General overview on SiteMinder logging
search cancel

General overview on SiteMinder logging

book

Article ID: 249914

calendar_today

Updated On:

Products

SITEMINDER

Issue/Introduction

Below is a summary of various SiteMinder components logging 

Resolution

1.  Log Types Defined:

Log Type Configuration Default Name Contains
Web Agent Error ACO Parameters   General Information, Warnings and Errors
Web Agent Trace ACO Parameters   Detailed Information on what is happening
Policy Server Audit SM Console SMAccess.log Who did what when
Policy Server Error SM Console SMPS.log General Information, Warnings and Errors
Policy Server Trace (aka Profiler) SM Console SMTraceDefault.log Detailed Information on what is happening
Policy Server CDS Log Properties File cds.log Details of certificate data store connections
WAM UI Log Properties File Server.log WAM UI Run Time Issues
WAM UI REST API Log Properties File smrestservices.log REST API log file 
WAM UI CDS Log Properties File cds.log WAM UI Certificate database log

2.  Policy Server Details

Controls
         
Type Control Parameter Default Value Support Recommendation Purpose
Policy Server Audit Log SM Console>Data Tab>Audit> File Name \log\smaccess.log \log\smaccess.log Defines where to do audit logging
Policy Server Audit Log SM Console>Data Tab>Audit>Rollover on Startup enabled enabled Specifies we make a new log on start up
Policy Server Audit Log SM Console>Data Tab>Audit>Rollover on Size enabled @ 10 mb enabled @ 10 mb Specifies we make a new log when the current hits a chosen size
Policy Server Audit Log SM Console>Data Tab>Audit>Rollover on Time disabled disabled Specifies roll over at a specific time
Policy Server Audit Log SM Console>Data Tab>Audit> Retention set to 10 set to 10 Specifies how many old logs to keep
Policy Server Audit Log SM Console>Logs Tab>Authentication Events None; Anonymous user unchecked All; Anonymous Checked Specifies auditing authentication events; including anonymous access
Policy Server Audit Log SM Console>Logs Tab>Authorization Event None; Anonymous user unchecked All; Anonymous Checked Specifies auditing authorization events; including anonymous access
Policy Server Audit Log SM Console>Logs Tab>Affiliate Events None All Specifies auditing affiliate requests
Policy Server Audit Log SM Console>Logs Tab>Administration Access Events None All Specifies auditing administrative access
Policy Server Audit Log SM Console>Logs Tab>Administrator Changes None All Specifies auditing administrative changes
         
         
Policy Server Error Log SM Console>Logs Tab>LogFile \log\smps.log \log\smps.log Defines where to do error logging
Policy Server Error Log SM Console>Logs Tab>Rollover on Startup enabled enabled Specifies we make a new log on start up
Policy Server Error Log SM Console>Logs Tab>Rollover on Size enabled @ 10 mb enabled @ 10 mb Specifies we make a new log when the current hits a chosen size
Policy Server Error Log SM Console>Logs Tab>Rollover on Time disabled disabled Specifies roll over at a specific time
Policy Server Error Log SM Console>Logs Tab>Retention set to 10 set to 10 Specifies how many old logs to keep
         
         
Policy Server Trace Log SM Console>Profiler Tab>Enabled disabled on when a problem is being tracked Determines if we trace
Policy Server Trace Log SM Console>Profiler Tab>Configuration File \config\smtracedefault.txt \config\smtracedefault.txt Determines where trace configuration is stored
Policy Server Trace Log SM Console>Profiler Tab>Console Output disabled disabled Specifies output to command prompt
Policy Server Trace Log SM Console>Profiler Tab>File Output enabled enabled Specifies output to file
Policy Server Trace Log SM Console>Profiler Tab>File Location \log\smtracedefault.log \log\smtracedefault.log Determines where we write the trace
Policy Server Trace Log SM Console>Profiler Tab>Rollover on Startup enabled enabled Specifies we make a new log on start up
Policy Server Trace Log SM Console>Profiler Tab>Rollover on Size enabled @ 10 mb enabled @ 10 mb Specifies we make a new log when the current hits a chosen size
Policy Server Trace Log SM Console>Profiler Tab>Rollover on Time disabled disabled Specifies roll over at a specific time
Policy Server Trace Log SM Console>Profiler Tab>Retention set to 10 set to 10 Specifies how many old logs to keep
Policy Server Trace Log SM Console>Profiler Tab>Format/Delimiter SM Default ([]) SM Default ([]) Specifies how to separate fields
Profiler Components
Component SubComponent Information Captured
AgentFunc   Web Agent interaction
  Init Agent initialization
  Uninit un-initialization
  IsProtected IsProtected calls
  Login Login calls
  ChangePassword ChangePassword call
  Validate Validate Session spec or session ID
  Logout Logout calls
  Authorize Authorization calls
  Audit Audit authorizations out of agent cache
  FreeAttributes free the attributes
  UpdateAttributes Update response attributes when authenticating or authorizing out of agent cache
  SGetSessionVariables Fetch Session Server Variables
  SetSessionVariables Set Session Server Variables
  DeleteSessionVariables Delete Session Server Variables
  Tunnel Tunnel API
  GetConfig Get agent configuration
  DoManagement Requests Agent Commands from Policy Server
  GetSingleUseCookie Policy server retrieves session cookie stored in session store
  SetSingleUseCookie Policy server creates a session cookie stored in session store
  DelSingleUseCookie Policy server deletes session cookie stored in session store
  GetAdvAuthToken  
  DelAdvAuthToken  
  SetProfiling  
  GetPolicyServerConfig  
Server   Policy Server activity
  Connectoin_Management Policy Server connection creation and termination
  Policy_Object Object Store changes, including creation, update, and deletion of objects in the Policy Store; and DoManagement messages
  Policy_Object_Cache Watch the parameters of the Policy Object Cache as well as when the Cache is being updated
  Administration Administrator session activity as well as user management activity initiated from Admin UI
  Audit_Logging When a log record is created and when it is committed to a persistent storage.
  Policy_Server_General Policy Server level general activity
IsProtected   Protection check events
  Function_Begin_End Which parameters are passed to the Policy Server and what is returned to an Agent
  Resource_Protection How the resource protection decision is made
Login_Logout   Users logging in or out
  Function_Begin_End Which parameters are passed to the Policy Server and what is returned to an Agent
  Authentication How the authentication decision is made
  Policy_Evaluation Details of authentication event processing
  Active_Expression Which parameters are passed to active expressions and what they return during the Authentication events processing
  Password_Service Details of password policy processing
  Certificates Details of certifivcate verification
  Session_Management When a user session is created, verified, and terminated as well as the details of the management of persistent sessions
  Send_Request Inspect the details of the Policy Server's request to the Agent.
  Receive_Request Inspect the details of the Agent's request to the Policy Server
IsAuthorized   User authorization tracking
  Function_Begin_End Which parameters are passed to the Policy Server and what is returned to an Agent
  Policy_Evaluation The details of access control policies processing
  Active_Expression Which parameters are passed to active expressions and what they return during the processing of access control policies and Authorization events
  Send_Response Inspect the details of the Policy Server's response to the Agent
  Receive_Response Inspect the details of the Agent's request to the Policy Server
  AzMapping See details of Auth-Az directory mapping evaluation
Tunnel_Service   Details about tunnel calls from custom Web Agents
  Function_Begin_End Which parameters are passed to the Policy Server and what is returned to an Agent
  User-Management_Api Trace the internal calls of User Management API
JavaAPI   Details java api calls
  Function_Begin_End Which parameters are passed to the Policy Server and what is returned to an the clients of DMS API and Java Policy Management API
Directory_Access   Access events on directories
  Access_Begin_End High-level details of the requests sent by the Policy Server to a user directory
  Attribute_Cache User attribute cache activity
ODBC   Details ODBC calls
  Sql_Statement_Begin_End Each SQL statement being sent to a directory as well as the returned results
  Internal_Operation Low level details of the database requests handling
  Connection_Management When and how Policy Server creates and terminates database connection and detects failed servers
  SQl_Errors Report all SQL errors
  Connection_Monitor Connection Monitor Thread and Connection State Changes
LDAP   Details LDAP calls
  Ldap_Call_Begin_End Details of each request sent to an LDAP directory as well as the returned results
  Internal_Operation Low level details of the LDAP requests handling including referrals, paging and sorting, etc
  Connection_Management When and how Policy Server creates and terminates LDAP connection and detects failed servers
  Performance_Measurement Collect LDAP query performance data
  Ldap_Error_Message Show the detailed error messages returned on failures
IdentityMinder   Details IDM interaction
  Function_Begin_End Watch what methods in the extensions kit are called and the return values from those methods
  IM_Error Error condition in extension kit
  IM_Info General information
  IM_Internal General IMS internal operations - Tracing
  IM_MetaData General provider tracing of meta data
  IM_RDB_Sql RDB provider tracing of sql
  IM_LDAP_Provider Ldap Provider specific Tracing
  IM_RuleParser IMS Policy Rule Parser - Tracing
  IM_RuleEvaluation Rule evaluation information
  IM_MemberPolicy Evaluation of member policies
  IM_AdminPolicy Evaluation of admin policies
  IM_OwnerPolicy Evaluation of owner policies
  IM_RoleMembership Tracing role membership
  IM_RoleAdmins Tracing role aministration
  IM_RoleOwners Tracing role ownership
  IM_PolicyServerRules Evaluation of policy server rules
  IM_LLSDK_Command Tracing LLSDK command processing
  IM_LLSDK_Message Traces directly sent from LLSDK
  IM_IdentityPolicy Evaluation of Identity policies
  IM_PasswordPolicy Evaluation of Identity policies
  IM_Version Tracing client and server version information
  IM_CertificationPolicy Evaluation of Certification policies
  IM_InMemoryEval Top level trace of in-memory evaluation processing
  IM_InMemoryEvalDetail Debug level traces of in-memory evaluation processing
TXM   Transaction Minder action details
  JNI "Errors and messages associated with JNI code in tmservices
  License Errors and messages associated with license check code in tmservices
  MetaData Errors and messages associated with metadata code in tmservices
Fed_server   Federation transactions details
  Assertion_Generator Details about the Assertion 
  Auth_Scheme Details about the SAML AuthScheme
  Configuration Properties of the federation configurations
  Single_Logout Single Logout related logs
  Saml_Requester details of the federated user
  Attribute_Authority Federation attributes management details
  DSig_Tunnel signature related logs 
  NameID_management NameID resolution logs 
  Signature_Processing Signature processing logs
SharePointAgent   Sharepoint 2007 and 2010 Agent Interaction
  PlugIn Sharepoint agent plugin module
  CfgModule Configuration UI to select the webapplication(siteminder)
  CfgModuleNETWrapper Wrapper to Config module
  MemberShipProvider Authentication module for user ( siteminder)
  RoleProvider Group information
  NativeAgentAPIWrapper Agent API
  UserManagementAPI Tunnel Calls
  ImportProfile Importing userprofile for Sharepoint
  UserMigration User migration from windows to siteminder
  SmWebModule HttpModule and aspx pages
  Impersonation user impersonation module(we authenticate the users using NTLM and convey them SharePoint)
     
Components
Policy Server Audit Log
Information Field Field Purpose
Access Type Type of access (eg: Authorization Accept (AzAccept))
Host Computer Where the acess was from
Date and Time When the access was done
IP Address IP the access was from
Username Who did the access
Agent Name Agent the access was from
Action Http method of access (ie: get, post, put)
Resource What was accessed
TransactionID Web Agent assigned transaction ID
Reason Why the action taken was taken
Status Message Any message associated with the access
   
Policy Server Error Log
Information Field Field Purpose
Process/Thread ID Process and Thread ID of message
Date and Time Day and time of message
Source File and Line Source file and line of message
Message Type Type of Message; ie: Informational, Warning or Error
Message What is happening
   
Policy Server Trace Log
Information Field Field Purpose
Date Day of message
Time Time of Message
PreciseTime Time of Message (with milliseconds)
Pid Process ID
Tid Thread ID
TransactionID Transaction ID (S##/R## number)
AgentName WebAgent name used
Resource Resource of request
User Complete DN of the iser making the request
SrcFile File & line of code the request is on
Function Function that is being executed
ReturnValue Return value of an executed function
Group Displays the type of group to which the object belongs in form of string variable. The group can be rule, response or agent group.
Domain Associated SiteMinder domain
Realm Associated SiteMinder realm
Policy Associated SiteMinder policy
Rule Associated SiteMinder rule
Directory User directory the user is found in
AgentType Displays an agent type in form of string variable.
ObjectClass Displays the object classes for organizations in form of string variable. The object class defines the types of attributes that an entry can contain. 
DomainOID OID of the associated SiteMinder domain
RealmOID OID of associated SiteMnder realm
ObjectOID OID of the associated SiteMinder object
SearchKey Displays the Searchkey in the form of string variable. The Searchkey indicates the key used during any searching operation done.
ErrorString Displays the error string in the form of string variable. The error message is set in the ErrorString during the occurrence of error conditions in the code.
ErrorValue Displays the error code returned by various functions as an integer value.
Property Displays the name of the property of an object in form of string variable.
IPAddr IP Address request is from
IPPort Port in use
RequestIPAddr Web Agent IP Address
AuthStatus Displays the Authenticating status can be redirection, error message  and user message in form of string variable.
AuthReason Displays authreason as an integer value. Authreason are the tokencodes transferred
AuthScheme Displays the authentication scheme used in form of string variable.
CertSerial Serial Number of the certificate (CertAuth only)
SubjectDn Subject DN of the certificate (CertAuth only)
IssuerDN Issuer DN of the certificate (CertAuth only)
SessionSpec Displays the server side session spec in form of string variable. Session spec provides the specification of the whole session and is encrypted and decrypted at PS side.
SessionID Displays the server side session specification identifiers in form of string variable .
CertDistPT Displays the distribution point of the certificate.
UserDN DN of the user
Action Displays the requested action in form of string variable. It is generally of 3 types GET,POST and PUT.
State Displays the server state in form of string variable. It can be "INIT", "INACTIVE", "ACTIVE", "DISABLED", "INTER", "FAILED"
ClusterID Displays the cluster identifier as an integer value. Every cluster is assigned a unique integer identifier. This id is mainly used for logging purposes.
HandleCount Displays the handle count as an integer value. Handle count is the connection count.
FreeHandleCount Displays the free handle count as an integer value. FreeHandleCount is the free connection count.
BusyHandleCount Displays the busy handle count as an integer value. BusyHandleCount is the busy connection count.
ResponseTime Displays response time in milliseconds.
Throughput Displays the throughput as an integer value. Throughput is transactions per seconds.
MaxThroughput Displays the maximum throughput (transactions per seconds) as an integer value.
Minthroughput Displays the minimum throughput (transactions per seconds) as an integer value.
Threshold Displays the active servers threshold number as an integer value.
TransactionName Displays the Transaction Name in form of string variable. Transaction name is extracted from the request packet.
HexadecimalData Displays the hexadecimal data transferred (in response packet) in form of string variable.
Query Displays the database access query, in form of string variable.
ActiveExpr Displays the Active Expressions in form of string variable.
CallDetail Displays the details of the call provided in form of string variable.
Returns Reserved for future use (not currently used)
Expression Reserved for future use (not currently used)
Result Reserved for future use (not currently used)
CacheHits Reserved for future use (not currently used)
CacheSize Reserved for future use (not currently used)
RefCount Reserved for future use (not currently used)
Message Type of message
Data Displays the data transferred (in response packet) in form of string variable.
ExecutionTime Time it took for a function to execute 
   
Policy Server CDS Log  
cdslog4j.properties
under /siteminder_home/config/properties  logger.CertificateDataStore.level  and logger.ClientDispatcher.level

3.  Web Agent Details

Controls
Type Control Parameter Default Value Support Recommendation Purpose
Web Agent Error Log LogAppend No No Determines whether we append only logs or start a new one each LLAWP Start up
Web Agent Error Log LogFile No Yes Determines If we create a log
Web Agent Error Log LogFileName     Is the location of the file we create when we create a log
Web Agent Error Log LogFileSize 0 10 Is the number, in MB the maximum size of the error log (0 = unlimited)
Web Agent Error Log LogFilesToKeep 0 10 Is the number of error logs aside form the current one that we keep (0 = unlimited)
Web Agent Error Log LogLocalTime Yes Yes Determines timestamps; Yes = local time; No = GMT
Web Agent Error Log LogFileName32     Is the log file for the 32 bit process in the 64 bit IIS 7 and 7.5 Agents
         
         
Web Agent Trace Log TraceAppend No No Determines whether or not we append the old trace files when tracing is reenabled
Web Agent Trace Log TraceConfigFile     Is the configuration file we use to determine what is traced  (not dynamic)
Web Agent Trace Log TraceDelimiter     Detemines the delimiter used between fields
Web Agent Trace Log TraceFile No   Determines if we trace processes
Web Agent Trace Log TraceFileName     Is the location of the file we create when we create a trace log
Web Agent Trace Log TraceFileSize 0 100 Is the number, in MB the maximum size of the trace log (0 = unlimited)
Web Agent Trace Log TraceFilesToKeep 0 10 Is the number of trace logs aside form the current one that we keep (0 = unlimited)
Web Agent Trace Log TraceFormat default default Determines the format of the file
Web Agent Trace Log TraceConfigFile32     Is the configuration file we use to determine what is traced for the 32 bit process in the 64 bit IIS 7 and 7.5 Agents (not dynamic)
Web Agent Trace Log TraceFileName32     Is the trace log file for the 32 bit process in the 64 bit IIS 7 and 7.5 Agents
         
Web Agent Trace Components
Component SubComponent Information Captured
AgentFramework   All Framework Related Messages
  Administration Agent administration messages
  Filter Filter messages; The filter interfaces with the
  HighLevelAgent High level request processing messages
  LowLevelAgent Low level (more detailed) request processing messages. Details regarding the interfacing with the Agent API
  LowLevelAgentWP Worker process messages
AffiliateAgent   Web agent messages for 4.x affiliate agent
  RequestProcessing Core Affiliate Agent request processing messages
SAMLAgent   Web agent messages for SAML affiliate support
  RequestProcessing Core SAML request processing messages
HTTPAgent   Web agent messages for Framework Agents
  AdvancedAuthentication Advanced authentication messages, such as Forms or Certificates
  RequestProcessing Core request processing messages
  SingleSignOn Messages related to single sign on
WebAgent   Web agent messages for all traditional agents
  AgentCore Core messages to the agent
  Cache Cache messages
  Authentication Authentication messages
  Responses Response messages
  Management DoManagement messages
  SSO single sign on messages
  Filter filter messages
Agent_Functions   Agent API messages
  Init Agent initialization
  Uninit un-initialization
  IsProtected IsProtected calls
  Login Login calls
  ChangePassword ChangePassword call
  Validate Validate Session spec or session ID
  Logout Logout calls
  Authorize Authorization calls
  Audit Audit authorizations out of agent cache
  FreeAttributes free the attributes
  UpdateAttributes Update response attributes when authenticating or authorizing out of agent cache
  GetSessionVariables Fetch Session Server Variables
  SetSessionVariables Set Session Server Variables
  DeleteSessionVariables Delete Session Server Variables
  Tunnel Tunnel API
  GetConfig Get agent configuration
  DoManagement Requests Agent Commands from Policy Server
Agent_Con_Manager   Agent to Policy Server Connection Messages
  RequestHandler Process Request, Handle HCO updates
  Cluster Trace the ClusterId, HandleCount
  Server Trace the Server IP address, port, connection count
  WaitQueue HandleCount, Free Handle count, Busy Handle count
  Management Connection Service
  Statistics Statistics of cluster, Request handler,waitque etc
     
Components
Web Agent Error Log
Information Field Field Purpose
Process & Thread ID Give the Process and Thread that generated the Message
Date and Time Give the Date and Time of the Message
Source File and Line Not the source file and line of the message
Type of Message Note the Message type: Informational, Warning or Error
Message What is Happening
   
Web Agent Trace
Information Field Field Purpose
Date Day of Message
Time Time of Message
PreciseTime Time of Message (with milliseconds)
PID Process ID
TID Thread ID
TransactionID Transaction ID (shows in Profiler as Attribute 221)
SrcFile Source file and line of message
Function Function containing the trace message
User Name of the user
UserDN DN of the user this is for
Domain SiteMinder Domain this is in
DomainOID OID of Domain this is in
Realm SiteMinder Realm this is in
RealmOID OID of Realm this is in
AgentName Agent name being used
IPAddr IP Address of user
IPPort Port on the user end
RequestIPAddr IP Address of the Web Agent
CertSerial Serial Number of the certificate (CertAuth only)
SubjectDN Subject DN of the certificate (CertAuth only)
IssuerDN Issuer DN of the certificate (CertAuth only)
SessionSpec Session Spec for the user
SessionID Sessoin ID for the user
Resource Resource the query is on
Action Action taken by the Web Agent
Message The actual information of what is happening

4.  WAM UI Details

Controls
Log Control File Parameter Valid Values Control File Location
Server.log log4j_jboss.properties
SiteMinderLog4j.properties 
logger.imsui.level
logger.imsdefault.level
logger.imsSSOIntegration.level
logger.imsMain.level
logger.imstmt.level
logger.imsTelemetryJob.level
rootLogger.level
Info, Warn, Debug adminui/standalone/deployments/iam_siteminder.ear/config/com/netegrity/config
Server.log log4j_jboss.properties
SiteMinderLog4j.properties 

loggers=logger0,CertificateDataStore,webadminBuildInfo,uiagent,xconnection,

xresponse,xxml,adirectory,sdirectory,fadminui,fclient,fapi,

swebadmintabs,swebadmintabhandler

Info, Warn, Debug,ALL

adminui/standalone/deployments/iam_siteminder.ear/config/com/netegrity/config

However, the preferred logging settings modification method is made product specific adminui/standalone/deployments/iam_siteminder.ear/user_console.war/META-INF/SiteMinderLog4j.properties

cds.log cdslog4j.properties

log4j.logger.com.ca.CertificateDataStore
log4j.appender.CertificateDataStore.File

Info, Warn, Debug,ALL

adminui/standalone/deployments/iam_siteminder.ear/user_console.war/META-INF

smrestservices.log smrestservices-logging.properties

logger.restapi.level
logger.restservlet.level
logger.securityservice.level
logger.adminapi.level
logger.rpc.level
rootLogger.level

Info, Warn, Debug,ALL

adminui/standalone/configuration