Security Auditing in Dashboard Application Services Hub

Edit online

You can enable and disable security auditing in the Dashboard Application Services Hub console to capture and store supported security events.

The following security elements can be audited in the console:

Authentication events
Authorization events

When auditing is enabled these types of events are recorded in audit log files. Each audit log can to be signed and encrypted to ensure data integrity. The audit logs can be analyzed to discover breaches in the existing security mechanisms and highlight potential weaknesses in the current security infrastructure.

Use the configureConsoleAudit.sh|bat console_admin_user_ID console_admin_user_password [true|false] to enable or disable security auditing in the console.

Note:

You can experience slower performance from the console when you enable security auditing. In that case, make a backup copy of following file and manually enable the features that you need and disable the features that you do not need. Restart the console server after you make your changes to the audit.xml file:

JazzSM_WAS_Profile/config/cells/JazzSMNode01Cell/audit.xml

Enabling and disabling auditing

Edit online

Procedure

Change directory to JazzSM_HOME/ui/bin.
To enable auditing run the following command:
- ./configureConsoleAudit.sh console_admin_user_ID console_admin_user_password true
- configureConsoleAudit.bat console_admin_user_ID console_admin_user_password true
where console_admin_user_ID is a console administrator user ID and console_admin_user_password is the associated password.
To disable auditing run the following command:
- ./configureConsoleAudit.sh console_admin_user_ID console_admin_user_password false
- configureConsoleAudit.bat console_admin_user_ID console_admin_user_password false
where console_admin_user_ID is a console administrator user ID and console_admin_user_password is the associated password.
After enabling or disabling security auditing, you must restart the Jazz® for Service Management application server, see Restarting Jazz for Service Management application servers

Audit file location

Edit online

When you enable security auditing, a binary audit log file is generated, which contains the audit records for various actions that are performed in Dashboard Application Services Hub.

The log file is created in the following directory:

JazzSM_WAS_Profile/logs/server1

The log file is named as BinaryAudit_JazzSMNode01Cell_JazzSMNode01_server1.log.

Note: The binary audit log file can be signed and encrypted to protect the audit data. For more information, see https://www.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/tsec_sa_audit_data_protection.html

Security event examples

Edit online

User login example

When auditing is enabled and a user logs in, a SECURITY_AUTHN event type is recorded in audit log files:

User logout example

When auditing is enabled and a user logs out, a SECURITY_AUTHN_TERMINATE event type is recorded in audit log files:

Authorization event example

For authorization events, for example, when a console administrator modifies roles, pages, or widgets, a SECURITY_MGMT_REGISTRY event types are recorded in audit log files: