Configuring Subsystem Debug Log

Overview

Each PKI subsystem provides a logging service using java.util.logging (JUL) framework. The logging service which can be used to generate debug logs for troubleshooting issues in the subsystem (e.g. database access, certificate issuance, key archival).

Configuration

The JUL configuration is stored in the following files:

• /usr/share/pki/ca/webapps/ca/WEB-INF/classes/logging.properties

• /usr/share/pki/kra/webapps/kra/WEB-INF/classes/logging.properties

• /usr/share/pki/ocsp/webapps/ocsp/WEB-INF/classes/logging.properties

• /usr/share/pki/tks/webapps/tks/WEB-INF/classes/logging.properties

• /usr/share/pki/tps/webapps/tps/WEB-INF/classes/logging.properties

By default they are configured as follows:

handlers = org.apache.juli.FileHandler

org.apache.juli.FileHandler.directory = ${catalina.base}/logs/${classloader.webappName}
org.apache.juli.FileHandler.prefix = debug.
org.apache.juli.FileHandler.maxDays = 7
org.apache.juli.FileHandler.formatter = org.dogtagpki.util.logging.PKIFormatter

.level = WARNING
.handler = org.apache.juli.FileHandler

org.dogtagpki.level = WARNING
com.netscape.level = WARNING
netscape.level = WARNING

The debug.level parameter is stored in the following files:

• /var/lib/pki/pki-tomcat/ca/conf/CS.cfg

• /var/lib/pki/pki-tomcat/kra/conf/CS.cfg

• /var/lib/pki/pki-tomcat/ocsp/conf/CS.cfg

• /var/lib/pki/pki-tomcat/tks/conf/CS.cfg

• /var/lib/pki/pki-tomcat/tps/conf/CS.cfg

By default they are configured as follows:

debug.level=10

Log Files

By default log messages will be stored in /var/log/pki/pki-tomcat/<subsystem>/debug.YYYY-MM-DD.log which will be rotated daily.

By default it will only keep log messages from the last 7 days.

Log Format

The messages will be formatted by org.dogtagpki.util.logging.PKIFormatter.

Log Level

The debug.level is mapped into JUL log level as follows:

PKI Log Level	SLF4J Log Level	JUL Log Level
0-1 (OBNOXIOUS)	TRACE	FINEST
2-5 (VERBOSE)	DEBUG	FINE
6-10 (INFORM)	INFO	INFO
11-15	WARN	WARNING
>15	ERROR	SEVERE

Displaying Current Debug Level

To show the current debug level, execute the following command:

$ pki-server ca-config-show debug.level
0

Changing Debug Level

To change the debug level, execute the following command:

$ pki-server ca-config-set debug.level 5

Then restart the server.