-
Title
Integration into SIEM solutions -
Description
Can a SIEM solution integrate with Password Manager to control user access to the application?. -
Resolution
The Password Manager server can be configured to produce either “verbose” logs or “error only” logs. If either of these options is chosen in General Settings > Logging then logs will be produced for the Host, Admin, Helpdesk & User sites. Logs are stored by default in “C:\Windows\Temp” but you can change this location if you choose to. The naming convention of logs is .log:
QPM.UI.User.MVC_AD_2017-11-20.log QPM.Service.Host_AD_2017-11-20.log
QPM.UI.Helpdesk.MVC_AD_2017-11-20.log
QPM.UI.Admin.MVC_AD_2017-11-20.logIf you have Password Policy Manager installed you can also configure PPM logging (QPM.PPMgr_2017-10-23.log) through the registry, see more details in the following KB article:
https://support.oneidentity.com/password-manager/kb/127926Verbose logging can also be enabled on Standalone servers or client machines again by making some registry changes. In this case only User and/or Helpdesk and/or SPE logs will be produced since there is no Admin site or PM Service on these machines:
https://support.oneidentity.com/password-manager/kb/98432QPM.UI.User.MVC_AD_2017-11-20.log
QPM.UI.Helpdesk.MVC_AD_2017-11-20.log
QPM_SPE
QPM_SPEnrollNote: The SPE logs do not contain the Current Date as part of the file name and are not recycled each day.
When enabled each log will cover a 24 hour period (except SPE) starting at midnight and the logging times are in UTC. If logs are stopped and restarted or the service is stopped and restarted within the 24 hour time period then the logs will also stop and restart. Stopping and restarting will not overwrite existing data, new data will be will continue on from where the old data stopped. If you have logging enabled and you delete a log then a new log will be automatically created with the current date stamp.
Finally, please be aware that Password Manager also writes errors, exceptions and information messages to the Windows event logs. These are located under Event Viewer > Application and Service Logs > PM – One Identity Password Manager. However most if not all of the data contained in the event logs will also be captured in the verbose logs if enabled.