Logging Tivoli Access Manager security

Use this topic to enable the trace specification to indicate tracing at the required level.

The Java Authorization Contract for Containers (JACC) for Tivoli Access Manager provider messages are logged to the configured trace output location, and messages are written to standard out SystemOut.log file. When trace is enabled, all logging, both trace and messaging, is sent to the trace.log file.

(zos) Note: These messages are sent to CTRACE. CTRACE can write them to a CTRACE dataset, memory buffer, and/or the SYSPRINT data set for the region's started task.

This topic references one or more of the application server log files. As a recommended alternative, we can configure the server to use the High Performance Extensible Logging (HPEL) log and trace infrastructure instead of using SystemOut.log , SystemErr.log, trace.log, and activity.log files on distributed and IBM i systems. We can also use HPEL in conjunction with the native z/OS logging facilities. If we are using HPEL, we can access all of the log and trace information using the LogViewer command-line tool from the server profile bin directory. See the information about using HPEL to troubleshoot applications for more information on using HPEL.

1. The amwas.node_server.pdjlog.properties file must be updated and the isLogging attribute set to true for the required component. For example, to enable tracing for the JACC provider for Tivoli Access Manager, set the following line to true: amwas.node_server.pdjlog.properties:baseGroup.AMWASWebTraceLogger.isLogging=true

2. Enable tracing for the JACC provider of Tivoli Access Manager components in the WAS console by completing the following steps:

   1. Click Troubleshooting > Logs and Trace > server_name.

   2. Under Logs and Trace tasks, click Diagnostic trace.

   3. Select the Enable Log option.

   4. Click Apply.

   5. Click Troubleshooting > Logs and Trace > server_name.

   6. Click Change Log Detail Levels.

   7. Click Components. Tracing for all components can be enabled using the com.tivoli.pd.as.* command. Tracing for separate components can be enabled using the following commands:

      • com.tivoli.pd.as.rbpf.* for role-based policy framework tracing

      • com.tivoli.pd.as.jacc.* for JACC provider tracing

      • com.tivoli.pd.as.pdwas.* for the authorization table

      • com.tivoli.pd.as.cfg.* for configuration

      • com.tivoli.pd.as.cache.* for caching

      For more information, see Log level settings.

   8. Click Apply.

What to do next

The trace specification now indicates that tracing is enabled at the required level. Save the configuration and restart the server for the changes to take effect.

Subtopics

• Tivoli Access Manager loggers
  The Java Authorization Contract for Containers (JACC) provider for Tivoli Access Manager uses the JLog logging framework as does the Java runtime environment for Tivoli Access Manager. We can enable tracing and messaging selectively for specific JACC providers for Tivoli Access Manager components.

Related tasks

Enable an external JACC provider

(iseries)(dist) Diagnostic trace service settings