Click Delete on the Delete dialog box to delete the entry. Click the Apply button on the ACL settings screen to apply the updated ACL.

17 Managing Oracle Virtual Directory Logging and Auditing 17-1 17 Managing Oracle Virtual Directory Logging and Auditing This chapter provides information about managing Oracle Virtual Directory logging and auditing. It contains the following topics: ■ Managing Oracle Virtual Directory Logging ■ Managing Oracle Virtual Directory Auditing

17.1 Managing Oracle Virtual Directory Logging

You can use Oracle Enterprise Manager Fusion Middleware Control and the Oracle WebLogic Scripting Tool WLST as the interface to manage Oracle Virtual Directory logging. This topic includes the following sections on managing Oracle Virtual Directory logging: ■ Managing Oracle Virtual Directory Logging Using Oracle Enterprise Manager ■ Managing Oracle Virtual Directory Logging Using WLST ■ Managing Granular Logging

17.1.1 Managing Oracle Virtual Directory Logging Using Oracle Enterprise Manager

Oracle Enterprise Manager Fusion Middleware Control enables you to list, search, and configure log files across Oracle Fusion Middleware components. You can view log files from Oracle Enterprise Manager Fusion Middleware Control or download log files and view them using another tool. Logging Considerations Specific to Oracle Virtual Directory The following items must supplement the information in the Oracle Fusion Middleware Administrators Guide as they are specific to Oracle Virtual Directory logging: ■ When setting log levels for Oracle Virtual Directory using Oracle Enterprise Manager Fusion Middleware Control, the following log levels do not apply to and have no effect on Oracle Virtual Directory: – NOTIFICATION: 16 CONFIG – TRACE: 16 FINER See: The Oracle Fusion Middleware Administrators Guide for complete information on logging using Oracle Enterprise Manager Fusion Middleware Control. 17-2 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory ■ Log messages are written to the access.log file only when logging is set to NOTIFICATION:1 INFO level. You can increase the log level to ERROR:1 SEVERE or WARNING:1 WARNING to disable information from being written to the access.log file. ■ Audit logs are created for search operations only when the search requests the userPassword attribute. ■ As a general guideline, Oracle recommends setting the log level for Oracle Virtual Directory to the least amount of information as possible for your environment.

17.1.2 Managing Oracle Virtual Directory Logging Using WLST

You can use WLST to perform Oracle Virtual Directory logging management tasks, including: ■ List loggers and levels using listLoggers ■ Get view the level for a logger using getLogLevel ■ Set the level for a logger using setLogLevel ■ List log handlers using listLogHandlers ■ Configure log handlers using configureLogHandler ■ Lists known logs using listLogs ■ Search and display the contents of logs using displayLogs

17.1.3 Managing Granular Logging

Message logging can be controlled using the java.util.logging.Filter implementation class and through the logLevel attributes specified for each adapter configuration in the in adapters.os_xml file. A default implementation of java.util.logging.Filter StringMatchFilter is included in Oracle Virtual Directory. This default implementation supports the following two parameters: ■ StringToBeMatched: Enables you to specify one or more DITStrings. ■ AcceptOnMatch: This boolean enables you to include or exclude the log messages based on matching the list of DITStrings specified. A java.util.logging.Filter implementation and its parameters can be specified in the server.os_xml file. The following is an example logFilter See: For complete information about managing Oracle Virtual Directory logging using WLST, refer to the following documents: ■ Oracle Fusion Middleware Administrators Guide ■ Oracle Fusion Middleware WebLogic Scripting Tool Command Reference Note: To manage the granular message logging functionality described in this section, manually edit the appropriate XML files and then restart the Oracle Virtual Directory server. You cannot manage granular message logging using Fusion Middleware Control or WebLogic Scripting Tool WLST. Managing Oracle Virtual Directory Logging and Auditing 17-3 configuration for StringMatchFilter class to exclude the log messages containing string c=us: logFilters filter className=com.octetstring.vde.util.StringMatchFilter param name=StringToBeMatched value=c=us param name=AcceptOnMatch value=false filter logFilters To include the log messages, set AcceptOnMatch to true and the log messages will contain the DIT specified in the logFilter configuration. To exclude the log messages, set AcceptOnMatch to false and the log messages will not contain the DIT specified. To enable StringMatchFilter, configure it as a filter for either Logger or Handler defined in the ovd-logging.xml file. The following is an example configuration to specify the filter for LogHandler: logging_configuration log_handlers log_handler name=OVDHandler class=oracle.core.ojdl.logging.ODLHandlerFactory filter=com.octetstring.vde.util.StringMatchFilter property ... property log_handler log_handlers loggers ... loggers logging_configuration

17.2 Managing Oracle Virtual Directory Auditing

Oracle Virtual Directory utilizes the Common Audit Framework of the Oracle Application Server 11g infrastructure for compliance, monitoring, and analytics purposes. You can use Oracle Enterprise Manager Fusion Middleware Control and WLST as the interface to the Common Audit Framework to manage Oracle Virtual Directory auditing. This topic contains the following sections on managing Oracle Virtual Directory auditing: ■ Managing Oracle Virtual Directory Auditing Using Fusion Middleware Control ■ Managing Oracle Virtual Directory Auditing Using WLST ■ Understanding Audit Data

17.2.1 Managing Oracle Virtual Directory Auditing Using Fusion Middleware Control

You can use Oracle Enterprise Manager Fusion Middleware Control to perform Oracle Virtual Directory auditing tasks, including managing: ■ Audit policies ■ Audit data collection and storage ■ Audit reports Note: The server.os_xml, ovd-logging.xml, and adapters.os_xml files are located in the following directory: ORACLE_INSTANCE configOVDconfigCOMPONENT_NAME