Federation Security Services Guide › Federation Security Services Trace Logging › Trace Logging

Trace Logging

The Web Agent trace logging facility and the Policy Server Profiler enable SiteMinder to monitor the performance of the Web Agent and Policy Server. These logging mechanisms provide comprehensive information about the operation of SiteMinder processes so you can analyze performance and troubleshoot issues.

For Federation Security Services, several logging components are available to collect trace messages related to federated communication. Trace messages provide detailed information about program operation for tracing, debugging, or both. Trace messages are ordinarily turned off during normal operation. You can enable them to extract in-depth information in addition to the trace message itself. For example, you can look at the FWSTrace.log to see the SAML assertion generated by SiteMinder or collect the name of the current user.

The collected trace messages are written to a trace log. The FWSTrace.log is located in the directory web_agent_home/log.

Note: For Web Agents on IIS 6.0 servers, log files are created only after the first user request has been submitted. To verify your configuration in the log file, a user has to submit a request.

FWS Log Messages at the Web Agent

The Federation Web Services (FWS) application that is installed with the Web Agent Option Pack, represents the federation client. The component that controls the trace messages and monitors FWS activity is the Fed_Client component.

Within the Fed_Client component, the following sub components are included:

single sign-on

Monitors single sign-on activity.

single logout

Monitors requests for single logout.

discovery profile

Monitors the identity provider discovery profile activity.

administration

Watches administration-related messages.

request

Monitors request and authentication activity.

general

Monitors activity that other subcomponents are not monitoring.

configuration

Monitors SAML 2.0 Service Provider configuration messages.

FWS uses the common tracing facility that the Web Agent uses to log trace messages. The following files are used to set up trace logging:

trace configuration file

Specifies the configuration file that determines which components and events FWS monitors. The default file is FWSTrace.conf.

trace log file

Specifies the output file for all the logged messages. You provide a name and the location for this file in the Web Agent configuration file.

Web Agent Configuration File or Agent Configuration Object

Contains the logging parameters that enable logging and format the log. This file does not define message content.

Configure FWS Trace Logging

To collect trace messages for the Federation Web Services application, configure the FWS trace logging.

Follow these steps:

1. Do one of the following tasks:
   • Make a copy of the default template, FWSTrace.conf and modify the file to include only the data you want to monitor.
   • Copy one of the preconfigured templates and assign a new name to it.

   Note: Do not edit the template directly.

2. Open the LoggerConfig.properties file in the directory web_agent_home/affwebservices/WEB-INF/classes, and set the following parameters:
   • Set TracingOn to Yes. This option instructs the trace facility to write messages to a file.
   • Set the TraceFileName parameter to the full path of the trace log file. The default location is in web_agent_home/config/FWSTrace.log.
   • Set the TraceConfigFile parameter to the full path of the trace configuration file, either the default template, FWSTrace.conf or another template. Templates can be found at web_agent_home/config.
3. Optionally, you can format the trace log file, the file that contains the log output. The following parameters are the Web Agent configuration parameters that dictate the format of the trace log file:
   • TraceRollover
   • TraceSize
   • TraceCount
   • TraceFormat
   • TraceDelim

   The LoggerConfig.properties file contains descriptions of all these settings.

FWS Log Messages at the Policy Server

The component that controls the trace messages for federation services at the Policy Server is the Fed_Server component. This component monitors activity for the assertion generator and the SAML authentication scheme. For example, you can view the generated assertion in the smtracedefault.log file.

To configure logging at the Policy Server, use the Policy Server Profiler. The Profiler is available from the Policy Server Management Console. The Profiler is a graphical user interface that lets you specify components for trace logging, which include:

trace configuration file

Defines the components and subcomponents that are included in the file.

trace log file

Specifies the output file for all the logged messages.

The following subcomponents are available for the Fed_Server component:

Configuration

Monitors SAML 2.0 Service Provider configuration activity.

Assertion_Generator

Watches the activity for the SAML 1.x and 2.0 assertion generators.

Auth_Scheme

Monitors the activity of the SAML 1.x or SAML 2.0 authentication schemes.

Saml_Requester

Watches SAML Requester activity

Attribute_Service

Watches the Attribute Service activity

Use the SiteMinder Profiler to Log Trace Messages

The profiler is the Policy Server facility for logging. You can use the profiler to collect trace messages for federation services.

Access the profiler from the Policy Server Management Console.

To configure the profiler

1. Open the Policy Server Management Console.
2. Select the Profiler tab.
3. Select the Enable Profiling check box.
4. In the Configuration File field, click Browse and locate the template that you want to use.

   You can load the default template, smtracedefault.txt, in the directory policy_server_home/config, or one of the preconfigured templates in the directory policy_server_home/config/profiler_templates.

5. In the Output section, select whether to log data to the Console or to a File or both. If you select a file, specify a path to that file in the Output to File field then select an output format.

   Note: Verify that the log file uses a unique name.

6. Click OK to save your changes.