View Log Options

When viewing the log, you can choose what logs to see by selecting the following options:

Log option

Description

Event

Select what kind of event to see. For example, Administrators logged in, CA related activities, certificate related activities, End Entity related activities, activities that caused error etc.

CA

Select to view all the logs related to a specific CA.

Module

Select to view all the logs related to a specific module, for example, CA, RA, Public Web, Hard Token, Approval, Service.

Username

Select to view all the logs related to a specific username.

Certificate

Select to view all the logs related to a specific certificate. The certificate is specified by its serial number written in hexadecimal format.

Administrator Certificate

Select to view all the logs created by a specific administrator. The administrator is specified by his certificate serial number written in hexadecimal format.

Comment

Select to view all the logs created with a specific comment.

Administrator details

Select to view all the logs created by a specific type of administrator, his or her IP address or the hexadecimal serial number of the administrator certificate used. There are six types of administrators:

  • An administrator who logs in with a certificate. Typically an administrator who logs into the Admin GUI to perform tasks that need administrator privileges. An administrator who logs in with a certificate is logged with their certificate's serial number and subject DN.

  • An administrator who logs into the public web using only username and password. An administrator who logs into the public web is logged with their IP address.

  • An RA user. The RA user is logged with his IP address.

  • An administrator performing administrative tasks through command line.

  • An administrator performing administrative tasks through batch command line.

  • An internal user performing tasks within EJBCA.

The log can be displayed on the screen or be exported as an XML file

Signing Log Files

The exported log file can be signed by a specific signing certificate of a certificate authority. This will generate a binary (DER) format CMS/PKCS#7 MIME Message (p7m) file.

Specific CMS compatible tools are needed to validate the signature and to 'strip' it off as to allow importing into other tools such as a text editor.

Below is an example using OpenSSL; ca.pem is the PEM format CA certificate and logexport.p7m is the file downloaded from the logging interface.

$ openssl smime -verify -nodetach -CAfile ca.pem -inform DER -in logexport.p7m -out logexport.xml
Verification successful