Debug Logs

The CipherTrust Manager maintains a variety of debug logs to record administrative actions, network activity, cryptography requests, and more. These logs can be useful for debugging, error handling, troubleshooting, and for chronologically tracing failures and system events with Thales customer support. Server Audit Records are recommended for more routine monitoring.

All of these logs are specific to the node, and are not clustered or included in backup files. High access permissions are required. The user must be part of the System Admins and Admin groups, and the user must be logged into the root domain.

The following types of logs are recorded:

• Connection request received

• Configuration changes

• Client requests

• Service starts, stops, and restarts

• System and user input errors

• Successful and failed operations

The debug logs can be downloaded using the CipherTrust Manager CLI, API, and web console.

The downloaded file contains following debug log files in .gzip format:

• auth.log (CLI and API only)

• cloud-init.log

• hostd.log

• kern.log (CLI and API only)

• keysecure.system.log

The extracted file type is LTSV.

Activity Logs

In addition to the debug logs, various activity logs can be extracted in a .gzip package. As with the debug logs, they are only available in the root domain to users who are part of the System Admins and Admin groups.

Web activity logs are always included are part of the web console download. In the CLI and API, these logs are available individually or as part of the all-logs option.

As well, KMIP and NAE Crypto Activity logs can be enabled. They are then included in the web console download. In the CLI and API, these logs are then available individually or as part of the all-logs option.

Downloading Logs using ksctl

To download CipherTrust Manager logs as a gzipped tarball, run:

Syntax

ksctl logs download --file <filename> --ca-id <Local-CA-ID> --type <Type-of-Logs>

Valid values for type parameter are:

• all-logs: Includes all types of logs available to the current user and domain.

• debug-logs: Includes the debug logs on the CipherTrust Manager.

• kmip-activity-logs: Includes the KMIP activity logs on the CipherTrust Manager

• nae-activity-logs: Includes the NAE activity logs on the CipherTrust Manager.

• web-activity-logs: Includes the web activity logs on the CipherTrust Manager.

For every case, both current and rotated logs are downloaded. You can optionally provide a Certificate Authority (CA) for issuing a signing certificate. If no CA is provided, the CipherTrust Root CA issues the certificate.

To download the NAE Crypto Activity logs

ksctl logs download --file <filename> --type "nae-activity-logs"

To download all debug logs

ksctl logs download --file <filename> --type "debug-logs"

To download all logs

ksctl logs download --file <filename> --type "all-logs"

To download the cloud-init.log file

Use one of:

• ksctl logs download --file <filename> --include_logs "system"

• ksctl logs download --file <filename> --include_logs "system, all"

Including the all option includes rotated logs. Otherwise, only current logs are returned.

Downloading Logs from the Web Console

Fewer debug logs are available from download on the web console compared to the API or CLI. auth.log and kern.log are not included in the download.

activity.kmip.log and activity.nae.log files can be present in the downloaded package if KMIP and NAE Crypto activity logs are also enabled. activity.web.log is always present.

Perform the following steps to download these logs using the GUI:

1. Navigate to Admin Settings > Logs.

2. Change the CA to issue a signing certificate, if desired. By default, the CipherTrust Root CA issues the certificate.

3. Download the logs:

   • To download the current Debug Logs, click Download.

   • To download all logs, enable the Download all logs option and then click Download. The downloaded log file will contain all logs that are up to 4 weeks old.

Preserving integrity of downloaded logs

CipherTrust Manager preserves integrity of downloaded logs by performing following steps:

• SHA512 hash of downloaded zip file is calculated, which is then signed by a dynamically generated asymmetric key pair.

• Certificate is issued by the CipherTrust Manager CA. This CA is selected while downloading the logs. By default, the CipherTrust Root CA issues the certificate.

• Certificate to verify the signed hash is contained in the downloaded content.

Verifying and viewing the downloaded logs

You must have installed OpenSSL on your machine to verify the log file. You can use the procedure in both Windows and UNIX/Linux environments.

Perform the following steps on the downloaded log file to verify its integrity:

1. Unzip (extract) the log file.

2. View the downloaded logs. The steps to view the logs depend on operating system.

   Caution

   Do not change, add, or delete any file in the extracted logs directory before verification. These actions will cause signature verification to fail.

   • For Windows users

     Note

     Do not use WinRAR for extracting the log files. Use of 7-Zip is recommended.

     1. Extract the tar.gz file using 7-Zip.

     2. Open files ending with the .log extension in a reader to view the logs. The available logs depend on download options.

   • For UNIX/Linux users

     Use the following commands in the Terminal:

     1. Decompress the tar.gz using this command: gzip -d keySecureLogs.tar.gz

        You will get keySecureLogs.tar.

     2. Extract the log files using this command: tar xvf keySecureLogs.tar

        The available logs depend on download options.

3. Run the verify-logs.sh script in the extracted logs directory.

   ./verify-logs.sh
   

   The response for a successful verification is There is no difference in log files digest.

   The response for a failed verification is There are differences in log files digest.

Managing KMIP/NAE Activity Log Settings

The CipherTrust Manager logs:

• All KMIP activities and operations

• All NAE crypto activities and operations

These activity logs are output in JSON format. You can also send these logs to Elasticsearch or Loki log forwarders.

Enabling/Disabling KMIP or NAE Crypto Activity Logs through the Web Console

The CipherTrust Manager logs all KMIP and NAE crypto activities and operations. You can configure CipherTrust Manager to keep a record of various KMIP and NAE crypto activities and operations.

To record KMIP or NAE crypto activities and operations:

1. Go to Admin Settings > Properties.

2. Under Activity Log Settings, select the KMIP Activity Logs toggle button to enable/disable KMIP activity logs.

3. Under Activity Log Settings, select the NAE Crypto Activity Logs toggle button to enable/disable NAE crypto activity logs.

These logs are now available for download through the web console, CLI, and API, in the root domain for users who are part of System Admins and Admin groups.

As well, these logs can now be sent to Elasticsearch or Loki log forwarders.

Enabling/Disabling KMIP or NAE Crypto Activity Logs through ksctl

To enable KMIP activity logs, run:

ksctl properties modify --name ENABLE_KMIP_ACTIVITY_LOGS --value true

To disable KMIP activity logs, run:

ksctl properties modify --name ENABLE_KMIP_ACTIVITY_LOGS --value false

To enable NAE crypto activity logs, run:

ksctl properties modify --name ENABLE_NAE_ACTIVITY_LOGS --value true

To disable NAE crypto activity logs, run:

ksctl properties modify --name ENABLE_NAE_ACTIVITY_LOGS --value false