D63114GC10_sg2

(1)

Oracle Access Manager 11g:

Administration

Volume II • Student Guide

D63114GC10 Edition 1.0 December 2010 D71611

(2)

This document contains proprietary information and is protected by copyright and other intellectual property laws. You may copy and print this document solely for your own use in an Oracle training course. The document may not be modified or altered in any way. Except where your use constitutes "fair use" under copyright law, you may not use, share, download, upload, copy, print, display, perform, reproduce, publish, license, post, transmit, or distribute this document in whole or in part without the express authorization of Oracle.

The information contained in this document is subject to change without notice. If you find any problems in the document, please report them in writing to: Oracle University, 500 Oracle Parkway, Redwood Shores, California 94065 USA. This document is not warranted to be error-free.

Restricted Rights Notice

If this documentation is delivered to the United States Government or anyone using the documentation on behalf of the United States Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS

The U.S. Government’s rights to use, modify, reproduce, release, perform, display, or disclose these training materials are restricted by the terms of the applicable Oracle license agreement and/or the applicable U.S. Government contract.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Authors Vishal Parashar David Goldsmith Technical Contributors and Reviewers Amjad Afanah Jeremy Banford Abhijit Bhatode Rama Bollu

Vikas Pooven Chathoth Toby Close Jui Deshpande Steve Doinidis Sunil Gupta Beomsuk Kim Ashish Kolli Vadim Lander Derick Leo Mayank Maria Madhu Martin Vamsi Motukuru Rey Ong Vimal Patel Peter Povinec Deepak Ramakrishnan Shankar Raman Chitra Sabapathy Narasimhaiah Sreehari Ramya Subramanya Ramana Turlapati Venkat Venkatnarayan Weifang Xie Editors Smita Kommini Priti Goswami Graphic Designer Satish Bettegowda Publishers Sujatha Nagendra Giri Venugopal

(3)

Auditing and Logging

(18)

Road Map

• Objectives

• Auditing and logging

• Fusion Middleware Audit Framework

• Audit output options

• Configuring audit settings

• Audited events and recorded data

• Generating audit reports

• Configuring logging settings

• Locating and examining logging output

• Locating log files from other servers

(19)

Objectives

After completing this lesson, you should be able to:

• Differentiate between auditing and logging

• Describe the Fusion Middleware Audit Framework

• Describe audit output options

• Configure audit settings

• Describe audited events and data recorded when an

audited event occurs

• Generate audit reports

• Configure logging settings

• Locate and examine logging output

• Locate log files from other servers in an Oracle Access

Manager deployment

(20)

Road Map

• Objectives

• Auditing and logging

• Fusion Middleware Audit Framework

• Audit output options

• Configuring audit settings

• Audited events and recorded data

• Generating audit reports

• Configuring logging settings

• Locating and examining logging output

• Locating log files from other servers

(21)

Auditing and Logging: Overview

This section describes the auditing and logging features of Oracle Access Manager server at a high level. Subsequent sections describe auditing and logging in greater detail.

Auditing

Compliance is a major requirement in the enterprise. With regulations such as Sarbanes-Oxley (financial) and Health Insurance Portability and Accountability Act (health care), many organizations must be able to audit identity information and user access of applications and devices. Events that require auditing might include the following:

• User authentication and access activities • Administrative changes to systems

By reviewing recorded audit data, compliance officers can perform periodic reviews of compliance policies.

While auditing can be enabled or disabled, it is normally enabled in production

environments. Auditing has a minimal performance impact, and the information captured by auditing is useful; sometimes mission-critical.

Auditing and Logging: Overview

Auditing:

• Helps users attain compliance with regulatory

requirements; for example, Sarbanes-Oxley and Health

Insurance Portability and Accountability Act (HIPAA)

• Is normally enabled in production environments

• Records authentication, authorization, and administrative

events

• Uses the Oracle Fusion Middleware Audit Framework:

–

Writes to a single, centralized Oracle Database instance or

to flat files

–

Integrates with Oracle Business Intelligence Publisher, which

provides a predefined set of compliance reports

(22)

Auditing and Logging Overview (continued)

Oracle Fusion Middleware Audit Framework

Oracle Fusion Middleware Audit Framework is a new service in Oracle Fusion Middleware 11g Release 1, designed to provide a centralized audit framework. The framework provides a common audit service for Oracle Access Manager and other Fusion Middleware component products.

With the Oracle Fusion Middleware Audit Framework, you can write all audit data to a single Oracle Database instance, or to flat files. The framework also integrates with Oracle Business Intelligence Publisher, which provides a predefined set of compliance reports.

(23)

Auditing and Logging: Overview (continued)

Logging

Oracle Access Manager server logging records messages from various OAM components. You control the amount of logging output by specifying log levels for each OAM component for which a logger is defined.

Log messages are used for problem diagnosis, either by users or by Oracle Technical Support. Documentation for log messages is not available. In some cases, users might be able to diagnose problems on their own by reading log files. More typically, you enable logging to produce files that you send to Oracle Technical Support for problem diagnosis.

Note: Diagnosing problems by using the information in the log files is not an objective for

users of this course. Configuring logging and locating log files are objectives for users of this course.

By default, the log level for all OAM server components is the notification level. Logging at the notification level generates log records for system errors and notifications only, therefore producing a relatively small amount of output. However, other log levels result in voluminous logging output; so much output that enabling some log levels can impact OAM server

performance.

Auditing and Logging: Overview

Logging:

• Records OAM component messages that are useful when

diagnosing problems.

• Normally configured to log only errors and system

notifications in production environments.

(24)

Auditing and Logging: Overview (continued)

Therefore, in production environments, the log level is set to a level (for example, the notification or error level) that results in a relatively small volume of logging output. The OAM logging system writes output to flat files only. Logging to an Oracle Database instance is not supported.

(25)

Road Map

• Objectives

• Auditing and logging

• Fusion Middleware Audit Framework

• Audit output options

• Configuring audit settings

• Audited events and recorded data

• Generating audit reports

• Configuring logging settings

• Locating and examining logging output

• Locating log files from other servers

(26)

The Fusion Middleware Audit Framework

Writing audit records to a database provides numerous advantages over writing to flat files, and is the preferred mode of operation for Oracle Access Manager server in production environments. Advantages include the following:

• Database logging implements a common auditing framework employed across a range of Oracle Fusion Middleware component products. Fusion Middleware products that leverage the common audit framework benefit from the commonality of auditing functionality at the platform level.

Other Oracle Fusion Middleware component products that leverage the Fusion Middleware Auditing Framework include (but are not limited to) Oracle Identity Manager, Oracle Web Services Manager, Oracle Internet Directory, Oracle Virtual Directory, and Oracle Directory Integration and Provisioning. Stand-alone applications can be integrated with the Oracle Fusion Middleware Audit Framework.

The Fusion Middleware Audit Framework

A common audit framework across the Fusion Middleware

product stack that includes the following features:

• Audit-aware component products

• Audit policies

• Configuration through Enterprise Manager and WLST

commands

• Flat file and database audit data stores

• Audit database initialized by Repository Creation Utility

• Pre-defined reports in Oracle Business Intelligence

Publisher

(27)

The Fusion Middleware Audit Framework (continued)

• Audit policies are declarations of the types of events to be captured by the audit

framework for particular components. For Java components, audit policies are defined at the domain level. For system components, audit policies are managed at the component instance level.

Pre-defined policy types include the following: – None

– Low (audits fewer events) – Medium (audits many events)

– Custom (implements filters to narrow the scope of audited events)

• The Fusion Middleware Audit Framework integrates with Oracle Enterprise Manager Fusion Middleware Control for UI-based configuration and management, thus leveraging the Oracle Fusion Middleware 11g infrastructure. It also supports the WLST tool for command-line configuration.

• Two output formats—flat files and database—are provided. Maintaining a common location for all audit records simplifies maintenance.

• When you use Oracle Database as the audit data store, you run the Repository Creation Utility (RCU) to initialize the predefined Oracle Fusion Middleware Audit Framework schema. Once configured, all the audit loaders are aware of the data store and upload data to it periodically. The audit data in the database is expected to be cumulative and grow over time. Ideally, this should not be an operational database used by any other applications; rather, it should be a stand-alone database used for audit purposes only. • The data in the audit store is exposed through predefined reports in Oracle Business

Intelligence Publisher (Oracle BI Publisher). By using Oracle BI Publisher reports, you can drill down through the audit data to perform analyses based on selected criteria. For example:

– Username – Time range – Application type

(28)

Road Map

• Objectives

• Auditing and logging

• Fusion Middleware Audit Framework

• Audit output options

• Configuring audit settings

• Audited events and recorded data

• Generating audit reports

• Configuring logging settings

• Locating and examining logging output

• Locating log files from other servers

(29)

Audit Output Options

You can write audit records to a flat file or to an Oracle Database instance. Although the formats differ, the content in the flat file and the database is identical.

Writing Audit Records to a Flat File

The default configuration for audit output is to write audit records to a flat file.

Writing Audit Records to a Oracle Database

You can configure Oracle Access Manager to write audit records to an Oracle database. Subsequent slides describe the architecture for database logging, and the advantages of using a database for audit logging rather than a flat file. A section later in this module describes how you configure audit logging to a database.

Audit Output Options

Flat File

Oracle DB Default OAM Server

Auditing Configuration

OAM Server Auditing to Oracle DB

(30)

Audit Architecture Using a Database as the Audit Store

The following features comprise the architecture for auditing when using a database as the audit store:

• An Oracle Database instance is required. For the required version of Oracle Database software, refer to the Oracle Fusion Middleware Administrator's Guide for Oracle

Access Manager.

• Schema for the audit log tables is provided by the Repository Creation Utility. You must run this utility before you can log to a database.

• The Oracle Access Manager server writes its audit data to a flat file.

• An independent process, called the audit loader, reads the flat file and inserts records in the log table in the Oracle database.

• Pre-defined reports in Oracle Business Intelligence Publisher expose the data in the audit database.

Audit Architecture Using a Database

as the Audit Store

Audit Loader Oracle BI Publisher Repository Creation Utility Oracle Access Manager Server

(31)

Deploying Auditing by Using a Database as the Audit Store

To deploy auditing when using a database as the audit store, perform the following tasks.

Creating the Audit Database

Before you can configure Oracle Access Manager to write audit records to a database, you must create the database.

Refer to the Oracle Access Manager Certification Matrix on Oracle Technology Network to obtain a list of supported Oracle Database versions for Oracle Access Manager 11g.

Running Repository Creation Utility

Next, run the Repository Creation Utility (RCU) to insert the auditing schema into the Oracle Database instance. Select the Audit Services check box when running RCU, as shown on the screen shot on the following page.

Deploying Auditing by Using a Database

as the Audit Store

Audit Loader Oracle BI Publisher Repository Creation Utility

2

3

4

1

Use FMW Control to enable auditing by using a database

Run Create database

Configure a data source on the admin server and managed server instances

5

_{admin and managed}Restart WebLogic server instances Oracle Access

(32)

Deploying Auditing by Using a Database as the Audit Store (continued)

Configuring a Data Source for the Audit Database

In this step, you define a JDBC data source for the audit database so that the WebLogic server can access the database. You must configure the data source on the administration server and on all WebLogic managed server instances running Oracle Access Manager server. Refer to the Oracle Fusion Middleware Security Guide 11g Release 1 for specific steps to follow to configure the data source.

Enabling Auditing by Using a Database in FMW Control

You must define the auditing type as database logging by using FMW Control.

To enable auditing in FMW Control, you select the WebLogic Domain > Security > Audit Store option and specify the JNDI name of the data source for the audit database.

Restarting WebLogic Server Instances

Finally, you must restart all the WebLogic Server instances—the admin server and all the managed server instances—in the domain. During the restart, the audit loader rereads the audit store configuration and starts using the database for auditing.

(33)

Road Map

• Objectives

• Auditing and logging

• Fusion Middleware Audit Framework

• Audit output options

• Configuring audit settings

• Audited events and recorded data

• Generating audit reports

• Configuring logging settings

• Locating and examining logging output

• Locating log files from other servers

(34)

Audit Settings

The screen shot shows configurable options for Oracle Access Manager auditing. Options include the following:

• Maximum Directory Size – The maximum size of the directory that contains audit

output files. For example, assuming that the maximum file size is 10 MB, a value of 100 for this parameter implies that the directory allows a maximum of 10 files. Once the maximum directory size is reached, auditing stops.

The Maximum Directory Size setting applies to auditing by using flat files only.

• Maximum File Size – The maximum size, in MB, of the audit file. Once the size of the

audit file reaches the maximum size, a new audit file is created and the previous log file is renamed.

The Maximum Directory Size setting applies to auditing by using flat files only.

Note: The two users listed by default in the filter settings—the orcladmin and SSOAdmin

user—are provided only as examples and can be removed if they are not required.

Audit Settings

(35)

Audit Settings (continued)

• Filter options:

– Filter Enabled – Select this check box to enable event filtering.

– Filter Preset – Controls the amount of audit information recorded. Events for the preset levels are defined in the MIDDLEWARE_HOME/user_projects/

domains/DOMAIN/config/fmwconfigcomponent_events.xmlfile. You cannot modify the content in this file.

When the filter preset is set to the level NONE, no auditing takes place.

– Audit Users – A list of users whose actions are audited irrespective of filter preset. This setting is effective if the filter preset is not set to the level NONE.

(36)

Road Map

• Objectives

• Auditing and logging

• Fusion Middleware Audit Framework

• Audit output options

• Configuring audit settings

• Audited events and recorded data

• Generating audit reports

• Configuring logging settings

• Locating and examining logging output

• Locating log files from other servers

(37)

Examples of Audited Events

The slide shows several examples of audited events.

For a complete list of audited events, refer to the Oracle Fusion Middleware Administrator's

Guide for Oracle Access Manager.

Examples of Audited Events

Type of Audited Event Event

Authentication Credentials collected

Authentication succeeded Authentication failed

Authorization Authorization succeeded

Authorization failed

Administrative Authentication scheme created

Administration console login failed Server configuration changed

(38)

Examples of Data Recorded When an Audited Event Occurs

The slide shows several examples of the different types of data that is recorded when an Oracle Access Manager event is audited.

For a complete list of the data collected during event auditing, refer to the Oracle Fusion

Examples of Data Recorded When an Audited

Event Occurs

Audited Event Data Collected

Authentication failed IP address, username, user DN, resource ID,

authentication scheme ID, failure error code, retry count, authentication policy ID, partner ID

Authorization succeeded IP address, user DN, resource ID, authorization policy ID

Administration console login succeeded

(39)

Answer: c, d

Quiz

To deploy auditing by using Oracle Database as the audit store,

which two of the following actions must you take?

a.

Create a separate WebLogic managed server instance that

executes the auditing logic

b.

Configure an identity data source in Oracle Access

Manager

c.

Enable auditing using a database by using FMW Control

(40)

Answer: c

Quiz

Which tool can you use to view predefined audit reports for

Oracle Access Manager?

a.

The WLST tool

b.

grep

c.

Oracle BI Publisher

(41)

Road Map

• Objectives

• Auditing and logging

• Fusion Middleware Audit Framework

• Audit output options

• Configuring audit settings

• Audited events and recorded data

• Generating audit reports

• Configuring logging settings

• Locating and examining logging output

• Locating log files from other servers

(42)

Oracle Business Intelligence Publisher

Oracle Business Intelligence is a general-purpose reporting and analysis tool that you can use to answer a range of business questions. For example:

• How is my business performing?

• Which factors are influencing my business? • Where is my business headed?

• Where should we focus our efforts?

The Fusion Middleware Audit Framework leverages Oracle BI Publisher to analyze audit data recorded to an audit database. A set of predefined Oracle BI Publisher report templates are provided with Oracle Access Manager. By using these report templates, you can run reports to analyze audit data. By using Oracle BI Publisher, you can take advantage of powerful reporting features such as flexible report display, filtering, scheduling, and custom reporting.

Oracle Business Intelligence Publisher

• Supports Fusion Middleware Audit Framework predefined

reports

• Provides flexible report display:

–

Output type

–

Appearance

• Provides report filtering

• Provides report scheduling

(43)

Deploying BI Publisher to Support FMW Audit Framework and Oracle Access Manager Reports

To deploy Fusion Middleware Audit Framework reports and reports specific to Oracle Access Manager in Oracle BI Publisher, perform the following steps:

1. Install the Oracle BI Publisher Web application.

2. In the Web container in which you installed Oracle Business Intelligence Publisher, define a data source for the audit database if you have not already done so.

3. Copy the AuditReportTemplates.jar file from the Fusion Middleware software installation directory to the XMLP/Reports subdirectory of the Oracle BI Publisher top-level installation directory. Unjar the AuditReportTemplates.jar file. 4. Copy the oam_audit_reports_11_1_1_3_0.zip file from the

middleware_home/idm_home/oam/server/reportsdirectory to the

XMLP/Reportssubdirectory of the Oracle BI Publisher top-level installation directory. Unzip the oam_audit_reports_11_1_1_3_0.zip file.

Deploying BI Publisher to Support FMW Audit

Framework and Oracle Access Manager Reports

Oracle BI Publisher

2

1

Install

Configure a data source in Oracle BI Publisher (if not already configured)

BI Publisher Installation Directory

XMLP/ReportsSubdirectory

3

Copy and unjar

AuditReport Templates.jarFile

4

Copy and unzip oam_audit_reports_

(44)

Generating Oracle BI Publisher Reports

To generate Fusion Middleware Audit Framework reports in Oracle BI Publisher, perform the following steps:

1. Log in to Oracle BI Publisher. The default user ID is Administrator and the default password is Administrator.

2. Select the Reports tab.

3. Click More to expose the list of standard reports, including audit reports.

4. Click Oracle _Fusion_Middleware_Audit, then navigate to the report you want to run. 5. Use filter options in the top part of the report page to filter reported data in various

ways. Report data appears on the bottom part of the report page.

Generating Oracle BI Publisher Reports

Report filtering and sorting options

OAM audit data

(45)

Navigating to Common User Activities Reports

Perform the following steps to run the Fusion Middleware common user activities reports in Oracle BI Publisher:

1. Start the Oracle BI Publisher console. The console’s default URL is http://host:9704/xmlpserver.

2. Log in to Oracle BI Publisher. The default user ID is Administrator, and the default password is also Administrator.

3. Click More.

4. Click Oracle_Fusion_Middleware_Audit. 5. Click Common_Reports.

6. Select the report that you want to run.

Navigating to Common User Activities Reports

Navigation Path Is Shared Folders / Oracle_Fusion_Middleware_Audit

User Activities Report

(46)

Navigating to Oracle Access Manager Reports

Perform the following steps to run the Oracle Access Manager reports in Oracle BI Publisher:

1. Start the Oracle BI Publisher console. The console’s default URL is http://host:9704/xmlpserver.

2. Log in to Oracle BI Publisher. The default user ID is Administrator, and the default password is also Administrator.

3. Click More.

4. Click Oracle_Fusion_Middleware_Audit. 5. Click Component_Specific.

6. Click Oracle_Access_Manager.

7. Select the report that you want to run.

Note: The common user activities reports appear both in the Common_Reports folder and

in the Oracle_Access_Manager folder. You can run the common user activities reports from either location in the Oracle BI Publisher console.

Navigating to Oracle Access Manager Reports

Navigation path Is Shared Folders / Oracle_Fusion_Middleware_Audit /

Component_Specific / Oracle_Access_Manager

(47)

Oracle BI Publisher Reports for Oracle Access Manager

The BI Publisher reports for Oracle Access Manager are divided into two categories: • Reports that are not specific to Oracle Access Manager

• Reports that are specific to Oracle Access Manager

Fusion Middleware Common User Activity Reports

The Fusion Middleware Audit Framework includes a set of user activity reports that provide information about events that occurred in both Oracle Access Manager and other Fusion Middleware component products. For example, the Authentication History report includes authentications to Oracle Access Manager, but might include binds to Oracle Internet Directory as well.

Oracle Access Manager Specific Reports

In addition, reports that are specific to Oracle Access Manager are included in the predefined set of Fusion Middleware Audit Framework reports. These reports provide information solely about audit events recorded by Oracle Access Manager.

Oracle BI Publisher Reports for

Oracle Access Manager

• Fusion Middleware Common User Activity Reports:

–

Authentication History

–

Multiple Logins from Same IP

–

Authorization History

–

Event Details

–

Dashboard

• Oracle Access Manager reports:

–

Authentication from IP by User

–

Authentication per IP

–

Authentication Statistics per Server

(48)

Oracle BI Publisher Reports for Oracle Access Manager (continued)

The following reports specific to Oracle Access Manager are available:

• Authentication From IP by User – For each IP address from which users have attempted to authenticate, this report shows the number of distinct users who have attempted to authenticate, the total authentication attempts, and the IDs of users who have attempted to authenticate.

• Authentication Per IP – The Authentication Per IP report is an abbreviated form of the Authentication From IP by User report. For each IP address from which users have attempted to authenticate, this report shows the number of distinct users who have attempted to authenticate and the total authentication attempts.

• Authentication Statistics Per Server – This report shows the authentication success and failure count for each Oracle Access Manager server instance.

• Authentication Statistics – This report provides a list of users who incurred the most successful and failed authentication attempts.

(49)

Road Map

• Objectives

• Auditing and logging

• Fusion Middleware Audit Framework

• Audit output options

• Configuring audit settings

• Audited events and recorded data

• Generating audit reports

• Configuring logging settings

• Locating and examining logging output

• Locating log files from other servers

(50)

Administrator Tasks: Logging

Administrators and Oracle Support use Oracle Access Manager server logging to diagnose problems. When the Oracle Access Manager server does not operate as expected, a customer might call Oracle Support to determine the cause of the problem. If the cause of the problem is not easily diagnosed, Oracle Support might ask the customer to generate logs to help Oracle Support analyze the problem and make recommendations for correcting the problem.

Therefore, administrators need to know how to configure Oracle Access Manager server logging in order to produce diagnostic output for Oracle Support. They need to know how to locate output log files so that they can send them to Oracle Support upon request. They need to know how to reset the logging configuration back to default levels after requested logs have been produced, so that logging overhead does not adversely affect Oracle Access Manager server performance.

Administrators are not expected to interpret logging output. Oracle Access Manager documentation does not describe log file formats or content; nor does this course. While experienced administrators might learn to interpret logging output, being able to do so is not a learning objective of this course.

Administrator Tasks: Logging

• Configure logging as requested by Oracle Support

• Locate logging output in order to send to Oracle Support

for problem diagnosis

• Reset logging to the default level after obtaining needed

log output to minimize performance impact

(51)

Logging Configuration Objects

Like all Fusion Middleware 11g component products, Oracle Access Manager implements the Oracle Diagnostic Logging (ODL) framework, an architecture that complements and extends the Java EE logging framework encapsulated in the java.util.logging classes. Two components—loggers and log handlers—work together in this architecture.

Loggers

Oracle Access Manager calls component loggers when events require logging. The set of component loggers is predefined in the Oracle Access Manager configuration. Some examples of component loggers are the authentication engine logger, the SSO controller logger, and the credential collector logger.

Oracle Access Manager logger names begin with the string oracle.oam.

For a complete list of Oracle Access Manager loggers, refer to the Oracle Fusion

Logging Configuration Objects

Authentication engine logging at TRACE:32 level

SSO controller logging at TRACE:32 level

Credential collector logging at TRACE:32 level

All other OAM components logging at NOTIFICATION:1 level

Loggers Log Handler(s)

(52)

Logging Configuration Objects (continued)

Log Handlers

Log handlers typically receive messages from loggers and write the messages to files. By default, Oracle Access Manager loggers use the odl-handler log handler. This log handler writes to the DOMAIN_HOME/servers/OAM_SERVER/logs/OAM_SERVER-diagnostic.logfile.

(53)

Log Levels

You can change the amount of logging output for loggers by modifying their log levels. The ODL log levels are listed on the slide. The INCIDENT_ERROR:1 level produces the least logging output. The TRACE:32 level produces the most output. The default log level for Oracle Access Manager server loggers is the NOTIFICATION:1 level.

While you can control the volume of output produced by logging, you cannot customize individual messages that loggers write when you set a given log level on a logger. The level associated with a log message is predefined in the Oracle Access Manager code.

ODL and Java EE Log Levels

Oracle Access Manager uses log levels defined in the ODL. The log levels are analogous to log levels defined in the java.util.logging.Level class in the Java EE logging

architecture. The Oracle Fusion Middleware Administrator's Guide for Oracle Access

Log Levels

• INCIDENT_ERROR:1

• ERROR:1

• WARNING:1

• NOTIFICATION:1

(default log level)

• NOTIFICATION:16

• TRACE:1

• TRACE:16

(54)

Oracle Access Manager Loggers and Log Level Inheritance

The ODL framework uses an inheritance model to determine loggers' log levels.

Logger names can consist of multiple strings delimited by periods. For example, the logger for Oracle Access Manager audit events is the oracle.oam.audit logger.

To determining a logger's log level, the logging system first looks to see if a log level is explicitly defined for the logger. In the example, no explicit log level is defined for the oracle.oam.auditlogger.

If no explicit log level is found for the logger, the logging system strips the right-most string and period from the logger name to construct a new logger name. In the example, the new logger name is oracle.oam. The logging system then checks to see if a log level is explicitly set for this logger. If a log level has been explicitly defined, the original logger inherits this log level.

The logging system repeats this action until the logger name has been stripped of all characters, oracle. The Oracle Access Manager logging configuration explicitly defines the NOTIFICATION:1 log level as the oracle logger's log level. Therefore, Oracle Access Manager loggers that do not have explicitly defined log levels default to the

NOTIFICATION:1log level.

Oracle Access Manager Loggers and

Log Level Inheritance

Log level explicitly set to NOTIFICATION:1 level

Log level not explicitly set, inherits log level from oracle logger

Log level not explicitly set,

inherits log level from oracle.oam logger oracle logger oracle.oam logger oracle.oam.audit logger

(55)

Log Handler Settings

Log handlers receive messages from one or more loggers and typically write the message to files.

You can configure a variety of log handler settings.

Log Handler Name

When you define a new log handler, you specify a unique log handler name.

Log Size

Two configuration settings determine the log size:

• The maximum size of any single log file. When this file size is exceeded, the logging system no longer writes to the current log file. Instead, it renames the log file and creates a new log file with the same name as the original log file.

• The maximum size of the log file and saved log files.

Log File Rotation Configuration

The logging system can rotate the log files based on a configurable start time, a rotation frequency, and a retention period.

Log Handler Settings

• Name

• Maximum log size

• Log file rotation configuration

• Log file path

• Log handler type

• Loggers that write to the log handler

(56)

Log Handler Settings (continued)

Log File Path

You can specify the path to which the log handler writes.

Log Handler Type

The Oracle Access Manager server loggers use the

oracle.core.ojdl.logging.ODLHandlerFactoryhandler type.

Loggers

You can specify loggers that write to the given log handler, or remove loggers from the list of loggers that write to the log handler.

Log Level

You can specify a log level to be used by all loggers that write to the log handler. If desired, you can override this setting for individual loggers.

(57)

Logging Configuration Tools

You use the Oracle Enterprise Manager Fusion Middleware Control (FMW Control) and the WLST tool to configure Oracle Access Manager logging. The Oracle Access Manager console does not provide the ability to configure Oracle Access Manager logging.

Oracle FMW Control

Oracle Enterprise Manager Fusion Middleware Control is a Web-based management system for administering Oracle Fusion Middleware products. With Fusion Middleware Control, you can manage services in your enterprise, including hosts, databases, listeners, application servers, HTTP Servers, and Web applications as one cohesive unit.

You start the FMW Control by navigating to the following URL: http://host:port/em, where

hostand port are the host name and port number of the WebLogic admin server.

The WLST Tool

You can use the WLST tool to perform a variety of logging configuration tasks. Specific WLST commands that you use to configure logging are described later in this lesson.

Logging Configuration Tools

• The Oracle Enterprise Manager Fusion Middleware

Control (FMW Control) Web-based management system

(58)

Viewing the Logging Configuration by Using FMW Control

View the logging configuration for the domain in which Oracle Access Manager is installed as follows:

1. Start Enterprise Manager Fusion Middleware Control by navigating to the following URL: http://host:port/em. In this example, host and port are the host name and port number of the WebLogic admin server.

2. In the navigator that appears in the left window pane, select Identity and Access > OAM > oam_server.

3. The Oracle Access Manager menu appears in the right window pane below the label, oam_server. Select Logs > Log Configuration from the pull-down menu.

4. The logger structure appears in the right window pane. The oracle logger appears in the list. Other Oracle Access Manager server loggers appear when you expand the list's nodes.

Viewing the Logging Configuration by

Using FMW Control

OAM loggers

(59)

Modifying Log Level by Using FMW Control

FMW Control provides a user interface for modifying log levels.

To modify the log level by using FMW Control, perform the following steps: 1. Start FMW Control and view the logging configuration.

2. Select the Log Levels tab.

3. Locate the logger that you want to modify.

4. Select the new log level from the drop-down list to the right of the logger's name. 5. Click Apply.

Modifying Log Level by Using FMW Control

Locate logger Select log level

1

2

(60)

Creating or Configuring Log Handlers by Using FMW Control

You can use FMW Control to create new log handlers and change the configuration of existing log handlers.

To locate the functionality for creating and configuring log handlers, start FMW Control and view the logging configuration. Then select the Log Files tab.

Buttons for creating new log handlers and modifying the configuration of existing log handlers appear on the page.

Creating or Configuring Log Handlers by

Using FMW Control

Select Log Files tab Provide log handler details

1

3

Click Create, Create Like, or Edit Configuration

(61)

Using the WLST Tool to Configure Logging

You can use the WLST tool to perform a variety of logging configuration tasks.

Two Versions of the WLST Tool

Every WebLogic Server installation provides the WLST tool. The WebLogic Server WLST tool is located in the WLS_HOME/common/bin directory.

When you install Oracle Access Manager or other Fusion Middleware identity management products, a second version of the WLST tool is installed. This version contains commands unique to Fusion Middleware software, including the commands that you can run to

configure logging, if you want to configure logging by using the command line. This version of the WLST tool is located in the ORACLE_HOME/common/bin directory.

To verify that you are using the version of the WLST tool that provides the commands unique to Fusion Middleware software, you can run the WLST help("listLoggers") command. If help is available for the listLoggers command, then you are using the version of the WLST tool that you need for configuring Oracle Access Manager logging.

D63114GC10_sg2

Oracle Access Manager 11g:

Administration

Contents

Auditing and Logging

Road Map

•

Objectives

•

Auditing and logging

•

Fusion Middleware Audit Framework

•

Audit output options

•

Configuring audit settings

•

Audited events and recorded data

•

Generating audit reports

•

Configuring logging settings

•

Locating and examining logging output

•

Locating log files from other servers

Objectives

After completing this lesson, you should be able to:

•

Differentiate between auditing and logging

•

Describe the Fusion Middleware Audit Framework

•

Describe audit output options

•

Configure audit settings

•

Describe audited events and data recorded when an

audited event occurs

•

Generate audit reports

•

Configure logging settings

•

Locate and examine logging output

•

Locate log files from other servers in an Oracle Access

Manager deployment

Road Map

•

Objectives

•

Auditing and logging

•

Fusion Middleware Audit Framework

•

Audit output options

•

Configuring audit settings

•

Audited events and recorded data

•

Generating audit reports

•

Configuring logging settings

•

Locating and examining logging output

•

Locating log files from other servers

Auditing and Logging: Overview

Auditing:

•

Helps users attain compliance with regulatory

requirements; for example, Sarbanes-Oxley and Health

Insurance Portability and Accountability Act (HIPAA)

•

Is normally enabled in production environments

•

Records authentication, authorization, and administrative

events