Security Audit Events

The security audit events are divided into Columns, Services, Modules, Status, and Events according to from where it originates.

The following lists and describes the different event types and the overview is also available in JavaDoc format of the API.

Note that since EJBCA is built around the CESeCore project, both EventTypes and EjbcaEventTypes in the API documentation need to be considered to view all the event types EJBCA can generate.

An example of how such an event would look like in the server log using the Log4jDevice is the event that the application is starting:

... INFO  [Log4jDevice] 2015-03-20 12:47:51+01:00;EJBCA_STARTING;SUCCESS;SERVICE;EJBCA;StartServicesServlet.init;;hostname;;msg=Init, EJBCA 6.7.0 Enterprise (r25420) startup.

and the same kind of event using IntegrityProtectedDevice that writes the log entry to the database:

mysql> select * from AuditRecordData where eventType='EJBCA_STARTING' ... \G
               pk: 24861ebf7f00010106e5a024d82c694d

additionalDetails: ...  Init, EJBCA 6.7.0 Enterprise (r25420) startup.  ...
        authToken: StartServicesServlet.init
         customId: NULL
      eventStatus: SUCCESS
        eventType: EJBCA_STARTING
           module: SERVICE
           nodeId: hostname
    rowProtection: 1:2:123:4d2f6...
       rowVersion: 0
    searchDetail1: hostname
    searchDetail2: NULL
   sequenceNumber: 17640195
          service: EJBCA
        timeStamp: 1426205614754

This should be interpreted as the following:

• Service is EJBCA (not shown in the Admin GUI) : the event originates from the part of the application that not part of the core shared with other products.
• Module is SERVICE: this event was generated from a module in EJBCA that is responsible for background services.

• Status (named "Outcome" in the Admin GUI) is SUCCESS: in the context of the event, this should be interpreted as no error were detected during the EJBCA startup.

• Event is EJBCA_STARTING: the application EJBCA is starting up.

• AdditionalDetails  is an event specific message with additional information telling us (in this case) the version of EJBCA that was started.
• AuthToken identifies that the event was generated by the internal module StartServicesServlet
• NodeId is the EJBCA node, in this case hostname, that generated the event
• SearchDetail1 is an additional message, in this case the hostname (same as NodeId) that EJBCA was started on.
• TimeStamp is the time, in milliseconds since epoch, the event occured

Columns

The following table includes descriptions of the log column names and a mapping between the columns names and the display names in the Admin GUI.

Services

Service can be one of EJBCA or CORE. Both are from the EJBCA application, but services originating from CORE originates from a part, CESeCore, that contains functions also shared with other products. These services relates to event types below.

This is not important from an audit perspective, but is useful information for an understanding of the logging format.

Modules

The Security Audit Log has one component that is the Module. The Module is a description of the internal module of EJBCA where the event happened and can be useful for categorizing events.

Modules are also documented in the source code in ModuleTypes.java and EjbcaModuleTypes.java.

Status

The outcome of an event can be one of the following.

Status is also documented in the source code in EventStatus.java

Events

Security Events are divided into two parts. The logical separation is that the CESeCore Events are PKI core events needed for Common Criteria certified operations, and kept in a Core module that is re-used across some different PrimeKey products. We keep the separation in the documentation for simplicity.

Example Log File Event

The EJBCA Startup log even will look like this in the application server log file.

2017-03-25 07:26:04+01:00;EJBCA_STARTING;SUCCESS;SERVICE;EJBCA;Application internal;;hostname;;msg=Init, EJBCA 6.7.0 Enterprise (r25420) startup.

CESeCore Events

CESeCore event types are also documented in the source code in EventTypes.java.

EJBCA Events

EJBCA event types are also documented in the source code in EjbcaEventTypes.java.