Encrypting, sanitizing, and signing log files

Log files are useful for understanding server usage patterns and troubleshooting problems, but they can also contain sensitive data like attribute values that might appear in entry DNs or search filters. To protect against this, the server can log to encrypted files.

File-based loggers include the following configuration properties to control this.

If you need to access data in an encrypted log file, then the encrypt-file tool can be used to decrypt its content. This tool is discussed in more detail in the encrypt-file tool section. However, it might not be necessary to decrypt log files to be able to use them. Both the search-logs and summarize-access-log tools both provide support for operating on encrypted and compressed log files.

In most cases, no special handling is needed, because the log data is encrypted with a definition from the server’s encryption settings database, and the tool can obtain the appropriate definition from that database. However, if the encryption settings database is not available, such as if the tool is run from a system other than the one on which the server is running, or no longer contains the definition that was used to encrypt the log file, then the --encryptionPassphraseFile argument can be used to specify the passphrase used to generate that definition.

For additional information, see the config/sample-dsconfig-batch-files/create-encrypted-loggers.dsconfig batch file.