File-based loggers include the following configuration properties to control this.

Property Description
encrypt-log

Indicates whether the log file should be encrypted.

encryption-settings-definition-id

Specifies the ID of the encryption settings definition that should be used to obtain the encryption key. If this is not specified, then the preferred definition is used.

If you need to access data in an encrypted log file, then the encrypt-file tool can be used to decrypt its content. This tool is discussed in more detail in the encrypt-file tool section. However, it might not be necessary to decrypt log files to be able to use them. Both the search-logs and summarize-access-log tools both provide support for operating on encrypted and compressed log files.

In most cases, no special handling is needed, because the log data is encrypted with a definition from the server’s encryption settings database, and the tool can obtain the appropriate definition from that database. However, if the encryption settings database is not available, such as if the tool is run from a system other than the one on which the server is running, or no longer contains the definition that was used to encrypt the log file, then the --encryptionPassphraseFile argument can be used to specify the passphrase used to generate that definition.

For additional information, see the config/sample-dsconfig-batch-files/create-encrypted-loggers.dsconfig batch file.