IBM WebSphere Deployment Manager Console Access Auditing
Keeping track of
configuration changes is essential for a production environment. This helps you to audit the changes done by the team and restore if needed quickly.
Having this implementation also discourage team to perform unauthorized changes in production.
So you see its win-win situation for business and production management.
By default, WebSphere DMGR logs (SystemOut.log) doesn’t capture who has logged in changes made in DMGR. Hence it’s risky for a critical production application.
So let’s find out how to enable tracking of DMGR console login.
First thing first – you should take a
backup of configuration as a best practice.
Backup is a
Now the implementation part…
Login into WAS DMGR
Click on System administration >> Deployment manager (at left navigation panel)
Click on Logging and tracing under Additional Properties
Click on NCSA access and HTTP error logging
If you are wondering
NCSA abbreviation – National Center for Supercomputing Applications
Tick the checkbox for “Enable logging service at server start-up
Select Combined from drop-down under NCDA access log format
Click on Apply and OK to review and save the configuration
Restart the DMGR to reflect the change
Once DMGR is restarted, you will notice new file generated (
http_access.log) under dmgr/logs
From now onwards, whoever login into DMGR, you will see their IP, browser, and action they perform.
172.16.179.135 - - [ 13/Aug/2015:04:25:16 -0700] "POST /ibm/console/j_security_check HTTP/1.1" 302 0 "https://172.16.179.135:9043/ ibm/console/logon.jsp" " Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Firefox/24.0" "com.ibm.ws.console.CSRFToken:431549926 JSESSIONID:0000ScnHefKWkhUnULSnPzKZIRy:-1 TJE: TE3: sessionCode:738940671"
So you can see in above log, there is a login from
172.16.179.135 at 13/Aug/2015:04:25:16.
Isn’t it cool to have this implemented, so you keep track of DMGR login?
Tip: by default, it will keep one file with maximum 500 MB. You may modify this to fit your capacity requirement.
Let’s say you want to allocate 1 GB for this logging then you can keep max ten files with 100 MB each so your configuration should be something like below.
I hope this helps you. Upgrade your skills in
Head here if you want to configure WebSphere Deployment Manager Console Identity.