Skip to main content

Operations

Java Observability Settings​

#Add-ons #Logging #Experimental

Plugin: nevisadmin-plugin-base

Sets up observability for Java-based Nevis components.

You can choose between OpenTelemetry and Application Insights.

This pattern adds a Java agent to integrate with either system.

Agent Type​

Choose agent type:

  • OpenTelemetry to integrate with self-hosted observability stack or with an OpenTelemetry compatible cloud provider.
  • Application Insights to integrate with Azure Application Insights.

Agent Library Path​

Path to the selected agent's library that is available locally to the deployed application.

Agent Configuration​

Configuration file of the selected agent.

Use ${...} expressions to refer parameter values. Default parameters:

  • ${name}: component name
  • ${instance}: instance name
  • ${version}: version
  • ${service.name}: service name (kubernetes deployment)

Sample configuration for OpenTelemetry:

otel.service.name = ${service.name}
otel.resource.attributes = service.version=${version}
otel.exporter.otlp.protocol = http/protobuf
otel.exporter.otlp.traces.protocol = http/protobuf
otel.exporter.otlp.traces.endpoint = ${tracesEndpoint}
otel.exporter.otlp.metrics.protocol = http/protobuf
otel.exporter.otlp.metrics.endpoint = ${metricsEndpoint}
otel.exporter.otlp.metrics.temporality.preference = cumulative
otel.exporter.otlp.logs.protocol = http/protobuf
otel.exporter.otlp.logs.endpoint = ${logsEndpoint}

Sample configuration for Application Insights:

{
  "connectionString": "${connectionString}",
  "role": {
    "name": "${service.name}"
  },
  "customDimensions": {
    "service.version": "${version}"
  },
  "sampling": {
    "percentage": 100
  },
  "instrumentation": {
    "logging": {
      "level": "OFF"
    }
  }
}

Configuration Parameters​

Provide parameters for your configuration file.

Examples:

connectionString = InstrumentationKey=00000000-0000-0000-0000-000000000000
tracesEndpoint = https://otel-collector:4318/v1/traces
metricsEndpoint = https://otel-collector:4318/v1/metrics
logsEndpoint = https://otel-collector:4318/v1/logs

Deployment Environment​

Select a value for the OpenTelemetry deployment.environment attribute.

Choose between:

  • production: example value used in OpenTelemetry documentation
  • staging: example value used in OpenTelemetry documentation
  • testing
  • development

If nothing is selected, then this attribute will not be set.

In case the attribute is set in the Agent Configuration as well, the configuration provided here wins.

You may use this attribute for filtering, e.g. to separate information from prod and test for metrics and traces.

nevisAdapt Log Settings​

#User Behavior Analytics #Logging

Plugin: nevisadmin-plugin-nevisadapt

Defines log levels and log retention of nevisAdapt. Assign to a nevisAdapt Instance using Log Settings.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Configure log levels.

See nevisAdapt Reference Guide, chapter Logging Configuration for details.

Comprehensive logging guide is found here.

Hint: If you only change log levels nevisAdmin 4 does not restart the component in classic VM deployment. The new log configuration will be reloaded within 60 seconds after deployment.

The default configuration is:

AdaptModules-Generic = INFO
ch.nevis.nevisadapt.util.logging.OpTracer = DEBUG

Examples:

org.springframework.web.filter.CommonsRequestLoggingFilter=DEBUG

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file. When Rotation Type is time, this property is used as Logback's maxHistory property. This means that logs will be archived for this number of time units where time unit is as defined in Rotation Interval.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

Note: not relevant when rotation type is time.

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Logback log format for the default SERVER logs. This pattern is used for non-kubernetes deployments.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Logback log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Log Targets​

Select the type of appender.

In Kubernetes the default appender writes to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to default target
  • default + syslog - log to default target and forward to a Syslog server
  • syslog - forward to a Syslog server only

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisAdapt Observation Cleanup Configuration​

#User Behavior Analytics #Experimental

Plugin: nevisadmin-plugin-nevisadapt

Allows customization of the observation cleanup interval.

Observation Timeframe​

This value defines the observation lookup period, the cleanup of trusted observations cannot happen sooner than this.

The default value is 60d.

Trusted Cleanup Period​

This value indicates the buffer time beyond the base observation timeframe for removing trusted observations.

The default value is 1d.

Untrusted Cleanup Timeframe​

nevisAdapt stores session data that was not marked as trusted (e.g.: failed 2FA authentication) for a certain amount of time. This is done to allow staff to investigate the issue and to provide the user with a better experience. However, storing untrusted session data for too long can lead to privacy issues. This pattern describes how to configure the cleanup of untrusted session data.

The default value is 12d.

nevisAuth Audit Channel​

#Authentication #Logging

Plugin: nevisadmin-plugin-nevisauth

nevisAuth raises events for audit purposes and allows to set up audit channels to handle these events.

Audit channels are Java classed which implement the AuditChannel interface.

Use this pattern to add a custom audit channel to your nevisAuth Instance.

Assign this pattern in your the nevisAuth Log Settings pattern under Audit Channels.

For convenience, the default NevisAuthChannel can be enabled in the nevisAuth Log Settings pattern.

Class​

Enter the fully qualified name of your Java class. The class must implement the AuditChannel interface.

The class must be on the classpath of the AuthEngine. You can upload your JAR file in the Classloading tab of the nevisAuth Instance under Custom Dependencies.

Properties​

Provide configuration for the audit channel.

For each key-value pair 1 property element will be generated.

nevisAuth Log Settings​

#Authentication #Logging

Plugin: nevisadmin-plugin-nevisauth

Configure log levels and retention of nevisAuth logs.

Assign to a nevisAuth Instance via Log Settings.

In classic VM deployment nevisAdmin 4 does not restart the nevisAuth instance when only log configuration is changed. New log configuration is reloaded within 60 seconds after deployment.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Set log levels.

The default is:

CategoryLevel
EsAuthStartINFO

The default gives you log messages during startup but is rather silent during runtime.

A good setting for troubleshooting is:

CategoryLevel
AuthEngineINFO
VarsINFO

When using nevisAuth Database with MariaDB the category org.mariadb.jdbc can be set. The levels behave as follows:

  • ERROR: log connection errors
  • WARNING: log query errors
  • DEBUG: log queries
  • TRACE: log all exchanges with server

Check the documentation for other important trace groups.

In classic deployment nevisAdmin 4 does not restart nevisAuth if you only change log levels. The log configuration will be reloaded within 60 seconds after deployment.

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

Note: not relevant when rotation type is time.

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Log4j 2 log format for the default SERVER logs.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Hidden Variables​

Enter variables that should be hidden in logs.

The special option auto hides the following variables:

  • variables used for GUI elements of type pw-text
  • dyncert.key
  • connection.HttpHeader.Authorization
  • client_secret

The wildcard * may be appended (but not prepended). This way, every variable that starts with a certain string will be hidden from the log. For instance, passw* will hide password and passwd.

Regex Filter​

If set, messages for esauth4sv.log which match the given regular expression will not be logged.

The regular expression must match the entire line. For instance, you may use the following format to match some text:

.*some text.*

Audit Log​

Configure audit logging of nevisAuth.

Audit logging is enabled by default, as recommended in the nevisAuth auditing documentation. It uses the default audit channel implementation provided by the NevisAuditChannel class.

Select disabled only if you explicitly want to turn off audit logging.

If you want to use your own channel, you have to assign Audit Channels and select one of the following options here:

  • enabled: use your own channel in addition to the NevisAuditChannel.
  • custom: use only your own channel.

Log Format​

Log4j 2 log format for the AUDIT logs.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the AUDIT SYS logs.

Note: not relevant when Log Targets is set to default.

Audit Channels​

Assign nevisAuth Audit Channel patterns to use your own channel implementations.

Event Log​

Enable Event Logging for nevisAuth.

Log messages are in JSON format.

The message contains a trace ID (trId) to allow for correlation with other logs.

Example:

{ "logVersion":"1", "timestamp":"2025-02-07T12:03:42.031Z", "logType":"sessionEvent", "eventType":"authenticate-completed", "trID":"a4c86aab76cff97c2156fd80d70b4fcc", "sessionID":"XDPl4CdfNaEcUpc4aVAbYaYxgr3a9rdYk6vO4Xef_ug", "conversationID":"450160216478", "client":{ "sessionID":"12ca12ac0200Y0FHJGcgRaQgv8fJ70cRSC9Ss9AIROUyW1fWcMcBZaAIWF", "clientID":"4818", "entryPoint":"nevis", "sslCipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "clientIP":"172.18.0.2" }, "agent":{ "userAgent":"Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36", "agentIP":"172.18.0.1", "sslProtocol":"TLSv1.2", "sslCipher":"ECDHE-RSA-CHACHA20-POLY1305", "resPath":"https:\/\/nevis\/nevisidm\/admin", "reqPath":"https:\/\/nevis\/nevisidm\/admin", "reqQuery":"login" }, "hostName":"172.18.0.2", "port":8991, "sessionStartTimestamp":"2025-02-07T12:03:42.027Z", "loginID":"bootstrap", "userID":"100", "authLevel":"1", "roles":[ "1", "nevisIdm", "nevisIdm.SelfAdmin", "nevisMeta", "nevisMeta.admin", "nevisAdapt", "nevisAdapt.admin", "nevisAdapt.user", "nevisIdm.Root" ], "realm":"SSO", "language":"en", "eventTrail":[ { "stateName":"SSO_login_screen", "stateClass":"ch.nevis.idm.authstate.IdmPasswordVerifyState", "timestamp":"2025-02-07T12:03:21.633Z", "tech":"nevisIDM", "type":"username\/password", "detail":"bootstrap" }, { "stateName":"SSO_login_screen", "stateClass":"ch.nevis.idm.authstate.IdmPasswordVerifyState", "timestamp":"2025-02-07T12:03:27.229Z", "tech":"nevisIDM", "type":"username\/password", "detail":"bootstrap" }, { "stateName":"SSO_login_screen-IdmPasswordChange", "stateClass":"ch.nevis.idm.authstate.IdmChangePasswordState", "timestamp":"2025-02-07T12:03:41.298Z", "tech":"nevisIDM", "type":"mutation" }, { "stateName":"SSO_login_screen-IdmPostProcessing", "stateClass":"ch.nevis.idm.authstate.IdmGetPropertiesState", "timestamp":"2025-02-07T12:03:41.383Z", "tech":"nevisIDM", "type":"selection", "detail":"profile: BootstrapProfile\/100" } ], "custom":{ } }

In Kubernetes deployment the prefix [nevisauth-events.log] is added to each message.

In classic VM deployment the messages are written to a separate file nevisauth-events.log.

Log Format​

Log4j 2 log format for log messages written to nevisauth-events.log.

We recommend not changing this configuration as log messages may not be valid JSON anymore.

This configuration is not used when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for messages sent via Syslog.

This configuration is used when Log Targets contains syslog.

We recommend not changing this configuration as log messages may not be valid JSON anymore.

Custom Log Fields​

Set to add additional fields to the nevisAuth events log.

Enter field names (with optional format JSON) to nevisAuth expressions.

Examples:

FieldExpression
unitDisplayName${sess:ch.nevis.idm.User.unit.displayName}
unitHierarchy:JSON${StringUtils.strip(sess['ch.nevis.idm.User.unit.hname'].replace('/',','),',')}

Based on this CustomField elements with name, value, and optional attribute format, are created in esauth4.xml.

Log Targets​

Select the type of log4j appender.

This property is relevant for classic VM deployments only.

In Kubernetes the main logs are written to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to a file
  • default + syslog - log to a file and forward to a Syslog server
  • syslog - forward to a Syslog server only

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisDataPorter Log Settings​

#Logging

Plugin: nevisadmin-plugin-nevisdp

The pattern defines log levels and log retention of nevisDataPorter. Assign to a nevisDataPorter Instance using Log Settings.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Configure log levels.

See nevisDataPorter Technical Documentation, chapter Logging, tracing, debugging, and profiling for details.

Hint: If you only change log levels nevisAdmin 4 does not restart the component in classic VM deployment. The new log configuration will be reloaded within 60 seconds after deployment.

The default configuration is:

dataporter = INFO

Examples:

dataporter.config=INFO
dataporter.statistics=INFO

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file.

This configuration applies to non-Kubernetes deployment only.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

This configuration applies to non-Kubernetes deployment only.

Note: not relevant when rotation type is time.

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Log4j 2 log format for the default SERVER logs.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Regex Filter​

If set, messages for dataporter.log which match the given regular expression will not be logged.

The regular expression must match the entire line. For instance, you may use the following format to match some text:

.*some text.*

Log Targets​

Select the type of appender.

In Kubernetes the default appender writes to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to default target
  • default + syslog - log to default target and forward to a Syslog server
  • syslog - forward to a Syslog server only

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisDetect Log Settings​

#User Behavior Analytics #Logging

Plugin: nevisadmin-plugin-nevisdetect

Defines log levels and log retention of nevisDetect. Assign to a nevisDetect <Subcomponent> Instance using Log Settings.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Configure log levels.

See nevisDetect Reference Guide, chapter Logging Configuration for details.

Hint: If you only change log levels nevisAdmin 4 does not restart the component in classic VM deployment. The new log configuration will be reloaded within 60 seconds after deployment.

The default configuration is:

ch.nevis.nevisadapt = INFO
ch.nevis.nevisdetect.util.logging.OpTracer = DEBUG

Examples:

org.springframework.web.filter.CommonsRequestLoggingFilter=DEBUG
ch.nevis.nevisdetect.entrypoint.icap.RequestProcessingHelper=INFO

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file. When Rotation Type is time, this property is used as Logback's maxHistory property. This means that logs will be archived for this number of time units where time unit is as defined in Rotation Interval.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

Note: not relevant when rotation type is time.

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Logback log format for the default SERVER logs. This pattern is used for non-kubernetes deployments.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Logback log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Log Targets​

Select the type of appender.

In Kubernetes the default appender writes to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to default target
  • default + syslog - log to default target and forward to a Syslog server
  • syslog - forward to a Syslog server only

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisFIDO FIDO2 Log Settings​

#FIDO2 #Logging

Plugin: nevisadmin-plugin-fido2

Defines log levels and log retention of nevisFIDO. Assign to a nevisFIDO FIDO2 Instance using Log Settings.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Configure log levels.

In classic deployment nevisAdmin 4 does not restart nevisFIDO if you only change log levels. The log configuration will be reloaded within 60 seconds after deployment.

The category ch.nevis.auth.fido.application.Application will always be generated. If you do not set its level, INFO will be used.

This gives you:

  • log messages during startup and when the startup is done
  • 1 line per incoming request
  • 1 line for each API call towards nevisIDM

Debug incoming requests:

org.springframework.web.filter.CommonsRequestLoggingFilter = DEBUG

Debug the entire component:

ch.nevis.auth.fido = DEBUG

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file. When Rotation Type is time, this property is used as Logback's maxHistory property. This means that logs will be archived for this number of time units where time unit is as defined in Rotation Interval.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

Note: not relevant when rotation type is time.

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Log4j 2 log format for the default SERVER logs. This pattern is used for non-kubernetes deployments.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Log Targets​

Select the type of appender.

In Kubernetes the default appender writes to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to default target
  • default + syslog - log to default target and forward to a Syslog server
  • syslog - forward to a Syslog server only

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisFIDO UAF Log Settings​

#Mobile Authentication #Logging

Plugin: nevisadmin-plugin-nevisfido

Defines log levels and log retention of nevisFIDO. Assign to a nevisFIDO UAF Instance using Log Settings.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Configure log levels.

In classic deployment nevisAdmin 4 does not restart nevisFIDO if you only change log levels. The log configuration will be reloaded within 60 seconds after deployment.

The category ch.nevis.auth.fido.application.Application will always be generated. If you do not set its level, INFO will be used.

This gives you:

  • log messages during startup and when the startup is done
  • 1 line per incoming request
  • 1 line for each API call towards nevisIDM

Debug incoming requests:

org.springframework.web.filter.CommonsRequestLoggingFilter = DEBUG

Debug the entire component:

ch.nevis.auth.fido = DEBUG

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file. When Rotation Type is time, this property is used as Logback's maxHistory property. This means that logs will be archived for this number of time units where time unit is as defined in Rotation Interval.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

Note: not relevant when rotation type is time.

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Log4j 2 log format for the default SERVER logs. This pattern is used for non-kubernetes deployments.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Log Targets​

Select the type of appender.

In Kubernetes the default appender writes to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to default target
  • default + syslog - log to default target and forward to a Syslog server
  • syslog - forward to a Syslog server only

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisIDM Generic Batch Job​

#Identity Management #Add-ons #Experimental

Plugin: nevisadmin-plugin-nevisidm

Configure a batch job for nevisIDM using the XML syntax described in the technical documentation.

Use the pattern only when there is no dedicated pattern for your batch job.

Assign the pattern to a nevisIDM Instance using Additional Settings.

Job(s)​

Add configuration of a bean which configures your batch job.

The basic syntax is as follows:

<bean id="someJobId" class="org.springframework.scheduling.quartz.JobDetailFactoryBean">
    <property name="description" value="Some job description"/>
    <property name="durability" value="true"/>
    <property name="jobClass" value="some.job.Class"/>
    <property name="jobDataMap">
        <bean class="org.quartz.JobDataMap">
            <constructor-arg>
                <map>
                    <entry key="someJobParam" value="some value"/>
                </map>
            </constructor-arg>
        </bean>
    </property>
</bean>

Trigger(s)​

Add configuration of a bean which acts as a trigger for job execution.

Execute every 24 hours:

<bean id="someTriggerId" class="org.springframework.scheduling.quartz.SimpleTriggerFactoryBean">
    <property name="description" value="Some description shown in nevisIDM Admin GUI"/>
    <property name="jobDetail" ref="someJobId"/> <!-- must be provided via Job(s) -->
    <property name="repeatInterval" value="86400000"/> <!-- 1 day in ms -->
    <property name="misfireInstructionName" value="MISFIRE_INSTRUCTION_RESCHEDULE_NEXT_WITH_EXISTING_COUNT"/>
</bean>

Execute once a day at midnight (cron expression):

<bean id="someTriggerId" class="org.springframework.scheduling.quartz.CronTriggerFactoryBean">
    <property name="description" value="Some description shown in nevisIDM Admin GUI"/>
    <property name="jobDetail" ref="someJobId"/> <!-- must be provided via Job(s) -->
    <property name="cronExpression" value="0 0 0 * * ?"/>
</bean>

Custom Batch Job JAR(s)​

Upload JAR file(s) for custom batch jobs.

Note that batch jobs which call the nevisIDM business layer are not supported by Nevis. Please call the nevisIDM REST API only.

nevisIDM Log Settings​

#Identity Management #Add-ons #Logging

Plugin: nevisadmin-plugin-nevisidm

Change log configuration for nevisIDM.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Configure log levels.

See the nevisIDM Technical Documentation, chapter nevisIDM log levels (file: logging.yml) for details.

Hint: If you only change log levels nevisAdmin 4 does not restart the component in classic VM deployment. The new log configuration will be reloaded within 60 seconds after deployment.

The default configuration is:

ch.nevis.idm.batch.jobs = INFO
ch.nevis.idm.standalone = INFO

Examples:

ch.adnovum.nevisidm.service.properties = INFO
ch.nevis.ninja = DEBUG

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file.

This setting applies to application.log and batch.log only. The audit.log is rotated on a daily basis.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

Note: This parameter only applies to application.log and batch.log (as audit.log is configured with DailyRollingFileAppender).

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Log4j 2 log format for the default SERVER logs.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Regex Filter​

If set, messages for application.log which match the given regular expression will not be logged.

The regular expression must match the entire line. For instance, you may use the following format to match some text:

.*some text.*

Log Type​

Configure audit logging capability of nevisIDM.

  • When JSON (default) is selected, nevisIDM will write audit entries in JSON format.
  • When plain is selected, nevisIDM will write audit entries as plain log lines. This setting is deprecated and may be removed in a future release.
  • When disabled is selected, nevisIDM will not log audit entries at all.

In classic VM deployments the log target is /var/opt/nevisidm/<instance>/logs/audit.log. In Kubernetes and when JSON is selected the log messages are written to the pod log with the prefix [audit.log].

If you deploy nevisIDM to multiple hosts (multi-instance setup), the audit logging will only be enabled on the first host.

Log Format​

Log4j 2 log format for the default SERVER logs.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Log Format​

Log4j 2 log format for the default SERVER logs.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the BATCH SYS logs.

Note: not relevant when Log Targets is set to default.

Log Targets​

Select the type of appender.

In Kubernetes the default appender writes to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to default target
  • default + syslog - log to default target and forward to a Syslog server
  • syslog - forward to a Syslog server only

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisIDM Prune History Job​

#Identity Management #Add-ons #Experimental

Plugin: nevisadmin-plugin-nevisidm

Assign to a nevisIDM Instance to configure a batch job which cleans up old history data.

Retention​

Define how long history data shall be kept in days.

Example: 30d

The minimum value is 1d. The maximum value is 1024d.

Cron Expression​

Enter a cron expression which defines when this job will be executed.

Cron expressions consist of 6 required fields and one optional field separated by white space.

The field order is:

  1. Seconds
  2. Minutes
  3. Hours
  4. Day-of-Month
  5. Month
  6. Day-of-Week
  7. Year (optional)

Cron expression can be complex and this pattern only validates the length. The most important wildcards are:

  • * is used to specify all values. For example, * in the minute field means every minute.
  • ? is allowed for the day-of-month and day-of-week fields. It is used to specify no specific value.
  • - is used to specify ranges.

Further information about the supported syntax can be found in the javadoc of org.quartz.CronExpression.

Examples:

  • 0 0 0 * * ?: fires every midnight.
  • 0 0/30 8-9 5,20 * ?: fires every half hour between the hours of 8 am and 10 am on the 5th and 20th of every month.
  • 0 30 10-13 ? * WED,FRI: fires at 10:30, 11:30, 12:30, and 13:30, on every Wednesday and Friday.

Skip List​

Comma-separated list of versioned tables (which are used to provide history data) to be ignored by the prune history job and left with their original content.

Possible values (Any combination of the following):

  • tidma_application_v
  • tidma_authorization_appl_v
  • tidma_authorization_client_v
  • tidma_authorization_erole_v
  • tidma_authorization_unit_v
  • tidma_authorization_v
  • tidma_cert_info_v
  • tidma_client_application_v
  • tidma_client_v
  • tidma_consent_v
  • tidma_cred_login_info_v
  • tidma_credential_v
  • tidma_dict_entry_v
  • tidma_dict_entry_value_v
  • tidma_enterprise_auth_v
  • tidma_enterprise_role_v
  • tidma_erole_member_v
  • tidma_fido2_v
  • tidma_fido_uaf_v
  • tidma_mobile_signature_v
  • tidma_oath_v
  • tidma_personal_answer_v
  • tidma_personal_question_v
  • tidma_policy_configuration_v
  • tidma_policy_parameter_v
  • tidma_profile_v
  • tidma_property_allowed_val_v
  • tidma_property_v
  • tidma_property_value_v
  • tidma_role_v
  • tidma_saml_federation_v
  • tidma_template_collection_v
  • tidma_template_text_v
  • tidma_template_v
  • tidma_terms_application_v
  • tidma_terms_url_v
  • tidma_terms_v
  • tidma_unit_cred_policy_v
  • tidma_unit_v
  • tidma_user_login_info_v
  • tidma_user_v

For further information about historical tables visit Versioned DB tables.

Job Identity​

Advanced setting. Overrides the internal name used to identify this job and its trigger in the Quartz scheduler.

By default, the job identity is a fixed, static value, independent of this pattern's display name. This is what you want in the normal case of a single Prune History Job per nevisIDM instance: the Quartz job and trigger keep the same identity even if the pattern is renamed, or deleted and recreated.

Only set this value if you need to run more than one Prune History Job against the same nevisIDM instance, or to keep compatibility with a job identity that was generated by an older version of this pattern.

Warning: changing this value after the job has already been deployed creates a new Quartz job with a different identity. The previously deployed job and its trigger are left behind in the Quartz job store and are not removed automatically. If you need to revert, set this field back to the exact value it had before.

nevisLogrend Log Settings​

#Authentication #Add-ons #Logging

Plugin: nevisadmin-plugin-nevisauth

Defines log levels and log retention of nevisLogrend. Assign to a nevisLogrend Instance using Log Settings.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Configure log levels.

Check the Nevis documentation for important log categories.

If you only change log levels and deploy to classic VMs, nevisAdmin does not restart the component. The new log configuration will be reloaded within 60 seconds after deployment.

Examples:

ch.nevis.logrend.beans.LoginBean: DEBUG

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

Note: not relevant when rotation type is time.

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Log4j 2 log format for the default SERVER logs.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Regex Filter​

If set, messages for nevislogrend.log which match the given regular expression will not be logged.

The regular expression must match the entire line. For instance, you may use the following format to match some text:

.*some text.*

Example: drop messages caused by the Kubernetes liveness checks

.*GET /nevislogrend/health.*

Log Targets​

Select the type of appender.

In Kubernetes the default appender writes to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to default target
  • default + syslog - log to default target and forward to a Syslog server
  • syslog - forward to a Syslog server only

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisMeta Log Settings​

#Federation #Logging

Plugin: nevisadmin-plugin-nevismeta

The pattern defines log levels and log retention of nevisMeta.

Assign to a nevisMeta Instance using Log Settings.

Default Log Level​

Change the level of the root logger. This impacts all logging apart from Log Levels.

Note that Syslog appenders have a threshold which ensures that only INFO, WARN, or ERROR messages are forwarded.

Log Levels​

Configure log levels.

See the nevisMeta Technical Documentation, chapter Logging for details.

Hint: If you only change log levels nevisAdmin 4 does not restart the component in classic VM deployment. The new log configuration will be reloaded within 60 seconds after deployment.

Examples:

ch.nevis.nevismeta = INFO
ch.nevis.ninja = DEBUG

Rotation Type​

Select log rotation type.

Choose between:

  • size - defines the maximum file size before the log files are rolled over
  • time - defines the time span after which logs are rolled over

If you rotate by time we recommend you monitor the disk usage as log files can be huge.

Note: a combination of size and time based log rotation is not supported.

Max Backup Files​

Maximum number of backup files to keep in addition to the current log file.

This setting applies to nevismeta.log only.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

Note: not relevant when rotation type is time.

Rotation Interval​

Rotation interval after which log files are rolled over.

This configuration is not used when Rotation Type is set to size.

Choose between:

  • daily - the postfix of rotated files will be .%d{yyyy-MM-dd}
  • hourly - the postfix of rotated files will be .%d{yyyy-MM-dd-HH}

Log Format​

Log4j 2 log format for the default SERVER logs.

Note: not relevant when Log Targets is set to syslog.

Syslog Format​

Log4j 2 log format for the SERVER SYS logs.

Note: not relevant when Log Targets is set to default.

Regex Filter​

If set, messages for nevismeta.log which match the given regular expression will not be logged.

The regular expression must match the entire line. For instance, you may use the following format to match some text:

.*some text.*

Log Targets​

Select type of log4j appender.

RollingFileAppender and SyslogAppender are possible options.

Syslog Host​

Defines where to send logs to via syslog.

This configuration is used only when syslog forwarding is enabled (see Log Targets).

The syslog facility is localhost3 and the threshold is INFO.

nevisProxy Log Settings​

#Application Protection #Logging

Plugin: nevisadmin-plugin-nevisproxy

Use to configure logging for nevisProxy. Assign to your nevisProxy Instance via Log Settings.

Default Log Level​

Sets the base log level of nevisProxy.

The level will be applied to BC.Tracer.ThresholdBase as follows:

  • ERROR: 3
  • NOTICE: 5
  • INFO: 6
  • DEBUG: 7
  • DEBUG_HIGH: 9
  • TRACE: 10

Note that if you only change log levels nevisProxy will not be restarted during deployment. The new configuration will be activated within 60 seconds.

Log Levels​

Configure log levels.

Overrules the Log Level property.

Check the nevisProxy reference guide to learn about log files and debugging.

The trace groups that you can configure here are described on the following subpages:

Note that the description in the reference guide includes a prefix BC.Tracer.DebugProfile. which is not needed here. Enter only the suffix of the name of the trace group.

Further, this pattern uses semantic log levels instead of the numeric levels that nevisProxy uses. Do not enter numbers for the log level as nevisAdmin4 will calculate them automatically.

Choose between:

  • ERROR
  • NOTICE
  • INFO
  • DEBUG
  • DEBUG_HIGH
  • TRACE

The default configuration is:

NavajoOp: INFO
NProxyOp: INFO

Debug startup:

NavajoStart: INFO

Debug HTTP Header Customization:

IW4HdrDlgFlt: DEBUG

Conditional Log Levels​

Can be used to configure log levels based on conditions.

Example:

Condition:REMOTE_ADDR:CIDR/10.4.12.0/24/
Pragma: block-begin
BC.Tracer.DebugProfile.NavajoOp=4
BC.Tracer.DebugProfile.IsiwebOp=4
BC.Tracer.DebugProfile.IW4IdentCreaFlt=4
Pragma: block-end

ModSecurity Audit Log​

Controls the ModSecurity audit log engine (SecAuditEngine).

  • disabled: audit logging is off
  • enabled: all transactions are logged
  • relevant only: only transactions matching SecAuditLogRelevantStatus are logged

Rotation Type​

Defines how to handle log retention for the access, apache and navajo log files. Rotation is possible based on:

  • file size
  • time interval

Max Files​

Maximum number of backup files to keep in addition to the current log file.

Max File Size​

Maximum allowed file size (in bytes) before rolling over.

Suffixes "KB", "MB" and "GB" are allowed. 10KB = 10240 bytes, etc.

If not set the following defaults will be used:

  • apache.log: 1MB
  • other logs: 10MB

Rotation Interval​

Interval on which a logfile will be rotated.

Compress Rotated Log​

Define rotated files will be compress or not

Compression Application​

You may specify a program or script which shall be used to compress rotated files.

Example:

/usr/bin/gzip

Log Targets​

Select if only log file should be used or if statements should also be forwarded to syslog.

This property is relevant for classic VM deployments only. In Kubernetes the main logs are written to system out so that log messages appear in the docker logs.

Choose between:

  • default - log to a file
  • default + syslog - log to a file and forward to syslog
  • syslog - forward to syslog only. The syslog facility is localhost3 and the threshold is INFO.

Event Log​

Enable event logging capability of nevisProxy.

Event logs are not forwarded to syslog.

Server LogFormat​

Allows the configuration of the LogFormat Apache directive in the navajo.xml file.

For more information, check the official Apache documentation of the directive.