Appearance
Audit log events
Version: 1.12
Doc. ID: SPEC-AL
Version history
| Date | Version | Description | Author |
|---|---|---|---|
| 11.09.2015 | 0.1 | Initial version | Kristo Heero |
| 14.09.2015 | 0.2 | Bug fixes | Kristo Heero |
| 16.09.2015 | 0.3 | Made editorial changes in introduction | Margus Freudenthal |
| 18.09.2015 | 1.0 | Editorial changes made | Imbi Nõgisto |
| 09.10.2015 | 1.1 | Delete certificate/key events of security server updated | Kristo Heero |
| 12.10.2015 | 1.2 | Updated CSR generation events. Fields nameExtractorMemberClass and nameExractorMethod replaced with field certificateProfileInfo | Kristo Heero |
| 20.10.2015 | 1.3 | New events 'Add subsystem' and 'Register management service provider as security server client' added | Kristo Heero |
| 21.10.2015 | 1.4 | New fields managementRequestId and keyLabel added | Kristo Heero |
| 23.10.2015 | 1.5 | Data field of the event 'Edit WSDL' changed | Kristo Heero |
| 08.12.2015 | 1.6 | Added audit log events for TLS internal key certificate requests and certificate import | Ilkka Seppälä |
| 10.05.2016 | 1.7 | Merged changes from xtee6-doc repo. Added New event ‘Skip unregistration of authentication certificate' added change made by Meril Vaht on 10.12.2015. | Kedi Välba |
| 10.05.2020 | 1.8 | Updated to match current implementation | Janne Mattila |
| 16.02.2023 | 1.9 | Converted document from docx to markdown | Raido Kaju |
| 17.04.2023 | 1.10 | Remove central services support | Justas Samuolis |
| 05.06.2023 | 1.11 | New Central Server | Eneli Reimets |
| 09.12.2023 | 1.12 | Management service TLS certificate | Eneli Reimets |
Table of Contents
- 1 Introduction
- 2 Audit Log Events
- 2.1 Central Server
- 2.1.1 Common Events
- 2.1.2 Initialization Event
- 2.1.3 Members Events
- 2.1.4 Security Servers Events
- 2.1.5 Global Groups Events
- 2.1.6 Certification Services Events
- 2.1.7 Timestamping Services Events
- 2.1.8 Management Requests Events
- 2.1.9 Configuration Management Events
- 2.1.10 System Settings Events
- 2.1.11 Backup and Restore Events
- 2.2 Security Server
- 2.3 Utility signer-console
- 2.1 Central Server
License
This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/3.0/.
1 Introduction
X-Road central and security servers keep audit log. The audit log events are generated by user interfaces when the user changes system state or configuration. Additionally, the utility signer-console generates audit log events. The user actions are logged regardless of whether the outcome was a success or a failure.
This document provides complete list of all audit log events and theirs related data sets.
1.1 Format of the Audit Log Event
The audit log record contains description of the audit log event in JSON format. The field event represents the description of the event, the field user represents the user name of the performer (events started by the system have the user name system), and the field data represents data fields related with the event:
json
{
"event": "...",
"user": "...",
"reason": "...",
"data": {
"data_field_1": "data_field_1_value",
...
}
}In case of failure the event description ends with suffix failed and related data set may contain less data fields than normally. Also, an additional field reason for the error message will be added.
Security Server and Central Server audit log contains some additional elements, described in the next chapter.
Section 2 lists all the possible (successful) event descriptions and corresponding set of data fields (some fields are optional).
1.1.1 Extended Audit Log Format
Security Server and Central Server use REST APIs to update data, and a new audit log implementation adds some features that are useful in auditing updates done through the API.
Example of extended audit log message for the security server:
bash
2023-05-25T13:26:32+03:00 dev-ss1.i.x-road.rocks correlation-id: [a81deb2bf312a60f] INFO [X-Road Proxy Admin REST API]
2023-05-25T13:26:32.409+03:00 - {
"event":"Refresh service description",
"user":"xrd",
"ipaddress":"192.0.2.1",
"auth":"Session",
"url":"/api/v1/service-descriptions/7/refresh",
"data":{
"clientIdentifier":{
"memberClass":"ORG",
"memberCode":"111",
"subsystemCode":"MANAGEMENT",
"fieldsForStringFormat":["ORG","111","MANAGEMENT"],
"objectType":"SUBSYSTEM",
"xroadInstance":"DEV"},
"url":"http://dev-cs.i.x-road.rocks/managementservices.wsdl",
"serviceType":"WSDL",
"wsdl":{
"servicesAdded":[],
"servicesDeleted":[]
}
}
}Log contains (outside the actual audit log event JSON) correlation-id element which can be used to associate audit log entry with a specific request, regular log entries and e.g. stack traces from regular log.
Audit log event JSON contains these additional elements:
- ipaddress
- the IP address of the user
- auth
- authentication type used for this API call
- possible values:
- Session - session based authentication (web application)
- ApiKey - direct API call using API key authentication
- HttpBasicPam - HTTP basic authentication with PAM login (for api key management API operations)
- possible values:
- authentication type used for this API call
- url
- url of called API endpoint
- warning
- for failed events, boolean indicating whether the failure was caused by unhandled warnings
json
{
"event": "...",
"user": "...",
"ipaddress":"...",
"reason": "...",
"warning": true,
"auth": "Session",
"url": "/api/service-descriptions/249",
"data": {
"data_field_1": "data_field_1_value",
...
}1.1.2 Common Value Structures of the Data Fields
Values of data fields memberIdentifier, clientIdentifier, ownerIdentifier, providerIdentifier, and serviceProviderIdentifier have a common structure:
json
{
"xRoadInstance": "...",
"memberClass": "...",
"memberCode": "..."
}where xRoadInstance is the X-Road instance, memberClass is the X-Road member class, and memberCode is the X-Road member code. In case of clientIdentifier, providerIdentifier, and serviceProviderIdentifier an optional field subsystemCode (the X-Road subsystem code) is present in the structure.
2 Audit Log Events
2.1 Central Server
2.1.1 Common Events
The audit log events related to the UI logging and the UI language settings.
| Event | Data fields |
|---|---|
| Log in user | |
| Log out user | |
| Set UI language | * locale - the selected UI locale (e.g en) |
2.1.2 Initialization Event
The audit log event related to initialization.
| Event | Data fields |
|---|---|
| Initialize Central Server |
|
2.1.3 Members Events
The audit log events related to configuration of the X-Road members.
| Event | Data fields |
|---|---|
| Add member |
|
| Edit member name |
|
| Delete member |
|
| Add subsystem |
|
| Delete subsystem |
|
| Unregister member as security server client |
|
2.1.4 Security Servers Events
The audit log events related to configuration of the X-Road security servers.
| Event | Data fields |
|---|---|
| Edit security server address |
|
| Delete security server |
|
| Delete authentication certificate of security server |
|
2.1.5 Global Groups Events
The audit log events related to configuration of the X-Road global groups.
| Event | Data fields |
|---|---|
| Add global group |
|
| Edit global group description |
|
| Delete global group |
|
| Add members to global group |
|
| Remove members from global group |
|
2.1.6 Certification Services Events
The audit log events related to configuration of the X-Road certification services.
| Event | Data fields |
|---|---|
| Add certification service |
|
| Edit certification service settings |
|
| Delete certification service |
|
| Add intermediate CA |
|
| Delete intermediate CA |
|
| Add OCSP responder of certification service |
|
| Add OCSP responder of intermediate CA |
|
| Edit OCSP responder |
|
| Delete OCSP responder |
|
2.1.7 Timestamping Services Events
The audit log events related to configuration of the X-Road timpestamping services.
| Event | Data fields |
|---|---|
| Add timestamping service |
|
| Edit timestamping service |
|
| Delete timestamping service |
|
2.1.8 Management Requests Events
The audit log events related to the management requests.
| Event | Data fields |
|---|---|
| Add management request |
|
| Revoke management request |
|
| Approve management request |
|
| Decline management request |
|
2.1.9 Configuration Management Events
The audit log events related to configuration management.
| Event | Data fields |
|---|---|
| Re-create internal configuration anchor |
|
| Generate internal configuration signing key |
|
| Activate internal configuration signing key |
|
| Delete internal configuration signing key |
|
| Re-create external configuration anchor |
|
| Generate external configuration signing key |
|
| Activate external configuration signing key |
|
| Delete external configuration signing key |
|
| Add trusted anchor |
|
| Delete trusted anchor |
|
| Log in to token |
|
| Log out from token |
|
| Upload configuration part |
|
2.1.10 System Settings Events
The audit log events related to the system settings.
| Event | Data fields |
|---|---|
| Edit Central Server address |
|
| Register management service provider as Security Server client |
|
| Edit provider of management services |
|
| Add member class |
|
| Edit member class description |
|
| Delete member class |
|
| API key create |
|
| API key update |
|
| API key remove |
|
| Generate management service TLS key and self-sign certificate |
|
| Generate management service TLS certificate signing request |
|
| Upload management service TLS certificate |
|
2.1.11 Backup and Restore Events
The audit log events related to back up and restore.
| Event | Data fields |
|---|---|
| Back up configuration |
|
| Upload backup file |
|
| Delete backup file |
|
| Restore configuration |
|
2.2 Security Server
2.2.1 Common Events
The audit log events related to the UI logging.
| Event | Data fields |
|---|---|
| Log in user | |
| Log out user |
2.2.2 Initialization Events
The audit log events related to initialization.
| Event | Data fields |
|---|---|
| Initialize anchor |
|
| Initialize server configuration |
|
2.2.3 Security Server Clients Events
The audit log events related to the security server clients configuration.
| Event | Data fields |
|---|---|
| Add client |
|
| Register client |
|
| Unregister client |
|
| Delete client |
|
| Delete orphaned client keys, certs and certificates |
|
| Change owner |
|
| Add service description |
|
| Delete service description |
|
| Disable service description |
|
| Enable service description |
|
| Refresh service description |
|
| Edit service description |
|
| Edit service parameters |
|
| Add access rights to service |
|
| Remove access rights from service |
|
| Add access rights to subject |
|
| Remove access rights from subject |
|
| Set connection type for servers in service consumer role |
|
| Add internal TLS certificate |
|
| Delete internal TLS certificate |
|
| Add group |
|
| Edit group description |
|
| Add members to group |
|
| Remove members from group |
|
| Delete group |
|
2.2.4 System Parameters Events
The audit log events related to the system parameters.
| Event | Data fields |
|---|---|
| Generate certificate request for TLS |
|
| Import TLS certificate from file |
|
| Upload configuration anchor |
|
| Add timestamping service |
|
| Delete timestamping service |
|
| Generate new internal TLS key and certificate |
|
2.2.5 Keys and Certificates Events
The audit log events related to keys and certificates management
| Event | Data fields |
|---|---|
| Log in to token |
|
| Log out from token |
|
| Generate key |
|
| Delete key Event name is used if event fails before Delete key from token and configuration part is reached |
|
| Delete key from token and configuration |
|
| Generate CSR |
|
| Delete CSR |
|
| Generate key and CSR |
|
| Import certificate from file |
|
| Import certificate from token |
|
| Delete certificate Event name is used if event fails before it is known where certificate is delete from (configuration or token) | |
| Delete certificate from configuration |
|
| Delete certificate from token |
|
| Enable certificate |
|
| Disable certificate |
|
| Register authentication certificate |
|
| Unregister authentication certificate |
|
| Skip unregistration of authentication certificate |
|
| Set friendly name to token |
|
| Set friendly name to key |
|
2.2.6 Backup and Restore Events
The audit log events related to backup and restore.
| Event | Data fields |
|---|---|
| Back up configuration |
|
| Upload backup file |
|
| Delete backup file |
|
| Restore configuration |
|
2.2.7 API Key Management Events
The audit log events related to API key management.
| Event | Data fields |
|---|---|
| API key create |
|
| API key update |
|
| API key remove |
|
2.2.8 Technical Events
The audit log events related to technical events, such as authentication failures. Except for Key management API log in event, these events are only logged if they fail.
| Event | Data fields |
|---|---|
| Key management API log in | |
| API key authentication | |
| Auth credentials discovery | |
| Access check (if user did not have permission to do an operation which is not an audit logged event) | |
| Authentication |
2.3 Utility signer-console
The audit log events logged by the utility signer-console.
| Event | Data fields |
|---|---|
| Set a friendly name to the token |
|
| Set a friendly name to the key |
|
| Activate the certificate |
|
| Deactivate the certificate |
|
| Delete the key from token |
|
| Delete the certificate |
|
| Delete the certificate request |
|
| Import a certificate from the file |
|
| Log into the token |
|
| Initialize the software token |
|
| Generate a key on the token |
|
| Generate CSR |
|