Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Appendix E. Audit events

This appendix contains two parts. The first part, Section E.1, “Required audit events and their examples”, contains a list of required audit events grouped by the requirement ID from the CA Protection Profile V2.1, where each audit event is accompanied by one or more examples. The second part, Section E.2, “Audit Event Descriptions” provides individual audit event and their parameter description and format. Every audit event in the log is accompanied by the following information:

  • The Java identifier of the thread. For example: 

    0.localhost-startStop-1
    Copy to Clipboard Toggle word wrap

  • The time stamp the event occurred at. For example: 

    [21/May/2023:17:53:00 IST]
    Copy to Clipboard Toggle word wrap

  • The log source (14 is SIGNED_AUDIT): 

    [14]
    Copy to Clipboard Toggle word wrap

  • The current log level (6 is Security-related events. See 13.1.2 Log Levels (Message Categories) in the Planning, Installation and Deployment Guide (Common Criteria Edition). For example: 

    [6]
    Copy to Clipboard Toggle word wrap

  • The information about the log event (which is log event specific; see Section E.2, “Audit Event Descriptions” for information about each field in a particular log event). For example: 

    [AuditEvent=AUDIT_LOG_STARTUP][SubjectID=$System$][Outcome=Success] audit function startup
    Copy to Clipboard Toggle word wrap

E.1. Required audit events and their examples
Link kopieren

This section contains all required audit events per Common Criteria CA Protection Profile v.2.1.

For audit events descriptions, see Section E.2, “Audit Event Descriptions”.

FAU_GEN.1

  • Start-up of the TSF audit functions

    • AUDIT_LOG_STARTUP

      Test case: start up a CS instance. 

      0.main - [17/Mar/2023:04:31:50 EDT] [14] [6] [AuditEvent=AUDIT_LOG_STARTUP][SubjectID=$System$][Outcome=Success] audit function startup
      Copy to Clipboard Toggle word wrap

  • All administrative actions invoked through the TFS interface

    • CONFIG_CERT_PROFILE

      Test case: modifying a profile via CLI or console. 

      0.https-jsse-nio-31443-exec-11 - [25/Apr/2023:05:59:44 EDT] [14] [6] [AuditEvent=CONFIG_CERT_PROFILE][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;rules+Operation;;OP_ADD+Resource;;caFullCMCUserCertFoobar+class_id;;caEnrollImpl] certificate profile configuration parameter(s) change
      Copy to Clipboard Toggle word wrap

    • CERT_PROFILE_APPROVAL

      Test case: as a CA admin, enabling a profile (e.g. caUserCert) via console or CLI. Then as a CA agent, approving the profile from the agent portal in the WebUI. 

      0.https-jsse-nio-31443-exec-1 - [28/Apr/2023:02:13:21 EDT] [14] [6] [AuditEvent=CERT_PROFILE_APPROVAL][SubjectID=rsa_SubCA_AgentV][Outcome=Success][ProfileID=caUserCert][Op=approve] certificate profile approval
      Copy to Clipboard Toggle word wrap

    • CONFIG_OCSP_PROFILE

      Test case: changing OCSP parameters via console, e.g. includeNextUpdate (make sure you revert changes after each test). 

      0.https-jsse-nio-32443-exec-20 - [11/May/2023:18:32:39 EDT] [14] [6] [AuditEvent=CONFIG_OCSP_PROFILE][SubjectID=ocspadmin][Outcome=Success][ParamNameValPairs=Scope;;ocspStoresRules+Operation;;OP_MODIFY+Resource;;defStore+includeNextUpdate;;false+byName;;true+implName;;com.netscape.cms.ocsp.DefStore+notFoundAsGood;;true] OCSP profile configuration parameter(s) change
      Copy to Clipboard Toggle word wrap

    • CONFIG_CRL_PROFILE

      Test case: in the console, selecting Certificate Manager > CRL Issuing Points > MasterCRL > Updates > and modifying the Update CRL every field as well as the Next update race period and Next update as this update extension fields. 

      0.https-jsse-nio-31443-exec-17 - [11/May/2023:18:37:05 EDT] [14] [6] [AuditEvent=CONFIG_CRL_PROFILE][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;crl+Operation;;OP_MODIFY+Resource;;MasterCRL+enableCRLUpdates;;true+updateSchema;;1+extendedNextUpdate;;true+alwaysUpdate;;true+enableDailyUpdates;;true+dailyUpdates;;1:00+enableUpdateInterval;;true+autoUpdateInterval;;241+nextUpdateGracePeriod;;1+nextAsThisUpdateExtension;;1] CRL profile configuration parameter(s) change
      Copy to Clipboard Toggle word wrap

    • CONFIG_AUTH

      Test case: in the console, selecting Authentication > Authentication Instance > and adding a new authentication instance by entering a new Auth Instance ID. For example, AgentCertAuth and then entering AgentCertAuth2 for the instance name. 

      0.https-jsse-nio-31443-exec-18 - [11/May/2023:19:13:09 EDT] [14] [6] [AuditEvent=CONFIG_AUTH][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;instance+Operation;;OP_ADD+Resource;;AgentCertAuth+implName;;AgentCertAuth] authentication configuration parameter(s) change
      Copy to Clipboard Toggle word wrap

    • CONFIG_ROLE(success)

      Test case: adding an user, e.g. # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n 'rsa_SubCA_AdminV' ca-user-add Test_UserV --fullName Testuser --password SECret.123. 

      0.https-jsse-nio-31443-exec-24 - [26/Apr/2023:08:29:25 EDT] [14] [6] [AuditEvent=CONFIG_ROLE][SubjectID=rsa_SubCA_AdminV][Outcome=Success][ParamNameValPairs=Scope;;users+Operation;;OP_ADD+Resource;;Test_UserV+password;;**+phone;;<null>+fullname;;Testuser+state;;<null>+userType;;<null>+email;;<null>] role configuration parameter(s) change
      Copy to Clipboard Toggle word wrap

    • CONFIG_ROLE(Failure)

      Test case: adding an existing user, e.g. # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n 'rsa_SubCA_AdminV' ca-user-add Test_UserV --fullName Testuser --password SECret.123. 

      0.https-jsse-nio-31443-exec-5 - [26/Apr/2023:08:31:53 EDT] [14] [6] [AuditEvent=CONFIG_ROLE][SubjectID=rsa_SubCA_AdminV][Outcome=Failure][ParamNameValPairs=Scope;;users+Operation;;OP_ADD+Resource;;Test_UserV+password;;**+phone;;<null>+fullname;;Testuser+state;;<null>+userType;;<null>+email;;<null>] role configuration parameter(s) change
      Copy to Clipboard Toggle word wrap

    • CONFIG_ACL

      • CA

        Test case: in the console, clicking Access Control List and removing a variable (adding it back afterwards). 

        0.https-jsse-nio-31443-exec-9 - [11/May/2023:18:13:52 EDT] [14] [6] [AuditEvent=CONFIG_ACL][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;acls+Operation;;OP_MODIFY+Resource;;certServer.ca.crl+aci;;allow (read,update) group="Certificate Manager Agents"+desc;;Certificate Manager agents may read or update crl+rights;;read] ACL configuration parameter(s) change
        Copy to Clipboard Toggle word wrap

    • CONFIG_SIGNED_AUDIT (FAU_SEL.1)

      • CA

        Test case: disabling, e.g. # pki -U https://rhcs10.example.com:21443 -d /root/.dogtag/pki_ecc_bootstrap/certs_db -c SECret.123 -n ecc_SubCA_AdminV ca-audit-mod --action disable. 

        0.https-jsse-jss-nio-21443-exec-5 - [23/Oct/2023:04:38:52 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=ecc_SubCA_AdminV][Outcome=Success][ParamNameValPairs=Action;;disable] signed audit configuration parameter(s) change
        Copy to Clipboard Toggle word wrap

        Test case: reenabling, e.g. # pki -U https://rhcs10.example.com:21443 -d /root/.dogtag/pki_ecc_bootstrap/certs_db -c SECret.123 -n ecc_SubCA_AdminV ca-audit-mod --action enable. 

        0.https-jsse-jss-nio-21443-exec-10 - [23/Oct/2023:04:47:23 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=ecc_SubCA_AdminV][Outcome=Success][ParamNameValPairs=Action;;enable] signed audit configuration parameter(s) change
        Copy to Clipboard Toggle word wrap

      • KRA

        Test case: disabling audit using the pki kra-audit-mod command: # pki -p 28443 -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -n "PKI KRA Administrator for RSA-KRA" kra-audit-mod --action disable. 

        0.https-jsse-nio-28443-exec-17 - [15/May/2023:18:30:44 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=kraadmin][Outcome=Success][ParamNameValPairs=Action;;disable] signed audit configuration parameter(s) change
        Copy to Clipboard Toggle word wrap

      • OCSP

        Test case: in the console, selecting Log > Log Event Listener Management tab > SignedAudit > Edit/View > and changing the flushInterval value. 

        0.https-jsse-nio-31443-exec-15 - [11/May/2023:19:42:24 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=Scope;;logRule+Operation;;OP_MODIFY+Resource;;SignedAudit+level;;Information+rolloverInterval;;Monthly+flushInterval;;5+mandatory.events;;<null>+bufferSize;;512+maxFileSize;;2000+fileName;;/var/lib/pki/rhcs10-RSA-SubCA/logs/ca/signedAudit/ca_audit+enable;;true+signedAuditCertNickname;;NHSM-CONN-XC:auditSigningCert cert-rhcs10-RSA-SubCA CA+implName;;file+type;;signedAudit+logSigning;;true+events;;ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,AUDIT_LOG_SIGNING,AUDIT_LOG_STARTUP,AUTH,AUTHORITY_CONFIG,AUTHZ,CERT_PROFILE_APPROVAL,CERT_REQUEST_PROCESSED,CERT_SIGNING_INFO,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,CLIENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CMC_REQUEST_RECEIVED,CMC_RESPONSE_SENT,CMC_SIGNED_REQUEST_SIG_VERIFY,CMC_USER_SIGNED_REQUEST_SIG_VERIFY,CONFIG_ACL,CONFIG_AUTH,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_ENCRYPTION,CONFIG_ROLE,CONFIG_SERIAL_NUMBER,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KEY,CRL_SIGNING_INFO,DELTA_CRL_GENERATION,FULL_CRL_GENERATION,KEY_GEN_ASYMMETRIC,LOG_PATH_CHANGE,OCSP_GENERATION,OCSP_SIGNING_INFO,PROFILE_CERT_REQUEST,PROOF_OF_POSSESSION,RANDOM_GENERATION,ROLE_ASSUME,SCHEDULE_CRL_GENERATION,SECURITY_DOMAIN_UPDATE,SELFTESTS_EXECUTION,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED] signed audit configuration parameter(s) change
        Copy to Clipboard Toggle word wrap

      • TKS

        Test case: disabling audit using the pki tps-audit-mod command, after importing the TKS admin cert into the db: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ client-cert-import --pkcs12 /opt/pki_rsa/rhcs10-RSA-TKS/tks_admin_cert.p12 --pkcs12-password SECret.123 then # pki -p 24443 -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -n "PKI TKS Administrator for RSA-TKS" tks-audit-mod --action disable. 

        0.https-jsse-nio-24443-exec-4 - [15/May/2023:18:23:02 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=tksadmin][Outcome=Success][ParamNameValPairs=Action;;disable] signed audit configuration parameter(s) change
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: disabling audit using the pki tps-audit-mod command, after importing the TPS admin cert into the db: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ client-cert-import --pkcs12 /opt/pki_rsa/rhcs10-RSA-TPS/tks_admin_cert.p12 --pkcs12-password SECret.123 then # pki -p 24443 -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -n "PKI TPS Administrator for RSA-TPS" tps-audit-mod --action disable. 

        0.https-jsse-nio-25443-exec-23 - [15/May/2023:18:39:02 EDT] [14] [6] [AuditEvent=CONFIG_SIGNED_AUDIT][SubjectID=tpsadmin][Outcome=Success][ParamNameValPairs=Action;;enable] signed audit configuration parameter(s) change
        Copy to Clipboard Toggle word wrap

    • CONFIG_DRM

      Test case: in the console, clicking Configuration > Data Recovery Manager > General Settings > and setting the number of required recovery agents to 2. 

      0.https-jsse-nio-28443-exec-19 - [20/Jun/2023:19:43:36 EDT] [14] [6] [AuditEvent=CONFIG_DRM][SubjectID=kraadmin][Outcome=Success][ParamNameValPairs=Scope;;general+Operation;;OP_MODIFY+Resource;;RS_ID_CONFIG+noOfRequiredRecoveryAgents;;8] DRM configuration parameter(s) change
      Copy to Clipboard Toggle word wrap

    • OCSP_ADD_CA_REQUEST_PROCESSED

      • Success

        Test case: in the WebUI, clicking Agent Services > Add Certificate Authority > then entering a valid CA certificate in PEM format. 

        0.https-jsse-jss-nio-22443-exec-8 - [08/Sep/2023:13:01:19 EDT] [14] [6] [AuditEvent=OCSP_ADD_CA_REQUEST_PROCESSED][SubjectID=OCSP_AgentV][Outcome=Success][CASubjectDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA] Add CA for OCSP Responder
        Copy to Clipboard Toggle word wrap

      • Failure

        Test case: in the WebUI, clicking Agent Services > Add Certificate Authority > then not entering anything valid. 

        0.https-jsse-jss-nio-22443-exec-14 - [08/Sep/2023:13:04:06 EDT] [14] [6] [AuditEvent=OCSP_ADD_CA_REQUEST_PROCESSED][SubjectID=OCSP_AgentV][Outcome=Failure][CASubjectDN=<null>] Add CA for OCSP Responder
        Copy to Clipboard Toggle word wrap

    • OCSP_REMOVE_CA_REQUEST_PROCESSED

      Test case: in the WebUI, clicking Agent Services > List Certificate Authorities > then clicking Remove CA (Remember to add it back after the test). 

      0.https-jsse-jss-nio-22443-exec-21 - [08/Sep/2023:13:06:04 EDT] [14] [6] [AuditEvent=OCSP_REMOVE_CA_REQUEST_PROCESSED][SubjectID=OCSP_AgentV][Outcome=Success][CASubjectDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA] Remove CA for OCSP Responder is successful
      Copy to Clipboard Toggle word wrap

    • SECURITY_DOMAIN_UPDATE

      • Operation: Issue_token

        Test case: checking the CA logs when other subsystems are added to or removed from the security domain. 

        0.https-jsse-nio-31443-exec-15 - [28/Apr/2023:09:52:30 EDT] [14] [6] [AuditEvent=SECURITY_DOMAIN_UPDATE][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=operation;;issue_token+token;;2094141712918570861+ip;;10.0.188.59+uid;;caadmin+groupname;;Enterprise TKS Administrators] security domain update
        Copy to Clipboard Toggle word wrap

      • Operation: Add

        Test case: checking the CA logs when other subsystems are added to or removed from the security domain. 

        0.https-jsse-nio-31443-exec-15 - [28/Apr/2023:09:53:10 EDT] [14] [6] [AuditEvent=SECURITY_DOMAIN_UPDATE][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=host;;ccrsa-1.rhcs10.example.com+name;;TKS ccrsa-1.rhcs10.example.com 24443+sport;;24443+clone;;false+type;;TKS+operation;;add] security domain update
        Copy to Clipboard Toggle word wrap

    • CONFIG_SERIAL_NUMBER

      • CA

        Test case: creating a RootCA subsystem clone. 

        0.https-jsse-jss-nio-8443-exec-13 - [18/Sep/2023:08:11:13 EDT] [14] [6] [AuditEvent=CONFIG_SERIAL_NUMBER][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=source;;updateNumberRange+type;;request+beginNumber;;9990001+endNumber;;10000000] serial number range update
        Copy to Clipboard Toggle word wrap

      • KRA

        Test case: creating a KRA subsystem clone. 

        0.https-jsse-jss-nio-21443-exec-8 - [18/Sep/2023:11:04:18 EDT] [14] [6] [AuditEvent=CONFIG_SERIAL_NUMBER][SubjectID=caadmin][Outcome=Success][ParamNameValPairs=source;;updateNumberRange+type;;request+beginNumber;;9990001+endNumber;;10000000] serial number range update
        Copy to Clipboard Toggle word wrap
FDP_CER_EXT.1 (extended)

  • Certificate generation

    • CERT_REQUEST_PROCESSED (success)

      Test case: a successful CMC request using SharedSecret (with cmc.popLinkWitnessRequired=true). 

      0.https-jsse-jss-nio-21443-exec-8 - [21/Nov/2023:16:49:57 EST] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=$Unidentified$][Outcome=Success][ReqID=86][CertSerialNum=229508606] certificate request processed
      Copy to Clipboard Toggle word wrap
FDP_CER_EXT.2 (extended)

  • Linking of certificates to certificate requests

    Test case: a successful CMC request signed and issued by a CA agent (with cmc.popLinkWitnessRequired=false):

    • PROFILE_CERT_REQUEST 

      0.https-jsse-jss-nio-21443-exec-3 - [21/Nov/2023:16:58:45 EST] [14] [6] [AuditEvent=PROFILE_CERT_REQUEST][SubjectID=caadmin][Outcome=Success][ReqID=87][ProfileID=caECFullCMCUserCert][CertSubject=CN=ecc test ecc-user1,UID=ecc-ecc-user1] certificate request made with certificate profiles
      Copy to Clipboard Toggle word wrap

    • CERT_REQUEST_PROCESSED (Success) 

      0.https-jsse-jss-nio-21443-exec-3 - [21/Nov/2023:16:58:45 EST] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=caadmin][Outcome=Success][ReqID=87][CertSerialNum=87161545] certificate request processed
      Copy to Clipboard Toggle word wrap
      Note

      In the success case, the ReqID field effectively links to the ReqID field of a successful CERT_REQUEST_PROCESSED event where the CertSerialNum field contains the certificate serial number.

FFDP_CER_EXT.3 FDP_CER_EXT.2 (Failure)
  • Failed certificate approvals

A failed CMC request using SharedSecret (with cmc.popLinkWitnessRequired=true) with wrong witness.sharedSecret

  • CMC_REQUEST_RECEIVED 

    0.https-jsse-jss-nio-21443-exec-9 - [21/Nov/2023:16:57:14 EST] [14] [6] [AuditEvent=CMC_REQUEST_RECEIVED][SubjectID=caadmin][Outcome=Success][CMCRequest=MIILQQYJKoZIhvcNAQcCoIILMjCCCy4CAQMxDzANBglghkgBZQ…] CMC request received
    Copy to Clipboard Toggle word wrap

  • CERT_REQUEST_PROCESSED (failure) 

    0.https-jsse-jss-nio-21443-exec-3 - [29/Nov/2023:16:32:16 PST] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=$Unidentified$][Outcome=Failure][ReqID=$Unidentified$][InfoName=rejectReason][InfoValue=Proof-of-Identification Verification Failed after verifyIdentityProofV2] certificate request processed
    Copy to Clipboard Toggle word wrap
    Note

    The concurrent occurrence of CMC_REQUEST_RECEIVED and CERT_REQUEST_PROCESSED linked the request object with the failure.

FIA_X509_EXT.1, FIA_X509_EXT.2

  • Failed certificate validations; failed authentications

    • ACCESS_SESSION_ESTABLISH (failure)

      • User with revoked cert trying to perform an operation.

        Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AgentR' ca-cert-find. 

        0.https-jsse-jss-nio-21443-exec-18 - [10/Jun/2024:08:48:13 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentR,UID=ecc_SubCA_AgentR][CertSerialNum=135246246][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Failure][Info=serverAlertSent: CERTIFICATE_REVOKED] access session establish failure
        Copy to Clipboard Toggle word wrap

      • User with expired cert trying to perform an operation.

        Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AgentE' ca-cert-find. 

        0.https-jsse-jss-nio-21443-exec-19 - [10/Jun/2024:08:49:54 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentE,UID=ecc_SubCA_AgentE][CertSerialNum=70705426][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Failure][Info=serverAlertSent: CERTIFICATE_EXPIRED] access session establish failure
        Copy to Clipboard Toggle word wrap

      • CMC enrollment request submitted using a TLS client cert issued by an unknown CA.

        Test case: Adding a client cert issued by unknown CA to nssdb and running # HttpClient /root/.dogtag/pki_ecc_bootstrap/certs_db/HttpClient-cmc-p10.self.cfg. 

        0.https-jsse-jss-nio-21443-exec-20 - [10/Jun/2024:09:20:34 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=PKI Administrator,E=caadmin@example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org][CertSerialNum=233456275785924569566051339521314398673][IssuerDN=CN=CA Signing Certificate,OU=topology-02-CA,O=topology-02_Foobarmaster.org][Outcome=Failure][Info=serverAlertSent: UNKNOWN_CA] access session establish failure
        Copy to Clipboard Toggle word wrap

      • No common encryption algorithm(s).

        Test case: changing the ciphers in the ECC CA’s server.xml to RSA ciphers, then running # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AdminV' ca-user-find. 

        0.https-jsse-jss-nio-21443-exec-1 - [10/Jun/2024:09:30:21 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=--][CertSerialNum=--][IssuerDN=--][Outcome=Failure][Info=serverAlertSent: HANDSHAKE_FAILURE] access session establish failure
        Copy to Clipboard Toggle word wrap
FIA_UIA_EXT.1 FIA_UAU_EXT.1

  • Privileged user identification and authentication

    • ACCESS_SESSION_ESTABLISH

      → The ClientIP field of the ACCESS_SESSION_ESTABLISH audit event contains the IP address of the client.
      The SubjectID field of the ACCESS_SESSION_ESTABLISH audit event contains the identity of the entity.

      • CA

        Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AdminV' ca-user-find. 

        0.https-jsse-jss-nio-21443-exec-7 - [10/Jun/2024:10:11:19 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AdminV,UID=ecc_SubCA_AdminV][CertSerialNum=195854754][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success] access session establish success
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'TPS_AdminV' tps-user-find. 

        0.https-jsse-jss-nio-25443-exec-1 - [11/Jun/2024:05:56:34 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=TPS_AdminV,UID=TPS_AdminV][CertSerialNum=190384736][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success] access session establish success
        Copy to Clipboard Toggle word wrap

    • AUTH

      The AuthMgr field contains the authentication mechanism in the AUTH audit event.

      • CA

        Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -P https -p 31443 -n 'rsa_SubCA_AdminV'. 

        0.https-jsse-nio-31443-exec-9 - [28/Apr/2023:06:16:11 EDT] [14] [6] [AuditEvent=AUTH][SubjectID=rsa_SubCA_AdminV][Outcome=Success][AuthMgr=certUserDBAuthMgr] authentication success
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'PKI TPS Administrator for RSA-TPS' tps-user-find. 

        0.https-jsse-nio-25443-exec-3 - [28/Apr/2023:06:13:46 EDT] [14] [6] [AuditEvent=AUTH][SubjectID=tpsadmin][Outcome=Success][AuthMgr=certUserDBAuthMgr] authentication success
        Copy to Clipboard Toggle word wrap

    • AUTHZ

      • CA

        Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -P https -p 31443 -n 'rsa_SubCA_AuditV' ca-audit-file-find. 

        0.https-jsse-nio-31443-exec-10 - [28/Apr/2023:06:43:30 EDT] [14] [6] [AuditEvent=AUTHZ][SubjectID=rsa_SubCA_AuditV][Outcome=Success][aclResource=certServer.log.content.signedAudit][Op=read][Info=AuditResource.findAuditFiles] authorization success
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'PKI TPS Administrator for RSA-TPS' tps-user-show tpsadmin. 

        0.https-jsse-nio-25443-exec-20 - [28/Apr/2023:06:46:23 EDT] [14] [6] [AuditEvent=AUTHZ][SubjectID=tpsadmin][Outcome=Success][aclResource=certServer.tps.users][Op=execute][Info=UserResource.getUser] authorization success
        Copy to Clipboard Toggle word wrap

    • ROLE_ASSUME

      The Role field of the ROLE_ASSUME audit event contains the name of the role that the user is assuming.

      • CA

        Test case: logging in to pkiconsole with valid credentials, e.g.: # pkiconsole -d /home/jgenie/.redhat-idm-console -n rsa_SubCA_AdminV. 

        0.https-jsse-nio-31443-exec-4 - [28/Apr/2023:06:59:18 EDT] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=rsa_SubCA_AdminV][Outcome=Success][Role=Administrators] assume privileged role
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: accessing the TPS Web UI Agent page using the TPS_AgentV certificate. 

        0.https-jsse-jss-nio-25443-exec-25 - [20/Sep/2023:06:32:56 EDT] [14] [6] [AuditEvent=ROLE_ASSUME][SubjectID=TPS_AgentV][Outcome=Success][Role=TPS Agents] assume privileged role
        Copy to Clipboard Toggle word wrap
FMT_SMR.2

  • Modifications to the group of users that are part of a role

    • CONFIG_ROLE

      See CONFIG_ROLE event above.

FPT_FLS.1

  • Failure with preservation of secure state

    • SELFTESTS_EXECUTION

      Test case: pointing the OCSP signing certificate to a non-existing certificate. E.g. ca.cert.ocsp_signing.nickname=NHSM-CONN-XC:non-existing certificate.

      • CA 

        0.main - [02/May/2023:05:04:54 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Failure] self tests execution (see selftests.log for details)
        Copy to Clipboard Toggle word wrap

      • CA_AUDIT 

        0.main - [01/Dec/2023:12:55:07 EST] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Failure] self tests execution (see selftests.log for details)
        Copy to Clipboard Toggle word wrap

      • SELFTESTS.LOG 

        0.main - [01/Dec/2023:12:55:07 EST] [20] [1] SystemCertsVerification: system certs verification failure: Unable to validate certificate NHSM-CONN-XC:non-existing certificate not found: NHSM-CONN-XC:non-existing certificate
        Copy to Clipboard Toggle word wrap 
        0.main - [01/Dec/2023:12:55:07 EST] [20] [1] SelfTestSubsystem: The CRITICAL self test plugin called selftests.container.instance.SystemCertsVerification running at startup FAILED!
        Copy to Clipboard Toggle word wrap
FPT_KST_EXT.2

  • Private/secret keys are stored by the HSM and the only operations to "access" those keys are through the TSF as signing operations.

    N/a: Under normal circumstances, HSM authentication is done at RHCS system startup time (server will not start if failed to authenticate), so once the system is up, there is no need to authenticate (no loggable cause of failure).

FPT_RCV.1

  • The fact that a failure or service discontinuity occurred. Resumption of the regular operation.

    • Failure: SELFTESTS_EXECUTION (failure)

      • CA

        Test case: adding a bogus cert nickname in the config file and restarting the server, e.g.: ca.cert.sslserver.nickname=Bogus Server-Cert. 

        0.main - [02/May/2023:05:04:54 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Failure] self tests execution (see selftests.log for details)
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: adding a bogus cert nickname in the config file and restarting the server, e.g.: selftests.plugin.TPSPresence.nickname=bogusCert. 

        0.main - [02/May/2023:05:11:04 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Failure] self tests execution (see selftests.log for details)
        Copy to Clipboard Toggle word wrap
    • Self-test log, see "Configuring Self-Tests" in the Installation Guide.

    • Resumption (e.g. fixing the bogus certificate nickname and restarting): AUDIT_LOG_STARTUP; SELFTESTS_EXECUTION (success)

      • TPS 

        0.main - [27/Apr/2023:09:38:36 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Success] self tests execution (see selftests.log for details)
        Copy to Clipboard Toggle word wrap 
        0.main - [11/May/2023:02:35:32 EDT] [14] [6] [AuditEvent=AUDIT_LOG_STARTUP][SubjectID=$System$][Outcome=Success] audit function startup
        Copy to Clipboard Toggle word wrap

      • CA 

        0.main - [02/May/2023:05:20:27 EDT] [14] [6] [AuditEvent=AUDIT_LOG_STARTUP][SubjectID=$System$][Outcome=Success] audit function startup
        Copy to Clipboard Toggle word wrap 
        0.main - [25/Apr/2023:02:30:14 EDT] [14] [6] [AuditEvent=SELFTESTS_EXECUTION][SubjectID=$System$][Outcome=Success] self tests execution (see selftests.log for details)
        Copy to Clipboard Toggle word wrap
FPT_STM.1

  • Changes to the time.

    Timestamps in the audit log for each event are provided by the Operational Environment, e.g.: 

    # date
Wed Nov 29 17:31:28 PST 2023
    Copy to Clipboard Toggle word wrap

    Changes to the time on the OS level are audited. See Section 12.2.3.3, “Displaying time change events”.

    Test steps: following "Enable OS-level audit logs" in the post-installation section (Installation Guide) and executing # ausearch -k rhcs_audit_time_change.

    To change the timezone, run # timedatectl list-timezones to list the zones then set the desired zone using timedatectl set-timezone. E.g.: 

    # timedatectl set-timezone America/Los_Angeles
    Copy to Clipboard Toggle word wrap

    Running the time change audit command will result in similar logs: 

    #  ausearch -k rhcs_audit_time_change

time->Tue Nov 21 17:05:52 2023
type=PROCTITLE msg=audit(1700615152.687:92865): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573
type=SYSCALL msg=audit(1700615152.687:92865): arch=c000003e syscall=44 success=yes exit=1080 a0=3 a1=7ffcba231970 a2=438 a3=0 items=0 ppid=1060472 pid=1060487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" subj=system_u:system_r:unconfined_service_t:s0 key=(null)
type=CONFIG_CHANGE msg=audit(1700615152.687:92865): auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 op=add_rule key="rhcs_audit_time_change" list=4 res=1
----
time->Tue Nov 21 17:05:52 2023
type=PROCTITLE msg=audit(1700615152.687:92866): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573
type=SOCKADDR msg=audit(1700615152.687:92866): saddr=100000000000000000000000
type=SYSCALL msg=audit(1700615152.687:92866): arch=c000003e syscall=44 success=yes exit=1080 a0=3 a1=7ffcba231970 a2=438 a3=0 items=0 ppid=1060472 pid=1060487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" subj=system_u:system_r:unconfined_service_t:s0 key=(null)
type=CONFIG_CHANGE msg=audit(1700615152.687:92866): auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 op=add_rule key="rhcs_audit_time_change" list=4 res=1
----
time->Tue Nov 21 17:05:52 2023
type=PROCTITLE msg=audit(1700615152.687:92867): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573
type=SOCKADDR msg=audit(1700615152.687:92867): saddr=100000000000000000000000
type=SYSCALL msg=audit(1700615152.687:92867): arch=c000003e syscall=44 success=yes exit=1080 a0=3 a1=7ffcba231970 a2=438 a3=0 items=0 ppid=1060472 pid=1060487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" subj=system_u:system_r:unconfined_service_t:s0 key=(null)
type=CONFIG_CHANGE msg=audit(1700615152.687:92867): auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 op=add_rule key="rhcs_audit_time_change" list=4 res=1
----
time->Tue Nov 21 17:05:52 2023
type=PROCTITLE msg=audit(1700615152.687:92868): proctitle=2F7362696E2F617564697463746C002D52002F6574632F61756469742F61756469742E72756C6573
type=SOCKADDR msg=audit(1700615152.687:92868): saddr=100000000000000000000000
type=SYSCALL msg=audit(1700615152.687:92868): arch=c000003e syscall=44 success=yes exit=1080 a0=3 a1=7ffcba231970 a2=438 a3=0 items=0 ppid=1060472 pid=1060487 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditctl" exe="/usr/sbin/auditctl" subj=system_u:system_r:unconfined_service_t:s0 key=(null)
type=CONFIG_CHANGE msg=audit(1700615152.687:92868): auid=4294967295 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 op=add_rule key="rhcs_audit_time_change" list=4 res=1
----
<skipping over the “op=add_rule key="rhcs_audit_time_change"” events>
----
time->Tue Nov 21 17:28:14 2023
type=PROCTITLE msg=audit(1700616494.023:92874): proctitle="/usr/sbin/timedatex"
type=PATH msg=audit(1700616494.023:92874): item=4 name="/etc/localtime" inode=20037025 dev=fc:03 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:locale_t:s0 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1700616494.023:92874): item=3 name="/etc/localtime" inode=16798494 dev=fc:03 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:locale_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1700616494.023:92874): item=2 name="/etc/localtime.855775472" inode=20037025 dev=fc:03 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:locale_t:s0 nametype=DELETE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1700616494.023:92874): item=1 name="/etc/" inode=16798305 dev=fc:03 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1700616494.023:92874): item=0 name="/etc/" inode=16798305 dev=fc:03 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1700616494.023:92874): cwd="/"
type=SYSCALL msg=audit(1700616494.023:92874): arch=c000003e syscall=82 success=yes exit=0 a0=7ffcb72d7a20 a1=55b57b9dcdaf a2=55b57d40cc00 a3=0 items=5 ppid=1 pid=1060749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="timedatex" exe="/usr/sbin/timedatex" subj=system_u:system_r:timedatex_t:s0 key="rhcs_audit_time_change"
----
time->Tue Nov 21 17:28:14 2023
type=PROCTITLE msg=audit(1700616494.024:92875): proctitle="/usr/sbin/timedatex"
type=SYSCALL msg=audit(1700616494.024:92875): arch=c000003e syscall=164 success=yes exit=0 a0=0 a1=7ffcb72d6a08 a2=fffffffffffffe1f a3=2ce33e6c02ce33e7 items=0 ppid=1 pid=1060749 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="timedatex" exe="/usr/sbin/timedatex" subj=system_u:system_r:timedatex_t:s0 key="rhcs_audit_time_change"
    Copy to Clipboard Toggle word wrap
FPT_TUD_EXT.1

  • Initiation of update.

    See Section 12.2.3.4, “Displaying package update events”.

    Test case: assuming some prior package updates were done, use the # ausearch -m SOFTWARE_UPDATE | grep pki command: 

    # ausearch -m SOFTWARE_UPDATE | grep pki

 30 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1289): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="pki-servlet-engine-1:9.0.30-3.module+el8.5.0+11388+9e95fe00.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/plat	form-python3.6" hostname=? addr=? terminal=? res=success'
 31 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1290): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="tomcatjss-7.7.2-1.module+el8pki+14677+1ef79a68.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-python3.	6" hostname=? addr=? terminal=? res=success'
 32 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1291): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-server-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platfor	m-python3.6" hostname=? addr=? terminal=? res=success'
 33 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1292): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-acme-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-	python3.6" hostname=? addr=? terminal=? res=success'
 34 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1293): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-ca-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-py	thon3.6" hostname=? addr=? terminal=? res=success'
 35 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1294): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-est-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-p	ython3.6" hostname=? addr=? terminal=? res=success'
 36 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1295): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-kra-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-p	ython3.6" hostname=? addr=? terminal=? res=success'
 37 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1296): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-ocsp-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-	python3.6" hostname=? addr=? terminal=? res=success'
 38 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1297): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-tks-10.13.5-2.module+el8pki+17707+69a21d82.noarch" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-p	ython3.6" hostname=? addr=? terminal=? res=success'
 39 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1298): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-tps-10.13.5-2.module+el8pki+17707+69a21d82.x86_64" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-p	ython3.6" hostname=? addr=? terminal=? res=success'
 40 type=SOFTWARE_UPDATE msg=audit(1682403837.928:1299): pid=5040 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=install 	sw="redhat-pki-10.13.5-2.module+el8pki+17707+69a21d82.x86_64" sw_type=rpm key_enforce=0 gpg_res=0 root_dir="/" comm="dnf" exe="/usr/libexec/platform-pytho	n3.6" hostname=? addr=? terminal=? res=success
    Copy to Clipboard Toggle word wrap
FTA_SSL.4

  • The termination of an interactive session.

    • ACCESS_SESSION_TERMINATED

      • CA

        Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AgentV' ca-cert-find. 

        0.https-jsse-jss-nio-21443-exec-5 - [10/Jun/2024:13:18:54 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentV,UID=ecc_SubCA_AgentV][CertSerialNum=72118278][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'TPS_AdminV' tps-user-find. 

        0.https-jsse-jss-nio-25443-exec-6 - [11/Jun/2024:05:56:36 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=TPS_AdminV,UID=TPS_AdminV][CertSerialNum=190384736][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
        Copy to Clipboard Toggle word wrap
FTP_TRP.1

  • Initiation of the trusted channel. Termination of the trusted channel. Failures of the trusted path functions.

    • ACCESS_SESSION_ESTABLISH

      • CA

        Test case: adding client certificate issued by unknown CA to nssdb and use it for running # HttpClient /root/.dogtag/pki_ecc_bootstrap/certs_db/HttpClient-cmc-p10.self.cfg. 

        0.https-jsse-jss-nio-21443-exec-20 - [10/Jun/2024:09:20:34 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=PKI Administrator,E=caadmin@example.com,OU=topology-02-CA,O=topology-02_Foobarmaster.org][CertSerialNum=233456275785924569566051339521314398673][IssuerDN=CN=CA Signing Certificate,OU=topology-02-CA,O=topology-02_Foobarmaster.org][Outcome=Failure][Info=serverAlertSent: UNKNOWN_CA] access session establish failure
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'PKI TPS Administrator for RSA-TPS' tps-token-find. 

        0.https-jsse-jss-nio-25443-exec-7 - [11/Jun/2024:06:00:52 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=PKI Administrator,E=tpsadmin@example.com,OU=rhcs10-RSA-TPS,O=Example-SubCA][CertSerialNum=32899047][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success] access session establish success
        Copy to Clipboard Toggle word wrap

    • ACCESS_SESSION_TERMINATED

      • CA

        Test case: # pki -d /root/.dogtag/pki_ecc_bootstrap/certs_db/ -c SECret.123 -p 21443 -n 'ecc_SubCA_AgentV' ca-cert-find. 

        0.https-jsse-jss-nio-21443-exec-7 - [10/Jun/2024:10:36:08 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentV,UID=ecc_SubCA_AgentV][CertSerialNum=72118278][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
        Copy to Clipboard Toggle word wrap

        Test case: logging in to the CA Agent page using the role user and closing the browser. 

        0.https-jsse-jss-nio-21443-exec-11 - [10/Jun/2024:13:35:09 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=ecc_SubCA_AgentV,UID=ecc_SubCA_AgentV][CertSerialNum=72118278][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
        Copy to Clipboard Toggle word wrap

      • TPS

        Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 25443 -n 'TPS_AdminV' tps-user-find or login to the TPS Agent page using a role user and close the browser. 

        0.https-jsse-jss-nio-25443-exec-20 - [11/Jun/2024:06:03:06 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_TERMINATED][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=TPS_AdminV,UID=TPS_AdminV][CertSerialNum=190384736][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success][Info=serverAlertSent: CLOSE_NOTIFY] access session terminated
        Copy to Clipboard Toggle word wrap
FCS_CKM.1 and FCS_CKM.2
  • Not available. There are no TOE-related functions where a TOE subsystem generates (or requests the OE to generate) a non-ephemeral key. All system certificates are generated in the same manner as user keys during the installation, before the TOE is running and, thus, before it can audit.
FCS_CKM_EXT.4
  • Not available
FCS_COP.1(2)

  • All occurrences of signature generation using a CA signing key.

    • CERT_SIGNING_INFO records CA signing certificate key info at system startup 

      0.https-jsse-nio-8443-exec-5 - [25/Apr/2023:02:26:34 EDT] [14] [6] [AuditEvent=CERT_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=96:44:A6:53:DB:AF:3D:C3:3D:A0:00:0A:84:CB:6E:0E:B5:3E:4E:10] certificate signing info
      Copy to Clipboard Toggle word wrap

    • CERT_REQUEST_PROCESSED (success)

      Test case: See CERT_REQUEST_PROCESSED (success) above. 

      0.https-jsse-nio-8443-exec-3 - [25/Apr/2023:02:28:17 EDT] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=caadmin][Outcome=Success][ReqID=7][CertSerialNum=165675596] certificate request processed
      Copy to Clipboard Toggle word wrap

    • OCSP_SIGNING_INFO records OCSP signing certificate key info at system startup 

      0.main - [25/Apr/2023:02:28:39 EDT] [14] [6] [AuditEvent=OCSP_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=A3:AB:71:4C:E0:C8:8B:E4:6D:08:5B:10:EC:F3:E4:6B:F3:70:EB:57] OCSP signing info
      Copy to Clipboard Toggle word wrap

    • OCSP_GENERATION (success)

      Test case: following the procedure in TBD "Testing CRL publishing" to run OCSPClient in order to trigger an OCSP response. 

      0.http-nio-32080-exec-1 - [25/Apr/2023:06:07:29 EDT] [14] [6] [AuditEvent=OCSP_GENERATION][SubjectID=$NonRoleUser$][Outcome=Success] OCSP response generation
      Copy to Clipboard Toggle word wrap

    • CRL_SIGNING_INFO records CRL signing certificate key info at system startup 

      0.main - [25/Apr/2023:05:55:22 EDT] [14] [6] [AuditEvent=CRL_SIGNING_INFO][SubjectID=$System$][Outcome=Success][SKI=2C:E1:7C:DB:B0:6E:62:36:70:67:B7:BF:19:80:4C:D0:8F:B5:80:02] CRL signing info
      Copy to Clipboard Toggle word wrap

    • FULL_CRL_GENERATION (success)

      Test case: removing the filters log.instance.SignedAudit.filters.FULL_CRL_GENERATION=(Outcome=Failure) and setting the revocation buffer auths.revocationChecking.bufferSize to 0 and ca.crl.MasterCRL.alwaysUpdate to true. Then revoking a certificate and invoking the UpdateCRL endpoint as per the procedure in "Testing CRL publishing" in the Installation Guide. 

      0.Thread-17 - [04/May/2023:05:46:26 EDT] [14] [6] [AuditEvent=FULL_CRL_GENERATION][SubjectID=$Unidentified$][Outcome=Success][CRLnum=62] Full CRL generation
      Copy to Clipboard Toggle word wrap

    • DELTA_CRL_GENERATION (success)

      Test case: following all the configuration of the previous case and enabling the DELTA CRL (ca.crl.MasterCRL.extension.DeltaCRLIndicator.enable to true). Then revoking a certificate and invoking the UpdateCRL endpoint as per the procedure in "Testing CRL publishing" in the Installation Guide. 

      0.Thread-17 - [04/May/2023:06:29:03 EDT] [14] [6] [AuditEvent=DELTA_CRL_GENERATION][SubjectID=$Unidentified$][Outcome=Success][CRLnum=63] Delta CRL generation
      Copy to Clipboard Toggle word wrap

  • Failure in signature generation.

    • CERT_REQUEST_PROCESSED (failure)

      Test case: follow the CMC enrollment procedure described above, but use the profile caCMCUserCert instead of caCMCECUserCert when composing the HttpClient configuration file. 

      0.https-jsse-jss-nio-21443-exec-18 - [14/Sep/2023:13:44:35 EDT] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=$NonRoleUser$][Outcome=Failure][ReqID=71][InfoName=rejectReason][InfoValue=Request 71 Rejected - Key Type RSA Not Matched] certificate request processed
      Copy to Clipboard Toggle word wrap

    • OCSP_GENERATION (failure) 

      0.http-nio-32080-exec-15 - [25/Apr/2023:02:47:47 EDT] [14] [6] [AuditEvent=OCSP_GENERATION][SubjectID=$NonRoleUser$][Outcome=Failure][FailureReason=End-of-file reached while decoding ASN.1 header] OCSP response generation
      Copy to Clipboard Toggle word wrap
FCS_HTTPS_EXT.1 and FCS_TLSS_EXT.2

  • Failure to establish a HTTPS/TLS session.

    • ACCESS_SESSION_ESTABLISH (failure)

      See FTP_TRP.1

  • Establishment/termination of a HTTPS/TLS session

    • ACCESS_SESSION_TERMINATED

      See FIA_UIA_EXT.1

FCS_TLSC_EXT.2

  • Failure to establish a TLS session.

    • CLIENT_ACCESS_SESSION_ESTABLISH (failure)

      When Server is not reachable by Client and Session ran into failures. In this scenario, CA acts as a client for KRA during Key Archival and KRA is not reachable by CA.

      Test case: disabling the KRA and perform a HttpClient request. E.g. following the procedure in "Test key archival" in the Installation Guide. 

      0.https-jsse-jss-nio-21443-exec-15 - [10/Jun/2024:12:29:16 EDT] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=10.0.188.72][ServerHost=rhcs10.example.com][ServerPort=23443][SubjectID=SYSTEM][Outcome=Failure][Info=send:java.io.IOException: Socket has been closed, and cannot be reused.] access session failed to establish when Certificate System acts as client
      Copy to Clipboard Toggle word wrap

      When CA’s subsystem cert is revoked and it tried to access KRA.

      Test case: revoking the CA system certificate and performing the KRA test.

      • KRA

        Test case: marking the CA’s subsystem certificate on-hold and performing the Key archival ( CA KRA ). HttpClient triggers the event in the KRA’s audit logging file. 

        0.https-jsse-jss-nio-23443-exec-1 - [10/Jun/2024:12:35:25 EDT] [14] [6] [AuditEvent=ACCESS_SESSION_ESTABLISH][ClientIP=10.0.188.72][ServerIP=10.0.188.72][SubjectID=CN=Subsystem Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][CertSerialNum=208481924][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Failure][Info=serverAlertSent: CERTIFICATE_REVOKED] access session establish failure
        Copy to Clipboard Toggle word wrap

      • CA

        Test case: revoking the CA System certificate and performing the KRA test. 

        0.https-jsse-jss-nio-21443-exec-3 - [10/Jun/2024:12:35:25 EDT] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH][ClientHost=10.0.188.72][ServerHost=rhcs10.example.com][ServerPort=23443][SubjectID=SYSTEM][Outcome=Failure][Info=send:java.io.IOException: Socket has been closed, and cannot be reused.] access session failed to establish when Certificate System acts as client
        Copy to Clipboard Toggle word wrap 
        0.ConnectAsync - [10/Jun/2024:12:35:25 EDT] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=10.0.188.72][ServerHost=10.0.188.72][ServerPort=23443][SubjectID=CN=rhcs10.example.com,OU=rhcs10-ECC-KRA,O=Example-SubCA][CertSerialNum=42383494][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][Info=clientAlertReceived: CERTIFICATE_REVOKED] access session terminated when Certificate System acts as client
        Copy to Clipboard Toggle word wrap

  • Establishment/termination of a TLS session.

    • CLIENT_ACCESS_SESSION_TERMINATED

      Test case: attempting to sign into a PKI Console without setting up CA Admin cert. 

      0.https-jsse-jss-nio-31443-exec-9 - [11/Jun/2024:09:31:47 EDT] [14] [6] [AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED][ClientHost=10.0.188.72][ServerHost=10.0.188.64][ServerPort=7636][SubjectID=CN=rhds11-5.example.com][CertSerialNum=119813240][IssuerDN=CN=CA Signing Certificate,OU=rhcs10-RSA-SubCA,O=Example-rhcs10-RSA-RootCA][Outcome=Success][Info=clientAlertSent: CLOSE_NOTIFY] access session terminated when Certificate System acts as client
      Copy to Clipboard Toggle word wrap
FDP_CRL_EXT.1

  • Failure to generate a CRL.

    • FULL_CRL_GENERATION (failure)

      Test case: as an agent, logging in on a CA agent WebUI portal, clicking on Update Revocation List and under Signature algorithm, selecting SHA1withRSA. Counting on SHA1withRSA still being an option in the UI, although no longer allowed. 

      0.CRLIssuingPoint-MasterCRL - [11/May/2023:00:09:42 EDT] [14] [6] [AuditEvent=FULL_CRL_GENERATION][SubjectID=$Unidentified$][Outcome=Failure][FailureReason=Signing algorithm not supported: SHA1withRSA: Unable to create signing context: (-8011) Unknown error] Full CRL generation
      Copy to Clipboard Toggle word wrap
FDP_OCSPG_EXT.1 (extended)

  • Failure to generate certificate status information.

    • OCSP_GENERATION (failure)

      Test case: setting ca.ocsp=false to disable OCSP service in the CA and run OCSPClient. 

      0.http-nio-31080-exec-1 - [30/Nov/2023:18:50:51 EST] [14] [6] [AuditEvent=OCSP_GENERATION][SubjectID=$NonRoleUser$][Outcome=Failure][FailureReason=OCSP service disabled] OCSP response generation
      Copy to Clipboard Toggle word wrap
FIA_AFL.1

  • The reaching of the threshold for the Unsuccessful Authentication Attempts. The action Taken. The re-enablement of disabled non-administrative accounts.

    Not available. For password authentication only. Certificate System provides certificate-based authentication only.

FIA_CMCS_EXT.1

  • CMC requests (generated or received) containing certificate requests or revocation requests. CMC responses issued.

    • CMC_SIGNED_REQUEST_SIG_VERIFY

      Test case: Removing the log.instance.SignedAudit.filters.CMC_SIGNED_REQUEST_SIG_VERIFY parameter from CS.cfg and restarting the CA. Then creating and submitting an agent-signed CMC request, e.g. the procedure for the issuance of user1’s certificate under "Testing CRL publishing" in the Installation Guide. 

      0.https-jsse-jss-nio-21443-exec-3 - [25/Nov/2023:16:47:47 PST] [14] [6] [AuditEvent=CMC_SIGNED_REQUEST_SIG_VERIFY][SubjectID=CN=PKI Administrator,E=example@redhat.com,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][ReqType=enrollment][CertSubject=CN=ecc test ecc-user1,UID=ecc-ecc-user1][SignerInfo=CN=PKI Administrator,E=example@redhat.com,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA] agent signed CMC request signature verification
      Copy to Clipboard Toggle word wrap

    • CMC_USER_SIGNED_REQUEST_SIG_VERIFY

      • Successful request:

        Test case: submitting a CMC (user-signed or self-signed) certificate enrollment or revocation request and verifying the signature. E.g:

        1. Removing the log.instance.SignedAudit.filters.CMC_SIGNED_REQUEST_SIG_VERIFY parameter from CS.cfg and restarting the CA.
        2. Then creating and submitting an user-signed (shared token) request, e.g. by following 7.8.4.3 "Test the CMC Shared Token" in the Installation Guide. 
        0.https-jsse-jss-nio-21443-exec-6 - [25/Nov/2023:17:02:13 PST] [14] [6] [AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY][SubjectID=CN=PKI Administrator,E=example@redhat.com,OU=rhcs10-ECC-SubCA,O=Example-rhcs10-ECC-RootCA][Outcome=Success][ReqType=enrollment][CertSubject=CN=eccFooUser123,UID=eccFooUser123,OU=self-signed][SignerInfo=$Unidentified$] User signed CMC request signature verification success
        Copy to Clipboard Toggle word wrap

    • CMC_REQUEST_RECEIVED

      • Successful request:

        Test case: a successful CMC request using SharedSecret (with cmc.popLinkWitnessRequired=true). 

        0.https-jsse-jss-nio-21443-exec-8 - [21/Nov/2023:16:49:57 EST] [14] [6] [AuditEvent=CMC_REQUEST_RECEIVED][SubjectID=$Unidentified$][Outcome=Success][CMCRequest=MIIDYgYJKoZIhvcNAQcCoIIDUzCCA08CAQMxDzANBglghkgBZQMEAgEFA…] CMC request received
        Copy to Clipboard Toggle word wrap

    • PROOF_OF_POSSESSION (Enrollment Event)

      Test case: a successful CMC request using SharedSecret (with cmc.popLinkWitnessRequired=true). 

      0.https-jsse-jss-nio-21443-exec-8 - [21/Nov/2023:16:49:57 EST] [14] [6] [AuditEvent=PROOF_OF_POSSESSION][SubjectID=eccFooUser123][Outcome=Success][Info=method=EnrollProfile: fillTaggedRequest: ] proof of possession
      Copy to Clipboard Toggle word wrap

    • PROFILE_CERT_REQUEST (Enrollment Event)

      Test case: a successful CMC request signed and issued by a CA agent (with cmc.popLinkWitnessRequired=false). 

      0.https-jsse-jss-nio-21443-exec-3 - [21/Nov/2023:16:58:45 EST] [14] [6] [AuditEvent=PROFILE_CERT_REQUEST][SubjectID=caadmin][Outcome=Success][ReqID=87][ProfileID=caECFullCMCUserCert][CertSubject=CN=ecc test ecc-user1,UID=ecc-ecc-user1] certificate request made with certificate profiles
      Copy to Clipboard Toggle word wrap

    • CERT_STATUS_CHANGE_REQUEST

      • Success:

        Test case: following the example in "Testing CRL publishing" of the Installation Guide to issue and then revoke certificate for user2. 

        [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=CN=ecc test ecc-user2,UID=ecc-ecc-user2][Outcome=Success][ReqID=14][CertSerialNum=15390937][RequestType=revoke][RevokeReasonNum=Unspecified][Approval=complete] certificate status change request processed
        Copy to Clipboard Toggle word wrap

      • Failure: 

        0.https-jsse-nio-31443-exec-5 - [09/May/2023:16:42:56 EDT] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST][SubjectID=caadmin][Outcome=Failure][ReqID=<null>][CertSerialNum=0x2c192ac][RequestType=on-hold] certificate revocation/unrevocation request made
        Copy to Clipboard Toggle word wrap

    • CERT_REQUEST_PROCESSED

      • Successful request:

        Test case: compelting certificate status change (revoked, expired, on-hold, off-hold). 

        0.https-jsse-nio-31443-exec-24 - [28/Apr/2023:09:58:07 EDT] [14] [6] [AuditEvent=CERT_REQUEST_PROCESSED][SubjectID=caadmin][Outcome=Success][ReqID=67][CertSerialNum=86198753] certificate request processed
        Copy to Clipboard Toggle word wrap

    • CERT_STATUS_CHANGE_REQUEST_PROCESSED

      • Successful request:

        Test case: completing certificate status change (revoked, expired, on-hold, off-hold). 

        0.https-jsse-nio-31443-exec-14 - [09/May/2023:17:29:35 EDT] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=rsa_SubCA_AgentV][Outcome=Success][ReqID=80][CertSerialNum=0x2c192ac][RequestType=<null>][RevokeReasonNum=6][Approval=complete] certificate status change request processed
        Copy to Clipboard Toggle word wrap

      • Failed request:

        • Completing a revocation, shrTok not found.

          Test case: 

          0.http-bio-20443-exec-14 - [29/Jan/2019:07:15:27 EST] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=<null>][Outcome=Failure][ReqID=<null>][CertSerialNum=20][RequestType=revoke][RevokeReasonNum=Certificate_Hold][Approval=rejected][Info=CMCOutputTemplate: SharedSecret.getSharedToken(BigInteger serial): shrTok not found in metaInfo] certificate status change request processed
          Copy to Clipboard Toggle word wrap

        • Completing a revocation, cert issuer and request issuer do not match.

          Test case: 

          0.http-bio-20443-exec-20 - [29/Jan/2019:07:30:41 EST] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=UID=user1a,OU=People,DC=rhel76,DC=test][Outcome=Failure][ReqID=<null>][CertSerialNum=20][RequestType=revoke][RevokeReasonNum=Certificate_Hold][Approval=rejected][Info= certificate issuer DN and revocation request issuer DN do not match] certificate status change request processed
          Copy to Clipboard Toggle word wrap

        • Completing a revocation, on-hold cert status update.

          Test case: following "Testing CRL publishing" in the Installation Guide to revoke a certificate as with user2 in the example, but instead of creating/revoking an actual certificate, just editing the CMC request file so that revRequest.serial is assigned a non-existent serial number, e.g. revRequest.serial=1111111. 

          0.https-jsse-jss-nio-21443-exec-12 - [27/Nov/2023:11:34:53 PST] [14] [6] [AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED][SubjectID=<null>][Outcome=Failure][ReqID=<null>][CertSerialNum=1111111][RequestType=revoke][RevokeReasonNum=Unspecified][Approval=rejected][Info= The certificate is not found] certificate status change request processed
          Copy to Clipboard Toggle word wrap

    • CMC_RESPONSE_SENT

      • Enrollment

        • Successful response

          Test case: creating a CSR by following Section 5.2, “Creating certificate signing requests (CSR)”, then creating a CMCRequest config file by following Section 5.3.1, “The CMC enrollment process” then submitting the request using HttpClient. 

          0.https-jsse-nio-31443-exec-8 - [01/May/2023:23:37:50 EDT] [14] [6] [AuditEvent=CMC_RESPONSE_SENT][SubjectID=FooUser123][Outcome=Success][CMCResponse=MIIM+wYJkwWSE/] CMC response sent
          Copy to Clipboard Toggle word wrap

      • Revocation

        • Successful revocation

          Test case: revoking a certificate, for example by following the procedure in Section 6.2.1.1, “Revoking a certificate using CMCRequest”. 

          0.http-bio-20443-exec-9 - [29/Jan/2019:07:43:36 EST] [14] [6] [AuditEvent=CMC_RESPONSE_SENT][SubjectID=$Unidentified$][Outcome=Success][CMCResponse=MIIExgYJKoZ...] CMC response sent
          Copy to Clipboard Toggle word wrap

        • Failed revocation

          • Revocation does not happen

            Test case: revoking a non-existing certificate, for example by following the procedure in Section 6.2.1.1, “Revoking a certificate using CMCRequest”. 

            0.https-jsse-nio-31443-exec-8 - [01/May/2023:23:37:50 EDT] [14] [6] [AuditEvent=CMC_RESPONSE_SENT][SubjectID=FooUser123][Outcome=Success][CMCResponse=MIIM+wYJKoZIh…] CMC response sent
            Copy to Clipboard Toggle word wrap
FPT_SKY_EXT.1(2)/OTH

  • AUTHZ

    • Failure: Agent user attempts to retrieve audit log:

      Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n 'rsa_SubCA_AdminV' ca-audit-file-find. 

      0.https-jsse-nio-31443-exec-24 - [03/May/2023:08:30:38 EDT] [14] [6] [AuditEvent=AUTHZ][SubjectID=rsa_SubCA_AdminV][Outcome=Failure][aclResource=certServer.log.content.signedAudit][Op=read][Info=Authorization Error] authorization failure
      Copy to Clipboard Toggle word wrap

    • Success: Auditor user retrieved audit log:

      Test case: # pki -d /root/.dogtag/pki_rsa_bootstrap/certs_db/ -c SECret.123 -p 31443 -n 'rsa_SubCA_AuditV' ca-audit-file-find. 

      0.https-jsse-nio-31443-exec-5 - [03/May/2023:08:31:11 EDT] [14] [6] [AuditEvent=AUTHZ][SubjectID=rsa_SubCA_AuditV][Outcome=Success][aclResource=certServer.log.content.signedAudit][Op=read][Info=AuditResource.findAuditFiles] authorization success
      Copy to Clipboard Toggle word wrap
FTP_ITC.1

  • Initiation of the trusted channel. Termination of the trusted channel. Failure of the trusted channel functions.

    • See FCS_HTTPS_EXT.1
    • See FCS_TLSC_EXT.2

E.2. Audit Event Descriptions
Link kopieren

This section provides descriptions to audit events.
For required audit events and their examples, see Section E.1, “Required audit events and their examples”.

E.2.1. TOE Environment audit events
Link kopieren

This section provides the format description of TOE (Target of Evaluation) Environment audit events. 

####################### SIGNED AUDIT EVENTS #############################
# Common fields:
# - Outcome: "Success" or "Failure"
# - SubjectID: The UID of the user responsible for the operation
#     "$System$" or "SYSTEM" if system-initiated operation (e.g. log signing).
#
#########################################################################
# Required Audit Events
#
# Event: ACCESS_SESSION_ESTABLISH with [Outcome=Failure]
# Description: This event is used when access session failed to establish.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - ClientIP: Client IP address.
# - ServerIP: Server IP address.
# - SubjectID: Client certificate subject DN.
# - Outcome: Failure
# - Info: Failure reason.
#
LOGGING_SIGNED_AUDIT_ACCESS_SESSION_ESTABLISH_FAILURE=\
<type=ACCESS_SESSION_ESTABLISH>:[AuditEvent=ACCESS_SESSION_ESTABLISH]{0} access session establish failure
#
# Event: ACCESS_SESSION_ESTABLISH with [Outcome=Success]
# Description: This event is used when access session was established successfully.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - ClientIP: Client IP address.
# - ServerIP: Server IP address.
# - SubjectID: Client certificate subject DN.
# - Outcome: Success
#
LOGGING_SIGNED_AUDIT_ACCESS_SESSION_ESTABLISH_SUCCESS=\
<type=ACCESS_SESSION_ESTABLISH>:[AuditEvent=ACCESS_SESSION_ESTABLISH]{0} access session establish success
#
# Event: ACCESS_SESSION_TERMINATED
# Description: This event is used when access session was terminated.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - ClientIP: Client IP address.
# - ServerIP: Server IP address.
# - SubjectID: Client certificate subject DN.
# - Info: The TLS Alert received from NSS
# - Outcome: Success
# - Info: The TLS Alert received from NSS
#
LOGGING_SIGNED_AUDIT_ACCESS_SESSION_TERMINATED=\
<type=ACCESS_SESSION_TERMINATED>:[AuditEvent=ACCESS_SESSION_TERMINATED]{0} access session terminated
#
# Event: AUDIT_LOG_SIGNING
# Description: This event is used when a signature on the audit log is generated (same as "flush" time).
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: Predefined to be "$System$" because this operation
#     associates with no user.
# - Outcome: Success
# - sig: The base-64 encoded signature of the buffer just flushed.
#
LOGGING_SIGNED_AUDIT_AUDIT_LOG_SIGNING_3=[AuditEvent=AUDIT_LOG_SIGNING][SubjectID={0}][Outcome={1}] signature of audit buffer just flushed: sig: {2}
#
# Event: AUDIT_LOG_STARTUP
# Description: This event is used at audit function startup.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: $System$
# - Outcome:
#
LOGGING_SIGNED_AUDIT_AUDIT_LOG_STARTUP_2=<type=AUDIT_LOG_STARTUP>:[AuditEvent=AUDIT_LOG_STARTUP][SubjectID={0}][Outcome={1}] audit function startup
#
# Event: AUTH with [Outcome=Failure]
# Description: This event is used when authentication fails.
#   In case of SSL-client auth, only webserver env can pick up the SSL violation.
#   CS authMgr can pick up certificate mismatch, so this event is used.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome: Failure
#     (obviously, if authentication failed, you won't have a valid SubjectID, so
#     in this case, SubjectID should be $Unidentified$)
# - AuthMgr: The authentication manager instance name that did
#     this authentication.
# - AttemptedCred: The credential attempted and failed.
#
LOGGING_SIGNED_AUDIT_AUTH_FAIL=<type=AUTH>:[AuditEvent=AUTH]{0} authentication failure
#
# Event: AUTH with [Outcome=Success]
# Description: This event is used when authentication succeeded.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: id of user who has been authenticated
# - Outcome: Success
# - AuthMgr: The authentication manager instance name that did
#     this authentication.
#
LOGGING_SIGNED_AUDIT_AUTH_SUCCESS=<type=AUTH>:[AuditEvent=AUTH]{0} authentication success
#
# Event: AUTHZ with [Outcome=Failure]
# Description: This event is used when authorization has failed.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: id of user who has failed to be authorized for an action
# - Outcome: Failure
# - aclResource: The ACL resource ID as defined in ACL resource list.
# - Op: One of the operations as defined with the ACL statement
#    e.g. "read" for an ACL statement containing "(read,write)".
# - Info:
#
LOGGING_SIGNED_AUDIT_AUTHZ_FAIL=<type=AUTHZ>:[AuditEvent=AUTHZ]{0} authorization failure
#
# Event: AUTHZ with [Outcome=Success]
# Description: This event is used when authorization is successful.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: id of user who has been authorized for an action
# - Outcome: Success
# - aclResource: The ACL resource ID as defined in ACL resource list.
# - Op: One of the operations as defined with the ACL statement
#     e.g. "read" for an ACL statement containing "(read,write)".
#
LOGGING_SIGNED_AUDIT_AUTHZ_SUCCESS=<type=AUTHZ>:[AuditEvent=AUTHZ]{0} authorization success
#
# Event: CERT_PROFILE_APPROVAL
# Description: This event is used when an agent approves/disapproves a certificate profile set by the
#   administrator for automatic approval.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: id of the CA agent who approved the certificate enrollment profile
# - Outcome:
# - ProfileID: One of the profiles defined by the administrator
#     and to be approved by an agent.
# - Op: "approve" or "disapprove".
#
LOGGING_SIGNED_AUDIT_CERT_PROFILE_APPROVAL_4=<type=CERT_PROFILE_APPROVAL>:[AuditEvent=CERT_PROFILE_APPROVAL][SubjectID={0}][Outcome={1}][ProfileID={2}][Op={3}] certificate profile approval
#
# Event: CERT_REQUEST_PROCESSED
# Description: This event is used when certificate request has just been through the approval process.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: The UID of the agent who approves, rejects, or cancels
#     the certificate request.
# - Outcome:
# - ReqID: The request ID.
# - InfoName: "certificate" (in case of approval), "rejectReason"
#     (in case of reject), or "cancelReason" (in case of cancel)
# - InfoValue: The certificate (in case of success), a reject reason in
#     text, or a cancel reason in text.
# - CertSerialNum:
#
LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED=<type=CERT_REQUEST_PROCESSED>:[AuditEvent=CERT_REQUEST_PROCESSED]{0} certificate request processed
#
# Event: CERT_SIGNING_INFO
# Description: This event indicates which key is used to sign certificates.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: $System$
# - Outcome: Success
# - SKI: Subject Key Identifier of the certificate signing certificate
# - AuthorityID: (applicable only to lightweight CA)
#
LOGGING_SIGNED_AUDIT_CERT_SIGNING_INFO=<type=CERT_SIGNING_INFO>:[AuditEvent=CERT_SIGNING_INFO]{0} certificate signing info
#
# Event: CERT_STATUS_CHANGE_REQUEST
# Description: This event is used when a certificate status change request (e.g. revocation)
#   is made (before approval process).
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: id of uer who performed the action
# - Outcome:
# - ReqID: The request ID.
# - CertSerialNum: The serial number (in hex) of the certificate to be revoked.
# - RequestType: "revoke", "on-hold", "off-hold"
#
LOGGING_SIGNED_AUDIT_CERT_STATUS_CHANGE_REQUEST=<type=CERT_STATUS_CHANGE_REQUEST>:[AuditEvent=CERT_STATUS_CHANGE_REQUEST]{0} certificate revocation/unrevocation request made
#
# Event: CERT_STATUS_CHANGE_REQUEST_PROCESSED
# Description: This event is used when certificate status is changed (revoked, expired, on-hold,
#   off-hold).
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: The UID of the agent that processed the request.
# - Outcome:
# - ReqID: The request ID.
# - RequestType: "revoke", "on-hold", "off-hold"
# - Approval: "complete", "rejected", or "canceled"
#     (note that "complete" means "approved")
# - CertSerialNum: The serial number (in hex).
# - RevokeReasonNum: One of the following number:
#     reason number       reason
#     --------------------------------------
#     0              Unspecified
#     1              Key compromised
#     2              CA key compromised (should not be used)
#     3              Affiliation changed
#     4              Certificate superceded
#     5              Cessation of operation
#     6              Certificate is on-hold
# - Info:
#
LOGGING_SIGNED_AUDIT_CERT_STATUS_CHANGE_REQUEST_PROCESSED=<type=CERT_STATUS_CHANGE_REQUEST_PROCESSED>:[AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED]{0} certificate status change request processed
#
# Event: CLIENT_ACCESS_SESSION_ESTABLISH with [Outcome=Failure]
# Description: This event is when access session failed to establish when Certificate System acts as client.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - ClientHost: Client hostname.
# - ServerHost: Server hostname.
# - ServerPort: Server port.
# - SubjectID: SYSTEM
# - Outcome: Failure
# - Info:
#
LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_ESTABLISH_FAILURE=\
<type=CLIENT_ACCESS_SESSION_ESTABLISH>:[AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH]{0} access session failed to establish when Certificate System acts as client
#
# Event: CLIENT_ACCESS_SESSION_ESTABLISH with [Outcome=Success]
# Description: This event is used when access session was established successfully when
#   Certificate System acts as client.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - ClientHost: Client hostname.
# - ServerHost: Server hostname.
# - ServerPort: Server port.
# - SubjectID: SYSTEM
# - Outcome: Success
#
LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS=\
<type=CLIENT_ACCESS_SESSION_ESTABLISH>:[AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH]{0} access session establish successfully when Certificate System acts as client
#
# Event: CLIENT_ACCESS_SESSION_TERMINATED
# Description: This event is used when access session was terminated when Certificate System acts as client.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - ClientHost: Client hostname.
# - ServerHost: Server hostname.
# - ServerPort: Server port.
# - SubjectID: SYSTEM
# - Outcome: Success
# - Info: The TLS Alert received from NSS
#
LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_TERMINATED=\
<type=CLIENT_ACCESS_SESSION_TERMINATED>:[AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED]{0} access session terminated when Certificate System acts as client
#
# Event: CMC_REQUEST_RECEIVED
# Description: This event is used when a CMC request is received.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: The UID of user that triggered this event.
#     If CMC requests is signed by an agent, SubjectID should
#     be that of the agent.
#     In case of an unsigned request, it would bear $Unidentified$.
# - Outcome:
# - CMCRequest: Base64 encoding of the CMC request received
#
LOGGING_SIGNED_AUDIT_CMC_REQUEST_RECEIVED_3=<type=CMC_REQUEST_RECEIVED>:[AuditEvent=CMC_REQUEST_RECEIVED][SubjectID={0}][Outcome={1}][CMCRequest={2}] CMC request received
#
# Event: CMC_RESPONSE_SENT
# Description: This event is used when a CMC response is sent.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: The UID of user that triggered this event.
# - Outcome:
# - CMCResponse: Base64 encoding of the CMC response sent
#
LOGGING_SIGNED_AUDIT_CMC_RESPONSE_SENT_3=<type=CMC_RESPONSE_SENT>:[AuditEvent=CMC_RESPONSE_SENT][SubjectID={0}][Outcome={1}][CMCResponse={2}] CMC response sent
#
# Event: CMC_SIGNED_REQUEST_SIG_VERIFY
# Description: This event is used when agent signed CMC certificate requests or revocation requests
#   are submitted and signature is verified.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: the user who signed the CMC request (success case)
# - Outcome:
# - ReqType: The request type (enrollment, or revocation).
# - CertSubject: The certificate subject name of the certificate request.
# - SignerInfo: A unique String representation for the signer.
#
LOGGING_SIGNED_AUDIT_CMC_SIGNED_REQUEST_SIG_VERIFY=<type=CMC_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_SIGNED_REQUEST_SIG_VERIFY]{0} agent signed CMC request signature verification
#
# Event: CMC_USER_SIGNED_REQUEST_SIG_VERIFY
# Description: This event is used when CMC (user-signed or self-signed) certificate requests or revocation requests
#   are submitted and signature is verified.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: the user who signed the CMC request (success case)
# - Outcome:
# - ReqType: The request type (enrollment, or revocation).
# - CertSubject: The certificate subject name of the certificate request.
# - CMCSignerInfo: A unique String representation for the CMC request signer.
# - info:
#
LOGGING_SIGNED_AUDIT_CMC_USER_SIGNED_REQUEST_SIG_VERIFY_FAILURE=<type=CMC_USER_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY]{0} User signed CMC request signature verification failure
LOGGING_SIGNED_AUDIT_CMC_USER_SIGNED_REQUEST_SIG_VERIFY_SUCCESS=<type=CMC_USER_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY]{0} User signed CMC request signature verification success
#
# Event: CONFIG_ACL
# Description: This event is used when configuring ACL information.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_ACL_3=<type=CONFIG_ACL>:[AuditEvent=CONFIG_ACL][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] ACL configuration parameter(s) change
#
# Event: CONFIG_AUTH
# Description: This event is used when configuring authentication.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- Password MUST NOT be logged ---
#
LOGGING_SIGNED_AUDIT_CONFIG_AUTH_3=<type=CONFIG_AUTH>:[AuditEvent=CONFIG_AUTH][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] authentication configuration parameter(s) change
#
# Event: CONFIG_CERT_PROFILE
# Description: This event is used when configuring certificate profile
#   (general settings and certificate profile).
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE_3=<type=CONFIG_CERT_PROFILE>:[AuditEvent=CONFIG_CERT_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] certificate profile configuration parameter(s) change
#
# Event: CONFIG_CRL_PROFILE
# Description: This event is used when configuring CRL profile
#   (extensions, frequency, CRL format).
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_CRL_PROFILE_3=<type=CONFIG_CRL_PROFILE>:[AuditEvent=CONFIG_CRL_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] CRL profile configuration parameter(s) change
#
# Event: CONFIG_DRM
# Description: This event is used when configuring KRA.
#   This includes key recovery scheme, change of any secret component.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- secret component (password) MUST NOT be logged ---
#
LOGGING_SIGNED_AUDIT_CONFIG_DRM_3=<type=CONFIG_DRM>:[AuditEvent=CONFIG_DRM][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] DRM configuration parameter(s) change
#
# Event: CONFIG_OCSP_PROFILE
# Description: This event is used when configuring OCSP profile
#   (everything under Online Certificate Status Manager).
# Applicable subsystems: OCSP
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_OCSP_PROFILE_3=<type=CONFIG_OCSP_PROFILE>:[AuditEvent=CONFIG_OCSP_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] OCSP profile configuration parameter(s) change
#
# Event: CONFIG_ROLE
# Description: This event is used when configuring role information.
#   This includes anything under users/groups, add/remove/edit a role, etc.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_ROLE=<type=CONFIG_ROLE>:[AuditEvent=CONFIG_ROLE]{0} role configuration parameter(s) change
#
# Event: CONFIG_SERIAL_NUMBER
# Description: This event is used when configuring serial number ranges
#   (when requesting a serial number range when cloning, for example).
# Applicable subsystems: CA, KRA
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_SERIAL_NUMBER_1=<type=CONFIG_SERIAL_NUMBER>:[AuditEvent=CONFIG_SERIAL_NUMBER][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] serial number range update
#
# Event: CONFIG_SIGNED_AUDIT
# Description: This event is used when configuring signedAudit.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: id of administrator who performed the action
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_SIGNED_AUDIT=<type=CONFIG_SIGNED_AUDIT>:[AuditEvent=CONFIG_SIGNED_AUDIT]{0} signed audit configuration parameter(s) change
#
# Event: CONFIG_TRUSTED_PUBLIC_KEY
# Description: This event is used when:
#   1. "Manage Certificate" is used to edit the trustness of certificates
#      and deletion of certificates
#   2. "Certificate Setup Wizard" is used to import CA certificates into the
#      certificate database (Although CrossCertificatePairs are stored
#      within internaldb, audit them as well)
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: ID of administrator who performed this configuration
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_TRUSTED_PUBLIC_KEY=<type=CONFIG_TRUSTED_PUBLIC_KEY>:[AuditEvent=CONFIG_TRUSTED_PUBLIC_KEY]{0} certificate database configuration
#
# Event: CRL_SIGNING_INFO
# Description: This event indicates which key is used to sign CRLs.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: $System$
# - Outcome:
# - SKI: Subject Key Identifier of the CRL signing certificate
#
LOGGING_SIGNED_AUDIT_CRL_SIGNING_INFO=<type=CRL_SIGNING_INFO>:[AuditEvent=CRL_SIGNING_INFO]{0} CRL signing info
#
# Event: DELTA_CRL_GENERATION
# Description: This event is used when delta CRL generation is complete.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: $Unidentified$
# - Outcome: "Success" when delta CRL is generated successfully, "Failure" otherwise.
# - CRLnum: The CRL number that identifies the CRL
# - Info:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_DELTA_CRL_GENERATION=<type=DELTA_CRL_GENERATION>:[AuditEvent=DELTA_CRL_GENERATION]{0} Delta CRL generation
#
# Event: FULL_CRL_GENERATION
# Description: This event is used when full CRL generation is complete.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: $System$
# - Outcome: "Success" when full CRL is generated successfully, "Failure" otherwise.
# - CRLnum: The CRL number that identifies the CRL
# - Info:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_FULL_CRL_GENERATION=<type=FULL_CRL_GENERATION>:[AuditEvent=FULL_CRL_GENERATION]{0} Full CRL generation
#
# Event: PROFILE_CERT_REQUEST
# Description: This event is used when a profile certificate request is made (before approval process).
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: The UID of user that triggered this event.
#     If CMC enrollment requests signed by an agent, SubjectID should
#     be that of the agent.
# - Outcome:
# - CertSubject: The certificate subject name of the certificate request.
# - ReqID: The certificate request ID.
# - ProfileID: One of the certificate profiles defined by the
#     administrator.
#
LOGGING_SIGNED_AUDIT_PROFILE_CERT_REQUEST_5=<type=PROFILE_CERT_REQUEST>:[AuditEvent=PROFILE_CERT_REQUEST][SubjectID={0}][Outcome={1}][ReqID={2}][ProfileID={3}][CertSubject={4}] certificate request made with certificate profiles
#
# Event: PROOF_OF_POSSESSION
# Description: This event is used for proof of possession during certificate enrollment processing.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: id that represents the authenticated user
# - Outcome:
# - Info: some information on when/how it occurred
#
LOGGING_SIGNED_AUDIT_PROOF_OF_POSSESSION_3=<type=PROOF_OF_POSSESSION>:[AuditEvent=PROOF_OF_POSSESSION][SubjectID={0}][Outcome={1}][Info={2}] proof of possession
#
# Event: OCSP_ADD_CA_REQUEST_PROCESSED
# Description: This event is used when an add CA request to the OCSP Responder is processed.
# Applicable subsystems: OCSP
# Enabled by default: Yes
# Fields:
# - SubjectID: OCSP administrator user id
# - Outcome: "Success" when CA is added successfully, "Failure" otherwise.
# - CASubjectDN: The subject DN of the leaf CA cert in the chain.
#
LOGGING_SIGNED_AUDIT_OCSP_ADD_CA_REQUEST_PROCESSED=<type=OCSP_ADD_CA_REQUEST_PROCESSED>:[AuditEvent=OCSP_ADD_CA_REQUEST_PROCESSED]{0} Add CA for OCSP Responder
#
# Event: OCSP_GENERATION
# Description: This event is used when an OCSP response generated is complete.
# Applicable subsystems: CA, OCSP
# Enabled by default: Yes
# Fields:
# - SubjectID: $NonRoleUser$
# - Outcome: "Success" when OCSP response is generated successfully, "Failure" otherwise.
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_OCSP_GENERATION=<type=OCSP_GENERATION>:[AuditEvent=OCSP_GENERATION]{0} OCSP response generation
#
# Event: OCSP_REMOVE_CA_REQUEST_PROCESSED with [Outcome=Failure]
# Description: This event is used when a remove CA request to the OCSP Responder is processed and failed.
# Applicable subsystems: OCSP
# Enabled by default: Yes
# Fields:
# - SubjectID: OCSP administrator user id
# - Outcome: Failure
# - CASubjectDN: The subject DN of the leaf CA certificate in the chain.
#
LOGGING_SIGNED_AUDIT_OCSP_REMOVE_CA_REQUEST_PROCESSED_FAILURE=<type=OCSP_REMOVE_CA_REQUEST_PROCESSED>:[AuditEvent=OCSP_REMOVE_CA_REQUEST_PROCESSED]{0} Remove CA for OCSP Responder has failed
#
# Event: OCSP_REMOVE_CA_REQUEST_PROCESSED with [Outcome=Success]
# Description: This event is used when a remove CA request to the OCSP Responder is processed successfully.
# Applicable subsystems: OCSP
# Enabled by default: Yes
# Fields:
# - SubjectID: OCSP administrator user id
# - Outcome: "Success" when CA is removed successfully, "Failure" otherwise.
# - CASubjectDN: The subject DN of the leaf CA certificate in the chain.
#
LOGGING_SIGNED_AUDIT_OCSP_REMOVE_CA_REQUEST_PROCESSED_SUCCESS=<type=OCSP_REMOVE_CA_REQUEST_PROCESSED>:[AuditEvent=OCSP_REMOVE_CA_REQUEST_PROCESSED]{0} Remove CA for OCSP Responder is successful
#
# Event: OCSP_SIGNING_INFO
# Description: This event indicates which key is used to sign OCSP responses.
# Applicable subsystems: CA, OCSP
# Enabled by default: Yes
# Fields:
# - SubjectID: $System$
# - Outcome:
# - SKI: Subject Key Identifier of the OCSP signing certificate
# - AuthorityID: (applicable only to lightweight CA)
#
LOGGING_SIGNED_AUDIT_OCSP_SIGNING_INFO=<type=OCSP_SIGNING_INFO>:[AuditEvent=OCSP_SIGNING_INFO]{0} OCSP signing info
#
# Event: ROLE_ASSUME
# Description: This event is used when a user assumes a role.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - Role: One of the valid roles:
#     "Administrators", "Certificate Manager Agents", or "Auditors".
#     Note that customized role names can be used once configured.
#
LOGGING_SIGNED_AUDIT_ROLE_ASSUME=<type=ROLE_ASSUME>:[AuditEvent=ROLE_ASSUME]{0} assume privileged role
#
# Event: SECURITY_DOMAIN_UPDATE
# Description: This event is used when updating contents of security domain
#   (add/remove a subsystem).
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID: CA administrator user ID
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_SECURITY_DOMAIN_UPDATE_1=<type=SECURITY_DOMAIN_UPDATE>:[AuditEvent=SECURITY_DOMAIN_UPDATE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] security domain update
#
# Event: SELFTESTS_EXECUTION
# Description: This event is used when self tests are run.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: $System$
# - Outcome:
#
LOGGING_SIGNED_AUDIT_SELFTESTS_EXECUTION_2=<type=SELFTESTS_EXECUTION>:[AuditEvent=SELFTESTS_EXECUTION][SubjectID={0}][Outcome={1}] self tests execution (see selftests.log for details)
#########################################################################
# Available Audit Events - Enabled by default: Yes
#########################################################################
#
# Event: SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST
# Description: This event is used when Server-Side Keygen enrollment keygen request is made.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - RequestID:
# - ClientID:
#
LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST=<type=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST]{0} Server-Side Keygen enrollment keygen request made
#
# Event: SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST_PROCESSED
# Description: This event is used when a request to do Server-Side Keygen enrollment keygen has been processed
#   is processed.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - RequestID:
# - ClientID:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST_PROCESSED=<type=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST_PROCESSED>:[AuditEvent=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST_PROCESSED]{0} Server-Side Keygen enrollment keygen request processed
#
# Event: SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST
# Description: This event is used when Server-Side Keygen enrollment key retrieval request is made.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - RequestID:
# - ClientID:
#
LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST=<type=SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_ENROLL_KEYGEN_REQUEST]{0} Server-Side Keygen enrollment retrieval request made
#
# Event: SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST_PROCESSED
# Description: This event is used when a request to do Server-Side Keygen enrollment retrieval has been processed
#   is processed.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - RequestID:
# - ClientID:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST_PROCESSED=<type=SERVER_SIDE_KEYGEN_ENROLL_KEY_RETRIEVAL_REQUEST_PROCESSED>:[AuditEvent=SERVER_SIDE_KEYGEN_ENROLL_RETRIEVAL_REQUEST_PROCESSED]{0} Server-Side Keygen enrollment retrieval request processed
#
# Event: ASYMKEY_GENERATION_REQUEST
# Description: This event is used when asymmetric key generation request is made.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - GenerationRequestID:
# - ClientKeyID:
#
LOGGING_SIGNED_AUDIT_ASYMKEY_GENERATION_REQUEST=<type=ASYMKEY_GENERATION_REQUEST>:[AuditEvent=ASYMKEY_GENERATION_REQUEST]{0} Asymkey generation request made
#
# Event: ASYMKEY_GENERATION_REQUEST_PROCESSED
# Description: This event is used when a request to generate asymmetric keys received by the KRA
#   is processed.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - GenerationRequestID:
# - ClientKeyID:
# - KeyID:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_ASYMKEY_GEN_REQUEST_PROCESSED=<type=ASYMKEY_GENERATION_REQUEST_PROCESSED>:[AuditEvent=ASYMKEY_GENERATION_REQUEST_PROCESSED]{0} Asymkey generation request processed
#
# Event: AUTHORITY_CONFIG
# Description: This event is used when configuring lightweight authorities.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_AUTHORITY_CONFIG_3=<type=AUTHORITY_CONFIG>:[AuditEvent=AUTHORITY_CONFIG][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] lightweight authority configuration change
#
# Event: CONFIG_ENCRYPTION
# Description: This event is used when configuring encryption (cert settings and SSL cipher preferences).
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_ENCRYPTION_3=<type=CONFIG_ENCRYPTION>:[AuditEvent=CONFIG_ENCRYPTION][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] encryption configuration parameter(s) change
#
# Event: CONFIG_TOKEN_AUTHENTICATOR
# Description: This event is used when configuring token authenticators.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - OP:
# - Authenticator:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- secret component (password) MUST NOT be logged ---
# - Info: Error info for failed cases.
#
LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_AUTHENTICATOR_6=<type=CONFIG_TOKEN_AUTHENTICATOR>:[AuditEvent=CONFIG_TOKEN_AUTHENTICATOR][SubjectID={0}][Outcome={1}][OP={2}][Authenticator={3}][ParamNameValPairs={4}][Info={5}] token authenticator configuration parameter(s) change
#
# Event: CONFIG_TOKEN_CONNECTOR
# Description: This event is used when configuring token connectors.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - Service: can be any of the methods offered
# - Connector:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- secret component (password) MUST NOT be logged ---
# - Info: Error info for failed cases.
#
LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_CONNECTOR_6=<type=CONFIG_TOKEN_CONNECTOR>:[AuditEvent=CONFIG_TOKEN_CONNECTOR][SubjectID={0}][Outcome={1}][Service={2}][Connector={3}][ParamNameValPairs={4}][Info={5}] token connector configuration parameter(s) change
#
# Event: CONFIG_TOKEN_MAPPING_RESOLVER
# Description: This event is used when configuring token mapping resolver.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: TPS administrator id
# - Outcome:
# - Service:
# - MappingResolverID:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- secret component (password) MUST NOT be logged ---
# - Info: Error info for failed cases.
#
LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_MAPPING_RESOLVER_6=<type=CONFIG_TOKEN_MAPPING_RESOLVER>:[AuditEvent=CONFIG_TOKEN_MAPPING_RESOLVER][SubjectID={0}][Outcome={1}][Service={2}][MappingResolverID={3}][ParamNameValPairs={4}][Info={5}] token mapping resolver configuration parameter(s) change
#
# Event: CONFIG_TOKEN_RECORD
# Description: This event is used when information in token record changed.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: TPS administrator id
# - Outcome:
# - OP: operation to add or delete token
# - TokenID: smart card unique id
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- secret component (password) MUST NOT be logged ---
# - Info: in general is used for capturing error info for failed cases
#
LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_RECORD_6=<type=CONFIG_TOKEN_RECORD>:[AuditEvent=CONFIG_TOKEN_RECORD][SubjectID={0}][Outcome={1}][OP={2}][TokenID={3}][ParamNameValPairs={4}][Info={5}] token record configuration parameter(s) change
#
# Event: KEY_GEN_ASYMMETRIC
# Description: This event is used when asymmetric keys are generated
#   such as when CA certificate requests are generated,
#   e.g. CA certificate change over, renewal with new key.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - PubKey: The base-64 encoded public key material.
#
LOGGING_SIGNED_AUDIT_KEY_GEN_ASYMMETRIC_3=<type=KEY_GEN_ASYMMETRIC>:[AuditEvent=KEY_GEN_ASYMMETRIC][SubjectID={0}][Outcome={1}][PubKey={2}] asymmetric key generation
#
# Event: LOG_PATH_CHANGE
# Description: This event is used when log file name (including any path changes) for any of
#   audit, system, transaction, or other customized log file change is attempted.
#   The ACL should not allow this operation, but make sure it's written after the attempt.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID: administrator user id
# - Outcome:
# - LogType: "System", "Transaction", or "SignedAudit"
# - toLogFile: The name (including any path changes) that the user is
#     attempting to change to.
#
LOGGING_SIGNED_AUDIT_LOG_PATH_CHANGE_4=<type=LOG_PATH_CHANGE>:[AuditEvent=LOG_PATH_CHANGE][SubjectID={0}][Outcome={1}][LogType={2}][toLogFile={3}] log path change attempt
#
# Event: RANDOM_GENERATION
# Description: This event is used when a random number generation is complete.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome: "Success" when a random number is generated successfully, "Failure" otherwise.
# - Info:
#   - Caller: PKI code that calls the random number generator.
#   - Size: Size of random number in bytes.
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_RANDOM_GENERATION=<type=RANDOM_GENERATION>:[AuditEvent=RANDOM_GENERATION]{0} Random number generation
#
# Event: SCHEDULE_CRL_GENERATION
# Description: This event is used when CRL generation is scheduled.
# Applicable subsystems: CA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome: "Success" when CRL generation is scheduled successfully, "Failure" otherwise.
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_SCHEDULE_CRL_GENERATION=<type=SCHEDULE_CRL_GENERATION>:[AuditEvent=SCHEDULE_CRL_GENERATION]{0} schedule for CRL generation
#
# Event: SECURITY_DATA_ARCHIVAL_REQUEST
# Description: This event is used when security data recovery request is made.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - ArchivalRequestID: The requestID provided by the CA through the connector.
#     It is used to track the request through from CA to KRA.
# - RequestId: The KRA archival request ID.
# - ClientKeyID: The user supplied client ID associated with
#     the security data to be archived.
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_SECURITY_DATA_ARCHIVAL_REQUEST=<type=SECURITY_DATA_ARCHIVAL_REQUEST>:[AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST]{0} security data archival request made
#
# Event: SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED
# Description: This event is used when user security data archive request is processed.
#   This is when KRA receives and processed the request.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - ArchivalRequestID: The requestID provided by the CA through the connector.
#     It is used to track the request through from CA to KRA.
# - RequestId: The KRA archival request ID.
# - ClientKeyID: The user supplied client ID associated with
#     the security data to be archived.
# - KeyID:
# - PubKey:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED=<type=SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED>:[AuditEvent=SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED]{0} security data archival request processed
#
# Event: SECURITY_DATA_RECOVERY_REQUEST
# Description: This event is used when security data recovery request is made.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - RecoveryID: The recovery request ID.
# - DataID: The ID of the security data being requested to be recovered.
# - PubKey:
#
LOGGING_SIGNED_AUDIT_SECURITY_DATA_RECOVERY_REQUEST=<type=SECURITY_DATA_RECOVERY_REQUEST>:[AuditEvent=SECURITY_DATA_RECOVERY_REQUEST]{0} security data recovery request made
#
# Event: SECURITY_DATA_RECOVERY_REQUEST_PROCESSED
# Description: This event is used when security data recovery request is processed.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - RecoveryID: The recovery request ID.
# - KeyID: The ID of the security data being requested to be recovered.
# - RecoveryAgents: The UIDs of the recovery agents approving this request.
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_SECURITY_DATA_RECOVERY_REQUEST_PROCESSED=<type=SECURITY_DATA_RECOVERY_REQUEST_PROCESSED>:[AuditEvent=SECURITY_DATA_RECOVERY_REQUEST_PROCESSED]{0} security data recovery request processed
#
# Event: SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE
# Description: This event is used when KRA agents login as recovery agents to change
#   the state of key recovery requests.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - RecoveryID: The recovery request ID.
# - Operation: The operation performed (approve, reject, cancel etc.).
#
LOGGING_SIGNED_AUDIT_SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE=<type=SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE>:[AuditEvent=SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE]{0} security data recovery request state change
#
# Event: SERVER_SIDE_KEYGEN_REQUEST
# Description: This event is used when server-side key generation request is made.
#   This is for token keys.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - EntityID: The representation of the subject that will be on the certificate when issued.
# - RequestID:
#
LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST=<type=SERVER_SIDE_KEYGEN_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST]{0} server-side key generation request
#
# Event: SERVER_SIDE_KEYGEN_REQUEST_PROCESSED
# Description: This event is used when server-side key generation request has been processed.
#   This is for token keys.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - EntityID: The representation of the subject that will be on the certificate when issued.
# - RequestID:
# - PubKey: The base-64 encoded public key associated with
#     the private key to be archived.
#
LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED=<type=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED]{0} server-side key generation request processed
#
# Event: SYMKEY_GENERATION_REQUEST
# Description: This event is used when symmetric key generation request is made.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - GenerationRequestID:
# - ClientKeyID: The ID of the symmetric key to be generated and archived.
#
LOGGING_SIGNED_AUDIT_SYMKEY_GENERATION_REQUEST=<type=SYMKEY_GENERATION_REQUEST>:[AuditEvent=SYMKEY_GENERATION_REQUEST]{0} symkey generation request made
#
# Event: SYMKEY_GENERATION_REQUEST_PROCESSED
# Description: This event is used when symmetric key generation request is processed.
#   This is when KRA receives and processes the request.
# Applicable subsystems: KRA
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - GenerationRequestID:
# - ClientKeyID: The user supplied client ID associated with
#     the symmetric key to be generated and archived.
# - KeyID:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_SYMKEY_GEN_REQUEST_PROCESSED=<type=SYMKEY_GENERATION_REQUEST_PROCESSED>:[AuditEvent=SYMKEY_GENERATION_REQUEST_PROCESSED]{0} symkey generation request processed
#
# Event: TOKEN_APPLET_UPGRADE with [Outcome=Failure]
# Description: This event is used when token apple upgrade failed.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - MSN:
# - KeyVersion:
# - oldAppletVersion:
# - newAppletVersion:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_APPLET_UPGRADE_FAILURE=<type=TOKEN_APPLET_UPGRADE>:[AuditEvent=TOKEN_APPLET_UPGRADE]{0} token applet upgrade failure
#
# Event: TOKEN_APPLET_UPGRADE with [Outcome=Success]
# Description: This event is used when token apple upgrade succeeded.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - MSN:
# - KeyVersion:
# - oldAppletVersion:
# - newAppletVersion:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_APPLET_UPGRADE_SUCCESS=<type=TOKEN_APPLET_UPGRADE>:[AuditEvent=TOKEN_APPLET_UPGRADE]{0} token applet upgrade success
#
# Event: TOKEN_KEY_CHANGEOVER with [Outcome=Failure]
# Description: This event is used when token key changeover failed.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - MSN:
# - tokenType:
# - AppletVersion:
# - oldKeyVersion:
# - newKeyVersion:
# - Info: Info in case of failure.
#
LOGGING_SIGNED_AUDIT_TOKEN_KEY_CHANGEOVER_FAILURE=<type=TOKEN_KEY_CHANGEOVER>:[AuditEvent=TOKEN_KEY_CHANGEOVER]{0} token key changeover failure
#
# Event: TOKEN_KEY_CHANGEOVER with [Outcome=Success]
# Description: This event is used when token key changeover succeeded.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - MSN:
# - tokenType:
# - AppletVersion:
# - oldKeyVersion:
# - newKeyVersion:
# - Info: Usually is unused for success.
#
LOGGING_SIGNED_AUDIT_TOKEN_KEY_CHANGEOVER_SUCCESS=<type=TOKEN_KEY_CHANGEOVER>:[AuditEvent=TOKEN_KEY_CHANGEOVER]{0} token key changeover success
#
# Event: TOKEN_KEY_CHANGEOVER_REQUIRED
# Description: This event is used when token key changeover is required.
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - MSN:
# - tokenType:
# - AppletVersion:
# - oldKeyVersion:
# - newKeyVersion:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_KEY_CHANGEOVER_REQUIRED_10=<type=TOKEN_KEY_CHANGEOVER_REQUIRED>:[AuditEvent=TOKEN_KEY_CHANGEOVER_REQUIRED][IP={0}][SubjectID={1}][CUID={2}][MSN={3}][Outcome={4}][tokenType={5}][AppletVersion={6}][oldKeyVersion={7}][newKeyVersion={8}][Info={9}] token key changeover required

#
# Event: LOGGING_SIGNED_AUDIT_TOKEN_KEY_SANITY_CHECK_SUCCESS
# Description: used for the CS.cfg properties: enableBoundedGPKeyVersion, cuidMustMatchKDD, and validateCardKeyInfoAgainstTokenDB
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - KDD:
# - TokenKeyVersion:
# - NewKeyVersion:
# - TokenDBKeyVersion:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_KEY_SANITY_CHECK_SUCCESS_9=<type=TOKEN_KEY_SANITY_CHECK>:[AuditEvent=TOKEN_KEY_SANITY_CHECK][IP={0}][SubjectID={1}][CUID={2}][KDD={3}][Outcome={4}][TokenKeyVersion={5}][NewKeyVersion={6}][TokenDBKeyVersion={7}][Info={8}] token key sanity check success
#
# Event: LOGGING_SIGNED_AUDIT_TOKEN_KEY_SANITY_CHECK_FAILURE
# Description: used for the CS.cfg properties: enableBoundedGPKeyVersion, cuidMustMatchKDD, and validateCardKeyInfoAgainstTokenDB
# Applicable subsystems: TPS
# Enabled by default: Yes
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - KDD:
# - TokenKeyVersion:
# - NewKeyVersion:
# - TokenDBKeyVersion:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_KEY_SANITY_CHECK_FAILURE_9=<type=TOKEN_KEY_SANITY_CHECK>:[AuditEvent=TOKEN_KEY_SANITY_CHECK][IP={0}][SubjectID={1}][CUID={2}][KDD={3}][Outcome={4}][TokenKeyVersion={5}][NewKeyVersion={6}][TokenDBKeyVersion={7}][Info={8}] token key sanity check failure
+#

#########################################################################
# Available Audit Events - Enabled by default: No
#########################################################################
#
# Event: AUDIT_LOG_DELETE
# Description: This event is used AFTER audit log gets expired.
#   The ACL should not allow this operation, but it is provided in case ACL gets compromised.
#   Make sure it is written AFTER the log expiration happens.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - LogFile: The complete name (including the path) of the
#     signedAudit log that is attempted to be deleted.
#
LOGGING_SIGNED_AUDIT_LOG_DELETE_3=<type=AUDIT_LOG_DELETE>:[AuditEvent=AUDIT_LOG_DELETE][SubjectID={0}][Outcome={1}][LogFile={2}] signedAudit log deletion
#
# Event: AUDIT_LOG_SHUTDOWN
# Description: This event is used at audit function shutdown.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
#
LOGGING_SIGNED_AUDIT_AUDIT_LOG_SHUTDOWN_2=<type=AUDIT_LOG_SHUTDOWN>:[AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID={0}][Outcome={1}] audit function shutdown
#
# Event: CIMC_CERT_VERIFICATION
# Description: This event is used for verifying CS system certificates.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - CertNickName: The certificate nickname.
#
LOGGING_SIGNED_AUDIT_CIMC_CERT_VERIFICATION_3=<type=CIMC_CERT_VERIFICATION>:[AuditEvent=CIMC_CERT_VERIFICATION][SubjectID={0}][Outcome={1}][CertNickName={2}] CS certificate verification
#
# Event: CMC_ID_POP_LINK_WITNESS
# Description: This event is used for identification and POP linking verification during CMC request processing.
# Applicable subsystems: CA
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - Info:
#
LOGGING_SIGNED_AUDIT_CMC_ID_POP_LINK_WITNESS_3=<type=CMC_ID_POP_LINK_WITNESS>:[AuditEvent=CMC_ID_POP_LINK_WITNESS][SubjectID={0}][Outcome={1}][Info={2}] Identification Proof of Possession linking witness verification
#
# Event: CMC_PROOF_OF_IDENTIFICATION
# Description: This event is used for proof of identification during CMC request processing.
# Applicable subsystems: CA
# Enabled by default: No
# Fields:
# - SubjectID:
#     In case of success, "SubjectID" is the actual identified identification.
#     In case of failure, "SubjectID" is the attempted identification.
# - Outcome:
# - Info:
#
LOGGING_SIGNED_AUDIT_CMC_PROOF_OF_IDENTIFICATION_3=<type=CMC_PROOF_OF_IDENTIFICATION>:[AuditEvent=CMC_PROOF_OF_IDENTIFICATION][SubjectID={0}][Outcome={1}][Info={2}] proof of identification in CMC request
#
# Event: COMPUTE_RANDOM_DATA_REQUEST
# Description: This event is used when the request for TPS to TKS to get random challenge data is received.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - Outcome:
# - AgentID: The trusted agent ID used to make the request.
#
LOGGING_SIGNED_AUDIT_COMPUTE_RANDOM_DATA_REQUEST_2=<type=COMPUTE_RANDOM_DATA_REQUEST>:[AuditEvent=COMPUTE_RANDOM_DATA_REQUEST][Outcome={0}][AgentID={1}] TKS Compute random data request
#
# Event: COMPUTE_RANDOM_DATA_REQUEST_PROCESSED with [Outcome=Failure]
# Description: This event is used when the request for TPS to TKS to get random challenge data is processed unsuccessfully.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - Outcome: Success or Failure.
# - Status: 0 for no error.
# - Error: The error message.
# - AgentID: The trusted agent ID used to make the request.
#
LOGGING_SIGNED_AUDIT_COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE=<type=COMPUTE_RANDOM_DATA_REQUEST_PROCESSED>:[AuditEvent=COMPUTE_RANDOM_DATA_REQUEST_PROCCESED]{0} TKS Compute random data request failed
#
# Event: COMPUTE_RANDOM_DATA_REQUEST_PROCESSED with [Outcome=Success]
# Description: This event is used when the request for TPS to TKS to get random challenge data is processed successfully.
# Applicable subsystems: TKS, TPS
# Fields:
# - Outcome: Success or Failure.
# - Status: 0 for no error.
# - AgentID: The trusted agent ID used to make the request.
#
LOGGING_SIGNED_AUDIT_COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS=<type=COMPUTE_RANDOM_DATA_REQUEST_PROCESSED>:[AuditEvent=COMPUTE_RANDOM_DATA_REQUEST_PROCESSED]{0} TKS Compute random data request processed successfully
#
# Event: COMPUTE_SESSION_KEY_REQUEST
# Description: This event is used when the request for TPS to TKS to get a session key for secure channel is received.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - Outcome:
# - AgentID: The trusted agent ID used to make the request.
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the
##   CUID.  Renamed to "CUID_encoded" and "KDD_encoded" to reflect fact that
##   encoded parameters are being logged.
# - CUID_encoded: The special-encoded CUID of the token establishing the secure channel.
# - KDD_encoded: The special-encoded KDD of the token establishing the secure channel.
#
LOGGING_SIGNED_AUDIT_COMPUTE_SESSION_KEY_REQUEST_4=<type=COMPUTE_SESSION_KEY_REQUEST>:[AuditEvent=COMPUTE_SESSION_KEY_REQUEST][CUID_encoded={0}][KDD_encoded={1}][Outcome={2}][AgentID={3}] TKS Compute session key request
#
# Event: COMPUTE_SESSION_KEY_REQUEST_PROCESSED with [Outcome=Failure]
# Description: This event is used when the request for TPS to TKS to get a session key for secure channel is processed unsuccessfully.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - Outcome: Failure
# - status: Error code or 0 for no error.
# - AgentID: The trusted agent ID used to make the request.
# - IsCryptoValidate: tells if the card cryptogram is to be validated
# - IsServerSideKeygen: tells if the keys are to be generated on server
# - SelectedToken: The cryptographic token performing key operations.
# - KeyNickName: The numeric keyset, e.g. #01#01.
# - Error: The error message.
#
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID.  Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged.
##                       Also added TKSKeyset, KeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd
# - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel.
# - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel.
# - TKSKeyset: The name of the TKS keyset being used for this request.
# - KeyInfo_KeyVersion: The key version number requested in hex.
# - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex.
# - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex.
#
LOGGING_SIGNED_AUDIT_COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE=<type=COMPUTE_SESSION_KEY_REQUEST_PROCESSED>:[AuditEvent=COMPUTE_SESSION_KEY_REQUEST_PROCESSED]{0} TKS Compute session key request failed
#
# Event: COMPUTE_SESSION_KEY_REQUEST_PROCESSED with [Outcome=Success]
# Description: This event is used when the request for TPS to TKS to get a session key for secure channel is processed successfully.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - AgentID: The trusted agent ID used to make the request.
# - Outcome: Success
# - status: 0 for no error.
# - IsCryptoValidate: tells if the card cryptogram is to be validated
# - IsServerSideKeygen: tells if the keys are to be generated on server
# - SelectedToken: The cryptographic token performing key operations.
# - KeyNickName: The number keyset, e.g. #01#01.
#
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the
##   CUID.  Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact
##   that decoded parameters are now logged.
##       Also added TKSKeyset, KeyInfo_KeyVersion,
##            NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd
# - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel.
# - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel.
# - TKSKeyset: The name of the TKS keyset being used for this request.
# - KeyInfo_KeyVersion: The key version number requested in hex.
# - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex.
# - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex.
#
LOGGING_SIGNED_AUDIT_COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS=<type=COMPUTE_SESSION_KEY_REQUEST_PROCESSED>:[AuditEvent=COMPUTE_SESSION_KEY_REQUEST_PROCESSED]{0} TKS Compute session key request processed successfully
#
# Event: CONFIG_CERT_POLICY
# Description: This event is used when configuring certificate policy constraints and extensions.
# Applicable subsystems: CA
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#
LOGGING_SIGNED_AUDIT_CONFIG_CERT_POLICY_3=<type=CONFIG_CERT_POLICY>:[AuditEvent=CONFIG_CERT_POLICY][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] certificate policy constraint or extension configuration parameter(s) change
#
# Event: CONFIG_TOKEN_GENERAL
# Description: This event is used when doing general TPS configuration.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- secret component (password) MUST NOT be logged ---
# - Info: Error info for failed cases.
#
LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_GENERAL_5=<type=CONFIG_TOKEN_GENERAL>:[AuditEvent=CONFIG_TOKEN_GENERAL][SubjectID={0}][Outcome={1}][Service={2}][ParamNameValPairs={3}][Info={4}] TPS token configuration parameter(s) change
#
# Event: CONFIG_TOKEN_PROFILE
# Description: This event is used when configuring token profile.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - Service: can be any of the methods offered
# - ProfileID:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- secret component (password) MUST NOT be logged ---
# - Info: Error info for failed cases.
#
LOGGING_SIGNED_AUDIT_CONFIG_TOKEN_PROFILE_6=<type=CONFIG_TOKEN_PROFILE>:[AuditEvent=CONFIG_TOKEN_PROFILE][SubjectID={0}][Outcome={1}][Service={2}][ProfileID={3}][ParamNameValPairs={4}][Info={5}] token profile configuration parameter(s) change
#
# Event: CRL_RETRIEVAL
# Description: This event is used when CRLs are retrieved by the OCSP Responder.
# Applicable subsystems: OCSP
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome: "Success" when CRL is retrieved successfully, "Failure" otherwise.
# - CRLnum: The CRL number that identifies the CRL.
#
LOGGING_SIGNED_AUDIT_CRL_RETRIEVAL_3=<type=CRL_RETRIEVAL>:[AuditEvent=CRL_RETRIEVAL][SubjectID={0}][Outcome={1}][CRLnum={2}] CRL retrieval
#
# Event: CRL_VALIDATION
# Description: This event is used when CRL is retrieved and validation process occurs.
# Applicable subsystems: OCSP
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
#
LOGGING_SIGNED_AUDIT_CRL_VALIDATION_2=<type=CRL_VALIDATION>:[AuditEvent=CRL_VALIDATION][SubjectID={0}][Outcome={1}] CRL validation
#
# Event: DELTA_CRL_PUBLISHING
# Description: This event is used when delta CRL publishing is complete.
# Applicable subsystems: CA
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome: "Success" when delta CRL is publishing successfully, "Failure" otherwise.
# - CRLnum:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_DELTA_CRL_PUBLISHING=<type=DELTA_CRL_PUBLISHING>:[AuditEvent=DELTA_CRL_PUBLISHING]{0} Delta CRL publishing
#
# Event: DIVERSIFY_KEY_REQUEST
# Description: This event is used when the request for TPS to TKS to do key changeover is received.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - Outcome:
# - AgentID: The trusted agent ID used to make the request.
# - oldMasterKeyName: The old master key name.
# - newMasterKeyName: The new master key name.
#
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID.  Renamed to "CUID_encoded" and "KDD_encoded" to reflect fact that encoded parameters are being logged.
# - CUID_encoded: The special-encoded CUID of the token establishing the secure channel.
# - KDD_encoded: The special-encoded KDD of the token establishing the secure channel.
#
LOGGING_SIGNED_AUDIT_DIVERSIFY_KEY_REQUEST_6=<type=DIVERSIFY_KEY_REQUEST>:[AuditEvent=DIVERSIFY_KEY_REQUEST][CUID_encoded={0}][KDD_encoded={1}][Outcome={2}][AgentID={3}][oldMasterKeyName={4}][newMasterKeyName={5}] TKS Key Change Over request
#
# Event: DIVERSIFY_KEY_REQUEST_PROCESSED with [Outcome=Failure]
# Description: This event is when the request for TPS to TKS to do key changeover is processed unsuccessfully.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - AgentID: The trusted agent ID used to make the request.
# - Outcome: Failure
# - status: 0 for success, non-zero for various errors.
# - oldMasterKeyName: The old master key name.
# - newMasterKeyName: The new master key name.
# - Error: The error message.
#
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID.  Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged.
##                       Also added TKSKeyset, OldKeyInfo_KeyVersion, NewKeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd
# - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel.
# - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel.
# - TKSKeyset: The name of the TKS keyset being used for this request.
# - OldKeyInfo_KeyVersion: The old key version number in hex.
# - NewKeyInfo_KeyVersion: The new key version number in hex.
# - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex.
# - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex.
#
LOGGING_SIGNED_AUDIT_DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE=<type=DIVERSIFY_KEY_REQUEST_PROCESSED>:[AuditEvent=DIVERSIFY_KEY_REQUEST_PROCESSED]{0} TKS Key Change Over request failed
#
# Event: DIVERSIFY_KEY_REQUEST_PROCESSED with [Outcome=Success]
# Description: This event is used when the request for TPS to TKS to do key changeover is processed successfully.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - AgentID: The trusted agent ID used to make the request.
# - Outcome: Success
# - status: 0 for success, non-zero for various errors.
# - oldMasterKeyName: The old master key name.
# - newMasterKeyName: The new master key name.
#
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID.  Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged.
##                       Also added TKSKeyset, OldKeyInfo_KeyVersion, NewKeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd
# - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel.
# - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel.
# - TKSKeyset: The name of the TKS keyset being used for this request.
# - OldKeyInfo_KeyVersion: The old key version number in hex.
# - NewKeyInfo_KeyVersion: The new key version number in hex.
# - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex.
# - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex.
#
LOGGING_SIGNED_AUDIT_DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS=<type=DIVERSIFY_KEY_REQUEST_PROCESSED>:[AuditEvent=DIVERSIFY_KEY_REQUEST_PROCESSED]{0} TKS Key Change Over request processed successfully
#
# Event: ENCRYPT_DATA_REQUEST
# Description: This event is used when the request from TPS to TKS to encrypt data
#   (or generate random data and encrypt) is received.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - SubjectID: The CUID of the token requesting encrypt data.
# - AgentID: The trusted agent ID used to make the request.
# - status: 0 for success, non-zero for various errors.
# - isRandom: tells if the data is randomly generated on TKS
#
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID.  Renamed to "CUID_encoded" and "KDD_encoded" to reflect fact that encoded parameters are being logged.
# - CUID_encoded: The special-encoded CUID of the token establishing the secure channel.
# - KDD_encoded: The special-encoded KDD of the token establishing the secure channel.
#
LOGGING_SIGNED_AUDIT_ENCRYPT_DATA_REQUEST_4=<type=ENCRYPT_DATA_REQUEST>:[AuditEvent=ENCRYPT_DATA_REQUEST][SubjectID={0}][status={1}][AgentID={2}][isRandom={3}] TKS encrypt data request
LOGGING_SIGNED_AUDIT_ENCRYPT_DATA_REQUEST_5=<type=ENCRYPT_DATA_REQUEST>:[AuditEvent=ENCRYPT_DATA_REQUEST][CUID_encoded={0}][KDD_encoded={1}][status={2}][AgentID={3}][isRandom={4}] TKS encrypt data request
#
# Event: ENCRYPT_DATA_REQUEST_PROCESSED with [Outcome=Failure]
# Description: This event is used when the request from TPS to TKS to encrypt data
#   (or generate random data and encrypt) is processed unsuccessfully.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - AgentID: The trusted agent ID used to make the request.
# - Outcome: Failure
# - status: 0 for success, non-zero for various errors.
# - isRandom: tells if the data is randomly generated on TKS
# - SelectedToken: The cryptographic token performing key operations.
# - KeyNickName: The numeric keyset, e.g. #01#01.
# - Error: The error message.
#
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID.  Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged.
##                       Also added TKSKeyset, KeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd
# - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel.
# - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel.
# - TKSKeyset: The name of the TKS keyset being used for this request.
# - KeyInfo_KeyVersion: The key version number requested in hex.
# - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex.
# - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex.
#
LOGGING_SIGNED_AUDIT_ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE=<type=ENCRYPT_DATA_REQUEST_PROCESSED>:[AuditEvent=ENCRYPT_DATA_REQUEST_PROCESSED]{0} TKS encrypt data request failed
#
# Event: ENCRYPT_DATA_REQUEST_PROCESSED with [Outcome=Success]
# Description: This event is used when the request from TPS to TKS to encrypt data
#   (or generate random data and encrypt) is processed successfully.
# Applicable subsystems: TKS, TPS
# Enabled by default: No
# Fields:
# - AgentID: The trusted agent ID used to make the request.
# - Outcome: Success
# - status: 0 for success, non-zero for various errors.
# - isRandom: tells if the data is randomly generated on TKS
# - SelectedToken: The cryptographic token performing key operations.
# - KeyNickName: The numeric keyset, e.g. #01#01.
#
## AC: KDF SPEC CHANGE - Need to log both the KDD and CUID, not just the CUID.  Renamed to "CUID_decoded" and "KDD_decoded" to reflect fact that decoded parameters are now logged.
##                       Also added TKSKeyset, KeyInfo_KeyVersion, NistSP800_108KdfOnKeyVersion, NistSP800_108KdfUseCuidAsKdd
# - CUID_decoded: The ASCII-HEX representation of the CUID of the token establishing the secure channel.
# - KDD_decoded: The ASCII-HEX representation of the KDD of the token establishing the secure channel.
# - TKSKeyset: The name of the TKS keyset being used for this request.
# - KeyInfo_KeyVersion: The key version number requested in hex.
# - NistSP800_108KdfOnKeyVersion: The value of the corresponding setting in hex.
# - NistSP800_108KdfUseCuidAsKdd: The value of the corresponding setting in hex.
#
LOGGING_SIGNED_AUDIT_ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS=<type=ENCRYPT_DATA_REQUEST_PROCESSED>:[AuditEvent=ENCRYPT_DATA_REQUEST_PROCESSED]{0} TKS encrypt data request processed successfully
#
# Event: FULL_CRL_PUBLISHING
# Description: This event is used when full  CRL publishing is complete.
# Applicable subsystems: CA
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome: "Success" when full CRL is publishing successfully, "Failure" otherwise.
# - CRLnum:
# - FailureReason:
#
LOGGING_SIGNED_AUDIT_FULL_CRL_PUBLISHING=<type=FULL_CRL_PUBLISHING>:[AuditEvent=FULL_CRL_PUBLISHING]{0} Full CRL publishing
#
# Event: INTER_BOUNDARY
# Description: This event is used when inter-CS boundary data transfer is successful.
#   This is used when data does not need to be captured.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - ProtectionMethod: "SSL" or "unknown".
# - ReqType: The request type.
# - ReqID: The request ID.
#
LOGGING_SIGNED_AUDIT_INTER_BOUNDARY_SUCCESS_5=<type=INTER_BOUNDARY>:[AuditEvent=INTER_BOUNDARY][SubjectID={0}][Outcome={1}][ProtectionMethod={2}][ReqType={3}][ReqID={4}] inter-CS boundary communication (data exchange) success
#
# Event: KEY_RECOVERY_AGENT_LOGIN
# Description: This event is used when KRA agents login as recovery agents to approve
#   key recovery requests.
# Applicable subsystems: KRA
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - RecoveryID: The recovery request ID.
# - RecoveryAgent: The recovery agent the KRA agent is
#     logging in with.
#
LOGGING_SIGNED_AUDIT_KEY_RECOVERY_AGENT_LOGIN_4=<type=KEY_RECOVERY_AGENT_LOGIN>:[AuditEvent=KEY_RECOVERY_AGENT_LOGIN][SubjectID={0}][Outcome={1}][RecoveryID={2}][RecoveryAgent={3}] key recovery agent login
#
# Event: KEY_RECOVERY_REQUEST
# Description: This event is used when key recovery request is made.
# Applicable subsystems: CA, OCSP, TKS, TPS, TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - RecoveryID: The recovery request ID.
# - PubKey: The base-64 encoded public key associated with
#     the private key to be recovered.
#
LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_4=<type=KEY_RECOVERY_REQUEST>:[AuditEvent=KEY_RECOVERY_REQUEST][SubjectID={0}][Outcome={1}][RecoveryID={2}][PubKey={3}] key recovery request made
#
# Event: KEY_STATUS_CHANGE
# Description: This event is used when modify key status is executed.
# Applicable subsystems: KRA
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - KeyID: An existing key ID in the database.
# - OldStatus: The old status to change from.
# - NewStatus: The new status to change to.
# - Info:
#
LOGGING_SIGNED_AUDIT_KEY_STATUS_CHANGE=<type=KEY_STATUS_CHANGE>:[AuditEvent=KEY_STATUS_CHANGE]{0} Key Status Change
#
# Event: LOG_EXPIRATION_CHANGE (disabled)
# Description: This event is used when log expiration time change is attempted.
#   The ACL should not allow this operation, but make sure it's written after the attempt.
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - LogType: "System", "Transaction", or "SignedAudit".
# - ExpirationTime: The amount of time (in seconds) that is
#     attempted to be changed to.
#
#LOGGING_SIGNED_AUDIT_LOG_EXPIRATION_CHANGE_4=<type=LOG_EXPIRATION_CHANGE>:[AuditEvent=LOG_EXPIRATION_CHANGE][SubjectID={0}][Outcome={1}][LogType={2}][ExpirationTime={3}] log expiration time change attempt
#
# Event: NON_PROFILE_CERT_REQUEST
# Description: This event is used when a non-profile certificate request is made (before approval process).
# Applicable subsystems: CA, KRA, OCSP, TKS, TPS
# Enabled by default: No
# Fields:
# - SubjectID: The UID of user that triggered this event.
#     If CMC enrollment requests signed by an agent, SubjectID should
#     be that of the agent.
# - Outcome:
# - CertSubject: The certificate subject name of the certificate request.
# - ReqID: The certificate request ID.
# - ServiceID: The identity of the servlet that submitted the original
#     request.
#
LOGGING_SIGNED_AUDIT_NON_PROFILE_CERT_REQUEST_5=<type=NON_PROFILE_CERT_REQUEST>:[AuditEvent=NON_PROFILE_CERT_REQUEST][SubjectID={0}][Outcome={1}][ReqID={2}][ServiceID={3}][CertSubject={4}] certificate request made without certificate profiles
#
# Event: OCSP_ADD_CA_REQUEST
# Description: This event is used when a CA is attempted to be added to the OCSP Responder.
# Applicable subsystems: OCSP
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - CA: The base-64 encoded PKCS7 certificate (or chain).
#
LOGGING_SIGNED_AUDIT_OCSP_ADD_CA_REQUEST=<type=OCSP_ADD_CA_REQUEST>:[AuditEvent=OCSP_ADD_CA_REQUEST]{0} request to add a CA for OCSP Responder
#
# Event: OCSP_REMOVE_CA_REQUEST
# Description: This event is used when a CA is attempted to be removed from the OCSP Responder.
# Applicable subsystems: OCSP
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - CASubjectDN: The DN ID of the CA.
#
LOGGING_SIGNED_AUDIT_OCSP_REMOVE_CA_REQUEST=<type=OCSP_REMOVE_CA_REQUEST>:[AuditEvent=OCSP_REMOVE_CA_REQUEST]{0} request to remove a CA from OCSP Responder
#
# Event: SECURITY_DATA_EXPORT_KEY
# Description: This event is used when user attempts to retrieve key after the recovery request
#   has been approved.
# Applicable subsystems: KRA
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - RecoveryID: The recovery request ID.
# - KeyID: The key being retrieved.
# - Info: The failure reason if the export fails.
# - PubKey: The public key for the private key being retrieved.
#
LOGGING_SIGNED_AUDIT_SECURITY_DATA_EXPORT_KEY=<type=SECURITY_DATA_EXPORT_KEY>:[AuditEvent=SECURITY_DATA_EXPORT_KEY]{0} security data retrieval request
#
# Event: SECURITY_DATA_INFO
# Description: This event is used when user attempts to get metadata information about a key.
# Applicable subsystems: KRA
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - KeyID: The key being retrieved.
# - ClientKeyId:
# - Info: The failure reason if the export fails.
# - PubKey: The public key for the private key being retrieved.
#
LOGGING_SIGNED_AUDIT_SECURITY_DATA_INFO=<type=SECURITY_DATA_INFO>:[AuditEvent=SECURITY_DATA_INFO]{0} security data info request
#
# Event: TOKEN_AUTH with [Outcome=Failure]
# Description: This event is used when authentication failed.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome: Failure
#     (obviously, if authentication failed, you won't have a valid SubjectID, so
#     in this case, AttemptedID is recorded)
# - IP:
# - CUID:
# - MSN:
# - OP:
# - tokenType:
# - AppletVersion:
# - AuthMgr: The authentication manager instance name that did
#     this authentication.
#
LOGGING_SIGNED_AUDIT_TOKEN_AUTH_FAILURE=<type=TOKEN_AUTH>:[AuditEvent=TOKEN_AUTH]{0} token authentication failure
#
# Event: TOKEN_AUTH with [Outcome=Success]
# Description: This event is used when authentication succeeded.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome: Success
# - IP:
# - CUID:
# - MSN:
# - OP:
# - tokenType:
# - AppletVersion:
# - AuthMgr: The authentication manager instance name that did
#     this authentication.
#
LOGGING_SIGNED_AUDIT_TOKEN_AUTH_SUCCESS=<type=TOKEN_AUTH>:[AuditEvent=TOKEN_AUTH]{0} token authentication success
#
# Event: TOKEN_CERT_ENROLLMENT
# Description: This event is used for TPS when token certificate enrollment request is made.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - tokenType:
# - KeyVersion:
# - Serial:
# - CA_ID:
# - Info: Info in case of failure.
#
LOGGING_SIGNED_AUDIT_TOKEN_CERT_ENROLLMENT_9=<type=TOKEN_CERT_ENROLLMENT>:[AuditEvent=TOKEN_CERT_ENROLLMENT][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][KeyVersion={5}][Serial={6}][CA_ID={7}][Info={8}] token certificate enrollment request made
#
# Event: TOKEN_CERT_RENEWAL
# Description: This event is used for TPS when token certificate renewal request is made.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - tokenType:
# - KeyVersion:
# - Serial:
# - CA_ID:
# - Info: Info in case of failure.
#
LOGGING_SIGNED_AUDIT_TOKEN_CERT_RENEWAL_9=<type=TOKEN_CERT_RENEWAL>:[AuditEvent=TOKEN_CERT_RENEWAL][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][KeyVersion={5}][Serial={6}][CA_ID={7}][Info={8}] token certificate renewal request made
#
# Event: TOKEN_CERT_RETRIEVAL
# Description: This event is used for TPS when token certificate retrieval request is made;
#   usually used during recovery, along with TOKEN_KEY_RECOVERY.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - tokenType:
# - KeyVersion:
# - Serial:
# - CA_ID:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_CERT_RETRIEVAL_9=<type=TOKEN_CERT_RETRIEVAL>:[AuditEvent=TOKEN_CERT_RETRIEVAL][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][KeyVersion={5}][Serial={6}][CA_ID={7}][Info={8}] token certificate retrieval request made
#
# Event: TOKEN_CERT_STATUS_CHANGE_REQUEST
# Description: This event is used when a token certificate status change request (e.g. revocation) is made.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID: The last token that the certificate was associated with.
# - tokenType:
# - CertSerialNum: The serial number (in decimal) of the certificate to be revoked.
# - RequestType: "revoke", "on-hold", "off-hold".
# - RevokeReasonNum:
# - CA_ID:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_CERT_STATUS_CHANGE_REQUEST_10=<type=TOKEN_CERT_STATUS_CHANGE_REQUEST>:[AuditEvent=TOKEN_CERT_STATUS_CHANGE_REQUEST][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][CertSerialNum={5}][RequestType={6}][RevokeReasonNum={7}][CA_ID={8}][Info={9}] token certificate revocation/unrevocation request made
#
# Event: TOKEN_FORMAT with [Outcome=Failure]
# Description: This event is used when token format operation failed.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - MSN:
# - tokenType:
# - AppletVersion:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_FORMAT_FAILURE=<type=TOKEN_FORMAT>:[AuditEvent=TOKEN_FORMAT]{0} token op format failure
#
# Event: TOKEN_FORMAT with [Outcome=Success]
# Description: This event is used when token format operation succeeded.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - MSN:
# - tokenType:
# - AppletVersion:
# - KeyVersion:
#
LOGGING_SIGNED_AUDIT_TOKEN_FORMAT_SUCCESS=<type=TOKEN_FORMAT>:[AuditEvent=TOKEN_FORMAT]{0} token op format success
#
# Event: TOKEN_KEY_RECOVERY
# Description: This event is used for TPS when token certificate key recovery request is made.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - IP:
# - CUID:
# - tokenType:
# - KeyVersion:
# - Serial:
# - CA_ID:
# - KRA_ID:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_KEY_RECOVERY_10=<type=TOKEN_KEY_RECOVERY>:[AuditEvent=TOKEN_KEY_RECOVERY][IP={0}][SubjectID={1}][CUID={2}][Outcome={3}][tokenType={4}][KeyVersion={5}][Serial={6}][CA_ID={7}][KRA_ID={8}][Info={9}] token certificate/key recovery request made
#
# Event: TOKEN_OP_REQUEST
# Description: This event is used when token processor operation request is made.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - IP:
# - CUID:
# - MSN:
# - Outcome:
# - OP: "format", "enroll", or "pinReset"
# - AppletVersion:
#
LOGGING_SIGNED_AUDIT_TOKEN_OP_REQUEST_6=<type=TOKEN_OP_REQUEST>:[AuditEvent=TOKEN_OP_REQUEST][IP={0}][CUID={1}][MSN={2}][Outcome={3}][OP={4}][AppletVersion={5}] token processor op request made
#
# Event: TOKEN_PIN_RESET with [Outcome=Failure]
# Description: This event is used when token pin reset request failed.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - IP:
# - SubjectID:
# - CUID:
# - Outcome:
# - tokenType:
# - AppletVersion:
# - Info:
#
LOGGING_SIGNED_AUDIT_TOKEN_PIN_RESET_FAILURE=<type=TOKEN_PIN_RESET>:[AuditEvent=TOKEN_PIN_RESET]{0} token op pin reset failure
#
# Event: TOKEN_PIN_RESET with [Outcome=Success]
# Description: This event is used when token pin reset request succeeded.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - IP:
# - SubjectID:
# - CUID:
# - Outcome:
# - tokenType:
# - AppletVersion:
# - KeyVersion:
#
LOGGING_SIGNED_AUDIT_TOKEN_PIN_RESET_SUCCESS=<type=TOKEN_PIN_RESET>:[AuditEvent=TOKEN_PIN_RESET]{0} token op pin reset success
#
# Event: TOKEN_STATE_CHANGE
# Description: This event is used when token state changed.
# Applicable subsystems: TPS
# Enabled by default: No
# Fields:
# - SubjectID:
# - Outcome:
# - oldState:
# - oldReason:
# - newState:
# - newReason:
# - ParamNameValPairs: A name-value pair
#     (where name and value are separated by the delimiter ;;)
#     separated by + (if more than one name-value pair) of config params changed.
#     --- secret component (password) MUST NOT be logged ---
# - Info: Error info for failed cases.
#
LOGGING_SIGNED_AUDIT_TOKEN_STATE_CHANGE_8=<type=TOKEN_STATE_CHANGE>:[AuditEvent=TOKEN_STATE_CHANGE][SubjectID={0}][Outcome={1}][oldState={2}][oldReason={3}][newState={4}][newReason={5}][ParamNameValPairs={6}][Info={7}] token state changed
Copy to Clipboard Toggle word wrap

E.2.2. Operational Environment audit events
Link kopieren

For Operational Environment audit events format descriptions, please see https://access.redhat.com/articles/4409591. In addition, for events relevant to RHCS, please reference "Enable OS-level audit logs" in the Installation Guide.

Nach oben
Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2025 Red Hat