WAS v8.5 > Script the application serving environment (wsadmin) > Scripting for security > Configure security with scripting > Configure security auditing using scripting

Configure security audit notifications using scripting

Configure the security auditing system to send email notifications to a distribution list, system log, or both a distribution list and a system log if a failure occurs in the audit subsystem. Security auditing provides tracking and archiving of auditable events.

Before configuring a notification object in the audit.xml configuration file, verify set up a security auditing subsystem and configured the security auditing policy. We can configure the security auditing system to notify a specific person or group when a failure occurs in the audit subsystem. Use the following steps to enable security auditing email notifications, set the format of notification email, and secure email:

IBM recommends using the HPEL log and trace infrastructure. With HPEL, one views logs using the LogViewer command-line tool in PROFILE/bin.

1. Launch the wsadmin scripting tool using the Jython scripting language. See the Starting the wsadmin scripting client article for more information.

2. Customize and enable security auditing email notifications.

   Command parameters. Use the createAuditNotification command and the following parameters to configure notifications:

   Parameter	Description	Data Types	Required
   -notificationName	Unique name to assign the audit notification object in the audit.xml file.	String	Yes
   -logToSystemOut	Whether to log the notification to the SystemOut.log file.	Boolean	Yes
   -sendEmail	Whether to email notifications.	Boolean	Yes
   -emailList	Email address or email distribution list to email notifications. The format for this parameter is: admin@company.com(smtp-server.mycompany.com)	String	No
   -emailFormat	Whether to send the email be HTML or TEXT format.	String	No

   To create the audit notification object, specify the -notificationName, -logToSystemOut, and -sendEmail parameters, as the following example demonstrates:

   AdminTask.createAuditNotification('-notificationName defaultEmailNotification 
   -logToSystemOut true -sendEmail true -emailList administrator@mycompany.com(smtp-server.mycompany.com) 
   -emailFormat HTML')

3. Create an audit notification monitor object.

   Create an audit notification monitor object to monitor the security auditing subsystem for possible failure.

   Command parameters. Use the createAuditNotificationMonitor command and the following parameters to create a monitor object for the security auditing system:

   Parameter	Description	Data Types	Required
   -notificationName	Unique name to assign the audit notification object in the audit.xml file.	String	Yes
   -logToSystemOut	Whether to log the notification to the SystemOut.log file.	Boolean	Yes
   -sendEmail	Whether to email notifications.	Boolean	Yes
   -emailList	Email address or email distribution list to email notifications. The format for this parameter is: admin@company.com(smtp-server.mycompany.com)	String	No
   -emailFormat	Whether to send the email be HTML or TEXT format.	String	No

   To create the audit notification monitor object, specify the -notificationName, -logToSystemOut, and -sendEmail parameters, as the following example demonstrates:

   AdminTask.createAuditNotificationMonitor('-notificationName defaultEmailNotification 
   -logToSystemOut true -sendEmail true -emailList administrator@mycompany.com(smtp-server.mycompany.com) 
   -emailFormat HTML')

4. Save your configuration changes.

   Use the following command example to save your configuration changes:

   AdminConfig.save()

Results

The security auditing system notifies the specified recipients if a failure occurs in the security auditing system.

Use the modifyAuditNotification command and the Audit Notification Commands command group for AdminTask to manage your notification configuration.

Related

Configure auditable events using scripting
Encrypting security audit data using scripting
Enable security auditing using scripting
Signing security audit data using scripting
Configure security auditing using scripting
Start the wsadmin scripting client using wsadmin.sh

Reference:

AuditKeyStoreCommands command group for AdminTask
AuditEmitterCommands for AdminTask
AuditSigningCommands command group for AdminTask
AuditEncryptionCommands command group for AdminTask
AuditEventFactoryCommands for AdminTask
AuditFilterCommands command group for AdminTask
AuditNotificationCommands command group for AdminTask
AuditPolicyCommands command group for AdminTask
AuditEventFormatterCommands command group for AdminTask

+

Search Tips   |   Advanced Search