemptedCred: The credential attempted and failed. # LOGGING_SIGNED_AUDIT_AUTH_FAIL=<type=AUTH>:[AuditEvent=AUTH]{0} authentication failure # Event: AUTH with [Outcome=Success] Description: This event is used when authentication succeeded. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: id of user who has been authenticated - Outcome: Success - AuthMgr: The authentication manager instance name that did this authentication. # LOGGING_SIGNED_AUDIT_AUTH_SUCCESS=<type=AUTH>:[AuditEvent=AUTH]{0} authentication success # Event: AUTHZ with [Outcome=Failure] Description: This event is used when authorization has failed. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: id of user who has failed to be authorized for an action - Outcome: Failure - aclResource: The ACL resource ID as defined in ACL resource list. - Op: One of the operations as defined with the ACL statement e.g. "read" for an ACL statement containing "(read,write)". - Info: # LOGGING_SIGNED_AUDIT_AUTHZ_FAIL=<type=AUTHZ>:[AuditEvent=AUTHZ]{0} authorization failure # Event: AUTHZ with [Outcome=Success] Description: This event is used when authorization is successful. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: id of user who has been authorized for an action - Outcome: Success - aclResource: The ACL resource ID as defined in ACL resource list. - Op: One of the operations as defined with the ACL statement e.g. "read" for an ACL statement containing "(read,write)". # LOGGING_SIGNED_AUDIT_AUTHZ_SUCCESS=<type=AUTHZ>:[AuditEvent=AUTHZ]{0} authorization success # Event: CERT_PROFILE_APPROVAL Description: This event is used when an agent approves/disapproves a certificate profile set by the administrator for automatic approval. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: id of the CA agent who approved the certificate enrollment profile - Outcome: - ProfileID: One of the profiles defined by the administrator and to be approved by an agent. - Op: "approve" or "disapprove". # LOGGING_SIGNED_AUDIT_CERT_PROFILE_APPROVAL_4=<type=CERT_PROFILE_APPROVAL>:[AuditEvent=CERT_PROFILE_APPROVAL][SubjectID={0}][Outcome={1}][ProfileID={2}][Op={3}] certificate profile approval # Event: CERT_REQUEST_PROCESSED Description: This event is used when certificate request has just been through the approval process. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: The UID of the agent who approves, rejects, or cancels the certificate request. - Outcome: - ReqID: The request ID. - InfoName: "certificate" (in case of approval), "rejectReason" (in case of reject), or "cancelReason" (in case of cancel) - InfoValue: The certificate (in case of success), a reject reason in text, or a cancel reason in text. - CertSerialNum: # LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED=<type=CERT_REQUEST_PROCESSED>:[AuditEvent=CERT_REQUEST_PROCESSED]{0} certificate request processed # Event: CERT_SIGNING_INFO Description: This event indicates which key is used to sign certificates. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: USDSystemUSD - Outcome: Success - SKI: Subject Key Identifier of the certificate signing certificate - AuthorityID: (applicable only to lightweight CA) # LOGGING_SIGNED_AUDIT_CERT_SIGNING_INFO=<type=CERT_SIGNING_INFO>:[AuditEvent=CERT_SIGNING_INFO]{0} certificate signing info # Event: CERT_STATUS_CHANGE_REQUEST Description: This event is used when a certificate status change request (e.g. revocation) is made (before approval process). Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: id of uer who performed the action - Outcome: - ReqID: The request ID. - CertSerialNum: The serial number (in hex) of the certificate to be revoked. - RequestType: "revoke", "on-hold", "off-hold" # LOGGING_SIGNED_AUDIT_CERT_STATUS_CHANGE_REQUEST=<type=CERT_STATUS_CHANGE_REQUEST>:[AuditEvent=CERT_STATUS_CHANGE_REQUEST]{0} certificate revocation/unrevocation request made # Event: CERT_STATUS_CHANGE_REQUEST_PROCESSED Description: This event is used when certificate status is changed (revoked, expired, on-hold, off-hold). Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: The UID of the agent that processed the request. - Outcome: - ReqID: The request ID. - RequestType: "revoke", "on-hold", "off-hold" - Approval: "complete", "rejected", or "canceled" (note that "complete" means "approved") - CertSerialNum: The serial number (in hex). - RevokeReasonNum: One of the following number: reason number reason -------------------------------------- 0 Unspecified 1 Key compromised 2 CA key compromised (should not be used) 3 Affiliation changed 4 Certificate superceded 5 Cessation of operation 6 Certificate is on-hold - Info: # LOGGING_SIGNED_AUDIT_CERT_STATUS_CHANGE_REQUEST_PROCESSED=<type=CERT_STATUS_CHANGE_REQUEST_PROCESSED>:[AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED]{0} certificate status change request processed # Event: CLIENT_ACCESS_SESSION_ESTABLISH with [Outcome=Failure] Description: This event is when access session failed to establish when Certificate System acts as client. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - ClientHost: Client hostname. - ServerHost: Server hostname. - ServerPort: Server port. - SubjectID: SYSTEM - Outcome: Failure - Info: # LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_ESTABLISH_FAILURE= <type=CLIENT_ACCESS_SESSION_ESTABLISH>:[AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH]{0} access session failed to establish when Certificate System acts as client # Event: CLIENT_ACCESS_SESSION_ESTABLISH with [Outcome=Success] Description: This event is used when access session was established successfully when Certificate System acts as client. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - ClientHost: Client hostname. - ServerHost: Server hostname. - ServerPort: Server port. - SubjectID: SYSTEM - Outcome: Success # LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS= <type=CLIENT_ACCESS_SESSION_ESTABLISH>:[AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH]{0} access session establish successfully when Certificate System acts as client # Event: CLIENT_ACCESS_SESSION_TERMINATED Description: This event is used when access session was terminated when Certificate System acts as client. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - ClientHost: Client hostname. - ServerHost: Server hostname. - ServerPort: Server port. - SubjectID: SYSTEM - Outcome: Success - Info: The TLS Alert received from NSS # LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_TERMINATED= <type=CLIENT_ACCESS_SESSION_TERMINATED>:[AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED]{0} access session terminated when Certificate System acts as client # Event: CMC_REQUEST_RECEIVED Description: This event is used when a CMC request is received. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: The UID of user that triggered this event. If CMC requests is signed by an agent, SubjectID should be that of the agent. In case of an unsigned request, it would bear USDUnidentifiedUSD. - Outcome: - CMCRequest: Base64 encoding of the CMC request received # LOGGING_SIGNED_AUDIT_CMC_REQUEST_RECEIVED_3=<type=CMC_REQUEST_RECEIVED>:[AuditEvent=CMC_REQUEST_RECEIVED][SubjectID={0}][Outcome={1}][CMCRequest={2}] CMC request received # Event: CMC_RESPONSE_SENT Description: This event is used when a CMC response is sent. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: The UID of user that triggered this event. - Outcome: - CMCResponse: Base64 encoding of the CMC response sent # LOGGING_SIGNED_AUDIT_CMC_RESPONSE_SENT_3=<type=CMC_RESPONSE_SENT>:[AuditEvent=CMC_RESPONSE_SENT][SubjectID={0}][Outcome={1}][CMCResponse={2}] CMC response sent # Event: CMC_SIGNED_REQUEST_SIG_VERIFY Description: This event is used when agent signed CMC certificate requests or revocation requests are submitted and signature is verified. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: the user who signed the CMC request (success case) - Outcome: - ReqType: The request type (enrollment, or revocation). - CertSubject: The certificate subject name of the certificate request. - SignerInfo: A unique String representation for the signer. # LOGGING_SIGNED_AUDIT_CMC_SIGNED_REQUEST_SIG_VERIFY=<type=CMC_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_SIGNED_REQUEST_SIG_VERIFY]{0} agent signed CMC request signature verification # Event: CMC_USER_SIGNED_REQUEST_SIG_VERIFY Description: This event is used when CMC (user-signed or self-signed) certificate requests or revocation requests are submitted and signature is verified. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: the user who signed the CMC request (success case) - Outcome: - ReqType: The request type (enrollment, or revocation). - CertSubject: The certificate subject name of the certificate request. - CMCSignerInfo: A unique String representation for the CMC request signer. - info: # LOGGING_SIGNED_AUDIT_CMC_USER_SIGNED_REQUEST_SIG_VERIFY_FAILURE=<type=CMC_USER_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY]{0} User signed CMC request signature verification failure LOGGING_SIGNED_AUDIT_CMC_USER_SIGNED_REQUEST_SIG_VERIFY_SUCCESS=<type=CMC_USER_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY]{0} User signed CMC request signature verification success # Event: CONFIG_ACL Description: This event is used when configuring ACL information. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_ACL_3=<type=CONFIG_ACL>:[AuditEvent=CONFIG_ACL][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] ACL configuration parameter(s) change # Event: CONFIG_AUTH Description: This event is used when configuring authentication. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- Password MUST NOT be logged --- # LOGGING_SIGNED_AUDIT_CONFIG_AUTH_3=<type=CONFIG_AUTH>:[AuditEvent=CONFIG_AUTH][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] authentication configuration parameter(s) change # Event: CONFIG_CERT_PROFILE Description: This event is used when configuring certificate profile (general settings and certificate profile). Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE_3=<type=CONFIG_CERT_PROFILE>:[AuditEvent=CONFIG_CERT_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] certificate profile configuration parameter(s) change # Event: CONFIG_CRL_PROFILE Description: This event is used when configuring CRL profile (extensions, frequency, CRL format). Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_CRL_PROFILE_3=<type=CONFIG_CRL_PROFILE>:[AuditEvent=CONFIG_CRL_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] CRL profile configuration parameter(s) change # Event: CONFIG_DRM Description: This event is used when configuring KRA. This includes key recovery scheme, change of any secret component. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- secret component (password) MUST NOT be logged --- # LOGGING_SIGNED_AUDIT_CONFIG_DRM_3=<type=CONFIG_DRM>:[AuditEvent=CONFIG_DRM][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] DRM configuration parameter(s) change # Event: CONFIG_OCSP_PROFILE Description: This event is used when configuring OCSP profile (everything under Online Certificate Status Manager). Applicable subsystems: OCSP Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_OCSP_PROFILE_3=<type=CONFIG_OCSP_PROFILE>:[AuditEvent=CONFIG_OCSP_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] OCSP profile configuration parameter(s) change # Event: CONFIG_ROLE Description: This event is used when configuring role information. This includes anything under users/groups, add/remove/edit a role, etc. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_ROLE=<type=CONFIG_ROLE>:[AuditEvent=CONFIG_ROLE]{0} role configuration parameter(s) change # Event: CONFIG_SERIAL_NUMBER Description: This event is used when configuring serial number ranges (when requesting a serial number range when cloning, for example). Applicable subsystems: CA, KRA Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_SERIAL_NUMBER_1=<type=CONFIG_SERIAL_NUMBER>:[AuditEvent=CONFIG_SERIAL_NUMBER][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] serial number range update # Event: CONFIG_SIGNED_AUDIT Description: This event is used when configuring signedAudit. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: id of administrator who performed the action - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_SIGNED_AUDIT=<type=CONFIG_SIGNED_AUDIT>:[AuditEvent=CONFIG_SIGNED_AUDIT]{0} signed audit configuration parameter(s) change # Event: CONFIG_TRUSTED_PUBLIC_KEY Description: This event is used when: 1. "Manage Certificate" is used to edit the trustness of certificates and deletion of certificates 2. "Certificate Setup Wizard" is used to import CA certificates into the certificate database (Although CrossCertificatePairs are stored within internaldb, audit them as well) Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: ID of administrator who performed this configuration - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_TRUSTED_PUBLIC_KEY=<type=CONFIG_TRUSTED_PUBLIC_KEY>:[AuditEvent=CONFIG_TRUSTED_PUBLIC_KEY]{0} certificate database configuration # Event: CRL_SIGNING_INFO Description: This event indicates which key is used to sign CRLs. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: USDSystemUSD - Outcome: - SKI: Subject Key Identifier of the CRL signing certificate # LOGGING_SIGNED_AUDIT_CRL_SIGNING_INFO=<type=CRL_SIGNING_INFO>:[AuditEvent=CRL_SIGNING_INFO]{0} CRL signing info # Event: DELTA_CRL_GENERATION Description: This event is used when delta CRL generation is complete. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: USDUnidentifiedUSD - Outcome: "Success" when delta CRL is generated successfully, "Failure" otherwise. - CRLnum: The CRL number that identifies the CRL - Info: - FailureReason: # LOGGING_SIGNED_AUDIT_DELTA_CRL_GENERATION=<type=DELTA_CRL_GENERATION>:[AuditEvent=DELTA_CRL_GENERATION]{0} Delta CRL generation # Event: FULL_CRL_GENERATION Description: This event is used when full CRL generation is complete. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: USDSystemUSD - Outcome: "Success" when full CRL is generated successfully, "Failure" otherwise. - CRLnum: The CRL number that identifies the CRL - Info: - FailureReason: # LOGGING_SIGNED_AUDIT_FULL_CRL_GENERATION=<type=FULL_CRL_GENERATION>:[AuditEvent=FULL_CRL_GENERATION]{0} Full CRL generation # Event: PROFILE_CERT_REQUEST Description: This event is used when a profile certificate request is made (before approval process). Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: The UID of user that triggered this event. If CMC enrollment requests signed by an agent, SubjectID should be that of the agent. - Outcome: - CertSubject: The certificate subject name of the certificate request. - ReqID: The certificate request ID. - ProfileID: One of the certificate profiles defined by the administrator. # LOGGING_SIGNED_AUDIT_PROFILE_CERT_REQUEST_5=<type=PROFILE_CERT_REQUEST>:[AuditEvent=PROFILE_CERT_REQUEST][SubjectID={0}][Outcome={1}][ReqID={2}][ProfileID={3}][CertSubject={4}] certificate request made with certificate profiles # Event: PROOF_OF_POSSESSION Description: This event is used for proof of possession during certificate enrollment processing. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: id that represents the authenticated user - Outcome: - Info: some information on when/how it occurred # LOGGING_SIGNED_AUDIT_PROOF_OF_POSSESSION_3=<type=PROOF_OF_POSSESSION>:[AuditEvent=PROOF_OF_POSSESSION][SubjectID={0}][Outcome={1}][Info={2}] proof of possession # Event: OCSP_ADD_CA_REQUEST_PROCESSED Description: This event is used when an add CA request to the OCSP Responder is processed. Applicable subsystems: OCSP Enabled by default: Yes Fields: - SubjectID: OCSP administrator user id - Outcome: "Success" when CA is added successfully, "Failure" otherwise. - CASubjectDN: The subject DN of the leaf CA cert in the chain. # LOGGING_SIGNED_AUDIT_OCSP_ADD_CA_REQUEST_PROCESSED=<type=OCSP_ADD_CA_REQUEST_PROCESSED>:[AuditEvent=OCSP_ADD_CA_REQUEST_PROCESSED]{0} Add CA for OCSP Responder # Event: OCSP_GENERATION Description: This event is used when an OCSP response generated is complete. Applicable subsystems: CA, OCSP Enabled by default: Yes Fields: - SubjectID: USDNonRoleUserUSD - Outcome: "Success" when OCSP response is generated successfully, "Failure" otherwise. - FailureReason: # LOGGING_SIGNED_AUDIT_OCSP_GENERATION=<type=OCSP_GENERATION>:[AuditEvent=OCSP_GENERATION]{0} OCSP response generation # Event: OCSP_REMOVE_CA_REQUEST_PROCESSED with [Outcome=Failure] Description: This event is used when a remove CA request to the OCSP Responder is processed and failed. Applicable subsystems: OCSP Enabled by default: Yes Fields: - SubjectID: OCSP administrator user id - Outcome: Failure - CASubjectDN: The subject DN of the leaf CA certificate in the chain. # LOGGING_SIGNED_AUDIT_OCSP_REMOVE_CA_REQUEST_PROCESSED_FAILURE=<type=OCSP_REMOVE_CA_REQUEST_PROCESSED>:[AuditEvent=OCSP_REMOVE_CA_REQUEST_PROCESSED]{0} Remove CA for OCSP Responder has failed # Event: OCSP_REMOVE_CA_REQUEST_PROCESSED with [Outcome=Success] Description: This event is used when a remove CA request to the OCSP Responder is processed successfully. Applicable subsystems: OCSP Enabled by default: Yes Fields: - SubjectID: OCSP administrator user id - Outcome: "Success" when CA is removed successfully, "Failure" otherwise. - CASubjectDN: The subject DN of the leaf CA certificate in the chain. # LOGGING_SIGNED_AUDIT_OCSP_REMOVE_CA_REQUEST_PROCESSED_SUCCESS=<type=OCSP_REMOVE_CA_REQUEST_PROCESSED>:[AuditEvent=OCSP_REMOVE_CA_REQUEST_PROCESSED]{0} Remove CA for OCSP Responder is successful # Event: OCSP_SIGNING_INFO Description: This event indicates which key is used to sign OCSP responses. Applicable subsystems: CA, OCSP Enabled by default: Yes Fields: - SubjectID: USDSystemUSD - Outcome: - SKI: Subject Key Identifier of the OCSP signing certificate - AuthorityID: (applicable only to lightweight CA) # LOGGING_SIGNED_AUDIT_OCSP_SIGNING_INFO=<type=OCSP_SIGNING_INFO>:[AuditEvent=OCSP_SIGNING_INFO]{0} OCSP signing info # Event: ROLE_ASSUME Description: This event is used when a user assumes a role. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - Role: One of the valid roles: "Administrators", "Certificate Manager Agents", or "Auditors". Note that customized role names can be used once configured. # LOGGING_SIGNED_AUDIT_ROLE_ASSUME=<type=ROLE_ASSUME>:[AuditEvent=ROLE_ASSUME]{0} assume privileged role # Event: SECURITY_DOMAIN_UPDATE Description: This event is used when updating contents of security domain (add/remove a subsystem). Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: CA administrator user ID - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_SECURITY_DOMAIN_UPDATE_1=<type=SECURITY_DOMAIN_UPDATE>:[AuditEvent=SECURITY_DOMAIN_UPDATE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] security domain update # Event: SELFTESTS_EXECUTION Description: This event is used when self tests are run. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: USDSystemUSD - Outcome: # LOGGING_SIGNED_AUDIT_SELFTESTS_EXECUTION_2=<type=SELFTESTS_EXECUTION>:[AuditEvent=SELFTESTS_EXECUTION][SubjectID={0}][Outcome={1}] self tests execution (see selftests.log for details) ######################################################################### Available Audit Events - Enabled by default: Yes ######################################################################### # Event: SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST Description: This event is used when Server-Side Keygen enrollment keygen request is made. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: - Outcome: - RequestID: - ClientID: # LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST=<type=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST]{0} Server-Side Keygen enrollment keygen request made # Event: SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST_PROCESSED Description: This event is used when a request to do Server-Side Keygen enrollment keygen has been processed is processed. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - RequestID: - ClientID: - FailureReason: # LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST_PROCESSED=<type=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST_PROCESSED>:[AuditEvent=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST_PROCESSED]{0} Server-Side Keygen enrollment keygen request processed # Event: SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST Description: This event is used when Server-Side Keygen enrollment key retrieval request is made. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: - Outcome: - RequestID: - ClientID: # LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST=<type=SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST]{0} Server-Side Keygen enrollment retrieval request made # Event: SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST_PROCESSED Description: This event is used when a request to do Server-Side Keygen enrollment retrieval has been processed is processed. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - RequestID: - ClientID: - FailureReason: # LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST_PROCESSED=<type=SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST_PROCESSED>:[AuditEvent=SERVER_SIDE_KEYGEN_ENROLL_RETRIEVAL_REQUEST_PROCESSED]{0} Server-Side Keygen enrollment retrieval request processed # Event: ASYMKEY_GENERATION_REQUEST Description: This event is used when asymmetric key generation request is made. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - GenerationRequestID: - ClientKeyID: # LOGGING_SIGNED_AUDIT_ASYMKEY_GENERATION_REQUEST=<type=ASYMKEY_GENERATION_REQUEST>:[AuditEvent=ASYMKEY_GENERATION_REQUEST]{0} Asymkey generation request made # Event: ASYMKEY_GENERATION_REQUEST_PROCESSED Description: This event is used when a request to generate asymmetric keys received by the KRA is processed. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - GenerationRequestID: - ClientKeyID: - KeyID: - FailureReason: # LOGGING_SIGNED_AUDIT_ASYMKEY_GEN_REQUEST_PROCESSED=<type=ASYMKEY_GENERATION_REQUEST_PROCESSED>:[AuditEvent=ASYMKEY_GENERATION_REQUEST_PROCESSED]{0} Asymkey generation request processed # Event: AUTHORITY_CONFIG Description: This event is used when configuring lightweight authorities. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_AUTHORITY_CONFIG_3=<type=AUTHORITY_CONFIG>:[AuditEvent=AUTHORITY_CONFIG][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] lightweight authority configuration change # Event: CONFIG_ENCRYPTION Description: This event is used when configuring encryption (cert settings and SSL cipher preferences). Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_ENCRYPTION_3=<type=CONFIG_ENCRYPTION>:[AuditEvent=CONFIG_ENCRYPTION][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] encryption configuration parameter(s) change # Event: CONFIG_TOKEN_AUTHENTICATOR Description: This event is used when configuring token authenticators. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - OP: - Authenticator: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- secret component (password) MUST NOT be logged --- - Info: Error info for failed cases. # LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_AUTHENTICATOR_6=<type=CONFIG_TOKEN_AUTHENTICATOR>:[AuditEvent=CONFIG_TOKEN_AUTHENTICATOR][SubjectID={0}][Outcome={1}][OP={2}][Authenticator={3}][ParamNameValPairs={4}][Info={5}] token authenticator configuration parameter(s) change # Event: CONFIG_TOKEN_CONNECTOR Description: This event is used when configuring token connectors. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - Service: can be any of the methods offered - Connector: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- secret component (password) MUST NOT be logged --- - Info: Error info for failed cases. # LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_CONNECTOR_6=<type=CONFIG_TOKEN_CONNECTOR>:[AuditEvent=CONFIG_TOKEN_CONNECTOR][SubjectID={0}][Outcome={1}][Service={2}][Connector={3}][ParamNameValPairs={4}][Info={5}] token connector configuration parameter(s) change # Event: CONFIG_TOKEN_MAPPING_RESOLVER Description: This event is used when configuring token mapping resolver. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: TPS administrator id - Outcome: - Service: - MappingResolverID: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- secret component (password) MUST NOT be logged --- - Info: Error info for failed cases. # LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_MAPPING_RESOLVER_6=<type=CONFIG_TOKEN_MAPPING_RESOLVER>:[AuditEvent=CONFIG_TOKEN_MAPPING_RESOLVER][SubjectID={0}][Outcome={1}][Service={2}][MappingResolverID={3}][ParamNameValPairs={4}][Info={5}] token mapping resolver configuration parameter(s) change # Event: CONFIG_TOKEN_RECORD Description: This event is used when information in token record changed. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: TPS administrator id - Outcome: - OP: operation to add or delete token - TokenID: smart card unique id - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- secret component (password) MUST NOT be logged --- - Info: in general is used for capturing error info for failed cases # LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_RECORD_6=<type=CONFIG_TOKEN_RECORD>:[AuditEvent=CONFIG_TOKEN_RECORD][SubjectID={0}][Outcome={1}][OP={2}][TokenID={3}][ParamNameValPairs={4}][Info={5}] token record configuration parameter(s) change # Event: KEY_GEN_ASYMMETRIC Description: This event is used when asymmetric keys are generated such as when CA certificate requests are generated, e.g. CA certificate change over, renewal with new key. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - PubKey: The base-64 encoded public key material. # LOGGING_SIGNED_AUDIT_KEY_GEN_ASYMMETRIC_3=<type=KEY_GEN_ASYMMETRIC>:[AuditEvent=KEY_GEN_ASYMMETRIC][SubjectID={0}][Outcome={1}][PubKey={2}] asymmetric key generation # Event: LOG_PATH_CHANGE Description: This event is used when log file name (including any path changes) for any of audit, system, transaction, or other customized log file change is attempted. The ACL should not allow this operation, but make sure it's written after the attempt. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: administrator user id - Outcome: - LogType: "System", "Transaction", or "SignedAudit" - toLogFile: The name (including any path changes) that the user is attempting to change to. # LOGGING_SIGNED_AUDIT_LOG_PATH_CHANGE_4=<type=LOG_PATH_CHANGE>:[AuditEvent=LOG_PATH_CHANGE][SubjectID={0}][Outcome={1}][LogType={2}][toLogFile={3}] log path change attempt # Event: RANDOM_GENERATION Description: This event is used when a random number generation is complete. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: "Success" when a random number is generated successfully, "Failure" otherwise. - Info: - Caller: PKI code that calls the random number generator. - Size: Size of random number in bytes. - FailureReason: # LOGGING_SIGNED_AUDIT_RANDOM_GENERATION=<type=RANDOM_GENERATION>:[AuditEvent=RANDOM_GENERATION]{0} Random number generation # Event: SCHEDULE_CRL_GENERATION Description: This event is used when CRL generation is scheduled. Applicable subsystems: CA Enabled by default: Yes Fields: - SubjectID: - Outcome: "Success" when CRL generation is scheduled successfully, "Failure" otherwise. - FailureReason: # LOGGING_SIGNED_AUDIT_SCHEDULE_CRL_GENERATION=<type=SCHEDULE_CRL_GENERATION>:[AuditEvent=SCHEDULE_CRL_GENERATION]{0} schedule for CRL generation # Event: SECURITY_DATA_ARCHIVAL_REQUEST Description: This event is used when security data recovery request is made. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - ArchivalRequestID: The requestID provided by the CA through the connector. It is used to track the request through from CA to KRA. - RequestId: The KRA archival request ID. - ClientKeyID: The user supplied client ID associated with the security data to be archived. - FailureReason: # LOGGING_SIGNED_AUDIT_SECURITY_DATA_ARCHIVAL_REQUEST=<type=SECURITY_DATA_ARCHIVAL_REQUEST>:[AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST]{0} security data archival request made # Event: SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED Description: This event is used when user security data archive request is processed. This is when KRA receives and processed the request. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - ArchivalRequestID: The requestID provided by the CA through the connector. It is used to track the request through from CA to KRA. - RequestId: The KRA archival request ID. - ClientKeyID: The user supplied client ID associated with the security data to be archived. - KeyID: - PubKey: - FailureReason: # LOGGING_SIGNED_AUDIT_SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED=<type=SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED>:[AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED]{0} security data archival request processed # Event: SECURITY_DATA_RECOVERY_REQUEST Description: This event is used when security data recovery request is made. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - RecoveryID: The recovery request ID. - DataID: The ID of the security data being requested to be recovered. - PubKey: # LOGGING_SIGNED_AUDIT_SECURITY_DATA_RECOVERY_REQUEST=<type=SECURITY_DATA_RECOVERY_REQUEST>:[AuditEvent=SECURITY_DATA_RECOVERY_REQUEST]{0} security data recovery request made # Event: SECURITY_DATA_RECOVERY_REQUEST_PROCESSED Description: This event is used when security data recovery request is processed. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - RecoveryID: The recovery request ID. - KeyID: The ID of the security data being requested to be recovered. - RecoveryAgents: The UIDs of the recovery agents approving this request. - FailureReason: # LOGGING_SIGNED_AUDIT_SECURITY_DATA_RECOVERY_REQUEST_PROCESSED=<type=SECURITY_DATA_RECOVERY_REQUEST_PROCESSED>:[AuditEvent=SECURITY_DATA_RECOVERY_REQUEST_PROCESSED]{0} security data recovery request processed # Event: SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE Description: This event is used when KRA agents login as recovery agents to change the state of key recovery requests. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - RecoveryID: The recovery request ID. - Operation: The operation performed (approve, reject, cancel etc.). # LOGGING_SIGNED_AUDIT_SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE=<type=SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE>:[AuditEvent=SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE]{0} security data recovery request state change # Event: SERVER_SIDE_KEYGEN_REQUEST Description: This event is used when server-side key generation request is made. This is for token keys. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - EntityID: The representation of the subject that will be on the certificate when issued. - RequestID: # LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST=<type=SERVER_SIDE_KEYGEN_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST]{0} server-side key generation request # Event: SERVER_SIDE_KEYGEN_REQUEST_PROCESSED Description: This event is used when server-side key generation request has been processed. This is for token keys. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - EntityID: The representation of the subject that will be on the certificate when issued. - RequestID: - PubKey: The base-64 encoded public key associated with the private key to be archived. # LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED=<type=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED]{0} server-side key generation request processed # Event: SYMKEY_GENERATION_REQUEST Description: This event is used when symmetric key generation request is made. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - GenerationRequestID: - ClientKeyID: The ID of the symmetric key to be generated and archived. # LOGGING_SIGNED_AUDIT_SYMKEY_GENERATION_REQUEST=<type=SYMKEY_GENERATION_REQUEST>:[AuditEvent=SYMKEY_GENERATION_REQUEST]{0} symkey generation request made # Event: SYMKEY_GENERATION_REQUEST_PROCESSED Description: This event is used when symmetric key generation request is processed. This is when KRA receives and processes the request. Applicable subsystems: KRA Enabled by default: Yes Fields: - SubjectID: - Outcome: - GenerationRequestID: - ClientKeyID: The user supplied client ID associated with the symmetric key to be generated and archived. - KeyID: - FailureReason: # LOGGING_SIGNED_AUDIT_SYMKEY_GEN_REQUEST_PROCESSED=<type=SYMKEY_GENERATION_REQUEST_PROCESSED>:[AuditEvent=SYMKEY_GENERATION_REQUEST_PROCESSED]{0} symkey generation request processed # Event: TOKEN_APPLET_UPGRADE with [Outcome=Failure] Description: This event is used when token apple upgrade failed. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - IP: - CUID: - MSN: - KeyVersion: - oldAppletVersion: - newAppletVersion: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_APPLET_UPGRADE_FAILURE=<type=TOKEN_APPLET_UPGRADE>:[AuditEvent=TOKEN_APPLET_UPGRADE]{0} token applet upgrade failure # Event: TOKEN_APPLET_UPGRADE with [Outcome=Success] Description: This event is used when token apple upgrade succeeded. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - IP: - CUID: - MSN: - KeyVersion: - oldAppletVersion: - newAppletVersion: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_APPLET_UPGRADE_SUCCESS=<type=TOKEN_APPLET_UPGRADE>:[AuditEvent=TOKEN_APPLET_UPGRADE]{0} token applet upgrade success # Event: TOKEN_KEY_CHANGEOVER with [Outcome=Failure] Description: This event is used when token key changeover failed. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - IP: - CUID: - MSN: - tokenType: - AppletVersion: - oldKeyVersion: - newKeyVersion: - Info: Info in case of failure. # LOGGING_SIGNED_AUDIT_TOKEN_KEY_CHANGEOVER_FAILURE=<type=TOKEN_KEY_CHANGEOVER>:[AuditEvent=TOKEN_KEY_CHANGEOVER]{0} token key changeover failure # Event: TOKEN_KEY_CHANGEOVER with [Outcome=Success] Description: This event is used when token key changeover succeeded. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - IP: - CUID: - MSN: - tokenType: - AppletVersion: - oldKeyVersion: - newKeyVersion: - Info: Usually is unused for success. # LOGGING_SIGNED_AUDIT_TOKEN_KEY_CHANGEOVER_SUCCESS=<type=TOKEN_KEY_CHANGEOVER>:[AuditEvent=TOKEN_KEY_CHANGEOVER]{0} token key changeover success # Event: TOKEN_KEY_CHANGEOVER_REQUIRED Description: This event is used when token key changeover is required. Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - IP: - CUID: - MSN: - tokenType: - AppletVersion: - oldKeyVersion: - newKeyVersion: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_KEY_CHANGEOVER_REQUIRED_10=<type=TOKEN_KEY_CHANGEOVER_REQUIRED>:[AuditEvent=TOKEN_KEY_CHANGEOVER_REQUIRED][IP={0}][SubjectID={1}][CUID={2}][MSN={3}][Outcome={4}][tokenType={5}][AppletVersion={6}][oldKeyVersion={7}][newKeyVersion={8}][Info={9}] token key changeover required # Event: LOGGING_SIGNED_AUDIT_TOKEN_KEY_SANITY_CHECK_SUCCESS Description: used for the CS.cfg properties: enableBoundedGPKeyVersion, cuidMustMatchKDD, and validateCardKeyInfoAgainstTokenDB Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - IP: - CUID: - KDD: - TokenKeyVersion: - NewKeyVersion: - TokenDBKeyVersion: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_KEY_SANITY_CHECK_SUCCESS_9=<type=TOKEN_KEY_SANITY_CHECK>:[AuditEvent=TOKEN_KEY_SANITY_CHECK][IP={0}][SubjectID={1}][CUID={2}][KDD={3}][Outcome={4}][TokenKeyVersion={5}][NewKeyVersion={6}][TokenDBKeyVersion={7}][Info={8}] token key sanity check success # Event: LOGGING_SIGNED_AUDIT_TOKEN_KEY_SANITY_CHECK_FAILURE Description: used for the CS.cfg properties: enableBoundedGPKeyVersion, cuidMustMatchKDD, and validateCardKeyInfoAgainstTokenDB Applicable subsystems: TPS Enabled by default: Yes Fields: - SubjectID: - Outcome: - IP: - CUID: - KDD: - TokenKeyVersion: - NewKeyVersion: - TokenDBKeyVersion: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_KEY_SANITY_CHECK_FAILURE_9=<type=TOKEN_KEY_SANITY_CHECK>:[AuditEvent=TOKEN_KEY_SANITY_CHECK][IP={0}][SubjectID={1}][CUID={2}][KDD={3}][Outcome={4}][TokenKeyVersion={5}][NewKeyVersion={6}][TokenDBKeyVersion={7}][Info={8}] token key sanity check failure +# ######################################################################### Available Audit Events - Enabled by default: No ######################################################################### # Event: AUDIT_LOG_DELETE Description: This event is used AFTER audit log gets expired. The ACL should not allow this operation, but it is provided in case ACL gets compromised. Make sure it is written AFTER the log expiration happens. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: No Fields: - SubjectID: - Outcome: - LogFile: The complete name (including the path) of the signedAudit log that is attempted to be deleted. # LOGGING_SIGNED_AUDIT_LOG_DELETE_3=<type=AUDIT_LOG_DELETE>:[AuditEvent=AUDIT_LOG_DELETE][SubjectID={0}][Outcome={1}][LogFile={2}] signedAudit log deletion # Event: AUDIT_LOG_SHUTDOWN Description: This event is used at audit function shutdown. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: No Fields: - SubjectID: - Outcome: # LOGGING_SIGNED_AUDIT_AUDIT_LOG_SHUTDOWN_2=<type=AUDIT_LOG_SHUTDOWN>:[AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID={0}][Outcome={1}] audit function shutdown # Event: CIMC_CERT_VERIFICATION Description: This event is used for verifying CS system certificates. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: No Fields: - SubjectID: - Outcome: - CertNickName: The certificate nickname. # LOGGING_SIGNED_AUDIT_CIMC_CERT_VERIFICATION_3=<type=CIMC_CERT_VERIFICATION>:[AuditEvent=CIMC_CERT_VERIFICATION][SubjectID={0}][Outcome={1}][CertNickName={2}] CS certificate verification # Event: CMC_ID_POP_LINK_WITNESS Description: This event is used for identification and POP linking verification during CMC request processing. Applicable subsystems: CA Enabled by default: No Fields: - SubjectID: - Outcome: - Info: # LOGGING_SIGNED_AUDIT_CMC_ID_POP_LINK_WITNESS_3=<type=CMC_ID_POP_LINK_WITNESS>:[AuditEvent=CMC_ID_POP_LINK_WITNESS][SubjectID={0}][Outcome={1}][Info={2}] Identification Proof of Possession linking witness verification # Event: CMC_PROOF_OF_IDENTIFICATION Description: This event is used for proof of identification during CMC request processing. Applicable subsystems: CA Enabled by default: No Fields: - SubjectID: In case of success, "SubjectID" is the actual identified identification. In case of failure, "SubjectID" is the attempted identification. - Outcome: - Info: # LOGGING_SIGNED_AUDIT_CMC_PROOF_OF_IDENTIFICATION_3=<type=CMC_PROOF_OF_IDENTIFICATION>:[AuditEvent=CMC_PROOF_OF_IDENTIFICATION][SubjectID={0}][Outcome={1}][Info={2}] proof of identification in CMC request # Event: COMPUTE_RANDOM_DATA_REQUEST Description: This event is used when the request for TPS to TKS to get random challenge data is received. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - Outcome: - AgentID: The trusted agent ID used to make the request. # LOGGING_SIGNED_AUDIT_COMPUTE_RANDOM_DATA_REQUEST_2=<type=COMPUTE_RANDOM_DATA_REQUEST>:[AuditEvent=COMPUTE_RANDOM_DATA_REQUEST][Outcome={0}][AgentID={1}] TKS Compute random data request # Event: COMPUTE_RANDOM_DATA_REQUEST_PROCESSED with [Outcome=Failure] Description: This event is used when the request for TPS to TKS to get random challenge data is processed unsuccessfully. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - Outcome: Success or Failure. - Status: 0 for no error. - Error: The error message. - AgentID: The trusted agent ID used to make the request. # LOGGING_SIGNED_AUDIT_COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE=<type=COMPUTE_RANDOM_DATA_REQUEST_PROCESSED>:[AuditEvent=COMPUTE_RANDOM_DATA_REQUEST_PROCCESED]{0} TKS Compute random data request failed # Event: COMPUTE_RANDOM_DATA_REQUEST_PROCESSED with [Outcome=Success] Description: This event is used when the request for TPS to TKS to get random challenge data is processed successfully. Applicable subsystems: TKS, TPS Fields: - Outcome: Success or Failure. - Status: 0 for no error. - AgentID: The trusted agent ID used to make the request. # LOGGING_SIGNED_AUDIT_COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS=<type=COMPUTE_RANDOM_DATA_REQUEST_PROCESSED>:[AuditEvent=COMPUTE_RANDOM_DATA_REQUEST_PROCESSED]{0} TKS Compute random data request processed successfully # Event: COMPUTE_SESSION_KEY_REQUEST Description: This event is used when the request for TPS to TKS to get a session key for secure channel is received. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - Outcome: - AgentID: The trusted agent ID used to make the request. ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the ## CUID. Renamed to "CUID_encoded" and "KDD_encoded" to reflect fact that ## encoded parameters are being logged. - CUID_encoded: The special-encoded CUID of the token establishing the secure channel. - KDD_encoded: The special-encoded KDD of the token establishing the secure channel. # LOGGING_SIGNED_AUDIT_COMPUTE_SESSION_KEY_REQUEST_4=<type=COMPUTE_SESSION_KEY_REQUEST>:[AuditEvent=COMPUTE_SESSION_KEY_REQUEST][CUID_encoded={0}][KDD_encoded={1}][Outcome={2}][AgentID={3}] TKS Compute session key request # Event: COMPUTE_SESSION_KEY_REQUEST_PROCESSED with [Outcome=Failure] Description: This event is used when the request for TPS to TKS to get a session key for secure channel is processed unsuccessfully. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - Outcome: Failure - status: Error code or 0 for no error. - AgentID: The trusted agent ID used to make the request. - IsCryptoValidate: tells if the card cryptogram is to be validated - IsServerSideKeygen: tells if the keys are to be generated on server - SelectedToken: The cryptographic token performing key operations. - KeyNickName: The numeric keyset, e.g. #01#01. - Error: The error message. # ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID. Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged. ## Also added TKSKeyset, KeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel. - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel. - TKSKeyset: The name of the TKS keyset being used for this request. - KeyInfo_KeyVersion: The key version number requested in hex. - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex. - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex. # LOGGING_SIGNED_AUDIT_COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE=<type=COMPUTE_SESSION_KEY_REQUEST_PROCESSED>:[AuditEvent=COMPUTE_SESSION_KEY_REQUEST_PROCESSED]{0} TKS Compute session key request failed # Event: COMPUTE_SESSION_KEY_REQUEST_PROCESSED with [Outcome=Success] Description: This event is used when the request for TPS to TKS to get a session key for secure channel is processed successfully. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - AgentID: The trusted agent ID used to make the request. - Outcome: Success - status: 0 for no error. - IsCryptoValidate: tells if the card cryptogram is to be validated - IsServerSideKeygen: tells if the keys are to be generated on server - SelectedToken: The cryptographic token performing key operations. - KeyNickName: The number keyset, e.g. #01#01. # ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the ## CUID. Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact ## that decoded parameters are now logged. ## Also added TKSKeyset, KeyInfo_KeyVersion, ## NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel. - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel. - TKSKeyset: The name of the TKS keyset being used for this request. - KeyInfo_KeyVersion: The key version number requested in hex. - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex. - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex. # LOGGING_SIGNED_AUDIT_COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS=<type=COMPUTE_SESSION_KEY_REQUEST_PROCESSED>:[AuditEvent=COMPUTE_SESSION_KEY_REQUEST_PROCESSED]{0} TKS Compute session key request processed successfully # Event: CONFIG_CERT_POLICY Description: This event is used when configuring certificate policy constraints and extensions. Applicable subsystems: CA Enabled by default: No Fields: - SubjectID: - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. # LOGGING_SIGNED_AUDIT_CONFIG_CERT_POLICY_3=<type=CONFIG_CERT_POLICY>:[AuditEvent=CONFIG_CERT_POLICY][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] certificate policy constraint or extension configuration parameter(s) change # Event: CONFIG_TOKEN_GENERAL Description: This event is used when doing general TPS configuration. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- secret component (password) MUST NOT be logged --- - Info: Error info for failed cases. # LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_GENERAL_5=<type=CONFIG_TOKEN_GENERAL>:[AuditEvent=CONFIG_TOKEN_GENERAL][SubjectID={0}][Outcome={1}][Service={2}][ParamNameValPairs={3}][Info={4}] TPS token configuration parameter(s) change # Event: CONFIG_TOKEN_PROFILE Description: This event is used when configuring token profile. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - Service: can be any of the methods offered - ProfileID: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- secret component (password) MUST NOT be logged --- - Info: Error info for failed cases. # LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_PROFILE_6=<type=CONFIG_TOKEN_PROFILE>:[AuditEvent=CONFIG_TOKEN_PROFILE][SubjectID={0}][Outcome={1}][Service={2}][ProfileID={3}][ParamNameValPairs={4}][Info={5}] token profile configuration parameter(s) change # Event: CRL_RETRIEVAL Description: This event is used when CRLs are retrieved by the OCSP Responder. Applicable subsystems: OCSP Enabled by default: No Fields: - SubjectID: - Outcome: "Success" when CRL is retrieved successfully, "Failure" otherwise. - CRLnum: The CRL number that identifies the CRL. # LOGGING_SIGNED_AUDIT_CRL_RETRIEVAL_3=<type=CRL_RETRIEVAL>:[AuditEvent=CRL_RETRIEVAL][SubjectID={0}][Outcome={1}][CRLnum={2}] CRL retrieval # Event: CRL_VALIDATION Description: This event is used when CRL is retrieved and validation process occurs. Applicable subsystems: OCSP Enabled by default: No Fields: - SubjectID: - Outcome: # LOGGING_SIGNED_AUDIT_CRL_VALIDATION_2=<type=CRL_VALIDATION>:[AuditEvent=CRL_VALIDATION][SubjectID={0}][Outcome={1}] CRL validation # Event: DELTA_CRL_PUBLISHING Description: This event is used when delta CRL publishing is complete. Applicable subsystems: CA Enabled by default: No Fields: - SubjectID: - Outcome: "Success" when delta CRL is publishing successfully, "Failure" otherwise. - CRLnum: - FailureReason: # LOGGING_SIGNED_AUDIT_DELTA_CRL_PUBLISHING=<type=DELTA_CRL_PUBLISHING>:[AuditEvent=DELTA_CRL_PUBLISHING]{0} Delta CRL publishing # Event: DIVERSIFY_KEY_REQUEST Description: This event is used when the request for TPS to TKS to do key changeover is received. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - Outcome: - AgentID: The trusted agent ID used to make the request. - oldMasterKeyName: The old master key name. - newMasterKeyName: The new master key name. # ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID. Renamed to "CUID_encoded" and "KDD_encoded" to reflect fact that encoded parameters are being logged. - CUID_encoded: The special-encoded CUID of the token establishing the secure channel. - KDD_encoded: The special-encoded KDD of the token establishing the secure channel. # LOGGING_SIGNED_AUDIT_DIVERSIFY_KEY_REQUEST_6=<type=DIVERSIFY_KEY_REQUEST>:[AuditEvent=DIVERSIFY_KEY_REQUEST][CUID_encoded={0}][KDD_encoded={1}][Outcome={2}][AgentID={3}][oldMasterKeyName={4}][newMasterKeyName={5}] TKS Key Change Over request # Event: DIVERSIFY_KEY_REQUEST_PROCESSED with [Outcome=Failure] Description: This event is when the request for TPS to TKS to do key changeover is processed unsuccessfully. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - AgentID: The trusted agent ID used to make the request. - Outcome: Failure - status: 0 for success, non-zero for various errors. - oldMasterKeyName: The old master key name. - newMasterKeyName: The new master key name. - Error: The error message. # ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID. Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged. ## Also added TKSKeyset, OldKeyInfo_KeyVersion, NewKeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel. - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel. - TKSKeyset: The name of the TKS keyset being used for this request. - OldKeyInfo_KeyVersion: The old key version number in hex. - NewKeyInfo_KeyVersion: The new key version number in hex. - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex. - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex. # LOGGING_SIGNED_AUDIT_DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE=<type=DIVERSIFY_KEY_REQUEST_PROCESSED>:[AuditEvent=DIVERSIFY_KEY_REQUEST_PROCESSED]{0} TKS Key Change Over request failed # Event: DIVERSIFY_KEY_REQUEST_PROCESSED with [Outcome=Success] Description: This event is used when the request for TPS to TKS to do key changeover is processed successfully. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - AgentID: The trusted agent ID used to make the request. - Outcome: Success - status: 0 for success, non-zero for various errors. - oldMasterKeyName: The old master key name. - newMasterKeyName: The new master key name. # ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID. Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged. ## Also added TKSKeyset, OldKeyInfo_KeyVersion, NewKeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel. - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel. - TKSKeyset: The name of the TKS keyset being used for this request. - OldKeyInfo_KeyVersion: The old key version number in hex. - NewKeyInfo_KeyVersion: The new key version number in hex. - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex. - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex. # LOGGING_SIGNED_AUDIT_DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS=<type=DIVERSIFY_KEY_REQUEST_PROCESSED>:[AuditEvent=DIVERSIFY_KEY_REQUEST_PROCESSED]{0} TKS Key Change Over request processed successfully # Event: ENCRYPT_DATA_REQUEST Description: This event is used when the request from TPS to TKS to encrypt data (or generate random data and encrypt) is received. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - SubjectID: The CUID of the token requesting encrypt data. - AgentID: The trusted agent ID used to make the request. - status: 0 for success, non-zero for various errors. - isRandom: tells if the data is randomly generated on TKS # ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID. Renamed to "CUID_encoded" and "KDD_encoded" to reflect fact that encoded parameters are being logged. - CUID_encoded: The special-encoded CUID of the token establishing the secure channel. - KDD_encoded: The special-encoded KDD of the token establishing the secure channel. # LOGGING_SIGNED_AUDIT_ENCRYPT_DATA_REQUEST_4=<type=ENCRYPT_DATA_REQUEST>:[AuditEvent=ENCRYPT_DATA_REQUEST][SubjectID={0}][status={1}][AgentID={2}][isRandom={3}] TKS encrypt data request LOGGING_SIGNED_AUDIT_ENCRYPT_DATA_REQUEST_5=<type=ENCRYPT_DATA_REQUEST>:[AuditEvent=ENCRYPT_DATA_REQUEST][CUID_encoded={0}][KDD_encoded={1}][status={2}][AgentID={3}][isRandom={4}] TKS encrypt data request # Event: ENCRYPT_DATA_REQUEST_PROCESSED with [Outcome=Failure] Description: This event is used when the request from TPS to TKS to encrypt data (or generate random data and encrypt) is processed unsuccessfully. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - AgentID: The trusted agent ID used to make the request. - Outcome: Failure - status: 0 for success, non-zero for various errors. - isRandom: tells if the data is randomly generated on TKS - SelectedToken: The cryptographic token performing key operations. - KeyNickName: The numeric keyset, e.g. #01#01. - Error: The error message. # ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID. Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged. ## Also added TKSKeyset, KeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel. - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel. - TKSKeyset: The name of the TKS keyset being used for this request. - KeyInfo_KeyVersion: The key version number requested in hex. - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex. - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex. # LOGGING_SIGNED_AUDIT_ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE=<type=ENCRYPT_DATA_REQUEST_PROCESSED>:[AuditEvent=ENCRYPT_DATA_REQUEST_PROCESSED]{0} TKS encrypt data request failed # Event: ENCRYPT_DATA_REQUEST_PROCESSED with [Outcome=Success] Description: This event is used when the request from TPS to TKS to encrypt data (or generate random data and encrypt) is processed successfully. Applicable subsystems: TKS, TPS Enabled by default: No Fields: - AgentID: The trusted agent ID used to make the request. - Outcome: Success - status: 0 for success, non-zero for various errors. - isRandom: tells if the data is randomly generated on TKS - SelectedToken: The cryptographic token performing key operations. - KeyNickName: The numeric keyset, e.g. #01#01. # ## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID. Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged. ## Also added TKSKeyset, KeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel. - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel. - TKSKeyset: The name of the TKS keyset being used for this request. - KeyInfo_KeyVersion: The key version number requested in hex. - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex. - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex. # LOGGING_SIGNED_AUDIT_ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS=<type=ENCRYPT_DATA_REQUEST_PROCESSED>:[AuditEvent=ENCRYPT_DATA_REQUEST_PROCESSED]{0} TKS encrypt data request processed successfully # Event: FULL_CRL_PUBLISHING Description: This event is used when full CRL publishing is complete. Applicable subsystems: CA Enabled by default: No Fields: - SubjectID: - Outcome: "Success" when full CRL is publishing successfully, "Failure" otherwise. - CRLnum: - FailureReason: # LOGGING_SIGNED_AUDIT_FULL_CRL_PUBLISHING=<type=FULL_CRL_PUBLISHING>:[AuditEvent=FULL_CRL_PUBLISHING]{0} Full CRL publishing # Event: INTER_BOUNDARY Description: This event is used when inter-CS boundary data transfer is successful. This is used when data does not need to be captured. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: No Fields: - SubjectID: - Outcome: - ProtectionMethod: "SSL" or "unknown". - ReqType: The request type. - ReqID: The request ID. # LOGGING_SIGNED_AUDIT_INTER_BOUNDARY_SUCCESS_5=<type=INTER_BOUNDARY>:[AuditEvent=INTER_BOUNDARY][SubjectID={0}][Outcome={1}][ProtectionMethod={2}][ReqType={3}][ReqID={4}] inter-CS boundary communication (data exchange) success # Event: KEY_RECOVERY_AGENT_LOGIN Description: This event is used when KRA agents login as recovery agents to approve key recovery requests. Applicable subsystems: KRA Enabled by default: No Fields: - SubjectID: - Outcome: - RecoveryID: The recovery request ID. - RecoveryAgent: The recovery agent the KRA agent is logging in with. # LOGGING_SIGNED_AUDIT_KEY_RECOVERY_AGENT_LOGIN_4=<type=KEY_RECOVERY_AGENT_LOGIN>:[AuditEvent=KEY_RECOVERY_AGENT_LOGIN][SubjectID={0}][Outcome={1}][RecoveryID={2}][RecoveryAgent={3}] key recovery agent login # Event: KEY_RECOVERY_REQUEST Description: This event is used when key recovery request is made. Applicable subsystems: CA, OCSP, TKS, TPS, TPS Enabled by default: No Fields: - SubjectID: - Outcome: - RecoveryID: The recovery request ID. - PubKey: The base-64 encoded public key associated with the private key to be recovered. # LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_4=<type=KEY_RECOVERY_REQUEST>:[AuditEvent=KEY_RECOVERY_REQUEST][SubjectID={0}][Outcome={1}][RecoveryID={2}][PubKey={3}] key recovery request made # Event: KEY_STATUS_CHANGE Description: This event is used when modify key status is executed. Applicable subsystems: KRA Enabled by default: No Fields: - SubjectID: - Outcome: - KeyID: An existing key ID in the database. - OldStatus: The old status to change from. - NewStatus: The new status to change to. - Info: # LOGGING_SIGNED_AUDIT_KEY_STATUS_CHANGE=<type=KEY_STATUS_CHANGE>:[AuditEvent=KEY_STATUS_CHANGE]{0} Key Status Change # Event: LOG_EXPIRATION_CHANGE (disabled) Description: This event is used when log expiration time change is attempted. The ACL should not allow this operation, but make sure it's written after the attempt. Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: No Fields: - SubjectID: - Outcome: - LogType: "System", "Transaction", or "SignedAudit". - ExpirationTime: The amount of time (in seconds) that is attempted to be changed to. # #LOGGING_SIGNED_AUDIT_LOG_EXPIRATION_CHANGE_4=<type=LOG_EXPIRATION_CHANGE>:[AuditEvent=LOG_EXPIRATION_CHANGE][SubjectID={0}][Outcome={1}][LogType={2}][ExpirationTime={3}] log expiration time change attempt # Event: NON_PROFILE_CERT_REQUEST Description: This event is used when a non-profile certificate request is made (before approval process). Applicable subsystems: CA, KRA, OCSP, TKS, TPS Enabled by default: No Fields: - SubjectID: The UID of user that triggered this event. If CMC enrollment requests signed by an agent, SubjectID should be that of the agent. - Outcome: - CertSubject: The certificate subject name of the certificate request. - ReqID: The certificate request ID. - ServiceID: The identity of the servlet that submitted the original request. # LOGGING_SIGNED_AUDIT_NON_PROFILE_CERT_REQUEST_5=<type=NON_PROFILE_CERT_REQUEST>:[AuditEvent=NON_PROFILE_CERT_REQUEST][SubjectID={0}][Outcome={1}][ReqID={2}][ServiceID={3}][CertSubject={4}] certificate request made without certificate profiles # Event: OCSP_ADD_CA_REQUEST Description: This event is used when a CA is attempted to be added to the OCSP Responder. Applicable subsystems: OCSP Enabled by default: No Fields: - SubjectID: - Outcome: - CA: The base-64 encoded PKCS7 certificate (or chain). # LOGGING_SIGNED_AUDIT_OCSP_ADD_CA_REQUEST=<type=OCSP_ADD_CA_REQUEST>:[AuditEvent=OCSP_ADD_CA_REQUEST]{0} request to add a CA for OCSP Responder # Event: OCSP_REMOVE_CA_REQUEST Description: This event is used when a CA is attempted to be removed from the OCSP Responder. Applicable subsystems: OCSP Enabled by default: No Fields: - SubjectID: - Outcome: - CASubjectDN: The DN ID of the CA. # LOGGING_SIGNED_AUDIT_OCSP_REMOVE_CA_REQUEST=<type=OCSP_REMOVE_CA_REQUEST>:[AuditEvent=OCSP_REMOVE_CA_REQUEST]{0} request to remove a CA from OCSP Responder # Event: SECURITY_DATA_EXPORT_KEY Description: This event is used when user attempts to retrieve key after the recovery request has been approved. Applicable subsystems: KRA Enabled by default: No Fields: - SubjectID: - Outcome: - RecoveryID: The recovery request ID. - KeyID: The key being retrieved. - Info: The failure reason if the export fails. - PubKey: The public key for the private key being retrieved. # LOGGING_SIGNED_AUDIT_SECURITY_DATA_EXPORT_KEY=<type=SECURITY_DATA_EXPORT_KEY>:[AuditEvent=SECURITY_DATA_EXPORT_KEY]{0} security data retrieval request # Event: SECURITY_DATA_INFO Description: This event is used when user attempts to get metadata information about a key. Applicable subsystems: KRA Enabled by default: No Fields: - SubjectID: - Outcome: - KeyID: The key being retrieved. - ClientKeyId: - Info: The failure reason if the export fails. - PubKey: The public key for the private key being retrieved. # LOGGING_SIGNED_AUDIT_SECURITY_DATA_INFO=<type=SECURITY_DATA_INFO>:[AuditEvent=SECURITY_DATA_INFO]{0} security data info request # Event: TOKEN_AUTH with [Outcome=Failure] Description: This event is used when authentication failed. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: Failure (obviously, if authentication failed, you won't have a valid SubjectID, so in this case, AttemptedID is recorded) - IP: - CUID: - MSN: - OP: - tokenType: - AppletVersion: - AuthMgr: The authentication manager instance name that did this authentication. # LOGGING_SIGNED_AUDIT_TOKEN_AUTH_FAILURE=<type=TOKEN_AUTH>:[AuditEvent=TOKEN_AUTH]{0} token authentication failure # Event: TOKEN_AUTH with [Outcome=Success] Description: This event is used when authentication succeeded. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: Success - IP: - CUID: - MSN: - OP: - tokenType: - AppletVersion: - AuthMgr: The authentication manager instance name that did this authentication. # LOGGING_SIGNED_AUDIT_TOKEN_AUTH_SUCCESS=<type=TOKEN_AUTH>:[AuditEvent=TOKEN_AUTH]{0} token authentication success # Event: TOKEN_CERT_ENROLLMENT Description: This event is used for TPS when token certificate enrollment request is made. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - IP: - CUID: - tokenType: - KeyVersion: - Serial: - CA_ID: - Info: Info in case of failure. # LOGGING_SIGNED_AUDIT_TOKEN_CERT_ENROLLMENT_9=<type=TOKEN_CERT_ENROLLMENT>:[AuditEvent=TOKEN_CERT_ENROLLMENT][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][KeyVersion={5}][Serial={6}][CA_ID={7}][Info={8}] token certificate enrollment request made # Event: TOKEN_CERT_RENEWAL Description: This event is used for TPS when token certificate renewal request is made. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - IP: - CUID: - tokenType: - KeyVersion: - Serial: - CA_ID: - Info: Info in case of failure. # LOGGING_SIGNED_AUDIT_TOKEN_CERT_RENEWAL_9=<type=TOKEN_CERT_RENEWAL>:[AuditEvent=TOKEN_CERT_RENEWAL][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][KeyVersion={5}][Serial={6}][CA_ID={7}][Info={8}] token certificate renewal request made # Event: TOKEN_CERT_RETRIEVAL Description: This event is used for TPS when token certificate retrieval request is made; usually used during recovery, along with TOKEN_KEY_RECOVERY. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - IP: - CUID: - tokenType: - KeyVersion: - Serial: - CA_ID: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_CERT_RETRIEVAL_9=<type=TOKEN_CERT_RETRIEVAL>:[AuditEvent=TOKEN_CERT_RETRIEVAL][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][KeyVersion={5}][Serial={6}][CA_ID={7}][Info={8}] token certificate retrieval request made # Event: TOKEN_CERT_STATUS_CHANGE_REQUEST Description: This event is used when a token certificate status change request (e.g. revocation) is made. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - IP: - CUID: The last token that the certificate was associated with. - tokenType: - CertSerialNum: The serial number (in decimal) of the certificate to be revoked. - RequestType: "revoke", "on-hold", "off-hold". - RevokeReasonNum: - CA_ID: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_CERT_STATUS_CHANGE_REQUEST_10=<type=TOKEN_CERT_STATUS_CHANGE_REQUEST>:[AuditEvent=TOKEN_CERT_STATUS_CHANGE_REQUEST][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][CertSerialNum={5}][RequestType={6}][RevokeReasonNum={7}][CA_ID={8}][Info={9}] token certificate revocation/unrevocation request made # Event: TOKEN_FORMAT with [Outcome=Failure] Description: This event is used when token format operation failed. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - IP: - CUID: - MSN: - tokenType: - AppletVersion: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_FORMAT_FAILURE=<type=TOKEN_FORMAT>:[AuditEvent=TOKEN_FORMAT]{0} token op format failure # Event: TOKEN_FORMAT with [Outcome=Success] Description: This event is used when token format operation succeeded. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - IP: - CUID: - MSN: - tokenType: - AppletVersion: - KeyVersion: # LOGGING_SIGNED_AUDIT_TOKEN_FORMAT_SUCCESS=<type=TOKEN_FORMAT>:[AuditEvent=TOKEN_FORMAT]{0} token op format success # Event: TOKEN_KEY_RECOVERY Description: This event is used for TPS when token certificate key recovery request is made. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - IP: - CUID: - tokenType: - KeyVersion: - Serial: - CA_ID: - KRA_ID: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_KEY_RECOVERY_10=<type=TOKEN_KEY_RECOVERY>:[AuditEvent=TOKEN_KEY_RECOVERY][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][KeyVersion={5}][Serial={6}][CA_ID={7}][KRA_ID={8}][Info={9}] token certificate/key recovery request made # Event: TOKEN_OP_REQUEST Description: This event is used when token processor operation request is made. Applicable subsystems: TPS Enabled by default: No Fields: - IP: - CUID: - MSN: - Outcome: - OP: "format", "enroll", or "pinReset" - AppletVersion: # LOGGING_SIGNED_AUDIT_TOKEN_OP_REQUEST_6=<type=TOKEN_OP_REQUEST>:[AuditEvent=TOKEN_OP_REQUEST][IP={0}][CUID={1}][MSN={2}][Outcome={3}][OP={4}][AppletVersion={5}] token processor op request made # Event: TOKEN_PIN_RESET with [Outcome=Failure] Description: This event is used when token pin reset request failed. Applicable subsystems: TPS Enabled by default: No Fields: - IP: - SubjectID: - CUID: - Outcome: - tokenType: - AppletVersion: - Info: # LOGGING_SIGNED_AUDIT_TOKEN_PIN_RESET_FAILURE=<type=TOKEN_PIN_RESET>:[AuditEvent=TOKEN_PIN_RESET]{0} token op pin reset failure # Event: TOKEN_PIN_RESET with [Outcome=Success] Description: This event is used when token pin reset request succeeded. Applicable subsystems: TPS Enabled by default: No Fields: - IP: - SubjectID: - CUID: - Outcome: - tokenType: - AppletVersion: - KeyVersion: # LOGGING_SIGNED_AUDIT_TOKEN_PIN_RESET_SUCCESS=<type=TOKEN_PIN_RESET>:[AuditEvent=TOKEN_PIN_RESET]{0} token op pin reset success # Event: TOKEN_STATE_CHANGE Description: This event is used when token state changed. Applicable subsystems: TPS Enabled by default: No Fields: - SubjectID: - Outcome: - oldState: - oldReason: - newState: - newReason: - ParamNameValPairs: A name-value pair (where name and value are separated by the delimiter ;;) separated by + (if more than one name-value pair) of config params changed. --- secret component (password) MUST NOT be logged --- - Info: Error info for failed cases. # LOGGING_SIGNED_AUDIT_TOKEN_STATE_CHANGE_8=<type=TOKEN_STATE_CHANGE>:[AuditEvent=TOKEN_STATE_CHANGE][SubjectID={0}][Outcome={1}][oldState={2}][oldReason={3}][newState={4}][newReason={5}][ParamNameValPairs={6}][Info={7}] token state changed