Logging details
In PassMan, you can track every relevant activity: what happened, when, and who did it. There are two types of logs:
System log
System log entries are written by the PassMan virtual machine, like the standard syslog. Log entries have a loose structure:
{system time} {passman node} {service}: {log message}
Audit log
Audit log entries are triggered by activities of Padmin and PassMan users. These entries have a stricter structure:
{system time} {passman node} {service}: {process name}(process id): {parameters in key = value format }
The most relevant parameter keys are:
- id of the log entry
- if the activity belongs to an activity group (such as an import, a multiple delete or a target restore), activity_group shows the id of the group
- type of the action
- start_timestamp is Unix epoch time (the number of seconds since January 1, 1970)
- user_upn is the universal principal name of the user who performed the action, in the format username@domain. Automatic tasks have the user 'auto@internal'.
- user_address is the IP address or server name of the user. Automatic tasks have 'localhost' as user address.
- business_result shows whether the action succeeded or failed.
- entity_type, entity_name and entity tell which entity the action applies to: an account, a target or a group.
- entity_parent_name, entity_path make it easier to find the entity in the tree (on the left of the PassMan UI). In case of private folders, the path looks like this: 'admin@local private/192.168.208.28/ad'
- details give additional information depending on the type of activity
- failure, failure_code and failure_details are filled if the activity failed
Activity details
| category | type | details | description |
|---|---|---|---|
| session | session_log | user: user attempting to sign in user_address: IP address of user token_issued_at: when the auth token was issued to the user token_expiry_time: when the auth token expires failure, failure_code logout_time: when the user explicitly signed out in the UI | PassMan session has started / finished. |
job / account | CreateAccount | target: id of target parameters of account | Create new account for given target. |
| job / account | UpdateAccount | account: id of account parameters of account | Change the parameters of the account, such as its name and description. Credential changes are done by UpdateCredentials. |
| job / account | DeleteAccount | account: id of account | Delete given account. |
| job / account | CheckCredentials | account: id of account | Check that the credentials are correct, by signing in to the target in the background. |
| job / account | DeleteCredentials | account: id of account credential_types: password, SSH key or both | Delete given credentials of an account. |
| job / account | CheckoutCredentials | account: id of account credential_type: password or SSH key exclusive_duration: time the account can't be checked out by others | Show the given credential to the user, who can use it to access the account manually. If an exclusive duration is given, PassMan ensures that other users cannot view the credentials of this account. |
| job / account | CheckinCredentials | account: id of account | If the credentials are checked out exclusively, this activity gives them back, so that other users can check them out. When the exclusive duration of the checkout is over, this job runs automatically. |
| job / account | LoginCheckoutCredentials | account: id of accountcredential_type: password or SSH keyexclusive_duration: time the account can't be checked out by others user agent: the PassMan agent that initiates the action | Similar to CheckoutCredentials, but the credentials are used to sign in to the account without showing them to the user. This needs a PassMan agent, which handles the automatic sign-in. |
| job / account | UpdateCredentials | account: id of account credentials: the password, SSH key or both to change (the values are not shown in the log) | Change the credentials of an account. The changes are not reflected on the target, only in PassMan. |
| job / account | ResetCredentials | account: id of account credentials: the password, SSH key or both to change (the values are not shown in the log) | Change the credentials of an account. Unlike UpdateCredentials, it changes them on the target system too. So if the target is unreachable, or none of the current credentials are in sync, it fails. |
| job / account | ResetElevatedCredentials | target: id of target accounts: ids of accounts of target computers: names of the Windows servers where the service passwords are changed | Change the credentials of several accounts of the given target, using a service account. It can also change the passwords of Windows services running on other computers. |
| job / target | CreateTarget | parent: id of group (folder) to create it in target parameters | Create target. |
| job / target | UpdateTarget | target: id of target target parameters | Change target parameters. |
| job / target | DeleteTarget | target: id of target | Delete given target. |
| job / target | MoveTarget | target: id of target destination group: id of group to move it to | Move the target to a different group (folder). It needs permission to delete it from the current group and to create it in the destination group. |
| job / target | RestoreAccounts | timestamp: time the accounts should be restored to account: id of account target: id of target | Target recovery restores the accounts to a previous state. This is useful if the target device was restored to a backup, and PassMan needs to be synchronized to this earlier state. |
| job / folder | CreateGroup | name: name of group parent: id of the group to create it in | Create group (folder). |
| job / folder | UpdateGroup | group: id of group name: new name of group description: new description of group | Change the name, the description or both of a group (folder). |
| job / folder | DeleteGroup | group: id of group | Delete group (folder). |
| job / folder | MoveGroup | group: id of group parent: id of group to move it to | Move given group (folder) to another parent group. |
| job / vault | OpenVault | key: vault username | Open the vault, which makes sensitive data in the database accessible. Only users with a vault username and password can do that. If the vault is closed, most jobs fail. |
| job / vault | AddVaultKey | key: vault username | Add a vault user, which is independent of the sign-in user name and password. A user who can open the vault does not need sign-in details for PassMan. |
| job / vault | DeleteVaultKey | key: vault username | Delete vault user. |
| job / policy | UpdateCredentialPolicy | credential_type: password or SSH key policy: requirements for the credential group: id of group target: id of target account: id of account | Change the policy that the credentials must conform to. |
| job / policy | UpdateACL | acl: access control list (list of rules) group: id of group target: id of target account: id of account | Edit the ACL, which controls the permissions of the given entity. |
| user man | AddUser | username user parameters | Add new local user to access PassMan. |
| user man | UpdateUser | username user parameters | Change local user parameters. |
| user man | DeleteUser | username | Delete given local user. |
| user man | ChangePassword | username | Change password of given local user. |
| user man | AddLocalGroup | name | Add local user group. |
| user man | DeleteLocalGroup | name | Delete local user group. |
| user man | UpdateLocalGroup | name | Change name of local group. |
| user man | ForgotPassword | name error_message | Send an email to the given user about a forgotten password. |
| padmin / certificate | PadminGenerateSelfSignedCert | domain country state company city admin_email | Secure communication over HTTPS needs a certificate. If the site does not have a properly signed certificate, you can generate a self-signed one. |
| padmin / certificate | PadminUploadCert | - | Upload certificate dedicated to the site running PassMan. |
| padmin / maintenance | PadminPassmanStart | - | Start PassMan, if it is stopped. After every start, the vault admin needs to open the vault for users to have access to sensitive data. |
| padmin / maintenance | PadminPassmanStop | - | Stop PassMan, if it is not stopped. |
| padmin / maintenance | PadminPassmanRestart | - | Stop PassMan and then start it again. Some changes take effect only after PassMan restarts. |
| padmin / maintenance | PadminPadminRestart | - | Restart Padmin service on virtual machine. |
| padmin / maintenance | PadminShutdown | - | Shut down the virtual machine. After that, it is not accessible from Padmin. |
| padmin / maintenance | PadminShutdownCluster | - | Shut down all nodes of the cluster. |
| padmin / maintenance | PadminReboot | - | Reboot the virtual machine. It might take a few minutes, and during that time it is not accessible from Padmin. |
| padmin / maintenance | PadminRebootCluster | - | Reboot all nodes of the cluster. |
| padmin / maintenance | PadminUpdateDatabaseIndexes | - | Update the database indexes of the PassManDatabase. It might be necessary after database restore activity. |
| padmin / update | PadminUpdatePassmanFile | upload_file | Update PassMan by uploading an update file. After that, restarting is necessary. |
| padmin / update | PadminUpdateFile | upload_file | Update Padmin by uploading an update file. After that, restarting is necessary. |
| padmin / update | PadminOsUpdate | upload_file | Update the operating system of the virtual machine. Afterwards, reboot is necessary. In cluster mode, it can update only one node, so the update process needs to be run three times on each node. |
| padmin / data | PadminDatabaseBackup | filename_postfix | Back up the PassMan database. Backups are stored on the virtual machine. |
| padmin / data | PadminDatabaseRestore | filename | Restore the PassMan database. It is a long process and might take several minutes. After that, PassMan needs to be restarted. |
| padmin / data | PadminDatabaseExport | filename | Export a database backup file, which the browser downloads. Export files are encrypted. |
| padmin / data | PadminDatabaseImport | db_dump_file | Import previously exported database backup file. Importing does not restore it automatically, just copies it to the virtual machine. |
| padmin / data | PadminDeleteBackup | filename | Delete a backup file from the virtual machine. Old backups are not deleted automatically. |
| padmin / data | PadminAutoBackup | - | Set daily automatic backup parameters. If export destination is set, then backup files are encrypted (just like in case of export), copied to the given destination and removed from the virtual machine. |
| padmin / system settings | PadminNetwork | network parameters | Change the network settings of the virtual machine, such as the IP address, gateway, DNS, search domains and static routes. If the changes make the virtual machine inaccessible over HTTP, it cannot be rescued through Padmin. |
| padmin / system settings | PadminLicense | - | Change the PassMan license. |
| padmin / system settings | PadminAutoJobs | changed parameters | The following automatic jobs can be configured to run daily at a specific time:
|
| padmin / system settings | PadminAuthentication | - | Configure the authentication methods of PassMan. PassMan must be restarted for the changes to take effect. |
| padmin / system settings | PadminEmail | parameters | Configure the email settings. |
| padmin / system settings | PadminSecurity | changed parameters | Automatic ACL rule update for parent groups to ensure that users can view the entity they were given access to. |
| padmin / system settings | PadminTime | changed parameters | Configure the time zone and NTP servers. |
| padmin / system settings | PadminSyslogServer | parameters | Configure the syslog server that the system and audit logs are sent to. |
| padmin / system settings | PadminZabbix | parameters | Configure the Zabbix monitoring software. |
| padmin / system settings | PadminDebugMode | changed parameters | Turn debug mode on or off, for a more detailed system log. It does not affect the audit log. |
| padmin / system settings | PadminSwap | changed parameters | Increase the size of the swap file. It can't be decreased. |
| padmin / system settings | PadminPmsl | changed parameters | Configure how PMSL (the PassMan Secure Login tool) is used to sign in to targets directly from the PassMan UI. |
| padmin / system settings | PadminRemoteLogin | changed parameters | Turn SSH access to the virtual machine on or off. |
| padmin / system settings | PadminConfigExport | - | Export all Padmin settings to an encrypted file, which the browser downloads. |
| padmin / system settings | PadminConfigImport | conf_file | Import all Padmin settings from a previously exported file. |