• Get application security done the right way! Detect, Protect, Monitor, Accelerate, and more…

    • IBM WebSphere Deployment Manager Console Access Auditing

    Keeping track of configuration changes is essential for a production environment. This helps you to audit the changes done by the team and restore if needed quickly.

    Having this implementation also discourage team to perform unauthorized changes in production.

    So you see its win-win situation for business and production management.

    By default, WebSphere DMGR logs (SystemOut.log) doesn’t capture who has logged in changes made in DMGR. Hence it’s risky for a critical production application.

    So let’s find out how to enable tracking of DMGR console login.

    First thing first – you should take a backup of configuration as a best practice.

    Backup is a lifesaver!

    Now the implementation part…

    • Login into WAS DMGR
    • Click on System administration >> Deployment manager (at left navigation panel)

    was-system-dmgr

    • Click on Logging and tracing under Additional Properties

    was-logging-tracing

    • Click on NCSA access and HTTP error logging

    was-ncsa-dmgr

    If you are wondering NCSA abbreviation – National Center for Supercomputing Applications

    • Tick the checkbox for “Enable logging service at server start-up
    • Select Combined from drop-down under NCDA access log format

    was-ncsa-combined

    • Click on Apply and OK to review and save the configuration
    • Restart the DMGR to reflect the change

    Once DMGR is restarted, you will notice new file generated (http_access.log) under dmgr/logs

    was-access-logs

    From now onwards, whoever login into DMGR, you will see their IP, browser, and action they perform. Ex:-

    172.16.179.135 - - [13/Aug/2015:04:25:16 -0700] "POST /ibm/console/j_security_check HTTP/1.1" 302 0 "https://172.16.179.135:9043/ibm/console/logon.jsp" "Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0" "com.ibm.ws.console.CSRFToken:431549926 JSESSIONID:0000ScnHefKWkhUnULSnPzKZIRy:-1 TJE: TE3: sessionCode:738940671"

    So you can see in above log, there is a login from 172.16.179.135 at 13/Aug/2015:04:25:16.

    Isn’t it cool to have this implemented, so you keep track of DMGR login?

    Tip: by default, it will keep one file with maximum 500 MB. You may modify this to fit your capacity requirement.

    Let’s say you want to allocate 1 GB for this logging then you can keep max ten files with 100 MB each so your configuration should be something like below.

    was-ncsa-custom

    I hope this helps you. Upgrade your skills in cloud computing.