TitlePage

webMethods Audit Logging Guide

Version 8.0

December 2009

Copyright & Docu mentID

ThisdocumentappliestowebMethodsProductSuiteVersion8.0andtoallsubsequentreleases. Specificationscontainedhereinaresubjecttochangeandthesechangeswillbereportedinsubsequentreleasenotesorneweditions. Copyright20052009SoftwareAG,Darmstadt,Germanyand/orSoftwareAGUSA,Inc.,Reston,VA,UnitedStatesofAmerica,and/or theirlicensors. ThenameSoftwareAG,webMethods,andallSoftwareAGproductnamesareeithertrademarksorregisteredtrademarksofSoftwareAG and/orSoftwareAGUSA,Inc.and/ortheirlicensors.Othercompanyandproductnamesmentionedhereinmaybetrademarksoftheir respectiveowners. UseofthissoftwareissubjecttoadherencetoSoftwareAGslicensingconditionsandterms.Thesetermsarepartoftheproduct documentation,locatedathttp://documentation.softwareag.com/legal/and/orintherootinstallationdirectoryofthelicensedproduct(s). Thissoftwaremayincludeportionsofthirdpartyproducts.Forthirdpartycopyrightnoticesandlicenseterms,pleaserefertoLicense Texts,CopyrightNoticesandDisclaimersofThirdPartyProducts.Thisdocumentispartoftheproductdocumentation,locatedat http://documentation.softwareag.com/legal/and/orintherootinstallationdirectoryofthelicensedproduct(s).

Document ID: WEBM-ALG-80SP1-20091204

Table of Contents
About This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Document Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Documentation Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Online Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1. Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Error Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Session Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Service Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Document Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Guaranteed Delivery Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Business Process Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Task Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Integration Process Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mediator Transaction Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Globalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2. Setting Up Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configure Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Start the Logger Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Enable the Logger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Choose the Logging Level for the Service Logger . . . . . . . . . . . . . . . . . . . . . . . . . . . . Choose the Mode for Writing Log Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Indicate Whether to Persist the Queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Specify the Maximum Queue Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Identify the Destination . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Specify the Maximum Retries for Database Destination . . . . . . . . . . . . . . . . . . . . . . . Specify the Wait Between Retries for Database Destination . . . . . . . . . . . . . . . . . . . . Additional Fields for the Security Logger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Choose Whether to Generate Auditing Data on Startup . . . . . . . . . . . . . . . . . . . . Choose When to Generate Security Auditing Data . . . . . . . . . . . . . . . . . . . . . . . . Choose Security Areas to Audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Complete the Logger Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set Up Additional Service Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set Up Customized Service Logging in Developer or Designer . . . . . . . . . . . . . . . . . . Write User-Defined Messages or Input Pipelines to the Integration Server Server Log Write User-Defined Messages to the IS Core Audit Log . . . . . . . . . . . . . . . . . . . . . . . Send Messages About Service Failures to Email Addresses . . . . . . . . . . . . . . . . . . . . Perform Additional Processing on Audit Log Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 5 6 6 9 10 11 11 11 12 13 13 13 14 14 15 15 17 18 18 18 18 19 19 20 20 21 22 22 23 23 23 23 23 24 24 25 25 26 27

webMethods Audit Logging Guide Version 8.0

Table of Contents

3. Viewing Audit Log Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Audit Logs in Integration Server Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Error Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Guaranteed Delivery Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Security Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Service Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Session Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Mediator Transaction Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change the Log Displays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Display Logged Data in Different Languages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change the Display Permanently for All Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change the Display Temporarily for a Particular Log . . . . . . . . . . . . . . . . . . . . . . . . . .

29 30 31 31 31 32 32 33 34 36 36 37 38

webMethods Audit Logging Guide Version 8.0

About This Guide

ThisguideexplainshowtoconfigurewebMethodsIntegrationServererror,session, service,security,document,andguaranteeddeliveryauditlogging,andhowtoview loggeddata.Inaddition,theguidebrieflydescribesbusinessprocess,task,integration processaudit,andwebMethodsMediatortransactioneventlogging,andpointstothe webMethodsdocumentationthatprovidesmoredetailedinformationforthosetypesof logging.

Document Conventions
Convention Bold Narrow font UPPERCASE Italic Description Identifieselementsonauserinterface. IdentifiesstoragelocationsforservicesonwebMethodsIntegration Server,usingtheconventionfolder.subfolder:service. Identifieskeyboardkeys.Keysyoumustpresssimultaneouslyare joinedwithaplussign(+). Identifiesvariablesforwhichyoumustsupplyvaluesspecifictoyour ownsituationorenvironment.Identifiesnewtermsthefirsttimethey occurinthetext. Identifiestextyoumusttypeormessagesdisplayedbythesystem. Indicatesasetofchoicesfromwhichyoumustchooseone.Typeonly theinformationinsidethecurlybraces.Donottypethe{}symbols. Separatestwomutuallyexclusivechoicesinasyntaxline.Typeoneof thesechoices.Donottypethe|symbol. Indicatesoneormoreoptions.Typeonlytheinformationinsidethe squarebrackets.Donottypethe[]symbols. Indicatesthatyoucantypemultipleoptionsofthesametype.Type onlytheinformation.Donottypetheellipsis(...).

Monospace font

{} | [] ...

webMethods Audit Logging Guide Version 8.0

About This Guide

Documentation Installation
YoucandownloadtheproductdocumentationusingtheSoftware AGInstaller. DependingonthereleaseofthewebMethodsproductsuite,thelocationofthe downloadeddocumentationwillbeasshowninthetablebelow. For webMethods... 6.x 7.x 8.x The documentation is downloaded to... Theinstallationdirectoryofeachproduct. Acentraldirectorynamed_documentationinthemain installationdirectory(webMethodsbydefault). Acentraldirectorynamed_documentationinthemain installationdirectory(Software AGbydefault).

Online Information
YoucanfindadditionalinformationaboutSoftware AGproductsatthelocationslisted below. Note: TheEmpowerProductSupportWebsiteandtheSoftware AGDocumentation WebsitereplaceSoftware AGServLine24andwebMethodsAdvantage. If you want to... Accessthelatestversionofproduct documentation. Findinformationaboutproductreleasesand toolsthatyoucanusetoresolveproblems. SeetheKnowledgeCenterto: Readtechnicalarticlesandpapers. Downloadfixesandservicepacks. Learnaboutcriticalalerts. SeetheProductsareato: Downloadproducts. Getinformationaboutproduct availability. Accessolderversionsofproduct documentation. Submitfeature/enhancementrequests. Go to... Software AG Documentation Web site http://documentation.softwareag.com Empower Product Support Web site https://empower.softwareag.com

webMethods Audit Logging Guide Version 8.0

About This Guide

If you want to... Accessadditionalarticles,demos,and tutorials. Obtaintechnicalinformation,useful resources,andonlinediscussionforums, moderatedbySoftware AGprofessionals, tohelpyoudomorewithSoftware AG technology. Usetheonlinediscussionforumsto exchangebestpracticesandchatwith otherexperts. Expandyourknowledgeaboutproduct documentation,codesamples,articles, onlineseminars,andtutorials. LinktoexternalWebsitesthatdiscuss openstandardsandmanyWeb technologytopics. Seehowothercustomersarestreamlining theiroperationswithtechnologyfrom Software AG.

Go to... Software AG Developer Community for webMethods http://communities.softwareag.com/ webmethods

webMethods Audit Logging Guide Version 8.0

About This Guide

webMethods Audit Logging Guide Version 8.0

Concepts
10 11 11 11 12 13 13 13 14 14 15 15

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Error Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Session Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Service Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Security Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Document Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Guaranteed Delivery Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Business Process Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Task Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Integration Process Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Mediator Transaction Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Globalization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

webMethods Audit Logging Guide Version 8.0

1 Concepts

Overview
AuditloggingforwebMethodsproductsprovidesimportantdatayouneedtomonitor webMethodssystemactivityandcorrectproblems.IntegrationServermaintainsmostof theauditloggingdatainthewebMethodsproductsuite.Thisguidedescribesaudit loggingmaintainedbyIntegrationServer,asfollows: This type of logging... Error Session Provides information about... ExceptionsthrownbyservicesrunningonIntegrationServer. SessionsopenedonIntegrationServerbywebMethods Developer,webMethodsDesigner,thirdpartyclients,and otherservers. ServicesthatruninIntegrationServer. Securityrelatedadministrativeandoperationalactionson IntegrationServer,suchasmodificationstoauthorizations andauthentication,andattemptstoaccessIntegrationServer resourcesorperformruntimeevents. Documentsthatareindoubt,havefailed,orhaveexhausted triggerretriesonIntegrationServer. GuaranteeddeliverytransactionsinIntegrationServer. BusinessprocessesmodeledinDesignerthatrunon IntegrationServers. TasksdesignedinDesignerthatrunonMywebMethods Server.Taskscanbecalledfrombusinessprocessesorcanrun asstandalonetasks. Integrationprocessesmadeupofachainofservicesthatrun onIntegrationServers. webMethodsMediatortransactioneventsproducedbythe LogInvocationruntimepolicy.

Service Security

Document Guaranteeddelivery Businessprocess Task

Integrationprocess Mediatortransaction

Thischapterdescribeseachtypeofauditlogging.Inaddition,thechapterliststhedefault languageusedforlogentriesanddescribestheeffectofyouroperatingenvironmentand webMethodslanguagepacksonlogentries. Note: ForinformationonsettingupauditloggingforwebMethodsadapters,seethe adapterguides.

10

webMethods Audit Logging Guide Version 8.0

1 Concepts

Error Audit Logging

Errorauditloggingprovidesdataaboutexceptionsthrownbyservicesrunningon IntegrationServer.Youcanuseerrorlogdatatodebugservices.Samplestacktrace informationisshownbelow.
java.lang.NullPointerException at JpLogger.addScheduleID(JpLogger.java:46) at java.lang.reflect.Method.invoke(Native Method) at com.wm.app.b2b.server.JavaService.baseInvoke(JavaService.java:287 at com.wm.app.b2b.server.ServiceManager.invoke(ServiceManager.java:344) at com.wm.app.b2b.server.comm.DefaultServerRequestHandler.handleMessage DefaultServerRequestHandler.java:97) at com.wm.app.b2b.server.HTTPMessageHandler.process(HTTPMessageHandler.java:167 at com.wm.app.b2b.server.Dispatch.run(Dispatch.java:204) at com.wm.util.pool.PooledThread.run(PooledThread.java:105) at java.lang.Thread.run(Thread.java:498)

Session Audit Logging

SessionauditloggingprovidesdataaboutsessionsopenedonIntegrationServerby Developer,Designer,thirdpartyclients,andotherservers. Youcanusesessionlogentriestodothefollowing: Trackwhensessionsstart,theircurrentstatus,andtheirduration. RecordtheclientthatinitiatedthesessionandtheIntegrationServerportonwhich theclientconnected.

Service Audit Logging

Serviceauditloggingprovidesdataaboutflowandcoded(forexample,Java)services thatruninIntegrationServer.Youcanuseservicelogentriesanddatatodothe following: Trackwhenservicesstart,theirstatus,andtheirduration. Trackwhetherservicescompletedsuccessfullyorfailed. Recordtheclientthatcalledtheservice,andtheIntegrationServerportonwhichthe clientconnected. Resubmitservices. InIntegrationServer,yougloballydisableallloggingforallservices,globallyenableone typeofloggingforallservices,orenablecustomizedloggingonaservicebyservice basis.

webMethods Audit Logging Guide Version 8.0

11

1 Concepts

Ifyouenablecustomizedlogging,yousetupthecustomizedloggingforspecificservices inDeveloperorDesigner.Foreachservice,youcanchoosethefollowing: Whentologbasedonhowtheserviceiscalled.Forexample,youmightchoosetolog onlywhentheserviceiscalledbyaclientrequestortrigger,asopposedtobyother services. Onwhatstatustolog.Forexample,youmightchoosetologonlywhentheservice fails. Whethertostoretheservicesinputpipelineand,ifso,when.Forexample,youmight choosetologtheinputpipelineonlywhenanerroroccurs.Storingtheinputpipeline allowsyoutoresubmittheservicelaterifnecessary. Note: WhetheryouenableordisableservicelogginginIntegrationServerand DeveloperorDesigner,iferrorloggingisenabled,IntegrationServeralwayswrites errorlogentrieswhenserviceerrorsoccur.Thedataincludesstacktracedataabout theerrors. YoucanaugmentserviceloggingdatausingIntegrationServerbuiltinservices.The builtinservicesdothefollowing: EnableservicestopostuserdefinedprogressmessagestotheIntegrationServer serverlogortheISCoreAuditLog.Forexample,youmighthaveaservicepost messagestoindicatethatcertainpiecesofcoderansuccessfully,ortorecordruntime valuesforvariablessoyoucanseehowthevalueschangedastheserviceran. EnableservicestowritethepipelinetotheIntegrationServerserverlog.

Security Audit Logging

Securityauditloggingprovidesdataaboutsecurityrelatedadministrativeand operationaleventsthatoccuronIntegrationServer.Administrativeeventsare configurationchangesrelatedtoIntegrationServersecurityactivities.Examplesinclude changestoauthorization,authentication,port,orauditsettings;SSLconfiguration, passwordrestrictions;orrootcertificates.Operationaleventsincludeattemptstologon toIntegrationServerandtoaccessIntegrationServerservicesanddocuments. Youcanusesecuritylogentriestodothefollowing: Tracksecurityeventsthatoccurred,whentheyoccurred,andbywhomtheywere performed;includeslogentriesaboutenablingordisablingsecurityauditingin generalandforparticularareas(forexample,authentication). Trackwhethereventscompletedsuccessfullyorfailed.

12

webMethods Audit Logging Guide Version 8.0

1 Concepts

Document Audit Logging

WhenatriggerisconfiguredforexactlyonceprocessingandIntegrationServercannot determinewhetherthecurrentdocumentisacopyofonethetriggerhasalready processed,IntegrationServerlogsthedocumenttotheexternalRDBMSasanindoubt document. IfatransienterroroccurswhileIntegrationServerispublishing,delivering,orretrieving adocumentforatrigger,IntegrationServerlogsthedocumenttotheexternalRDBMSas afaileddocument. IfIntegrationServerhastriedrepeatedlytopublishordeliveradocumentforatrigger fromitsoutboundstoreandfailed,IntegrationServerlogsthedocumenttotheexternal RDBMSasaretriesexceededdocument. Forcompleteinformation,seethePublishSubscribeDevelopersGuide.

Guaranteed Delivery Audit Logging

IfyouconfiguretheguaranteeddeliverycapabilityinIntegrationServer,guaranteed deliveryauditloggingprovidesdataaboutguaranteeddeliverytransactions.Youcanuse guaranteeddeliverylogentriestodothefollowing: Trackwhentransactionsstartandtheircurrentstatus. Seethenamesofguaranteeddeliveryprocessesthatarerunning. Trackwhethertheprocessescompletedsuccessfullyorfailed. ForcompleteinformationaboutIntegrationServersguaranteeddeliverycapability,see AdministeringwebMethodsIntegrationServer.

Business Process Audit Logging

BusinessprocessauditloggingprovidesdataforbusinessprocessesmodeledinDesigner thatrunonIntegrationServers.Youcanusebusinessprocesslogentriesanddatatodo thefollowing: Identifybusinessprocesses. Recordthepaththatbusinessprocessestookatruntime. Trackwhenbusinessprocessesandbusinessprocessstepsstarted,changedstatus, andended. Trackwhetherbusinessprocessesandstepscompletedsuccessfullyorfailed. Resubmitbusinessprocessesatspecifiedsteps.

webMethods Audit Logging Guide Version 8.0

13

1 Concepts

InDesignerandtheMonitoruserinterface,youspecifytheamountandtypeofdatato logforeachbusinessprocessmodelversion.InDesigner,youcanalsospecifyprocess stepinputandoutputdocumentfieldsforwhichtologruntimevalues.IntheMonitor userinterface,youcanalsochoosetologprocesstransitionssoyoucanseethepaththe processtookatruntime.Forinstructionsonsettingupbusinessprocesslogging,seethe DesigneronlinehelpandMonitoringBPM,Services,andDocumentswithBAM:webMethods MonitorUsersGuide. ProcessEngineslogauditdataforbusinessprocesses.TheProcessEngineisapackage installedoneveryIntegrationServerthatrunsbusinessprocesssteps.Fordetailed informationontheProcessEngineandhowitlogsdata,seeAdministeringwebMethods ProcessEngine.

Task Audit Logging

TasksarecreatedinDesignerandrunonMywebMethodsServer.Youcanlogtwotypes ofauditdatafortasks: Foralltasks,youcanusetasklogentriestotrackthefollowing:

Whentasksarequeued. Whenusersacceptorreleasetasks,suspendandresumetasks,andcompleteor canceltasks. Whethertaskscompletedsuccessfully,failed,orexpired.

TaskEngineslogauditdatafortasksandsendthedatatoIntegrationServer.The TaskEngineisafeatureinstalledoneveryMywebMethodsServerthatrunstasks. FordetailedinformationontheTaskEngineandinstructionsonsettinguptask logging,seeWorkingwithBPMTasks:webMethodsTaskEngineUsersGuide. UsersperformtheactionslistedabovefromthetasklistinMywebMethods.For instructionsonperformingactionsontasks,seeWorkingwithBPMTasks:webMethods TaskEngineUsersGuide. Fortasksthatarecalledfrombusinessprocesses,youcanwritebusinessprocesslog entries.Taskscalledfrombusinessprocessesarerunasbusinessprocesssteps,soyou canlogthesamedataforataskthatyoucanlogforanyotherbusinessstep(see BusinessProcessAuditLogging,above).ProcessEngineslogallbusinessprocess entries.

Integration Process Audit Logging

Youcanlogentriesthattracktheprogressandresultsofintegrationprocesses.Todoso, youhavetheservicesthatmakeuptheintegrationprocesscallwebMethodsMonitor builtinservicesthatcreatetheseentries.Forcompleteinformation,seeMonitoringBPM, Services,andDocumentswithBAM:webMethodsMonitorUsersGuide.

14

webMethods Audit Logging Guide Version 8.0

1 Concepts

Mediator Transaction Logging

YoucanlogMediatortransactioneventsproducedbytheLogInvocationruntimepolicy. ThispolicyisenforcedinMediator,butyouidentifytheauditlogasthedestinationfor theeventsinCentraSite.YoucanuseMediatortransactionlogentriestodothefollowing: IdentifytheSOAPsession,virtualservice,andinstanceofMediatoronwhichthe transactioneventsoccurred. IftheIdentifyConsumerpolicyactionisdefinedforthevirtualservice,identifytheIP addressandnameoftheserviceconsumer. Trackwhethereventscompletedsuccessfullyorfailed. Recordthecontentofrequestandresponsepayloadsforservicecalls. Note: YoucanonlylogrequestandresponsepayloadsifyouarewritingMediator transactioneventstoanexternalRDBMS. Forinformationaboutidentifyingtheauditlogasthedestination,seetheCentraSite ActiveSOAdocumentation.ForinformationaboutenforcingpolicieswithMediator,see AdministeringwebMethodsMediator.

Globalization
IfawebMethodsproductisequippedwithwebMethodslanguagepacksandsomeof thoselanguagepackscorrespondtothelanguageusedbytheoperatingenvironmentin whichtheproductisrunning,theproductwritesitslogentriesinthelanguageusedby theoperatingsystem.Iftheproductisequippedwithnolanguagepacksorwith languagepacksthatdonotcorrespondtothelanguageusedbytheoperatingsystem,the productwritesitslogentriesinU.S.English. SupposeyouroperatingenvironmentusesJapaneseasitslanguage.Youhaveinstalled languagepacksincludingtheJapaneseLanguagePacksonIntegrationServer,so IntegrationServerstoresitsownlogentriesinJapanese.Youhavenotinstalledthe JapaneseLanguagepacksonTradingNetworks,soIntegrationServerstoresTrading NetworkslogentriesinU.S.English. Note: EvenifnolanguagepacksareinstalledonthewebMethodsproductandthe productisusingU.S.English,IntegrationServermightstorelogentriesfromexternal sources,suchasdatabasedriversoradapterresources,inthelanguageusedbythe operatingenvironmentinwhichtheproductisrunning.

webMethods Audit Logging Guide Version 8.0

15

1 Concepts

16

webMethods Audit Logging Guide Version 8.0

Setting Up Audit Logging

18 18 24 27

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configure Audit Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Set Up Additional Service Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Perform Additional Processing on Audit Log Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

webMethods Audit Logging Guide Version 8.0

17

2 Setting Up Audit Logging

Overview
IntegrationServerwriteserror,session,service,security,document,guaranteeddelivery, andMediatortransactionauditloggingdatatofilesordatabasetablescollectivelycalled theISCoreAuditLog.ThischapterexplainshowtosetuploggingfortheISCoreAudit Log. IntegrationServerwritesbusinessprocess,integrationprocess,andtaskauditlogging datatodatabasetablescollectivelycalledtheProcessAuditLog.Forinstructionsonsetting uploggingfortheProcessAuditLog,seeMonitoringBPM,Services,andDocumentswith BAM:webMethodsMonitorUsersGuide(businessandintegrationprocessauditlogging) andWorkingwithBPMTasks:webMethodsTaskEngineUsersGuide(taskauditlogging).

Configure Audit Logging

IntegrationServerwritestotheISCoreAuditLogusingauditloggers.Eachtypeof loggingdatahasitsownauditlogger.Forexample,theerrorauditloggerwritestheaudit logentriesforerrors,theserviceauditloggerwritesauditlogentriesforservices,andthe documentloggerwritesdocuments.Eachloggerhasadefaultconfiguration,butyoucan reconfigureit.Youdonothavetodisablealoggertoreconfigureit;youcanreconfigure anenabledlogger.

Start the Logger Configuration

1 InIntegrationServerAdministrator,gototheSettings > Loggingpage.Thepagelists theauditloggerforeachtypeofdata. Note: IfyourIntegrationServerlicensedoesnotincludesecurityauditing, guaranteeddelivery,orMediator,thoseloggersareunavailable. 2 3 IntheLogger List,clickaloggeryouwanttosetup.Thepageshowsallsettingsfor thatlogger. ClickEdit type loggerandsetthefieldsdescribedbelow.

Enable the Logger

IntheEnabledarea,indicatewhetheryouwanttheloggertowriteauditlogentries.The defaultisYesforallloggersexcepttheSecuritylogger.

18

webMethods Audit Logging Guide Version 8.0

2 Setting Up Audit Logging

Choose the Logging Level for the Service Logger

IntheLevelarea,choosethelevelofloggingforservices.ThedefaultisperSvc. Value perSvc Brief Description Letsyousetupcustomizedloggingonaservicebyservicebasisin DeveloperorDesigner. Theloggerwritesstartandfailureorstartandsuccesslogentriesforevery serviceeverytimetheserviceiscalled,eitherdirectly(toplevel)orby anotherservice(nested). SameasBrief,exceptthattheloggeralsowritestheinputpipelineinall cases.

Verbose

Thebriefandverbosevaluesaregloballyappliedtoservices;ifyouchooseoneofthose values,youcannotoverrideitinDeveloperorDesignerforindividualservices. Software AGrecommendsusingthesevaluesonlyinadevelopmentenvironment,when performinganextensivedebuggingeffort.

Choose the Mode for Writing Log Entries

IntheModearea,choosethemodefortheloggertousetowritelogentries.Thedefaultis Asynchronous. Value Synchronous Description Theloggerwriteslogentriesdirectlytothedestination(seeIdentify the Destinationonpage 21).Youmightusesynchronousloggingwhenyou haveanapplicationthatrequiressometypeofauditingtosucceed, andyoudonotwanttoproceedwithoutknowingthattheauditing occurred. Ifsynchronousloggingforanentryfails(forexample,becausethe destinationisunavailable),theloggerswitchestoasynchronousmode forthatentry. Asynchronous Theloggerwriteslogentriestoaqueue,andthequeuelaterwritesthe entriestothedestination.Eachloggerhasitsownqueue.

webMethods Audit Logging Guide Version 8.0

19

2 Setting Up Audit Logging

Indicate Whether to Persist the Queue

IntheGuaranteedarea,indicatewhetherIntegrationServeristopersistthequeueondisk whentheloggerisloggingasynchronously.ThedefaultisNo. Value No Description IntegrationServermaintainsthequeueinmemory.Thisoptionprovides betterloggingperformance.However,ifIntegrationServershutsdown abnormally,thelogentriesinthequeuewillbelost. IntegrationServerpersiststhequeueondisk.Thisoptionissaferbutcan adverselyaffectloggingperformance.

Yes

Specify the Maximum Queue Size

Forasynchronouslogging,intheMaximum Queue Sizefield,specifythemaximumnumber oflogentriestheloggersqueuecanhold.Thedefaultis100000.Specifynumeralsonly; forexample,donotincludecommasorperiods. Chooseavaluethataccommodatesyoursystemsaveragevolumeforlogentries.Ifyour loggingvolumehassuddenspikes,thequeuecanusuallycatchupbywritingthe pendingentriesduringlulls.MakesuretheIntegrationServerhostmachinehasenough diskspaceormemorytoaccommodatethelargestpossiblesizeofthequeueasspecified inthisfield,aswellastherequirementsofotherapplicationstheIntegrationServeris hosting.Iftheloggeriswritingtoadatabase,thequeuesinsertionofloggeddataintothe databaseisconstrainedbythedatabasesavailabilityandconnectionslimit. Ifthequeuereachesitsmaximum,theloggerwritesthelogentriestoafilecalled FailedAudit_yyyymmdd_hhmmss.logintheIntegrationServer_directory/logsdirectory.You canscanthefiletofindeventsthatwerenotlogged. Note: TheServiceloggercannotwritetheinputpipelinetothisfile,andtheMediator loggercannotwriterequestandresponsepayloadstothisfile.

20

webMethods Audit Logging Guide Version 8.0

2 Setting Up Audit Logging

Identify the Destination

IntheDestinationarea,identifywheretheloggeristowritelogentries. Value Database Description TheloggerwriteslogentriestoanexternalRDBMS.Youmustalsosetthe Maximum RetriesandWait Between Retriesfields(seeSpecify the Maximum Retries for Database Destinationonpage 22andSpecify the Wait Between Retriesfor DatabaseDestinationonpage 22). Unlessotherwisenoted,theloggerwritesentriestoafileintheIntegration Server_directory\logsdirectory,asfollows: Logger Error Session Service Security Guaranteed delivery Log File Name WMERROR_yyyymmdd_hhmmss.log WMSESSION_yyyymmdd_hhmmss.log WMSERVICE_yyyymmdd_hhmmss.log WMSECURITY_yyyymmdd_hhmmss.log WMTXIN_yyyymmdd_hhmmss.log(inboundtransactionslog file,onthehostmachineoftheIntegrationServerthatis handlingguaranteeddeliveryrequests) WMTXOUT_yyyymmdd_hhmmss.log(outboundtransactions file,onthehostmachineofanIntegrationServerthatis submittingguaranteeddeliveryrequests) Mediator transaction MED_EVENT_TXN_yyyymmdd_hhmmss.log Note: TheloggerwritesthefiletotheIntegration Server_directory/logs/Mediatordirectory.

File

Note: ThisvalueisunavailablefortheDocumentandProcessEngine loggers,whichcanonlywritetoanexternalRDBMS. ThefirsttimeyoustartIntegrationServer,thesettingsdependonwhethertheISCore AuditLogfunctioninIntegrationServerconnectstoanexternalRDBMS,asfollows: Ifitdoesnotconnect,theError,Session,Service,Security,GuaranteedDeliveryand MediatortransactionloggersaresettoFile.(TheDocumentandProcessEngine loggerscanonlywritetoRDBMSandsoareunavailable.) Ifitconnects,allloggersaresettoDatabase.However,iftheISCoreAuditLog functioncannotconnectwhenyoustartIntegrationServerforasubsequentsession (forexample,becausetheRDBMSisunavailable),theloggersareresettoFile,andyou willhavetosetthemtoDatabaseagainyourself. Note: TheISCoreAuditLogwasconfiguredduringorafterIntegrationServer installation.ForMediatortransactionevents,theMediatorEventsdatabase componentwasinstalled.Fordetails,seetheSoftware AGInstallationGuide.

webMethods Audit Logging Guide Version 8.0

21

2 Setting Up Audit Logging

Specify the Maximum Retries for Database Destination

IfthedestinationissettoDatabase,intheMaximum Retriesfield,specifythenumberof timesthelogger(synchronous)orqueue(asynchronous)shouldtrytoconnecttothe database.Thedefaultis3retries. Forsynchronouslogging,theloggertriestowriteeachlogentryuptothenumberof timesspecified,thenswitchestoasynchronouslogging. Forasynchronouslogging,thequeuetriestowriteeachlogentryuptothenumberof timesspecified,thenwritestheentrytoafilecalled FailedAudit_yyyymmdd_hhmmss.logintheIntegrationServer_directory/logsdirectory. Youcanscanthefiletofindeventsthatwerenotlogged. Note: TheServiceloggercannotwritetheinputpipelinetothisfile,andthe Mediatorloggercannotwriterequestandresponsepayloadstothisfile.

Specify the Wait Between Retries for Database Destination

IfthedestinationissettoDatabase,intheWait Between Retriesfield,specifythenumberof secondstheloggershouldwaitbetweentriestoconnecttotheRDBMS.Thedefaultis5 seconds.

22

webMethods Audit Logging Guide Version 8.0

2 Setting Up Audit Logging

Additional Fields for the Security Logger

IfyouareconfiguringtheSecuritylogger,settheadditionalfieldsbelow.

Choose Whether to Generate Auditing Data on Startup

Bydefault,thesecurityloggerwritessecurityeventsthatoccurafterIntegrationServer hascompleteditsstartupsequence.IntheGenerate Audit Data on Startuparea,choose whethertheloggershouldalsowritesecurityeventsthatoccurduringIntegration Serversstartupsequence.ThedefaultisNo. Note: Writingsecurityeventsduringstartupmakesthestartupsequencesignificantly slower.

Choose When to Generate Security Auditing Data

IntheGenerate Auditing Data onarea,choosewhenIntegrationServershouldlogsecurity events.ThedefaultisSuccess or Failure. Value Success Failure Success or Failure Description Onlywhentheeventcompletessuccessfully. Onlywhentheeventfails. Regardlessofoutcome.

Choose Security Areas to Audit

IntheSecurity Areas to Auditarea,selecttheareasforwhichtologsecurityrelatedevents.

Complete the Logger Configuration

Whenyouaredonesettingsthefields,clickSave ChangesandthenrestartIntegration Server.

webMethods Audit Logging Guide Version 8.0

23

2 Setting Up Audit Logging

Set Up Additional Service Logging

IfyouselectedperSvcloggingfortheServiceslogger,youmustsetupcustomizedlogging inDeveloperorDesignerforeveryserviceyouwanttoaudit. YoucanaugmentanytypeofserviceloggingbyusingIntegrationServerbuiltinservices towriteuserdefinedmessagestotheIntegrationServerserverlogortheISCoreAudit Log.

Set Up Customized Service Logging in Developer or Designer

Foreachservice,youcanchoosethefollowingloggingoptions.Forcompleteinformation onworkingwithservices,seeDevelopingIntegrationSolutions:webMethodsDeveloperUsers GuideorDesigneronlinehelp. Whethertologand,ifso,when,asfollows:

Everytimetheserviceiscalled,whetherbyaclientrequest,trigger,oranother service. Onlywhentheserviceiscalledbyaclientrequestoratrigger(thatis,whenthe serviceisatoplevelservice).

Thestatusesintheservicesexecutiononwhichtologwhentheservicefails,failsor succeeds,orstartsandfailsorsucceeds. Whethertostoretheservicesinputpipelineand,ifso,alwaysoronlywhenanerror occurs.Storingtheinputpipelineallowsyoutoresubmittheservicelaterifnecessary. Note: Youcanonlyloginputpipelinesifyouarewritingservicedatatoanexternal RDBMS. Toimproveserviceloggingperformance,dothefollowing: Setupcustomizedloggingfortoplevelservicesonly.Avoidloggingnestedservices. Logonservicefailureorlogonservicefailureorsuccess.Onlychoosetologon servicefailureorsuccessandstartwhenyouneedthegreatestpossiblequalityof service. Loggingthepipelinecannegativelyaffectperformance,especiallyifthepipeline containslargeobjects,becauseIntegrationServerhastomakeacopyofthepipeline everytimetheserviceisinvoked.Storetheinputpipelineonlyfortoplevelservices, andonlywhenabsolutelynecessary(forexample,onfailureonly).Removeall unnecessarydatafromthepipelinetominimizethevolumeofdatatostore. TheauditlogentriesthattheProcessEnginecanwriteforbusinessprocessstepsthat runservicesconveythesameinformationastheauditlogentriesyoucanwritefor services.Inaddition,theProcessEnginecanstoretheinputpipelineforservicesthat

24

webMethods Audit Logging Guide Version 8.0

2 Setting Up Audit Logging

arerunbyprocesssteps.Toimproveloggingperformance,avoidloggingthesame informationtwicebycoordinatingauditloggingforservicesthatareinvokedby processsteps. Note: Whencoordinatinglogging,keepinmindthatwhenaserviceisrunbya processstep,itisactuallycalledbyawrapperservice,makingitanestedservice ratherthanatoplevelservice.

Write User-Defined Messages or Input Pipelines to the Integration Server Server Log
YoucanhaverunningservicespostuserdefinedprogressmessagestotheIntegration Serverserverlog.Forexample,youmighthaveaservicepostmessagestoindicatethat certainpiecesofcoderansuccessfully,ortorecordruntimevaluesforvariablessoyou canseehowthevalueschangedastheserviceran.Todoso,youmaketheservicecallthe IntegrationServerbuiltinservicepub.flow:debugLog. YoucanalsohaverunningserviceswriteinputpipelinestotheIntegrationServerserver log.Todoso,youmaketheservicecalltheIntegrationServerbuiltinservice pub.flow:tracePipeline. Youcanwritethisinformationregardlessofhowyouhaveconfiguredserviceaudit logging.Forinstructionsonusingtheseservices,seethewebMethodsIntegrationServer BuiltInServicesReferenceandDevelopingIntegrationSolutions:webMethodsDeveloperUsers Guide.ForinformationontheIntegrationServerserverlog,seeAdministeringwebMethods IntegrationServer.

Write User-Defined Messages to the IS Core Audit Log

IfyouarestoringserviceauditdatainanexternalRDBMS,andyouhaveinstalledthe ProcessEngine,youcanhaveservicespostuserdefinedprogressmessagestotheISCore AuditLog.Forexample,youmighthaveaservicepostmessagestoindicatethatcertain piecesofcoderansuccessfully,ortorecordruntimevaluesforvariablessoyoucansee howthevalueschangedastheserviceran.Todoso,youmaketheservicecallthe IntegrationServerbuiltinservicepub.prt.log:logActivityMessages. Note: YouviewthesemessagesinMonitor. Thepub.prt.log:logActivityMessagesserviceisstoredintheWmPRTpackage.Itsinputand outputparametersaredescribedbelow. Input Parameters FullMessage BriefMessage StringOptional.CompletemessagetorecordintheISCoreAuditLog. Themessagecanbeupto1024bytes. StringOptional.Shortenedversionofthefullmessage.Themessage canbeupto240bytes.

webMethods Audit Logging Guide Version 8.0

25

2 Setting Up Audit Logging

EntryType

StringTypeofmessage. Set to...

Message Warning

To indicate that the message is... Informational.Noactionisneeded. Awarningmessage.Theservicecancompletesuccessfully evenifthecircumstancecausingthewarningisnot addressed. Anerrormessage.Anerrormessagewillnotstopthe serviceorputitinanerrorstate.However,theservice cannotcompletesuccessfullyuntilthecircumstance causingtheerrorisresolved.Thisisthedefault.

Error

Output Parameters None.

Send Messages About Service Failures to Email Addresses

YoucanconfigureIntegrationServertoautomaticallysendnotificationstoaspecified emailaddresseachtimeaservicefails.Theseservicefailuresarethestacktrackdata writtentotheerrorlog.Inadevelopmentenvironment,youmightdirectthesemessages tothedeveloper.Inaproductionenvironment,youmightdirectthemtotheIntegration Serveradministrator. To send messages about service failures to e-mail addresses 1 2 3 InIntegrationServerAdministrator,gototheSettings > ResourcespageandclickEdit Resource Settings. IntheSMTP Serverfield,typetheservernameorIPaddressoftheSMTPservertouse tosendthemessages. IntheInternal Emailfield,typetheemailaddresstowhichtosendmessagesabout criticallogentries.Typically,youwouldspecifytheemailaddressfortheIntegration Serveradministrator. IntheService Emailfield,typetheemailaddresstowhichtosendmessagesabout servicefailures.Inadevelopmentenvironment,youmightdirectthesemessagesto thedeveloper.Inaproductionenvironment,youmightdirectthesemessagestothe IntegrationServeradministrator. Bydefault,IntegrationServerusescharactersetUTF8forthemessages.Ifyouwant touseadifferentcharacterset,identifythecharactersetintheDefault Email Charset field. ClickSave Changes.

26

webMethods Audit Logging Guide Version 8.0

2 Setting Up Audit Logging

Bydefault,IntegrationServerconnectstoport25onthespecifiedSMTPserver.Also bydefault,whensendingamessage,IntegrationServerprovidesitsownaddress(the FromAddress)asIntegrationServer@localhost,wherelocalhostistheIntegration Serverhostmachine.Ifyouwanttochangeeitheroftheseproperties,followthese steps: a InIntegrationServerAdministrator,gototheSettings > Extendedpage.Integration ServerAdministratordisplaysalistofIntegrationServerconfigurationproperties youcanchangeusingthismethod. ClickEdit Extended Settings.IntheExtended Settingsbox,setthepropertiesas follows: To change this... SMTPserverport IntegrationServers FromAddress c Set this...
watt.server.smtpServerPort=port to use watt.server.email.from=new From Address to use

ClickSave Changes,thenrestartIntegrationServer.

Perform Additional Processing on Audit Log Entries

Ifyouwanttoperformadditionalprocessingonlogentries,youcancreateanevent handler.Forexample,youcouldcreateaneventhandlerthatsendsservicelogentriesto anotherlog,suchastheEventLogonaWindowssystem.Forinformation,seethe webMethodsIntegrationServerBuiltInServicesReferenceandDevelopingIntegration Solutions:webMethodsDeveloperUsersGuide.

webMethods Audit Logging Guide Version 8.0

27

2 Setting Up Audit Logging

28

webMethods Audit Logging Guide Version 8.0

Viewing Audit Log Data

30 31 34 36

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Audit Logs in Integration Server Administrator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . View the Mediator Transaction Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Change the Log Displays . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

webMethods Audit Logging Guide Version 8.0

29

3 Viewing Audit Log Data

Overview
YoucanuseIntegrationServerAdministrator,Monitor,orbothtoviewauditlogdata. Audit Log Data Documents Errors Guaranteeddelivery Security Services View using Integration Server Administrator? No Yes Yes Yes Allexceptloggedinput pipelinesanduserdefined messagesintheISCoreAudit Log Yes No No No No View using Monitor? Yes Errorsforloggedservices, documents,andprocesses No No Yes

Sessions Businessprocesses Tasks* Integrationprocesses Mediator transaction**

No Yes No Yes No

*Forinformationonviewingloggeddatafortasks,seeWorkingwithBPMTasks:webMethodsTaskEngineUsersGuide. **ToviewloggeddataforMediatortransactions,youmustopenthelogfilemanuallyorlookupthedatainthe MED_EVENT_TXNtable.Formoreinformation,seeViewtheMediatorTransactionLogsonpage 34.

Monitorlinksrelatedloggeddatainitsdisplay;forexample,forabusinessprocessor businessprocessstep,youcanseeallrelevantservice,error,anduserdefinedmessage entries.YoucanalsoperformavarietyofactionsfromMonitor;forexample,ifyou loggedinputpipelinesforservices,youcaneditthepipelinesandresubmittheservices, andyoucanarchiveordeleteauditlogdata.Forcompleteinformation,seeMonitoring BPM,Services,andDocumentswithBAM:webMethodsMonitorUsersGuide. IntegrationServerAdministratordoesnotlinkrelateddataforyou.Youmustlook throughtheindividuallogsforrelateddatayourself.Thischapterexplainshowtoview auditlogsinIntegrationServerAdministratorandchangevariousaspectsofthelog displays.

30

webMethods Audit Logging Guide Version 8.0

3 Viewing Audit Log Data

View the Audit Logs in Integration Server Administrator

Bydefault,IntegrationServerAdministratordisplaysthemostrecententriesinthelogs.

View the Error Log

InIntegrationServerAdministrator,gototheLogs > Errorpagetoviewtheerrorlog.The fieldsintheerrorlogarelistedbelow. Column Timestamp Service Name Service Stack Error Message Stack Trace Details Dateandtimetheentrywaswrittentothelog. Nameoftheserviceinwhichtheerroroccurred. Parentservicesfortheserviceinwhichtheerroroccurred. Messagethatdescribestheerrorthatoccurred. Tracethatshowsthecallsequenceleadingtotheerror.Toexpand thedisplayofstacktracedata,selecttheExpand Stack Trace Data checkboxintheLog display controlsareaandclickRefresh. ContextinformationMonitorusestoconnectrelatedentriesfrom differentlogs.

Root Context Parent Context Current Context

View the Guaranteed Delivery Log

InIntegrationServerAdministrator,gototheLogs > Guaranteed Deliverypagetoviewthe guaranteeddeliverylog.Thefieldsintheguaranteeddeliverylogarelistedbelow. Column Timestamp Status Message Error Message Root Context Parent Context Current Context Details Dateandtimetheentrywaswrittentothelog. Currentstatusofthetransaction(StartorStop). Nameoftheguaranteeddeliveryprocessthatisrunning. Ifthetransactionfailed,messagethatdescribestheerrorthat occurred. ContextinformationMonitorusestoconnectrelatedentriesfrom differentlogs.

IntegrationServerwritesguaranteeddeliverylogentriestotwologs,oneforinbound transactionsandoneforoutboundtransactions.Bydefault,IntegrationServer Administratordisplaysthemostrecententriesintheinboundguaranteeddelivery transactionslog.Youcanswitchtothelogentriesintheoutboundtransactionslogby clickingView Guaranteed Delivery Outbound Log.

webMethods Audit Logging Guide Version 8.0

31

3 Viewing Audit Log Data

View the Security Log

InIntegrationServerAdministrator,gototheLogs > Securitypagetoviewthesecurity log.Thefieldsinthesecuritylogarelistedbelow. Column Timestamp Message Server Id Details Dateandtimetheentrywaswrittentothelog. Textthatexplainsthesecurityeventthatoccurred. IntegrationServeronwhichthesecurityeventoccurred.Thisis necessaryinformationwhenIntegrationServersareclusteredand writingtoasharedRDBMS.TheIDcanbeDNSname:portor IPaddress:port. Note: TheportisalwaystheIntegrationServersprimaryport,even iftheeventoccurredonadifferent(nonprimary)Integration Serverport. Client Id User Id Security Event Type NetworkIPaddressfortheclientfromwhichthesecurityevent wasperformed. IntegrationServerusernameunderwhichtheclientconnectedto performthesecurityevent. Categoryforthesecurityeventthatoccurred(authentication, authorization,certificates,configuration,andsoon).

View the Service Log

InIntegrationServerAdministrator,gototheLogs > Servicepagetoviewtheservicelog. Thefieldsintheservicelogarelistedbelow. Column Timestamp User Id Server Id Details Dateandtimetheentrywaswrittentothelog. IntegrationServerusernameoftheclientthatcalledtheservice thatgeneratedthelogentry. IntegrationServeronwhichtheservicethatgeneratedthelog entryran.ThisisnecessaryinformationwhenIntegrationServers areclusteredandwritingtoasharedRDBMS.TheIDcanbe DNSname:portorIPaddress:port. Note: TheportisalwaystheIntegrationServersprimaryport,even ifaserviceexecutedonadifferent(nonprimary)Integration Serverport. Service Name Servicethatgeneratedthelogentry.

32

webMethods Audit Logging Guide Version 8.0

3 Viewing Audit Log Data

Column Resubmittable

Details WhetheryoucanresubmittheservicefromMonitor.Youcan resubmitaserviceifitisatoplevel(asopposedtonested)service andtheservicesinputpipelinewaslogged. Currentstatusoftheservice(Started,Retried,Ended,orFailed). Lengthoftimetheserviceran(inmilliseconds). Iftheservicefailed,messagethatdescribestheerrorthatoccurred. ContextinformationMonitorusestoconnectrelatedentriesfrom differentlogs.

Status Duration Error Message Root Context Parent Context Current Context

ForinformationaboutviewingservicelogentriesinMonitor,seeMonitoringBPM, Services,andDocumentswithBAM:webMethodsMonitorUsersGuide.

View the Session Log

InIntegrationServerAdministrator,gototheLogs > Sessionpagetoviewthesessionlog. Thefieldsinthesessionlogarelistedbelow. Column Timestamp Server Id Details Dateandtimetheentrywaswrittentothelog. IntegrationServeronwhichthesessionoccurred.Thisis necessaryinformationwhenIntegrationServersareclusteredand writingtoasharedRDBMS.TheIDcanbeDNSname:portor IPaddress:port. Note: ThefieldliststheIntegrationServersprimaryport,evenif thesessionoccurredonadifferent(nonprimary)Integration Serverport. User Id Client IP IntegrationServerusernameunderwhichtheclientconnectedfor thesession. IPaddressofthemachinefromwhichtheclientrequestwas submitted.Thewordsystemappearsforsessionrequestsfrom IntegrationServerforoperationssuchasrunningascheduled serviceorrefreshingthedisplay. Currentstatusofthesession(Started,Expired,orEnded). Numberofservicestheclienthascalledsofarduringthesession. Durationofthesession,inmilliseconds. Astringtheservergeneratestouniquelyidentifyeachsession.

Session State RPCs Age Session ID

webMethods Audit Logging Guide Version 8.0

33

3 Viewing Audit Log Data

View the Mediator Transaction Logs

YoucannotviewlogsforMediatortransactionsusingtheIntegrationServer AdministratororMonitor.YoucanviewlogsforMediatortransactionsonlybymanually openingeither: The log file (the flat file). Youcanopenthelogfileusingatexteditor.Thelogfileis locatedintheIntegrationServer_directory/logs/Mediatordirectory. The audit table. YoucanopentheaudittableusingyourRDBMSeditor.Thetablename isMED_EVENT_TXN.Formoreinformation,seethedocumentationforyour RDBMSeditor. ThecolumnsintheMediatortransactionlogarelistedbelow. Flat File Column Name Session ID Service Name Target Name Consumer Database Column Name SESSION_ID SERVICE_NAME TARGET_NAME CONSUMER_NAME Details SOAPinvocationsession. Nameofthevirtualservicethatgenerated thelogentry. NameoftheMediatorinstancereportingthe event. Serviceconsumernameassociatedwiththe call.ThisisincludedwhenanIdentify Consumerpolicyactionisdefinedforthe virtualservice. IPaddressoftheserviceconsumer.Thisis includedwhenanIdentifyConsumerpolicy actionisdefinedforthevirtualservice. Currentstatusoftherequest(Successor Failure). Responsepayload.Thisfieldiswrittenonly ifyouusetheMediatordatabasecomponent. ItcannotbewrittentotheMediatorlogfile. Requestpayload.Thisfieldiswrittenonlyif youusetheMediatordatabasecomponent.It cannotbewrittentotheMediatorlogfile. Timeinmillisecondsrequiredtoinvokethe serviceprovider.Thistimeincludesthe overheadincurredbyMediator.Overhead includessecurityoverheadforencryption, decryption,andloadbalanceretries.

Consumer IP

CONSUMER_IP

Request Status Response Payload

STATUS RESPONSE

Request Payload

REQUEST

Total Roundtrip Time

TOTAL_TIME

34

webMethods Audit Logging Guide Version 8.0

3 Viewing Audit Log Data

Flat File Column Name Provider Roundtrip Time Insert Timestamp Timestamp Root Context Id Parent Context Id Context Id Message Id Server Id

Database Column Name PROVIDER_TIME

Details TimeinmillisecondsrequiredforMediator toinvokeaserviceproviderandreceivea response. Dateandtimetheentrywaswrittentothe log.ThisiscalculatedbytheRDBMS. Dateandtimetheauditentrywascreated. ThisiscalculatedbytheIntegrationServer. Globallyuniqueidentifier(GUID)forthe Mediatortransactionevent.

INSERTTIMESTAMP AUDITTIMESTAMP ROOTCONTEXTID PARENTCONTEXTID CONTEXTID MSGID SERVERID

GUIDusedastheprimarykeyfortherow. IDofthehostmachinethatproducedthe auditrecord.TheIDcanbeDNSname:portor IPaddress:port. Note: TheportisalwaystheIntegration Serversprimaryport,eveniftheevent occurredonadifferent(nonprimary) IntegrationServerport.

webMethods Audit Logging Guide Version 8.0

35

3 Viewing Audit Log Data

Change the Log Displays

YoucanchangethedisplayoflogpagesinIntegrationServerAdministrator.Youcan: Displayloggeddataindifferentlanguages. Changevariousaspectsofthedisplayforalllogspermanently. Changevariousaspectsofaparticularlogsdisplaytemporarily.

Display Logged Data in Different Languages

Note: ThechangesinthissectionwillalsoaffecttheIntegrationServerserverlog, describedinAdministeringwebMethodsIntegrationServer. Thissectionappliesonlytologgeddatathatisstoredinfiles. IfyouwanttoviewloggeddatainalanguageotherthanEnglish,youmighthaveto adjustyourtexteditororcommandshell.IntegrationServerwritesthefilesinthe UnicodeUTF8encoding.ThesefilesdonotcontainaByteOrderMark(BOM,Unicode characterU+FEFF).IfthefilescontainnonASCIIdata,suchaslogentrieswritteninnon U.S.English,youmighthavetoadjustthecharacterencodingusedbyyourtexteditoror commandshellsoyoucanviewthelogentries. OnaUNIXsystem,youcanadjustthecharacterencodingbychangingyourlocalesetting (LC_ALL)totheappropriateUTF8encodedlocales.Forexample,toviewJapanese charactersinatexteditororcommandshellonaSolarissystem,youmightchangeyour localesettingtoja_JP.UTF8. OnaWindowssystem,becausethefilesdonotcontaintheBOMcharacter,texteditors suchasNotepadmightnotdetecttheUTF8encodingcorrectly.Adjusttheencoding manuallysoyoucanviewthefiles.Toviewthelogsinthecmdshell,youcanusethe commandchcp 65001.

36

webMethods Audit Logging Guide Version 8.0

3 Viewing Audit Log Data

Change the Display Permanently for All Logs

Bydefault,thenumberoflogentriesshownforlogsinIntegrationServerAdministrator is35andtherefreshintervalis90seconds.Youcanchangethesedefaults. Important! Significantlyincreasingthenumberofentriesdisplayedordecreasingthe refreshintervalcanslowsystemperformance.Changingthesepropertieswillalso affecttheIntegrationServerserverlog,describedinAdministeringwebMethods IntegrationServer. Alsobydefault,thetimestampsinthelogentriesdefaulttolocaltimeanddisplaythe timezone.YoucanchangethistotheCoordinatedUniversalTime(UTC)thatisrecorded fortheentriesintheISCoreAuditLogdatabasecomponent. 1 InIntegrationServerAdministrator,gototheSettings > ExtendedpageandclickShow and Hide Keys.IntegrationServerAdministratordisplaysalistoftheIntegration Serverconfigurationpropertiesyoucanchangeusingthismethod. Selectthecheckboxnexttoeachpropertyyouwanttochange,asfollows: If you want to change... Numberoflogentriesshown Refreshintervalforlogdisplay TimestampforlogentriestoUTC 3 4 Select this property... watt.server.log.maxEntries watt.server.log.refreshInterval watt.server.audit.displayLogs.convertTime

ClickSave Changes.IntegrationServerAdministratordisplaystheselectedproperties intheExtended Settingsbox. ClickEdit Extended Settings.IntheExtended Settingsbox,setthepropertiesasfollows: To change... Numberoflogentriesshown Refreshintervalforlogdisplay Timestampforlogentriesto UTC Property watt.server.log.maxEntries watt.server.log.refreshInterval watt.server.audit.displayLogs. convertTime Set to... Positiveinteger Positiveinteger false

ClickSave Changes.Changestakeeffectimmediately.

webMethods Audit Logging Guide Version 8.0

37

3 Viewing Audit Log Data

Change the Display Temporarily for a Particular Log

Tochangethedisplayforaparticularlogtemporarily,usetheLog display controls areaat thetopofthelogdisplaypageandthenclickRefresh.Thechangesremainuntilyou changethemagain,oruntilyoushutdownIntegrationServer,whichevercomesfirst. Note: IfIntegrationServerisstoringloggeddatainanexternalRDBMS,mostlog pagesofferFrom:andTo:fieldsthatletyouchoosetheentriestodisplayusingadate range.However,usingdaterangescanslowsystemperformance.

38

webMethods Audit Logging Guide Version 8.0