Novell XDASV2 - ADMINISTRATION GUIDE V1 Instruction Manual

Novell®
www.novell.com
novdocx (en) 16 April 2010
AUTHORIZED DOCUMENTATION
Novell XDASv2 Administration Guide
XDASv2 for eDirectory, IDM, and NMAS
v1
October 15, 2010
Administration Guide

novdocx (en) 16 April 2010
Legal Notices
Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on
the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.
You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the
Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on
exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export
approvals.
Copyright © 2010 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 16 April 2010
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010

Contents 5
Contents
novdocx (en) 16 April 2010
About This Guide 7
1Overview 9
1.1 Key Benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 XDASv2 Server Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2 Configuring XDASv2 11
2.1 Installing eDirectory XDASv2 Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2 Configuring XDASv2 Property File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.3 Configuring XDAS Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2.4 Loading the Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3 iManager Plug-In for XDASv2 13
3.1 System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.2 Installing iManager Plug-In for XDASv2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.3 Using iManager Plug-In Console for XDASv2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
3.4 Configuring XDASv2 Events for Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.4.1 Configuring Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.4.2 Configuring XDASv2 Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.4.3 Configuring XDASv2 Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.5 Securing the iManager Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
4 Troubleshooting 19
A XDASv2 Events 21
A.1 Account Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
A.2 Session Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
A.3 Data Item and Resource Element Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
A.4 Service or Application Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
A.5 Service or Application Utilization Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
A.6 Peer Association Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
A.7 Data Item or Resource Element Content Access Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
A.8 Work Flow Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
A.9 Role Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
A.10 Exceptional Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
A.11 Audit Service Management Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
A.12 Authentication Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
B XDASv2 Schema 33
B.1 XDAS V2 JSON Schema . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
B.2 XDAS Field Definitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
B.3 Outcome Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
B.4 Example of an Event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

6Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010

About This Guide 7
novdocx (en) 16 April 2010
About This Guide
This guide describes how to configure and use XDASv2 to audit Novell eDirectory 8.8 and Novell
Identity Manager.
Chapter 1, “Overview,” on page 9
Chapter 2, “Configuring XDASv2,” on page 11
Chapter 3, “iManager Plug-In for XDASv2,” on page 13
Chapter 4, “Troubleshooting,” on page 19
Chapter A, “XDASv2 Events,” on page 21
Appendix B, “XDASv2 Schema,” on page 33
Audience
This guide is intended for Administrators.
Feedback
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comments feature at the bottom of each page of the
online documentation, or go to www.novell.com/documentation/feedback.html and enter your
comments there.
Documentation Updates
For the most recent version of the XDASv2 Administration Guide, visit the eDirectory Web site
(http://www.novell.com/documentation/edir88).
Additional Documentation
For documentation on eDirectory documentation, see the following:
Novell eDirectory 8.8 Administration Guide (http://www.novell.com/documentation/edir88/
index.html).
Novell eDirectory 8.8 Installation Guide (http://www.novell.com/documentation/edir88/
index.html).
Novell iManager 2.7 Administration Guide (http://www.novell.com/documentation/
imanager27/index.html).

8Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010

Overview
1
9
novdocx (en) 16 April 2010
1
Overview
The XDASv2 specification provides a standardized classification for audit events. It defines a set of
generic events at a global distributed system level. XDASv2 provides a common portable audit
record format to facilitate the merging and analysis of audit information from multiple components
at the distributed system level. The XDASv2 events are encapsulated within a hierarchical
notational system that helps to extend the standard or existing event identifier set.The XDASv2
taxonomy defines a set of fields, of these the primary fields are observer, initiator and target.
XDASv2 events helps you easily understand the audit trails of heterogeneous applications
Section 1.1, “Key Benefits,” on page 9
Section 1.2, “XDASv2 Server Architecture,” on page 9
1.1 Key Benefits
Provides secured audit services for a distributed system.
Defines a set of generic events at a global distributed system level.
Defines a common portable audit record format to help merge and analyse the audit
information from multiple components of a distributed system.
Defines a common format for audit events that analysis applications can use.
Records XDASv2 audit trail.
Configures event preselection criteria and event disposition actions.
Provides a common audit format regardless of the platform on which the XDASv2 service is
running.
Supports heterogeneous environments without the necessity to reengineer the current operating
system or application-specific audit service implementations.
Supports adequate separation of duties for users.
Protects the audit log by making it accessible only to principals acting in specific
administrative or security roles.
1.2 XDASv2 Server Architecture

10 Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010
Figure 1-1 XDASv2 Server Architecture

Configuring XDASv2
2
11
novdocx (en) 16 April 2010
2
Configuring XDASv2
This chapter contains the following information:
Section 2.1, “Installing eDirectory XDASv2 Files,” on page 11
Section 2.2, “Configuring XDASv2 Property File,” on page 11
Section 2.3, “Configuring XDAS Events,” on page 12
Section 2.4, “Loading the Modules,” on page 12
2.1 Installing eDirectory XDASv2 Files
The following eDirectory XDASv2 files are, by default, installed as part of eDirectory.
Linux:
 novell-edirectory-xdaslog
 novell-edirectory-xdaslog-conf
 novell-edirectory-xdasinstrument
Solaris:
 NOVLlog
 NOVLedirxdasin
Windows
 xdasauditds.dlm
 xdaslog.dll
2.2 Configuring XDASv2 Property File
The XDASv2 property file is located at /etc/opt/novell/configuration/
xdasconfig.properties
. You can customize the file according to your requirement.
The following is the content of the XDASv2 property file:
# Set the level of the root logger to DEBUG and attach appenders.
#log4j.rootLogger=debug, S, R
# Defines appender S to be a SyslogAppender.
#log4j.appender.S=org.apache.log4j.net.SyslogAppender
# Defines location of Syslog server.
#log4j.appender.S.Host=localhost
#log4j.appender.S.Port=port
# Specify protocol to be used (UDP/TCP/SSL)
#log4j.appender.S.Protocol=UDP
# Specify SSL certificate file for SSL connection.
# File path should be given with double backslash.
#log4j.appender.S.SSLCertFile=/etc/opt/novell/mycert.pem

12 Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010
# Minimum log-level allowed in syslog.
#log4j.appender.S.Threshold=INFO
# Defines the type of facility.
#log4j.appender.S.Facility=USER
# Layout definition for appender Syslog S.
#log4j.appender.S.layout=org.apache.log4j.PatternLayout
#log4j.appender.S.layout.ConversionPattern=%c : %p%m%n
# Defines appender R to be a Rolling File Appender.
#log4j.appender.R=org.apache.log4j.RollingFileAppender
# Log file for appender R.
#log4j.appender.R.File=/var/opt/novell/eDirectory/log/xdas-events.log
# Max size of log file for appender R.
#log4j.appender.R.MaxFileSize=100MB
# Set the maximum number of backup files to keep for appender R.
# Max can be 13. If set to zero, then there will be no backup files.
#log4j.appender.R.MaxBackupIndex=10
# Layout definition for appender Rolling log file R.
#log4j.appender.R.layout=org.apache.log4j.PatternLayout
#log4j.appender.R.layout.ConversionPattern=%d{MMM dd HH:mm:ss} %c : %p%m%n
Table 2-1 XDASv2 Property File
2.3 Configuring XDAS Events
See Chapter 3, “iManager Plug-In for XDASv2,” on page 13 for information on configuring
XDASv2 events for eDirectory.
2.4 Loading the Modules
After you have configured the XDASv2 events, run the following command to load the XDASv2
modules:
Linux/Solaris: Run the following command to load the XDASv2 modules:
ndstrace -c "load xdasauditds"
Windows: Run ndscons.exe , select xdasauditds option from the list of available modules,
then click Start.
If you have installed NMAS and enabled NMAS auditing, the NMAS server automatically loads the
XDASv2 library.
Options ID Description
Syslog Appender S
Rolling File Appender R

iManager Plug-In for XDASv2
3
13
novdocx (en) 16 April 2010
3
iManager Plug-In for XDASv2
You can manage and configure eDirectory for XDASv2 auditing by using Novell iManager. Novell
iManager is a Web-based application that is used to manage, maintain, and monitor Novell
eDirectory through wired and wireless devices.The XDASv2 iManager plug-in is included with the
eDirectory installation.
NOTE: iManager plug-in is only for enabling and configuring XDASv2 events for eDirectory. This
plug-in does not apply to NMAS and Identity Manager.
Section 3.1, “System Requirements,” on page 13
Section 3.2, “Installing iManager Plug-In for XDASv2,” on page 13
Section 3.3, “Using iManager Plug-In Console for XDASv2,” on page 13
Section 3.4, “Configuring XDASv2 Events for Auditing,” on page 14
Section 3.5, “Securing the iManager Connection,” on page 18
3.1 System Requirements
Installing and using the Novell Audit iManager Plug-in requires iManager 2.7.4. See Novell
iManager Product Page (http://www.novell.com/products/consoles/) for requirements and download
instructions.
3.2 Installing iManager Plug-In for XDASv2
iManager plug-in for XDASv2 is, by default, installed with eDirectory.
3.3 Using iManager Plug-In Console for XDASv2
1Log in to the iManager console.
1a Open iManager from a Web browser, using the following URL:
https://ip_address_or_DNS/nps/iManager.html
where ip_address_or_DNS is the IP address or DNS name of your iManager server.
For example:
http://192.168.0.5/nps/iManager.html
1b Log in using your username and password.
In iManager, you have access only to those roles for which you have assigned rights. To
have full access to all Novell iManager features, you must log in as a user with Admin
rights to the tree.
For more information, see Accessing iManager (http://www.novell.com/documentation/
imanager27/imanager_admin_273/data/bsxrjzp.html)
2Select Audit Configuration from Roles and Tasks.
3Specify the NCP Server.

14 Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010
Click the Object Selector icon to browse for the NCP server.
4Click OK.
The XDASv2 Audit page is displayed. Continue with Section 3.4.1, “Configuring Events,” on
page 14.
3.4 Configuring XDASv2 Events for Auditing
Section 3.4.1, “Configuring Events,” on page 14
Section 3.4.2, “Configuring XDASv2 Roles,” on page 16
Section 3.4.3, “Configuring XDASv2 Accounts,” on page 17
3.4.1 Configuring Events
Use this page to configure XDASv2 events.

iManager Plug-In for XDASv2 15
novdocx (en) 16 April 2010
Figure 3-1 XDASv2 Events
1You can select both or either of the following components for XDASv2 event settings:
DS: Specifies an eDirectory™ object. For each DS object, a corresponding LDAP object
exists.
LDAP: Specifies an LDAP object.
2Log event values:
The events are logged into a text file. Event values with more than 768 bytes in size are
considered as large values. You can log events of any size.
Log Large Values: Select this option to log events that are more than 768 bytes in size.
Do Not Log Large Values: Select this option to log events that are less than 768 Byte in size.
If the event size is more, the event value is truncated and saved to the log file.
3Specify the following based on your requirement:

16 Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010
For more information on events, see Chapter A, “XDASv2 Events,” on page 21.
3.4.2 Configuring XDASv2 Roles
Configure XDASv2 roles for the objects for which you want to collect XDASv2 events. You can
select object classes and set attributes for them.
Options Description
Account Management Events Select the account management events for which you
want to log events. You can log events to create, delete,
enable, disable, and query accounts, and also to modify
account security token.
Session Management Events Select the session management events for which you
want to log events. You can log events to create,
terminate, and modify sessions.
Data Item or Resource Element
Management Events
Select the data item or resource element management
events for which you want to log events. You can log
events to create and delete data items and to modify
and query data item attributes.
Service or Application Management
Events
Select the service or application management events
for which you want to log events. You can log events for
enabling and disabling services.
Service or Application Utilization Events Select the service or application utilization events for
which you want to log events. You can log events to
start and terminate services, and to modify process
contexts.
Peer Association Management Events Select the peer association events for which you want to
log events. You can log events for creating and
terminating peer associations.
Data Item or Resource Element Content
Access Events
Select the data item or resource element content
access events for which you want to log events. You can
log events to create, terminate, and modify data item
associations.
Role Management Events Select the role management events for which you want
to log events. You can log events to create, delete,
query, and modify roles.
Exceptional Management Events Select the exceptional management events for which
you want to log events. You can log events to start and
shut down systems and also to back up and recover
data stores.
Authentication Management Events Select the authentication management events for which
you want to log events. You can log events to
authenticate sessions and create access tokens.
Operational Events Select the operational management events for which
you want to log events. You can log events to generate
eDirectory operation IDs.

iManager Plug-In for XDASv2 17
novdocx (en) 16 April 2010
Figure 3-2 XDASv2 Roles
1Select object classes for which you want to collect events.
2Set any number of attributes for the object classes you have selected. Click the attribute and
click the arrow to add the attribute to the selected list of attributes.
3Click OK after you add the attributes. Click Apply to confirm the modifications.
The selected attributes appear in this list.
3.4.3 Configuring XDASv2 Accounts
Configure XDASv2 accounts by selecting available object classes. Click OK to exit the application.

18 Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010
Figure 3-3 XDASv2 Accounts
1Select object classes from the list for which you want to collect events.
2Selected object classes appear in this list.
3Click Apply after adding the object classes.
3.5 Securing the iManager Connection
When you log in to iManager, your connection is automatically forwarded to a secure port. The
default HTTPS port for iManager is 443.
For more information on running iManager over an SSL connection, see “Configuring and Using
SSL for LDAP Connections” in the iManager Administration Guide. (http://www.novell.com/
documentation/imanager27)

Troubleshooting
4
19
novdocx (en) 16 April 2010
4
Troubleshooting
Keep in mind the following information when you install Novell XDASv2:
Initializing XDAS module error
Possible Cause: You cannot connect to the server IP or the port number mentioned in
xdasconfig.properties file when you initialize the XDASv2 module. It displays
the followng message:
log4cxx: Could not instantiate TCP Socket to <IP>. All
logging will FAIL.
log4cxx: IO Exception : status code = 111
Action: To work around this issue,
1Check whether the sever IP or the port number given in the
xdasconfig.properties file is correct.
2Check whether the remote server is reachable and is accepting the
connection on the given port.
3Reload the xdasauditds module.
The TCP connection is lost
Possible Cause: If the remote server is not reachable or does not accept connection on the given
port, the following error is displayed:
log4cxx: Detected problem with TCP connection to <IP>. All
logging will FAIL.
log4cxx: IO Exception : status code = 32
Action: To work around this issue:
1Check whether remote server is reachable and is accepting the connection
on the given port.
2Reload the xdasauditds module.
The SSL certificate file issue
Possible Cause: The SSL certificate file is either not valid or not present at the given location in
the xdasconfig.properties file. The following error is displayed:
log4cxx: could not load verify locations for SSL
Action: To work around this issue,
1Specify the absolute path to a valid certificate file.
2Reload the xdasauditds module.

20 Novell XDASv2 Administration Guide
novdocx (en) 16 April 2010
The network connection to the remote server is lost
Source: The following error is displayed:
log4cxx: SSL write failed for <IP>. All logging will FAIL.
Action: To work around this issue,
1Check whether remote server is reachable and is accepting the connection
on the given port.
2Reload the xdasauditds module.
The SSL connection has failed
Possible Cause: The SSL connection fails because either the TLS/SSL handshake fails or a
connection failure occurs. The following error message is displayed:
log4cxx: SSL Connect Failed to <IP>
Action: To work around this issue,
1Check whether remote server is reachable and is listening on the given
port.
2Check whether the certificate is valid.
3Reload the xdasauditds module.