Skip to content

Audit Configuration

Jump to bottom
Endi S. Dewata edited this page Oct 20, 2026 · 1 revision

Overview

This page describes audit configuration in all PKI subsystems.

By default audit is enabled so various operations in PKI subsystem will generate audit logs. The audit signing certificate is also created, but log signing is disabled by default.

Configuration

The audit configuration is stored in /var/lib/pki/<instance>/conf/<subsystem>/CS.cfg:

log.instance.SignedAudit.type=signedAudit
log.instance.SignedAudit.enable=true
log.instance.SignedAudit.bufferSize=512
log.instance.SignedAudit.expirationTime=0
log.instance.SignedAudit.level=1
log.instance.SignedAudit.pluginName=file

Log Filename

The log filename can be configured with the following parameter:

log.instance.SignedAudit.fileName=/var/lib/pki/pki-tomcat/logs/ca/signedAudit/ca_audit

By default the log files will be stored in /var/lib/pki/<instance>/logs/<subsystem>/signedAudit folder with the following names:

  • CA: ca_audit

  • KRA: kra_cert-kra_audit

  • OCSP: ocsp_cert-ocsp_audit

  • TKS: tks_cert-tks_audit

  • TPS: tps_cert-tps_audit

If the server has been running more than the time specified in rolloverInterval, or the log file has exceeded the size specified in maxFileSize, the log file will be renamed into <filename>.yyyyMMddHHmmss.

Flush Interval

The maximum time (in seconds) before the buffer is flushed to the file can be configured with the following parameter:

log.instance.SignedAudit.flushInterval=5

The default is 5 seconds.

Maximum File Size

The maximum size (in kilobytes) for log files can be configured with the following parameter:

log.instance.SignedAudit.maxFileSize=2000

The default is 2000 kB which is around 2MB.

Rollover Interval

The rollover interval (in seconds) for log files can be configured with the following parameter:

log.instance.SignedAudit.rolloverInterval=2592000

The default is 2592000 seconds which means 30 days (30 * 24 * 60 * 60).

Events

The events to be audited can be configured with the following parameter:

log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,...

Some events are enabled by default. See Audit Events.

The available events are listed in this LogMessages.properties, for example:

# LOGGING_SIGNED_AUDIT_ACCESS_SESSION_ESTABLISH_SUCCESS
# - used when access session was established successfully
# ParamNameValPairs must be a name;;value pair
#    (where name and value are separated by the delimiter ;;)
#    separated by + (if more than one name;;value pair) of config params changed
#
LOGGING_SIGNED_AUDIT_ACCESS_SESSION_ESTABLISH_SUCCESS=\
<type=ACCESS_SESSION_ESTABLISH>:[AuditEvent=ACCESS_SESSION_ESTABLISH]{0} access session establish success

Event Filters

If an event type is listed in log.instance.SignedAudit.events, all events of that type will be recorded as audit logs, which sometimes could generate too many logs. To reduce the number of logs, the events can be limited using Audit Event Filters, for example:

log.instance.SignedAudit.filters.ACCESS_SESSION_ESTABLISH=(Outcome=Failure)

Log Signing

Tip
 To find a page in the Wiki, enter the keywords in search field, press Enter, then click Wikis.

Clone this wiki locally