Event Logs
All automated events (e.g. CRL publishing, Email alert sending, certificate renewal etc) are logged in Event Logs Area. Note that automated events for CRL polling and retrieval of CRLs are separately logged in CRL Monitor Logs. See the CRL Monitor Log section for more details.
The following screen in ADSS Server shows the Event Logs:
The details in the screen are as follows:
| Item | Description |
| |< < > >| |
These buttons are for navigating the different pages of the event log records. Note the number of records shown per page is configurable from within Global Settings. |
| Export Logs |
Used to export the logs shown in Event Log Viewer window into a tab separated file at a configurable path. Note the records continue to remain in the database also (i.e. they are not deleted from the database as part of the export process). |
| Verify Integrity |
Verifies the integrity of the Event logs. It detects tampered and deleted records and generates a report that can be exported to the physical drive. When exporting HMAC verification report, it is recommended to save the file with “.html” extension so that the report can be viewed in an internet browser. |
| Clear Search |
After a Search the window will only show the filtered records, this button clears the search view and then shows the full set of records again. |
| Search |
This opens a new window where search criteria can be entered based on each column of log viewer grid (see below for further details). |
| Log ID |
A unique identifier assigned by ADSS for this event. |
| Event ID | This is the type of specific event occurred. This column can have following possible values:
|
| Module ID |
Specifies the module generating a particular event. |
| Sub Module ID | Specifies the sub module generating a particular event. |
| Occurred At | This identifies the date and time when the event was occurred. |
| Status | This identifies the status of the event occurred. This can take following two values: INFORMATION ERROR |
| Detail link |
Clicking on this link will display the HMAC verification report. See the screen shot below. |
From the drop down menu in above screen, choose Show Archived and click on Go button. This will show the following screen:
| Item | Description |
| Import archived transaction file |
Use this option to browse the archived log file in zip format from the operator machine. By using this option the archived log file is uploaded on the ADSS Server. It can be an expensive operation if the file is of large size so the operator is allowed to upload a file with maximum size up to 25 MB. Use the archived file path option for files bigger than 25 MB. |
| Archived transaction file path |
Use this option if the file size is greater than 25 MB. This option does not upload the archived file to the server. Rather the server reads the file from given file path before importing which is faster than the above option. You can either specify the local file system path or a network path. Note: Do specify the archived log file name in the file path. |
The archived files were created in the csv format till ADSS Server v4.7.5 but from v4.7.6 and onward the archived files are zipped to save the disk space when archiving. If you are importing the archived files created using a pre-v4.7.6 deployment to ADSS Server v4.7.6 or later then first zip them before importing otherwise ADSS Server will not recognise them as correct archived files.
As explained above, clicking on the Search button on Event Logs displays following screen:
This helps to locate a particular type of event within a particular time frame or in a particular module. If a search is based on multiple values, then these will be combined together using the “AND” operand, and thus only records that meet all the criteria will be presented.
Each log record within the database is protected with an HMAC checksum to detect any intentional or accidental modification of records. Clicking Verify Integrity button verifies the log integrity and generates a report as shown below:
Click on the Export logs button to export the request/response to a network file. Clicking the Fix HMAC Errors button will re-calculate the HMAC for tempered transaction logs records for this module.
Note: This option will not detect the unauthorized deleted records but it will only fix the unauthorized modifications and/or ambiguous records for which HMAC value is not present/incorrect.
Verify Integrity feature is available for the transactions log of all services within ADSS Server.
The following screen displays the details of a particular HMAC verification event:
Event Log records can be sorted in either Ascending or Descending order by selecting a table column from the drop down list.
See also