Enable Syslog TCP input

This example uses syslog over TCP. To enable using syslog TCP input in Graylog, do the following:

1. Go to the Graylog Web Console and select System > Input.

2. Select Syslog TCP in the Select Input list-menu and click Launch new input.

Configure EJBCA Logging

On the EJBCA server, configure WildFly to send messages to Graylog with syslog TCP. This is done by adding the following section in the logging subsystem in the JBoss/WildFly standalone.xml:

You also need to configure the root-logger to use the new handler, this will start sending the same logs to syslog. Add the new handler by modifying the root-loggers section in standalone.xml:

You can limit the logging further to only include the audit log, by configuring to only send events from org.cesecore.audit.impl.log4j.Log4jDevice to the syslog handler. This may be good if your main interest is statistics, but you will then miss things like Exceptions in the log.

Send some log items by performing an action in the EJBCA Admin UI, for example saving a certificate profile.

Create Graylog Extractors

Graylog Extractors are used to extract fields, that can be used in queries in Graylog, from the log stream. Create extractors for your log input under System > Input in the Graylog Web Console.

You can analyze log items and create the extractors you need. In our example, the following extractors are created:

• RADN: An administrators DN who issued a certificate, for example 'CN=RA Admin,O=PrimeKey,C=SE'

  • Extractor type: Split & Index

  • Split by: ;

  • Target index: 6

• EVENT: The event that happened, for example 'CERT_CREATION'

  • Extractor type: Split & Index

  • Split by: ;

  • Target index: 2

• CERTPROFILE: the certificate profile a certificate was issued for, for example 'certprofile=346136222'

  • Extractor type: Split & Index

  • Split by: ;

  • Target index: 11

• CERT: the certificate issued, for example 'cert=MIIE1DCCArygAw...'

  • Extractor type: Split & Index

  • Split by: ;

  • Target index: 13

  • Condition: Only attempt extraction if field contains string 'cert='

• SUBJECTDN: the subject DN a certificate is issued to, for example 'subjectdn=CN=Test1 test'

  • Extractor type: Split & Index

  • Split by: ;

  • Target index: 10

  • Condition: Only attempt extraction if field contains string 'subjectdn='

You can edit and create extractors of many different types, the above are simple examples.

Once the extractors have been created, go to EJBCA and make some actions to log something you want to visualize. For example, running the stresstest clientToolBox stress to issue a bunch of certificates, by different RAs.

Create Graylog Dashboard

Graylog dashboards allow you to build pre-defined views and visualize your data.

To create a new Graylog Dashboard, do the following:

1. Go to the Dashboards section and click Create dashboard to create a new dashboard called EJBCA stats.

2. Go to Search and create some searches for your dashboard.