Below is a summary of various SiteMinder components logging
Log Type | Configuration | Default Name | Contains |
Web Agent Error | ACO Parameters | General Information, Warnings and Errors | |
Web Agent Trace | ACO Parameters | Detailed Information on what is happening | |
Policy Server Audit | SM Console | SMAccess.log | Who did what when |
Policy Server Error | SM Console | SMPS.log | General Information, Warnings and Errors |
Policy Server Trace (aka Profiler) | SM Console | SMTraceDefault.log | Detailed Information on what is happening |
Policy Server CDS Log | Properties File | cds.log | Details of certificate data store connections |
WAM UI Log | Properties File | Server.log | WAM UI Run Time Issues |
WAM UI REST API Log | Properties File | smrestservices.log | REST API log file |
WAM UI CDS Log | Properties File | cds.log | WAM UI Certificate database log |
Controls | ||||
Type | Control Parameter | Default Value | Support Recommendation | Purpose |
Policy Server Audit Log | SM Console>Data Tab>Audit> File Name | \log\smaccess.log | \log\smaccess.log | Defines where to do audit logging |
Policy Server Audit Log | SM Console>Data Tab>Audit>Rollover on Startup | enabled | enabled | Specifies we make a new log on start up |
Policy Server Audit Log | SM Console>Data Tab>Audit>Rollover on Size | enabled @ 10 mb | enabled @ 10 mb | Specifies we make a new log when the current hits a chosen size |
Policy Server Audit Log | SM Console>Data Tab>Audit>Rollover on Time | disabled | disabled | Specifies roll over at a specific time |
Policy Server Audit Log | SM Console>Data Tab>Audit> Retention | set to 10 | set to 10 | Specifies how many old logs to keep |
Policy Server Audit Log | SM Console>Logs Tab>Authentication Events | None; Anonymous user unchecked | All; Anonymous Checked | Specifies auditing authentication events; including anonymous access |
Policy Server Audit Log | SM Console>Logs Tab>Authorization Event | None; Anonymous user unchecked | All; Anonymous Checked | Specifies auditing authorization events; including anonymous access |
Policy Server Audit Log | SM Console>Logs Tab>Affiliate Events | None | All | Specifies auditing affiliate requests |
Policy Server Audit Log | SM Console>Logs Tab>Administration Access Events | None | All | Specifies auditing administrative access |
Policy Server Audit Log | SM Console>Logs Tab>Administrator Changes | None | All | Specifies auditing administrative changes |
Policy Server Error Log | SM Console>Logs Tab>LogFile | \log\smps.log | \log\smps.log | Defines where to do error logging |
Policy Server Error Log | SM Console>Logs Tab>Rollover on Startup | enabled | enabled | Specifies we make a new log on start up |
Policy Server Error Log | SM Console>Logs Tab>Rollover on Size | enabled @ 10 mb | enabled @ 10 mb | Specifies we make a new log when the current hits a chosen size |
Policy Server Error Log | SM Console>Logs Tab>Rollover on Time | disabled | disabled | Specifies roll over at a specific time |
Policy Server Error Log | SM Console>Logs Tab>Retention | set to 10 | set to 10 | Specifies how many old logs to keep |
Policy Server Trace Log | SM Console>Profiler Tab>Enabled | disabled | on when a problem is being tracked | Determines if we trace |
Policy Server Trace Log | SM Console>Profiler Tab>Configuration File | \config\smtracedefault.txt | \config\smtracedefault.txt | Determines where trace configuration is stored |
Policy Server Trace Log | SM Console>Profiler Tab>Console Output | disabled | disabled | Specifies output to command prompt |
Policy Server Trace Log | SM Console>Profiler Tab>File Output | enabled | enabled | Specifies output to file |
Policy Server Trace Log | SM Console>Profiler Tab>File Location | \log\smtracedefault.log | \log\smtracedefault.log | Determines where we write the trace |
Policy Server Trace Log | SM Console>Profiler Tab>Rollover on Startup | enabled | enabled | Specifies we make a new log on start up |
Policy Server Trace Log | SM Console>Profiler Tab>Rollover on Size | enabled @ 10 mb | enabled @ 10 mb | Specifies we make a new log when the current hits a chosen size |
Policy Server Trace Log | SM Console>Profiler Tab>Rollover on Time | disabled | disabled | Specifies roll over at a specific time |
Policy Server Trace Log | SM Console>Profiler Tab>Retention | set to 10 | set to 10 | Specifies how many old logs to keep |
Policy Server Trace Log | SM Console>Profiler Tab>Format/Delimiter | SM Default ([]) | SM Default ([]) | Specifies how to separate fields |
Profiler Components | ||
Component | SubComponent | Information Captured |
AgentFunc | Web Agent interaction | |
Init | Agent initialization | |
Uninit | un-initialization | |
IsProtected | IsProtected calls | |
Login | Login calls | |
ChangePassword | ChangePassword call | |
Validate | Validate Session spec or session ID | |
Logout | Logout calls | |
Authorize | Authorization calls | |
Audit | Audit authorizations out of agent cache | |
FreeAttributes | free the attributes | |
UpdateAttributes | Update response attributes when authenticating or authorizing out of agent cache | |
SGetSessionVariables | Fetch Session Server Variables | |
SetSessionVariables | Set Session Server Variables | |
DeleteSessionVariables | Delete Session Server Variables | |
Tunnel | Tunnel API | |
GetConfig | Get agent configuration | |
DoManagement | Requests Agent Commands from Policy Server | |
GetSingleUseCookie | Policy server retrieves session cookie stored in session store | |
SetSingleUseCookie | Policy server creates a session cookie stored in session store | |
DelSingleUseCookie | Policy server deletes session cookie stored in session store | |
GetAdvAuthToken | ||
DelAdvAuthToken | ||
SetProfiling | ||
GetPolicyServerConfig | ||
Server | Policy Server activity | |
Connectoin_Management | Policy Server connection creation and termination | |
Policy_Object | Object Store changes, including creation, update, and deletion of objects in the Policy Store; and DoManagement messages | |
Policy_Object_Cache | Watch the parameters of the Policy Object Cache as well as when the Cache is being updated | |
Administration | Administrator session activity as well as user management activity initiated from Admin UI | |
Audit_Logging | When a log record is created and when it is committed to a persistent storage. | |
Policy_Server_General | Policy Server level general activity | |
IsProtected | Protection check events | |
Function_Begin_End | Which parameters are passed to the Policy Server and what is returned to an Agent | |
Resource_Protection | How the resource protection decision is made | |
Login_Logout | Users logging in or out | |
Function_Begin_End | Which parameters are passed to the Policy Server and what is returned to an Agent | |
Authentication | How the authentication decision is made | |
Policy_Evaluation | Details of authentication event processing | |
Active_Expression | Which parameters are passed to active expressions and what they return during the Authentication events processing | |
Password_Service | Details of password policy processing | |
Certificates | Details of certifivcate verification | |
Session_Management | When a user session is created, verified, and terminated as well as the details of the management of persistent sessions | |
Send_Request | Inspect the details of the Policy Server's request to the Agent. | |
Receive_Request | Inspect the details of the Agent's request to the Policy Server | |
IsAuthorized | User authorization tracking | |
Function_Begin_End | Which parameters are passed to the Policy Server and what is returned to an Agent | |
Policy_Evaluation | The details of access control policies processing | |
Active_Expression | Which parameters are passed to active expressions and what they return during the processing of access control policies and Authorization events | |
Send_Response | Inspect the details of the Policy Server's response to the Agent | |
Receive_Response | Inspect the details of the Agent's request to the Policy Server | |
AzMapping | See details of Auth-Az directory mapping evaluation | |
Tunnel_Service | Details about tunnel calls from custom Web Agents | |
Function_Begin_End | Which parameters are passed to the Policy Server and what is returned to an Agent | |
User-Management_Api | Trace the internal calls of User Management API | |
JavaAPI | Details java api calls | |
Function_Begin_End | Which parameters are passed to the Policy Server and what is returned to an the clients of DMS API and Java Policy Management API | |
Directory_Access | Access events on directories | |
Access_Begin_End | High-level details of the requests sent by the Policy Server to a user directory | |
Attribute_Cache | User attribute cache activity | |
ODBC | Details ODBC calls | |
Sql_Statement_Begin_End | Each SQL statement being sent to a directory as well as the returned results | |
Internal_Operation | Low level details of the database requests handling | |
Connection_Management | When and how Policy Server creates and terminates database connection and detects failed servers | |
SQl_Errors | Report all SQL errors | |
Connection_Monitor | Connection Monitor Thread and Connection State Changes | |
LDAP | Details LDAP calls | |
Ldap_Call_Begin_End | Details of each request sent to an LDAP directory as well as the returned results | |
Internal_Operation | Low level details of the LDAP requests handling including referrals, paging and sorting, etc | |
Connection_Management | When and how Policy Server creates and terminates LDAP connection and detects failed servers | |
Performance_Measurement | Collect LDAP query performance data | |
Ldap_Error_Message | Show the detailed error messages returned on failures | |
IdentityMinder | Details IDM interaction | |
Function_Begin_End | Watch what methods in the extensions kit are called and the return values from those methods | |
IM_Error | Error condition in extension kit | |
IM_Info | General information | |
IM_Internal | General IMS internal operations - Tracing | |
IM_MetaData | General provider tracing of meta data | |
IM_RDB_Sql | RDB provider tracing of sql | |
IM_LDAP_Provider | Ldap Provider specific Tracing | |
IM_RuleParser | IMS Policy Rule Parser - Tracing | |
IM_RuleEvaluation | Rule evaluation information | |
IM_MemberPolicy | Evaluation of member policies | |
IM_AdminPolicy | Evaluation of admin policies | |
IM_OwnerPolicy | Evaluation of owner policies | |
IM_RoleMembership | Tracing role membership | |
IM_RoleAdmins | Tracing role aministration | |
IM_RoleOwners | Tracing role ownership | |
IM_PolicyServerRules | Evaluation of policy server rules | |
IM_LLSDK_Command | Tracing LLSDK command processing | |
IM_LLSDK_Message | Traces directly sent from LLSDK | |
IM_IdentityPolicy | Evaluation of Identity policies | |
IM_PasswordPolicy | Evaluation of Identity policies | |
IM_Version | Tracing client and server version information | |
IM_CertificationPolicy | Evaluation of Certification policies | |
IM_InMemoryEval | Top level trace of in-memory evaluation processing | |
IM_InMemoryEvalDetail | Debug level traces of in-memory evaluation processing | |
TXM | Transaction Minder action details | |
JNI | "Errors and messages associated with JNI code in tmservices | |
License | Errors and messages associated with license check code in tmservices | |
MetaData | Errors and messages associated with metadata code in tmservices | |
Fed_server | Federation transactions details | |
Assertion_Generator | Details about the Assertion | |
Auth_Scheme | Details about the SAML AuthScheme | |
Configuration | Properties of the federation configurations | |
Single_Logout | Single Logout related logs | |
Saml_Requester | details of the federated user | |
Attribute_Authority | Federation attributes management details | |
DSig_Tunnel | signature related logs | |
NameID_management | NameID resolution logs | |
Signature_Processing | Signature processing logs | |
SharePointAgent | Sharepoint 2007 and 2010 Agent Interaction | |
PlugIn | Sharepoint agent plugin module | |
CfgModule | Configuration UI to select the webapplication(siteminder) | |
CfgModuleNETWrapper | Wrapper to Config module | |
MemberShipProvider | Authentication module for user ( siteminder) | |
RoleProvider | Group information | |
NativeAgentAPIWrapper | Agent API | |
UserManagementAPI | Tunnel Calls | |
ImportProfile | Importing userprofile for Sharepoint | |
UserMigration | User migration from windows to siteminder | |
SmWebModule | HttpModule and aspx pages | |
Impersonation | user impersonation module(we authenticate the users using NTLM and convey them SharePoint) | |
Components | |
Policy Server Audit Log | |
Information Field | Field Purpose |
Access Type | Type of access (eg: Authorization Accept (AzAccept)) |
Host Computer | Where the acess was from |
Date and Time | When the access was done |
IP Address | IP the access was from |
Username | Who did the access |
Agent Name | Agent the access was from |
Action | Http method of access (ie: get, post, put) |
Resource | What was accessed |
TransactionID | Web Agent assigned transaction ID |
Reason | Why the action taken was taken |
Status Message | Any message associated with the access |
Policy Server Error Log | |
Information Field | Field Purpose |
Process/Thread ID | Process and Thread ID of message |
Date and Time | Day and time of message |
Source File and Line | Source file and line of message |
Message Type | Type of Message; ie: Informational, Warning or Error |
Message | What is happening |
Policy Server Trace Log | |
Information Field | Field Purpose |
Date | Day of message |
Time | Time of Message |
PreciseTime | Time of Message (with milliseconds) |
Pid | Process ID |
Tid | Thread ID |
TransactionID | Transaction ID (S##/R## number) |
AgentName | WebAgent name used |
Resource | Resource of request |
User | Complete DN of the iser making the request |
SrcFile | File & line of code the request is on |
Function | Function that is being executed |
ReturnValue | Return value of an executed function |
Group | Displays the type of group to which the object belongs in form of string variable. The group can be rule, response or agent group. |
Domain | Associated SiteMinder domain |
Realm | Associated SiteMinder realm |
Policy | Associated SiteMinder policy |
Rule | Associated SiteMinder rule |
Directory | User directory the user is found in |
AgentType | Displays an agent type in form of string variable. |
ObjectClass | Displays the object classes for organizations in form of string variable. The object class defines the types of attributes that an entry can contain. |
DomainOID | OID of the associated SiteMinder domain |
RealmOID | OID of associated SiteMnder realm |
ObjectOID | OID of the associated SiteMinder object |
SearchKey | Displays the Searchkey in the form of string variable. The Searchkey indicates the key used during any searching operation done. |
ErrorString | Displays the error string in the form of string variable. The error message is set in the ErrorString during the occurrence of error conditions in the code. |
ErrorValue | Displays the error code returned by various functions as an integer value. |
Property | Displays the name of the property of an object in form of string variable. |
IPAddr | IP Address request is from |
IPPort | Port in use |
RequestIPAddr | Web Agent IP Address |
AuthStatus | Displays the Authenticating status can be redirection, error message and user message in form of string variable. |
AuthReason | Displays authreason as an integer value. Authreason are the tokencodes transferred |
AuthScheme | Displays the authentication scheme used in form of string variable. |
CertSerial | Serial Number of the certificate (CertAuth only) |
SubjectDn | Subject DN of the certificate (CertAuth only) |
IssuerDN | Issuer DN of the certificate (CertAuth only) |
SessionSpec | Displays the server side session spec in form of string variable. Session spec provides the specification of the whole session and is encrypted and decrypted at PS side. |
SessionID | Displays the server side session specification identifiers in form of string variable . |
CertDistPT | Displays the distribution point of the certificate. |
UserDN | DN of the user |
Action | Displays the requested action in form of string variable. It is generally of 3 types GET,POST and PUT. |
State | Displays the server state in form of string variable. It can be "INIT", "INACTIVE", "ACTIVE", "DISABLED", "INTER", "FAILED" |
ClusterID | Displays the cluster identifier as an integer value. Every cluster is assigned a unique integer identifier. This id is mainly used for logging purposes. |
HandleCount | Displays the handle count as an integer value. Handle count is the connection count. |
FreeHandleCount | Displays the free handle count as an integer value. FreeHandleCount is the free connection count. |
BusyHandleCount | Displays the busy handle count as an integer value. BusyHandleCount is the busy connection count. |
ResponseTime | Displays response time in milliseconds. |
Throughput | Displays the throughput as an integer value. Throughput is transactions per seconds. |
MaxThroughput | Displays the maximum throughput (transactions per seconds) as an integer value. |
Minthroughput | Displays the minimum throughput (transactions per seconds) as an integer value. |
Threshold | Displays the active servers threshold number as an integer value. |
TransactionName | Displays the Transaction Name in form of string variable. Transaction name is extracted from the request packet. |
HexadecimalData | Displays the hexadecimal data transferred (in response packet) in form of string variable. |
Query | Displays the database access query, in form of string variable. |
ActiveExpr | Displays the Active Expressions in form of string variable. |
CallDetail | Displays the details of the call provided in form of string variable. |
Returns | Reserved for future use (not currently used) |
Expression | Reserved for future use (not currently used) |
Result | Reserved for future use (not currently used) |
CacheHits | Reserved for future use (not currently used) |
CacheSize | Reserved for future use (not currently used) |
RefCount | Reserved for future use (not currently used) |
Message | Type of message |
Data | Displays the data transferred (in response packet) in form of string variable. |
ExecutionTime | Time it took for a function to execute |
Policy Server CDS Log | |
cdslog4j.properties |
under /siteminder_home/config/properties logger.CertificateDataStore.level and logger.ClientDispatcher.level |
Controls | ||||
Type | Control Parameter | Default Value | Support Recommendation | Purpose |
Web Agent Error Log | LogAppend | No | No | Determines whether we append only logs or start a new one each LLAWP Start up |
Web Agent Error Log | LogFile | No | Yes | Determines If we create a log |
Web Agent Error Log | LogFileName | Is the location of the file we create when we create a log | ||
Web Agent Error Log | LogFileSize | 0 | 10 | Is the number, in MB the maximum size of the error log (0 = unlimited) |
Web Agent Error Log | LogFilesToKeep | 0 | 10 | Is the number of error logs aside form the current one that we keep (0 = unlimited) |
Web Agent Error Log | LogLocalTime | Yes | Yes | Determines timestamps; Yes = local time; No = GMT |
Web Agent Error Log | LogFileName32 | Is the log file for the 32 bit process in the 64 bit IIS 7 and 7.5 Agents | ||
Web Agent Trace Log | TraceAppend | No | No | Determines whether or not we append the old trace files when tracing is reenabled |
Web Agent Trace Log | TraceConfigFile | Is the configuration file we use to determine what is traced (not dynamic) | ||
Web Agent Trace Log | TraceDelimiter | Detemines the delimiter used between fields | ||
Web Agent Trace Log | TraceFile | No | Determines if we trace processes | |
Web Agent Trace Log | TraceFileName | Is the location of the file we create when we create a trace log | ||
Web Agent Trace Log | TraceFileSize | 0 | 100 | Is the number, in MB the maximum size of the trace log (0 = unlimited) |
Web Agent Trace Log | TraceFilesToKeep | 0 | 10 | Is the number of trace logs aside form the current one that we keep (0 = unlimited) |
Web Agent Trace Log | TraceFormat | default | default | Determines the format of the file |
Web Agent Trace Log | TraceConfigFile32 | Is the configuration file we use to determine what is traced for the 32 bit process in the 64 bit IIS 7 and 7.5 Agents (not dynamic) | ||
Web Agent Trace Log | TraceFileName32 | Is the trace log file for the 32 bit process in the 64 bit IIS 7 and 7.5 Agents | ||
Web Agent Trace Components | ||
Component | SubComponent | Information Captured |
AgentFramework | All Framework Related Messages | |
Administration | Agent administration messages | |
Filter | Filter messages; The filter interfaces with the | |
HighLevelAgent | High level request processing messages | |
LowLevelAgent | Low level (more detailed) request processing messages. Details regarding the interfacing with the Agent API | |
LowLevelAgentWP | Worker process messages | |
AffiliateAgent | Web agent messages for 4.x affiliate agent | |
RequestProcessing | Core Affiliate Agent request processing messages | |
SAMLAgent | Web agent messages for SAML affiliate support | |
RequestProcessing | Core SAML request processing messages | |
HTTPAgent | Web agent messages for Framework Agents | |
AdvancedAuthentication | Advanced authentication messages, such as Forms or Certificates | |
RequestProcessing | Core request processing messages | |
SingleSignOn | Messages related to single sign on | |
WebAgent | Web agent messages for all traditional agents | |
AgentCore | Core messages to the agent | |
Cache | Cache messages | |
Authentication | Authentication messages | |
Responses | Response messages | |
Management | DoManagement messages | |
SSO | single sign on messages | |
Filter | filter messages | |
Agent_Functions | Agent API messages | |
Init | Agent initialization | |
Uninit | un-initialization | |
IsProtected | IsProtected calls | |
Login | Login calls | |
ChangePassword | ChangePassword call | |
Validate | Validate Session spec or session ID | |
Logout | Logout calls | |
Authorize | Authorization calls | |
Audit | Audit authorizations out of agent cache | |
FreeAttributes | free the attributes | |
UpdateAttributes | Update response attributes when authenticating or authorizing out of agent cache | |
GetSessionVariables | Fetch Session Server Variables | |
SetSessionVariables | Set Session Server Variables | |
DeleteSessionVariables | Delete Session Server Variables | |
Tunnel | Tunnel API | |
GetConfig | Get agent configuration | |
DoManagement | Requests Agent Commands from Policy Server | |
Agent_Con_Manager | Agent to Policy Server Connection Messages | |
RequestHandler | Process Request, Handle HCO updates | |
Cluster | Trace the ClusterId, HandleCount | |
Server | Trace the Server IP address, port, connection count | |
WaitQueue | HandleCount, Free Handle count, Busy Handle count | |
Management | Connection Service | |
Statistics | Statistics of cluster, Request handler,waitque etc | |
Components | |
Web Agent Error Log | |
Information Field | Field Purpose |
Process & Thread ID | Give the Process and Thread that generated the Message |
Date and Time | Give the Date and Time of the Message |
Source File and Line | Not the source file and line of the message |
Type of Message | Note the Message type: Informational, Warning or Error |
Message | What is Happening |
Web Agent Trace | |
Information Field | Field Purpose |
Date | Day of Message |
Time | Time of Message |
PreciseTime | Time of Message (with milliseconds) |
PID | Process ID |
TID | Thread ID |
TransactionID | Transaction ID (shows in Profiler as Attribute 221) |
SrcFile | Source file and line of message |
Function | Function containing the trace message |
User | Name of the user |
UserDN | DN of the user this is for |
Domain | SiteMinder Domain this is in |
DomainOID | OID of Domain this is in |
Realm | SiteMinder Realm this is in |
RealmOID | OID of Realm this is in |
AgentName | Agent name being used |
IPAddr | IP Address of user |
IPPort | Port on the user end |
RequestIPAddr | IP Address of the Web Agent |
CertSerial | Serial Number of the certificate (CertAuth only) |
SubjectDN | Subject DN of the certificate (CertAuth only) |
IssuerDN | Issuer DN of the certificate (CertAuth only) |
SessionSpec | Session Spec for the user |
SessionID | Sessoin ID for the user |
Resource | Resource the query is on |
Action | Action taken by the Web Agent |
Message | The actual information of what is happening |
Controls | ||||
Log | Control File | Parameter | Valid Values | Control File Location |
Server.log | log4j_jboss.properties SiteMinderLog4j.properties |
logger.imsui.level logger.imsdefault.level logger.imsSSOIntegration.level logger.imsMain.level logger.imstmt.level logger.imsTelemetryJob.level rootLogger.level |
Info, Warn, Debug | adminui/standalone/deployments/iam_siteminder.ear/config/com/netegrity/config |
Server.log | log4j_jboss.properties SiteMinderLog4j.properties |
loggers=logger0,CertificateDataStore,webadminBuildInfo,uiagent,xconnection, xresponse,xxml,adirectory,sdirectory,fadminui,fclient,fapi, swebadmintabs,swebadmintabhandler |
Info, Warn, Debug,ALL |
adminui/standalone/deployments/iam_siteminder.ear/config/com/netegrity/config However, the preferred logging settings modification method is made product specific adminui/standalone/deployments/iam_siteminder.ear/user_console.war/META-INF/SiteMinderLog4j.properties |
cds.log | cdslog4j.properties |
log4j.logger.com.ca.CertificateDataStore |
Info, Warn, Debug,ALL |
adminui/standalone/deployments/iam_siteminder.ear/user_console.war/META-INF |
smrestservices.log | smrestservices-logging.properties |
logger.restapi.level |
Info, Warn, Debug,ALL |
adminui/standalone/configuration |