Chapter 9. IdM log files and directories
Chapter 9. IdM log files and directories Use the following sections to monitor, analyze, and troubleshoot the individual components of Identity Management (IdM): LDAP Apache web server Certificate system Kerberos DNS Custodia Additionally, you can monitor, analyze, and troubleshoot the IdM server and client and enable audit logging on an IdM server . 9.1. IdM server and client log files and directories The following table presents directories and files that the Identity Management (IdM) server and client use to log information. You can use the files and directories for troubleshooting installation errors. Directory or File Description /var/log/ipaserver-install.log The installation log for the IdM server. /var/log/ipareplica-install.log The installation log for the IdM replica. /var/log/ipaclient-install.log The installation log for the IdM client. /var/log/sssd/ Log files for SSSD. You can enable detailed logging for SSSD in the sssd.conf file or with the sssctl command . ~/.ipa/log/cli.log The log file for errors returned by remote procedure calls (RPCs) and responses by the ipa utility. Created in the home directory for the effective user that runs the tools. This user might have a different user name than the IdM user principal, that is the IdM user whose ticket granting ticket (TGT) has been obtained before attempting to perform the failed ipa commands. For example, if you are logged in to the system as root and have obtained the TGT of IdM admin , then the errors are logged in to the /root/.ipa/log/cli.log file. /etc/logrotate.d/ The log rotation policies for DNS, SSSD, Apache, Tomcat, and Kerberos. /etc/pki/pki-tomcat/logging.properties This link points to the default Certificate Authority logging configuration at /usr/share/pki/server/conf/logging.properties . Additional resources Troubleshooting IdM server installation Troubleshooting IdM client installation Troubleshooting IdM replica installation Troubleshooting authentication with SSSD in IdM 9.2. Directory Server log files The following table presents directories and files that the Identity Management (IdM) Directory Server (DS) instance uses to log information. You can use the files and directories for troubleshooting DS-related problems. Table 9.1. Directory Server log files Directory or file Description /var/log/dirsrv/slapd- REALM_NAME / Log files associated with the DS instance used by the IdM server. Most operational data recorded here are related to server-replica interactions. /var/log/dirsrv/slapd- REALM_NAME /audit Contains audit trails of all DS operations when auditing is enabled in the DS configuration. Note You can also audit the Apache error logs, where the IdM API logs access. However, because changes can be made directly over LDAP too, Red Hat recommends enabling the more comprehensive /var/log/dirsrv/slapd-REALM_NAME/audit log for auditing purposes. /var/log/dirsrv/slapd- REALM_NAME /access Contains detailed information about attempted access for the domain DS instance. /var/log/dirsrv/slapd- REALM_NAME /errors Contains detailed information about failed operations for the domain DS instance. Additional resources Monitoring Server and Database Activity Log File Reference 9.3. Enabling audit logging on an IdM server Follow this procedure to enable logging on an Identity Management (IdM) server for audit purposes. Using detailed logs, you can monitor data, troubleshoot issues, and examine suspicious activity on the network. Note The LDAP service may become slower if there are many LDAP changes logged, especially if the values are large. Prerequisites The Directory Manager password Procedure Bind to the LDAP server: Press [Enter]. Specify all the modifications you want to make, for example: Indicate the end of the ldapmodify command by entering EOF on a new line. Press [Enter] twice. Repeat the steps on all the other IdM servers on which you want to enable audit logging. Verification Open the /var/log/dirsrv/slapd-REALM_NAME/audit file: The fact that the file is not empty anymore confirms that auditing is enabled. Important The system logs the bound LDAP distinguished name (DN) of the entry that makes a change. For this reason, you might have to post-process the log. For example, in the IdM Directory Server, it is an ID override DN that represents the identity of an AD user that modified a record: Use the pysss_nss_idmap.getnamebysid Python command to look up an AD user if you have the user SID: Additional resources The audit log configuration options in Core server configuration attributes in the Red Hat Directory Server documentation How to enable Audit logging in IPA/IDM Server and Replica Servers (Red Hat Knowledgebase) Directory Server log files 9.4. Modifying error logging on an IdM server Follow this procedure to obtain debugging information about specific types of errors. The example focuses on obtaining detailed error logs about replication by setting the error log level to 8192. To record a different type of information, select a different number from the table in Error Log Logging Levels in the Red Hat Directory Server documentation. Note The LDAP service may become slower if there are many types of LDAP errors logged, especially if the values are large. Prerequisites The Directory Manager password. Procedure Bind to the LDAP server: Press [Enter]. Specify the modifications you want to make. For example to collect only logs related to replication: Press [Enter] twice, to indicate the end of the ldapmodify instruction. This displays the modifying entry "cn=config" message. Press [Ctrl+C] to exit the ldapmodify command. Repeat the steps on all the other IdM servers on which you want to collect detailed logs about replication errors. Important After you finish troubleshooting, set nsslapd-errorlog-level back to 0 to prevent performance problems. Additional resources The Directory Server error logging levels 9.5. The IdM Apache server log files The following table presents directories and files that the Identity Management (IdM) Apache Server uses to log information. Table 9.2. Apache Server log files Directory or File Description /var/log/httpd/ Log files for the Apache web server. /var/log/httpd/access_log Standard access and error logs for Apache servers. Messages specific to IdM are recorded along with the Apache messages because the IdM web UI and the RPC command-line interface use Apache. The access logs log mostly only the user principal and the URI used, which is often an RPC endpoint. The error logs contain the IdM server logs. /var/log/httpd/error_log Additional resources Log Files in the Apache documentation 9.6. Certificate System log files in IdM The following table presents directories and files that the Identity Management (IdM) Certificate System uses to log information. Table 9.3. Certificate System log files Directory or File Description /var/log/pki/pki-ca-spawn. time_of_installation .log The installation log for the IdM certificate authority (CA). /var/log/pki/pki-kra-spawn. time_of_installation .log The installation log for the IdM Key Recovery Authority (KRA). /var/log/pki/pki-tomcat/ The top level directory for PKI operation logs. Contains CA and KRA logs. /var/log/pki/pki-tomcat/ca/ Directory with logs related to certificate operations. In IdM, these logs are used for service principals, hosts, and other entities which use certificates. /var/log/pki/pki-tomcat/kra Directory with logs related to KRA. /var/log/messages Includes certificate error messages among other system messages. Additional resources Configuring subsystem logs in the Red Hat Certificate System Administration Guide 9.7. Kerberos log files in IdM The following table presents directories and files that Kerberos uses to log information in Identity Management (IdM). Table 9.4. Kerberos Log Files Directory or File Description /var/log/krb5kdc.log The primary log file for the Kerberos KDC server. /var/log/kadmind.log The primary log file for the Kerberos administration server. Locations for these files are configured in the krb5.conf file. They can be different on some systems. 9.8. DNS log files in IdM The following table presents directories and files that DNS uses to log information in Identity Management (IdM). Table 9.5. DNS log files Directory or File Description /var/log/messages Includes DNS error messages and other system messages. DNS logging in this file is not enabled by default. To enable it, enter the # /usr/sbin/rndc querylog command. The command results in the following lines being added to var/log/messages : Jun 26 17:37:33 r8server named-pkcs11[1445]: received control channel command 'querylog' Jun 26 17:37:33 r8server named-pkcs11[1445]: query logging is now on To disable logging, run the command again. 9.9. Custodia log files in IdM The following table presents directories and files that Custodia uses to log information in Identity Management (IdM). Table 9.6. Custodia Log Files Directory or File Description /var/log/custodia/ Log file directory for the Custodia service. 9.10. Additional resources Viewing Log Files . You can use journalctl to view the logging output of systemd unit files.
ldapmodify -D "cn=Directory Manager" -W << EOF dn: cn=config changetype: modify replace: nsslapd-auditlog-logging-enabled nsslapd-auditlog-logging-enabled: on - replace:nsslapd-auditlog nsslapd-auditlog: /var/log/dirsrv/slapd-REALM_NAME/audit - replace:nsslapd-auditlog-mode nsslapd-auditlog-mode: 600 - replace:nsslapd-auditlog-maxlogsize nsslapd-auditlog-maxlogsize: 100 - replace:nsslapd-auditlog-logrotationtime nsslapd-auditlog-logrotationtime: 1 - replace:nsslapd-auditlog-logrotationtimeunit nsslapd-auditlog-logrotationtimeunit: day 389-Directory/1.4.3.231 B2021.322.1803 server.idm.example.com:636 (/etc/dirsrv/slapd-IDM-EXAMPLE-COM) time: 20220607102705 dn: cn=config result: 0 changetype: modify replace: nsslapd-auditlog-logging-enabled nsslapd-auditlog-logging-enabled: on [...] modifiersName: ipaanchoruuid=:sid:s-1-5-21-19610888-1443184010-1631745340-279100,cn=default trust view,cn=views,cn=accounts,dc=idma,dc=idm,dc=example,dc=com >>> import pysss_nss_idmap >>> pysss_nss_idmap.getnamebysid('S-1-5-21-1273159419-3736181166-4190138427-500')) {'S-1-5-21-1273159419-3736181166-4190138427-500': {'name': 'administrator@ad.vm', 'type': 3}} ldapmodify -x -D "cn=directory manager" -w <password> dn: cn=config changetype: modify add: nsslapd-errorlog-level nsslapd-errorlog-level: 8192