Audit log entries and structure
This section provides a summary of the entries collected in audit logs, and a brief description of the information included in each log entry.
Logged entries
The entries logged fall under the following three categories:
Administrative entries
C_Initialize
C_Finalize
C_InitToken
CT_ResetToken
C_InitPIN
CT_InitPIN
C_SetPIN
C_OpenSession
C_CloseSession
C_CloseAllSessions
C_GetSessionInfo
C_Login
C_Logout
Object management entries
C_CreateObject
C_CopyObject
CT_Copyobject
C_DestroyObject
C_GetAttributeValue
C_SetAttributeValue
C_FindObjects
C_DeriveKey
C_GenerateKey
C_GenerateKeyPair
C_WrapKey
C_UnwrapKey
Object use entries
C_Encrypt
C_EncryptUpdate
C_Decrypt
C_DecryptUpdate
C_Digest
C_DigestUpdate
C_DigestKey
C_Sign
C_SignUpdate
C_SignRecover
C_Verify
C_VerifyUpdate
C_VerifyRecover
C_DigestEncryptUpdate
C_DecryptDigestUpdate
C_SignEncryptUpdate
C_DecryptVerifyUpdate
Entries structure
Each audit log entry contains the following information:
-
Time of entry
-
Success/failure of function
-
Slot where the entry occurred
-
Name of entry
-
Signature of the previous entry
-
Signature of the current entry
For example:
2017-07-12 14:12:29,success,0,Audit Log initial message ,0000000000000000000000000000000000000000000000000000000000000000,692f41f2ec2bbb42411c7b2c5e3230b39dab28bd5178ef1b3e71b34331500765
2017-07-12 14:53:44,success,0,CS_Initialize: ,692f41f2ec2bbb42411c7b2c5e3230b39dab28bd5178ef1b3e71b34331500765,6afe98063371c25d675616827ec51d5d23f879312d935c230ebe566db3e064a0
2017-07-12 14:53:44,success,1,CS_OpenSession: ,6afe98063371c25d675616827ec51d5d23f879312d935c230ebe566db3e064a0,868b4457c44c525febad5c87d9d27ee745829aa38f9ac6bf2405a788f8c3ea89
2017-07-12 14:53:44,success,1,CS_OpenSession: ,868b4457c44c525febad5c87d9d27ee745829aa38f9ac6bf2405a788f8c3ea89,8e65ee17ce0d0b835fd746558d5c114a45baf6e4e7f579b1f7b22f204db51538
2017-07-12 14:53:44,success,1,CS_FindObjects: ,8e65ee17ce0d0b835fd746558d5c114a45baf6e4e7f579b1f7b22f204db51538,7ff4201694d9b5a68b6f3e205c75380e10975cddd9ff45641cd82fdb7d7eee17
2017-07-12 14:53:44,success,1,CS_GetAttributeValue: ,7ff4201694d9b5a68b6f3e205c75380e10975cddd9ff45641cd82fdb7d7eee17,c2fd9b7bd90e370a8684259f120beda70f3ce2a7aa217e753f02864618066fc8
2017-07-12 14:53:44,success,1,CS_CloseSession: ,c2fd9b7bd90e370a8684259f120beda70f3ce2a7aa217e753f02864618066fc8,a3ef1d28edcf2b1eb4efa2f7d075241e2bf1253f85b7dc36895b2ce07cd4732b
Message chaining
Each entry is signed by the Audit Key. To ensure that the audit log data is not tampered with, each entry includes both its own signature and the signature of the previous entry. Note that the first entry includes a string of zeroes for the previous signature.
