System Logs

The CipherTrust Manager maintains a variety of logs to record administrative actions, network activity, cryptography requests, and more.

The following types of logs are recorded:

• Connection request received

• Configuration changes

• Client requests

• Service starts, stops, and restarts

• System and user input errors

• Successful and failed operations

These logs can be useful for debugging, error handling, troubleshooting, and for chronologically tracing failures and system events. The logs can be downloaded using the CipherTrust Manager GUI. The downloaded file contains following files in .gzip format:

• hostd.log

• cloud-init.log

• keysecuresystem.log

If it is desired to download the rotated logs as well, enable the Download all logs option. The downloaded log file will additionally contain rotated logs that are up to 4 weeks old.

Downloading Logs

Perform the following steps to download these logs using the GUI:

1. Navigate to Admin Settings > Logs.

2. Select a CA for signing the logs.

3. Download the logs:

   • To download the System Logs, click Download.

   • To download the rotated logs as well, enable the Download all logs option and then click Download.

     Note

     Only the users who are part of System Admins and Admin groups can download the logs from the root domain.

Preserving integrity of downloaded logs

CipherTrust Manager preserves integrity of downloaded logs by performing following steps:

• SHA256 hash of downloaded zip file is calculated, which is then signed by a dynamically generated asymmetric key pair.

• Certificate is issued by the CipherTrust Manager CA. This CA is selected while downloading the logs, as explained here.

• Certificate to verify the signed hash is contained in the downloaded content.

Verifying and viewing the downloaded logs

You must have installed OpenSSL on your machine to verify the log file. You can use the procedure in both Windows and UNIX/Linux environments.

Perform the following steps on the downloaded log file to verify its integrity:

1. Unzip (extract) the log file.

2. Use the following commands:

   1. openssl x509 -pubkey -noout -in keySecure.cert > pubkey.pem

   2. openssl dgst -sha256 -verify pubkey.pem -keyform PEM -sha256 -signature keySecure.signature keySecureLogs.tar.gz

3. Depending on your operating system, use following steps to view the downloaded logs:

   • For Windows users

     Note

     Do not use WinRAR for extracting the log files. Use of 7-Zip is recommended.

     1. Extract the keySecureLogs.tar.gz file using 7-Zip.

        You will get three logs file: cloud-init.log, hostd.log, keysecure.system.log.

     2. Open these files in a reader to view the logs.

   • For UNIX/Linux users

     Use the following commands in the Terminal:

     1. Decompress the keySecureLogs.tar.gz using this command: gzip -d keySecureLogs.tar.gz

        You will get keySecureLogs.tar.

     2. Extract the log files using this command: tar xvf keySecureLogs.tar

        You will get three logs file: cloud-init.log, hostd.log, keysecure.system.log.