Logging and Auditing

The server and proxy containers, by default, send all auditing and logging information to the console of the container in JSON format.

Logging

By default all error and informational messages for the server and proxy containers are logged to the console of the container in JSON format. A standard message contains the following fields.

Table 1. Logging Fields

Field	Description
instance.epochSecond	The number of seconds since Unix epoch at which the message was generated.
instance.threadId	The identifier of the thread that generated the message.
instance.level	The level of the generated message (for example, Information).
instance.loggerName	The name of the component that generated the message (for example, ISVD Bootstrapper).
instance.message.id	An identifier for the generated message. This identifier corresponds to a message from the Messages reference.
instance.message.text	The text that is associated with the generated message.

An example message is:

{
  "instance": {
    "epochSecond": 1663559882
  },
  "threadId": "0x26aac880",
  "level": "Information",
  "loggerName": "ISVD Bootstrapper",
  "message": {
    "id": "GLPBOO002I",
    "text": "Bootstrapping the container."
  }
}

Note: To make the example more readable, the JSON is formatted across multiple lines. In a containerized environment, the JSON message is collapsed into a single line.

The general.json-logging Boolean configuration entry, when set to false, disables the JSON based logging, and changes the message format to a simple text string.

Auditing

By default, the generation of auditing records for LDAP requests is disabled. If auditing is needed, set the general.audit.enabled Boolean configuration entry to true. This setting causes audit records to be generated and sent to the console in JSON format.

Table 2. Auditing Fields

Field	Description
instance.epochSecond	The number of seconds since Unix epoch at which the auditing record was generated.
instance.threadId	The identifier of the thread that generated the auditing record.
instance.level	The level of the auditing record (always Audit).
instance.loggerName	The name of the component that generated the auditing record (always: audit.event).
instance.event	The details of the auditing event. The details vary based on the type of audit record that was generated.

The following code is an example audit record.

{
  "instance": {
    "epochSecond": 1663561058
  "threadId": "0xd445a700",
  "level": "Audit",
  "loggerName": "audit.event",
  "event": {
    "id": "",
    "version": 4,
    "start": {
      "secs": 1663561058,
      "msecs": 261
    },
    "end": {
      "secs": 1663561058,
      "msecs": 263
    },
    "sslProtocol": "",
    "auth": "unauthenticated ",
    "preOperation": "",
    "operation": "Bind",
    "bindDn": "cn=root",
    "client": {
      "address": "127.0.0.1",
      "port": 50356,
      "id": 1
    },
    "admin": "N",
    "transactionId": "",
    "result": "Invalid credentials",
    "controls": [
      {
        "type": "1.3.6.1.4.1.42.2.27.8.5.1",
        "critical": false
      }
    ],
    "opDetails": {
      "type": "bind",
      "name": "cn=root",
      "choice": "simple",
      "status": "Not Locked"
    }
  }
}

Note: To make the example more readable, the JSON is formatted across multiple lines. In a containerized environment, the JSON auditing record is collapsed into a single line.

The general.audit.json-format Boolean configuration entry, when set to false disables the JSON based auditing, and changes the audit record format to a simple text string. The general.audit.log-to-file Boolean configuration entry, when set to true, sends auditing records to the /var/isvd/logs/audit.log file on the container file system, instead of sending the records to the console of the container.