IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Event
capturing
and
logging
You
can
capture
events
for
logging
and
auditing
by
using
the
Tivoli
Access
Manager
event
logging
facility.
Event
logging
provides
a
structured
hierarchy
for
gathering
messages
for
logging
and
auditing
purposes.
The
event
logging
feature
also
supports
the
use
of
alternate
destinations
for
logging
output,
such
as
consoles
(stdout),
pipes,
and
remote
servers.
The
event
logging
facility
has
many
different
configuration
options.
This
chapter
describes
how
to
configure
event
logging
to
capture
common
events
generated
by
WebSEAL.
Before
using
this
chapter,
it
is
recommended
that
you
read
the
overview
of
event
logging
in
the
IBM
Tivoli
Access
Manager
Base
Administration
Guide.
This
overview
provides
many
details
on
configuration
options,
including
output
destinations,
that
might
apply
to
your
deployment.
Note:
WebSEAL
also
supports
the
Tivoli
Access
Manager
legacy
auditing
model.
Use
of
this
model
is
recommended
for
backwards
compatibility
only.
For
more
information,
see
“Legacy
auditing”
on
page
105.
Topic
index:
v
“Event
logging
configuration
tasks”
v
“Example
configuration”
on
page
99
v
“Configuring
HTTP
logging
using
event
logging”
on
page
100
v
“Authentication
event
log
output”
on
page
102
v
“Audit
data
in
UTF-8
format”
on
page
104
Event
logging
configuration
tasks
The
following
configuration
tasks
are
required
for
each
WebSEAL
audit
trail
file:
1.
Enable
auditing
Enable
the
creation
of
audit
records.
2.
Specify
type
of
audit
event.
Supported
types
of
audit
events
for
WebSEAL:
v
Authorization
v
Credential
acquisition
authentication
v
HTTP
requests
3.
Specify
audit
file
location
Location
on
the
filesystem
for
the
audit
records.
4.
Specify
audit
file
size
Maximum
size
of
an
audit
trail
file.
When
the
maximum
size
is
reached,
the
file
is
backed
up
and
a
new
file
is
started.
5.
Specify
file
flush
interval
Frequency
with
which
the
server
flushes
audit
trail
buffers
to
the
file.
The
following
configuration
tasks
are
optional
for
each
WebSEAL
audit
trail
file:
v
Specify
maximum
event
queue
Maximum
number
of
events
to
queue
in
memory.
v
Specify
event
queue
high
water
mark
Number
of
events
in
queue
which
trigger
a
flush
from
memory
to
file.
v
Specify
maximum
buffer
size
98
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide