Auditing ContextHandler Elements Configuring the WebLogic Auditing Provider

Configuring WebLogic Security Providers 4-7 All auditing information recorded by the WebLogic Auditing provider is saved in WL_ HOME \yourdomain\yourserver\logs\DefaultAuditRecorder.log by default. Although an Auditing provider is configured per security realm, each server writes auditing data to its own log file in the server directory. You can specify a new directory location for the DefaultAuditRecorder.log file on the command line with the following Java startup option: -Dweblogic.security.audit.auditLogDir=c:\foo The new file location will be c:\foo\yourserver\logs\DefaultAuditRecorder.log. For more information, see Security in the Command Reference for Oracle WebLogic Server. For more information, see Configure Auditing providers in the Oracle WebLogic Server Administration Console Help.

4.7.1 Auditing ContextHandler Elements

An Audit Event includes a ContextHandler that can hold a variety of information or objects. Set the WebLogic Auditing providers Active ContextHandler Entries attribute to specify which ContextElement entries in the ContextHandler are recorded by the Auditing provider. By default, none of the ContextElements are audited. Objects in the ContextHandler are in most cases logged using the toString method. Table 4–2 lists the available ContextHandler entries. Event Severity Rank INFORMATION 1 WARNING 2 ERROR 3 SUCCESS 4 FAILURE 5 Note: Using an Auditing provider affects the performance of WebLogic Server even if only a few events are logged. Table 4–2 Context Handler Entries for Auditing Context Element Name Description and Type com.bea.contextelement. servlet.HttpServletRequest A servlet access request or SOAP message via HTTP javax.http.servlet.HttpServletRequest com.bea.contextelement. servlet.HttpServletResponse A servlet access response or SOAP message via HTTP javax.http.servlet.HttpServletResponse com.bea.contextelement. wli.Message A WebLogic Integration message. The message is streamed to the audit log. java.io.InputStream com.bea.contextelement. channel.Port Internal listen port of the network channel accepting or processing the request java.lang.Integer 4-8 Securing Oracle WebLogic Server com.bea.contextelement. channel.PublicPort External listen port of the network channel accepting or processing the request java.lang.Integer com.bea.contextelement. channel.RemotePort Port of the remote end of the TCPIP connection of the network channel accepting or processing the request java.lang.Integer com.bea.contextelement. channel.Protocol Protocol used to make the request of the network channel accepting or processing the request java.lang.String com.bea.contextelement. channel.Address The internal listen address of the network channel accepting or processing the request java.lang.String com.bea.contextelement. channel.PublicAddress The external listen address of the network channel accepting or processing the request java.lang.String com.bea.contextelement. channel.RemoteAddress Remote address of the TCPIP connection of the network channel accepting or processing the request java.lang.String com.bea.contextelement. channel.ChannelName Name of the network channel accepting or processing the request java.lang.String com.bea.contextelement. channel.Secure Whether the network channel is accepting or processing the request using SSL java.lang.Boolean com.bea.contextelement. ejb20.Parameter[1-N] Object based on parameter com.bea.contextelement. wsee.SOAPMessage javax.xml.rpc.handler.MessageContext com.bea.contextelement. entitlement.EAuxiliaryID Used by a WebLogic Server internal process. weblogic.entitlement.expression.EAuxiliary com.bea.contextelement. security.ChainPrevalidatedBySS L SSL framework has validated the certificate chain, meaning that the certificates in the chain have signed each other properly; the chain terminates in a certificate that is one of the servers trusted CAs; the chain honors the basic constraints rules; and the certificates in the chain have not expired. java.lang.Boolean com.bea.contextelement. xml.SecurityToken Not used in this release of WebLogic Server. weblogic.xml.crypto.wss.provider.SecurityToken com.bea.contextelement. xml.SecurityTokenAssertion Not used in this release of WebLogic Server. java.util.Map com.bea.contextelement. webservice.Integrity{id:XXXXX} javax.security.auth.Subject Table 4–2 Cont. Context Handler Entries for Auditing Context Element Name Description and Type Configuring WebLogic Security Providers 4-9

4.7.2 Configuration Auditing