PKI Subsystem Audit CLI

Overview

The pki <subsystem>-audit commands provide an interface to manage audit configuration and to access audit logs remotely.

Displaying Audit Configuration

To display audit configuration:

$ pki -n caadmin <subsystem>-audit-show
-------------------
Audit configuration
-------------------
  Status: Enabled
  Signed: false
  Interval (seconds): 5
  Buffer size (bytes): 512
  Events:
    AUDIT_LOG_SHUTDOWN: mandatory
    AUDIT_LOG_STARTUP: mandatory
    AUTHZ_FAIL: enabled
    AUTHZ_SUCCESS: enabled
    AUTH_FAIL: enabled
    AUTH_SUCCESS: enabled
    ...

Exporting Audit Configuration

To export audit configuration into a file:

$ pki -n caadmin <subsystem>-audit-show --output audit.json
------------------------------------------
Stored audit configuration into audit.json
------------------------------------------

The audit configuration is stored in JSON format:

{
  "status" : "Enabled",
  "signed" : false,
  "interval" : 5,
  "bufferSize" : 512,
  "eventConfigs" : {
    "AUDIT_LOG_SHUTDOWN" : "mandatory",
    "AUDIT_LOG_STARTUP" : "mandatory",
    "AUTHZ_FAIL" : "enabled",
    "AUTHZ_SUCCESS" : "enabled",
    "AUTH_FAIL" : "enabled",
    "AUTH_SUCCESS" : "enabled",
    ...
  }
}

Modifying Audit Configuration

To modify the audit configuration, export the current audit configuration into a file using the pki <subsystem>-audit-show command above. Edit the file as needed:

{
  ...
  "signed" : true,
  "interval" : 10,
  "bufferSize" : 1024,
  "eventConfigs" : {
    ...
    "AUTHZ_SUCCESS" : "disabled",
    ...
    "AUTH_SUCCESS" : "disabled",
    ...
  },
  ...
}

Then upload the new configuration with the following command:

$ pki -n caadmin <subsystem>-audit-mod --input audit.json
----------------------------
Modified audit configuration
----------------------------
  Status: Enabled
  Signed: false
  Interval (seconds): 10
  Buffer size (bytes): 512
  Events:
    AUDIT_LOG_SHUTDOWN: mandatory
    AUDIT_LOG_STARTUP: mandatory
    AUTHZ_FAIL: enabled
    AUTHZ_SUCCESS: disabled
    AUTH_FAIL: enabled
    AUTH_SUCCESS: disabled
    ...

Optionally, the updated configuration can be stored into a file using the --output parameter.

Listing Audit Log Files

To list all available audit log files:

$ pki -n auditor ca-audit-file-find
-----------------
3 entries matched
-----------------
  File name: ca_audit.20170331225716
  Size: 2883

  File name: ca_audit.20170401001030
  Size: 189

  File name: ca_audit
  Size: 6705
----------------------------
Number of entries returned 3
----------------------------

Retrieving Audit Log File

To retrieve an audit log file and store it locally:

$ pki -n auditor ca-audit-file-retrieve <filename>

To retrieve an audit log file and store it in a different file:

$ pki -n auditor ca-audit-file-retrieve <filename> --output <new filename>

See Also

• Using PKI Audit CLI