Audit Events and Auditing Providers

4-12 Securing Oracle WebLogic Server Table 4–5 lists additional message attributes for configuration auditing messages. All configuration auditing messages specify the same values for these attributes.

4.7.5 Audit Events and Auditing Providers

An audit event is an object that Auditing providers can read and process in specific ways. An Auditing provider is a pluggable component that the security realm uses to collect, store, and distribute information about operating requests and the outcome of those requests for the purposes of non-repudiation. If you enable a domain to emit Audit Events, the domain emits the events described in Table 4–6 . All Auditing providers that are configured for the domain can handle these events. All of the events are of severity level SUCCESS and describe the security principal who initiated the action, whether permission was granted, and the object MBean or MBean attribute of the requested action. Note: Each time an authorized user adds, modifies, or deletes a resource, the Management subsystem also generates an Info message with the ID 140009 regardless of whether configuration auditing is enabled. For example: Sep 15, 2005 11:54:47 AM EDT Info Management 140009 Configuration changes for domain saved to the repository. While the message informs you that the domains configuration has changed, it does not provide the detailed information that configuration auditing messages provide. Nor does the Management subsystem generate this message when you invoke operations on resources. Table 4–5 Common Message Attributes and Values Message Attribute Attribute Value Severity Info Subsystem Configuration Audit User ID kernel identity This value is always kernel identity, regardless of which user modified the resource or invoked the resource operation. Server Name AdminServerName Because the Administration Server maintains the configuration data for all resources in a domain, this value is always the name of the Administration Server. Machine Name AdminServerHostName Because the Administration Server maintains the configuration data for all resources in a domain, this value is always the name of the Administration Servers host machine. Thread ID execute-thread The value depends on the number of execute threads that are currently running on the Administration Server. Timestamp timeStamp at which the message is generated. Configuring WebLogic Security Providers 4-13 If you enable the default WebLogic Server Auditing provider, it writes all Audit Events as log messages in its own log file. Other Auditing providers that you create or purchase can filter these events and write them to output repositories such as an LDAP server, database, or a simple file. In addition, other types of security providers can request audit services from an Auditing provider. See Auditing Providers in Developing Security Providers for Oracle WebLogic Server.

4.8 Configuring a WebLogic Credential Mapping Provider