Key Protect (sse_kms) log entry fields

Edit online

Table 1. Key Protect log entry fields
Field name Type Required Description
 
ghost GhostRequestInfo No Container to hold information related to a request to GhoST on a wrap request. There should be one ghost container for each attempt to GhoST
result String Yes The result of a request to GhoST.

Values: success|fail

Note: If GhostRequestInfo is included in the access log, this field is required.
code int No The return code from GhoST.
Note: If GhostRequestInfo is included in the access log and a request is made to Ghost and is successful and is included in this response, this field is required.
message String No The description in the response from GhoST for errors or OK for success.
Note: If GhostRequestInfo is included in the access log and a request is made to Ghost and is successful and is included in this response, this field is required.
endpoints EndpointInfo No The endpoints for the KMS instance of interest.
Note: If GhostRequestInfo is included in the access log and a request is made to Ghost and is successful and is included in this response, this field is required.
private String No The private endpoint provided by GhoST for the KMS instance of interest.
Note: This field should be included in the access log if a private endpoint was returned by GhoST.
public String No The public endpoint provided by GhoST for the KMS instance of interest.
Note: This field should be included in the access log if a public endpoint was returned by GhoST.
ghost_endpoint String No The endpoint of the GhoST server that serviced the request.
Note: If GhostRequestInfo is included in the access log and a request is made to Ghost and is successful and is included in this response, this field is required.
ghost_instance String No The Kubernetes instance of GhoST that serviced the request.
Note: If GhostRequestInfo is included in the access log and a request is made to Ghost and is successful and is included in this response, this field is required.
latency String Yes The latency of the call to GhoST. This latency should include network latency, so it is not the latency returned by GhoST.

Rather, this latency shall be calculated within the endpoint service from the time the request was sent to GhoST to the time a response was received from GhoST or the request timed out. The reported latency should be the cumulative latency, inclusive of all retries.

Note: If GhostRequestInfo is included in the access log, this field is required.
num_attempts int No The number of tries that a request is attempted. Note, since there will be a list of some information about each attempt, num-tries will increase in the list with each attempt to GhoST for the same request.
Note: If GhostRequestInfo is included in the access log and a request is made to Ghost. If no request is made to ghost, the number's default is 0. This field is required.
transaction_id String No The transaction_id that was sent to GhoST. This should be the transaction_id used for the last request to the target service, in the case where multiple attempts are made for the same request.
Note: If GhostRequestInfo is included in the access log and a request is made to Ghost and is successful and is included in this response, this field is required.
 
sit SitRequestInfo No Container to hold information related to obtaining a SIT token. There should be one sit container for each attempt to IAM_TS.
result String Yes The result of a request to IAM_TS.

Values: success|fail

Note: If SitRequestInfo is included in the access log, this field is required.
latency String Yes The latency of the call to SIT.

This latency shall be calculated within the SIT token service from the time the request was sent to IAM_TS to the time a response was received from IAM_TS or the request timed out. The reported latency should be the cumulative latency, inclusive of all retries.

Note: If SitRequestInfo is included in the access log, this field is required.
 
kms Map<String,kmsRequestInfo> No Container to hold information related to obtaining keys from the KMS. There should be one kmsRequestInfo container for each attempt to the IBM KMS. This map of all requests to KMS is keyed off the request type with values being the kmsRequestInfo. Supported Keys: registration, deregistration, wrap, unwrap, replace_registration, key_metadata, kms_event_ack
result String No The result of a request to KMS.

Values: success|fail

Note: If KmsRequestInfo is included in the access log, this field is required.
code int No The return code from KMS.
Note: Only included if KMS is contacted. Set to value returned from KMS.
message String Yes This is the message from the KMS or OK for a Success case.
Note: Only included if KMS is contacted. Set to value returned from KMS.
is_cached String Yes This field should be set to true if the DEK returned was from cache.

Values: success|fail

Note: Always Included.
is_stale String No This field should be set to true if the DEK returned was from cache and was marked as stale.

Values: success|fail

Note: Only included if stale cache entry is used.
time_start String Yes This field marks the start time of a request to the KMS Service. A human-readable date string associated with when the background request was sent to the KMS Server (ISO 8601 in yyyy-MM-dd'T'HH:mm:ss.SSS'Z')
latency String Yes The latency of the call to KMS.

This latency shall be calculated within the KP SDK from the time the request was sent to KMS to the time a response was received from KMS or the request timed out. The reported latency should be the cumulative latency, inclusive of all retries

Note: If KmsRequestInfo is included in the access log, this field is required. Set to zero if DEK is read from cache.
num_attempts int Yes The number of tries that a request is attempted. Note, since there will be a list of some information about each attempt, num-tries will increase in the list with each attempt to KMS for the same request.
Note: If KmsRequestInfo is included in the access log, this field is required. Set to Zero if DEK is read from Cache.
kms_endpoint_used String No The endpoint that was used to contact KMS.
Note: Only included if KMS is contacted.
correlation_id String Yes The correlation_id that was sent to KMS. This should be the transaction_id used for the last request to the target service, in the case where multiple attempts are made for the same request.
Note: If KmsRequestInfo is included in the access log, this field is required.
crk_crn_status String No This field is included if the CRK in question was either rotated or deleted.
As of ClevOS 3.14.9 (Key Protect Registration) This also includes the state of the Key after each request. The supported states are:
Deleted, Rotated
Only seen during unwrap operations.
registered_mutable, unregistered, deregistered
Only seen during wrap and de-registration operations.
unknown, active, deactivated, destroyed
Only be seen during the key metadata processing.
enable/disable
Only seen during kms_event_ack processing.
Note: Required if a response from KMS indicates that the key in question was either rotated or deleted.
request_method String Yes The method used in the REST call to the KMS server. Options include PUT, POST, PATCH, DELETE, GET
remote_replica_check_status String No Indicates status of the check.

Values: success|fail|unknown

Note: Present if request included remoteReplicaCheck query parameter and KMS processing was successful to the point of populating this field.