Configure Logging

The Configuration file logs activity related to running the Keyfactor Command configuration wizard only. The fields you may wish to edit are:

• fileName="C:\Keyfactor\logs\Command_Configuration_Log.txt"

  The path and file name of the active Keyfactor Command configuration wizard log file.

  Important:  If you choose to change the path for storage of the log files, you will need to create the new directory (e.g. D:\KeyfactorLogs) and grant both the service account under which the Keyfactor Command Service is running and the service account under which the IIS application pool for Keyfactor Command is running full control permissions on this directory. These roles may be served by the same service account.

• archiveFileName="C:\Keyfactor\logs\Command_Configuration_Log_Archive_{#}.txt"

  The path and file name of previous days’ Keyfactor Command configuration wizard log files. Keyfactor Command rotates log files daily and names the previous files using this naming convention.

• fileName="C:\Keyfactor\logs\Command_Audit_Log.txt"

  The path and file name of the active Keyfactor Command log file for auditable configuration wizard events. These logs are generated separately from the configuration log events to allow for separate tracking of auditable events. By default, the audit log filename/location for all components is the same to allow for a central source for tracking auditable events across the platform.

• archiveFileName="C:\Keyfactor\logs\Command_Audit_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command log files for auditable configuration wizard events.

• maxArchiveFiles="10"

  The number of archive files to retain before deletion. This field is listed multiple times in the NLog_Configuration.config file on a server —once for the main logging section and once for the audit logging section. The default number of files to retain is 10 for the main log and 14 for the audit log. The audit logs are small by default, and retaining a larger number of them shouldn't create a disk space issue.

• archiveAboveSize="52428800"

  The maximum file size of each log file. Once a log file reaches this size (50 MB by default), it will be rotated to archive even if the end of the day has not been reached.

• name="*" minlevel="Info" writeTo="logfile"

  The level of log detail that should be generated. This line applies to all the logs in the configuration file. The default "Info" level logs error and some informational data but at a minimal level to avoid generating large log files. For troubleshooting, it may be desirable to set the logging level to "Debug" or "Trace". Available log levels (in order of increasing verbosity) are:

  • OFF – No logging
  • FATAL – Log severe errors that cause early termination
  • ERROR – Log severe errors and other runtime errors or unexpected conditions that may not cause early termination
  • WARN – Log errors and use of deprecated APIs, poor use of APIs, "almost" errors, and other runtime situations that are undesirable or unexpected but not necessarily "wrong"
  • INFO – Log all of the above plus runtime events (startup/shutdown)
  • DEBUG – Log all of the above plus detailed information on the flow through the system
  • TRACE – Maximum log information—this option can generate VERY large log files

The KeyfactorAPI file is the primary file for logging activity related to running Keyfactor Command API. The fields you may wish to edit are:

• fileName="C:\Keyfactor\logs\Command_API_Log.txt"

  The path and file name of the active Keyfactor Command primary log file.

  Important:  If you choose to change the path for storage of the log files, you will need to create the new directory (e.g. D:\KeyfactorLogs) and grant both the service account under which the Keyfactor Command Service is running and the service account under which the IIS application pool for Keyfactor Command is running full control permissions on this directory. These roles may be served by the same service account.

• archiveFileName="c:\Keyfactor\logs\Command_API_Log_Archive_{#}.txt"

  The path and file name of previous days’ Keyfactor Command primary log files. Keyfactor Command rotates log files daily and names the previous files using this naming convention.

• fileName="C:\Keyfactor\logs\Command_Alert_Log.txt"

  The path and file name of the active Keyfactor Command primary log file for alerting events. This entry is only found on servers with the Keyfactor Command Service installed. Info level messages are written to this log whenever alerts (certificate expiration, pending certificate request, issued certificate, denied certificate request, or revocation monitoring) are run either as scheduled tasks or as tests. The log messages include the type of alert (e.g. expiration alert), the recipient of the alert (if an email was scheduled to be sent), and the alert subject line. You can change the level of logging in the log line that references writeTo="alertlogfile". These logs are generated separately from the primary log events to allow for separate tracking and log shipping of alerting events. By default, the alert log filename/location for all components is the same to allow for a central source for tracking alert events across the platform.

• archiveFileName="c:\Keyfactor\logs\Command_Alert_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command primary log files for alert events.

• fileName="C:\Keyfactor\logs\Command_Audit_Log.txt"

  The path and file name of the active Keyfactor Command primary log file for auditable events. These logs are generated separately from the primary log events to allow for separate tracking of auditable events. By default, the audit log filename/location for all components is the same to allow for a central source for tracking auditable events across the platform.

• archiveFileName="c:\Keyfactor\logs\Command_Audit_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command primary log files for auditable events.

• name="EmailAlertLogger" minlevel="Info" writeTo="alertlogfile"

  The level of log detail that should be generated for alert events and written to the alert logs.

• maxArchiveFiles="10"

  The number of archive files to retain before deletion. This field is listed multiple times in the NLog_KeyfactorAPI.config file —once for the main logging section, once for the alert logging section, and once for the audit logging section. The default number of files to retain is 10 for the main log and the synchronization log but 14 for the alert log and audit log. The alert and audit logs are small by default, and retaining a larger number of them shouldn't create a disk space issue.

• archiveAboveSize="52428800"

  The maximum file size of each log file. Once a log file reaches this size (50 MB by default), it will be rotated to archive even if the end of the day has not been reached.

• name="*" minlevel="Info" writeTo="logfile"

  The level of log detail that should be generated. This line applies to all the logs of the KeyfactorAPI file. The default "Info" level logs error and some informational data but at a minimal level to avoid generating large log files. For troubleshooting, it may be desirable to set the logging level to "Debug" or "Trace". Available log levels (in order of increasing verbosity) are:

  • OFF – No logging
  • FATAL – Log severe errors that cause early termination
  • ERROR – Log severe errors and other runtime errors or unexpected conditions that may not cause early termination
  • WARN – Log errors and use of deprecated APIs, poor use of APIs, "almost" errors, and other runtime situations that are undesirable or unexpected but not necessarily "wrong"
  • INFO – Log all of the above plus runtime events (startup/shutdown)
  • DEBUG – Log all of the above plus detailed information on the flow through the system
  • TRACE – Maximum log information—this option can generate VERY large log files

The Timer Service file logs activity related to scheduled and automated events within Keyfactor Command and includes the CA A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. sync logs. The fields you may wish to edit are:

• fileName="C:\Keyfactor\logs\Command_Service_Log.txt"

  The path and file name of the active Keyfactor Command timer service log file.

  Important:  If you choose to change the path for storage of the log files, you will need to create the new directory (e.g. D:\KeyfactorLogs) and grant both the service account under which the Keyfactor Command Service is running and the service account under which the IIS application pool for Keyfactor Command is running full control permissions on this directory. These roles may be served by the same service account.

• archiveFileName="C:\Keyfactor\logs\Command_Service_Log_Archive_{#}.txt"

  The path and file name of previous days’ Keyfactor Command timer service log files. Keyfactor Command rotates log files daily and names the previous files using this naming convention.

• fileName="C:\Keyfactor\logs\Command_Alert_Log.txt"

  The path and file name of the active Keyfactor Command timer service log file for alerting events. This entry is only found on servers with the Keyfactor Command Service installed. Info level messages are written to this log whenever alerts (certificate expiration, pending certificate request, issued certificate, denied certificate request, or revocation monitoring) are run either as scheduled tasks or as tests. The log messages include the type of alert (e.g. expiration alert), the recipient of the alert (if an email was scheduled to be sent), and the alert subject line. You can change the level of logging in the log line that references writeTo="alertlogfile". These logs are generated separately from the general timer service events to allow for separate tracking and log shipping of alerting events. By default, the alert log filename/location for all components is the same to allow for a central source for tracking alert events across the platform.

• archiveFileName="C:\Keyfactor\logs\Command_Alert_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command timer service log files for alert events.

• fileName="C:\Keyfactor\logs\Command_Audit_Log.txt"

  The path and file name of the active Keyfactor Command timer service log file for auditable events. These logs are generated separately from the general timer service events to allow for separate tracking of auditable events. By default, the audit log filename/location for all components is the same to allow for a central source for tracking auditable events across the platform.

• archiveFileName="C:\Keyfactor\logs\Command_Audit_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command timer service log files for auditable events.

• name="EmailAlertLogger" minlevel="Info" writeTo="alertlogfile"

  The level of log detail that should be generated for alert events and written to the alert logs.

• maxArchiveFiles="10"

  The number of archive files to retain before deletion. This field is listed multiple times in the NLog_TimerService.config file on a server with the Keyfactor Command Service installed—once for the main logging section, once for the alert logging section, and once for the audit logging section. The default number of files to retain is 10 for the main log and the synchronization log but 14 for the alert log and audit log. The alert and audit logs are small by default, and retaining a larger number of them shouldn't create a disk space issue.

• archiveAboveSize="52428800"

  The maximum file size of each log file. Once a log file reaches this size (50 MB by default), it will be rotated to archive even if the end of the day has not been reached.

• name="*" minlevel="Info" writeTo="logfile"

  The level of log detail that should be generated. This line applies to all the logs of the timer service file. The default "Info" level logs error and some informational data but at a minimal level to avoid generating large log files. For troubleshooting, it may be desirable to set the logging level to "Debug" or "Trace". Available log levels (in order of increasing verbosity) are:

  • OFF – No logging
  • FATAL – Log severe errors that cause early termination
  • ERROR – Log severe errors and other runtime errors or unexpected conditions that may not cause early termination
  • WARN – Log errors and use of deprecated APIs, poor use of APIs, "almost" errors, and other runtime situations that are undesirable or unexpected but not necessarily "wrong"
  • INFO – Log all of the above plus runtime events (startup/shutdown)
  • DEBUG – Log all of the above plus detailed information on the flow through the system
  • TRACE – Maximum log information—this option can generate VERY large log files

The Orchestrators, or OrchestratorsAPI, file logs activity related to orchestrators API. The fields you may wish to edit are:

• fileName="C:\Keyfactor\logs\Command_OrchestratorsAPI_Log.txt"

  The path and file name of the active Keyfactor Command orchestrators log file.

  Important:  If you choose to change the path for storage of the log files, you will need to create the new directory (e.g. D:\KeyfactorLogs) and grant both the service account under which the Keyfactor Command Service is running and the service account under which the IIS application pool for Keyfactor Command is running full control permissions on this directory. These roles may be served by the same service account.

• archiveFileName="C:\Keyfactor\logs\Command_OrchestratorsAPI_Log_Archive_{#}.txt"

  The path and file name of previous days’ Keyfactor Command orchestrators log files. Keyfactor Command rotates log files daily and names the previous files using this naming convention.

• fileName="C:\Keyfactor\logs\Command_Alert_Log.txt"

  The path and file name of the active Keyfactor Command orchestrators log file for alerting events. This entry is found on servers with the Keyfactor Command Service installed. Info level messages are written to this log whenever alerts (certificate expiration, pending certificate request, issued certificate, denied certificate request, or revocation monitoring) are run either as scheduled tasks or as tests. The log messages include the type of alert (e.g. expiration alert), the recipient of the alert (if an email was scheduled to be sent), and the alert subject line. You can change the level of logging in the log line that references writeTo="alertlogfile". These logs are generated separately from the general orchestrator Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. events to allow for separate tracking and log shipping of alerting events. By default, the alert log filename/location for all components is the same to allow for a central source for tracking alert events across the platform.

• archiveFileName="C:\Keyfactor\logs\Command_Alert_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command orchestrators log files for alert events.

• fileName="C:\Keyfactor\logs\Command_Audit_Log.txt"

  The path and file name of the active Keyfactor Command orchestrators log file for auditable events. These logs are generated separately from the general orchestrator events to allow for separate tracking of auditable events. By default, the audit log filename/location for all components is the same to allow for a central source for tracking auditable events across the platform.

• archiveFileName="C:\Keyfactor\logs\Command_Audit_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command orchestrators log files for auditable events.

• name="EmailAlertLogger" minlevel="Info" writeTo="alertlogfile"

  The level of log detail that should be generated for alert events and written to the alert logs.

• maxArchiveFiles="10"

  The number of archive files to retain before deletion. This field is listed multiple times in the NLog_Orchestrators.config file on a server with the Keyfactor Command Service installed—once for the main logging section, once for the alert logging section, and once for the audit logging section. The default number of files to retain is 10 for the main log and the synchronization log but 14 for the alert log and audit log. The alert and audit logs are small by default, and retaining a larger number of them shouldn't create a disk space issue.

• archiveAboveSize="52428800"

  The maximum file size of each log file. Once a log file reaches this size (50 MB by default), it will be rotated to archive even if the end of the day has not been reached.

  Note:  The default value for the archiveAboveSize setting was significantly larger in versions of Keyfactor Command prior to 7.5. In addition, the default maxArchiveFiles value was 2 for the main and CA synchronization logging sections. In environments where the logging level is consistently set at debug level or greater, this change may result in the generation of several log files per day.
• name="*" minlevel="Info" writeTo="logfile"

  The level of log detail that should be generated. This line applies to all the logs of the orchestrators file. The default "Info" level logs error and some informational data but at a minimal level to avoid generating large log files. For troubleshooting, it may be desirable to set the logging level to "Debug" or "Trace". Available log levels (in order of increasing verbosity) are:

  • OFF – No logging
  • FATAL – Log severe errors that cause early termination
  • ERROR – Log severe errors and other runtime errors or unexpected conditions that may not cause early termination
  • WARN – Log errors and use of deprecated APIs, poor use of APIs, "almost" errors, and other runtime situations that are undesirable or unexpected but not necessarily "wrong"
  • INFO – Log all of the above plus runtime events (startup/shutdown)
  • DEBUG – Log all of the above plus detailed information on the flow through the system
  • TRACE – Maximum log information—this option can generate VERY large log files

The Portal log is for logging any activity to do with the Keyfactor Command web portal.The fields you may wish to edit are:

• fileName="C:\Keyfactor\logs\Command_Portal_Log.txt"

  The path and file name of the active Keyfactor Command portal log file.

  Important:  If you choose to change the path for storage of the log files, you will need to create the new directory (e.g. D:\KeyfactorLogs) and grant both the service account under which the Keyfactor Command Service is running and the service account under which the IIS application pool for Keyfactor Command is running full control permissions on this directory. These roles may be served by the same service account.

• archiveFileName="C:\Keyfactor\logs\Command_Portal_Log_Archive_{#}.txt"

  The path and file name of previous days’ Keyfactor Command portal log files. Keyfactor Command rotates log files daily and names the previous files using this naming convention.

• fileName="C:\Keyfactor\logs\Command_Alert_Log.txt"

  The path and file name of the active Keyfactor Command portal log file for alerting events. This entry is found on servers with the Keyfactor Command Service installed. Info level messages are written to this log whenever alerts (certificate expiration, pending certificate request, issued certificate, denied certificate request, or revocation monitoring) are run either as scheduled tasks or as tests. The log messages include the type of alert (e.g. expiration alert), the recipient of the alert (if an email was scheduled to be sent), and the alert subject line. You can change the level of logging in the log line that references writeTo="alertlogfile". These logs are generated separately from the general portal events to allow for separate tracking and log shipping of alerting events. By default, the alert log filename/location for all components is the same to allow for a central source for tracking alert events across the platform.

• archiveFileName="C:\Keyfactor\logs\Command_Alert_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command portal log files for alert events.

• fileName="C:\Keyfactor\logs\Command_Audit_Log.txt"

  The path and file name of the active Keyfactor Command portal log file for auditable events. These logs are generated separately from the general portal events to allow for separate tracking of auditable events. By default, the audit log filename/location for all components is the same to allow for a central source for tracking auditable events across the platform.

• archiveFileName="C:\Keyfactor\logs\Command_Audit_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command portal log files for auditable events.

• name="EmailAlertLogger" minlevel="Info" writeTo="alertlogfile"

  The level of log detail that should be generated for alert events and written to the alert logs.

• maxArchiveFiles="10"

  The number of archive files to retain before deletion. This field is listed multiple times in the NLog_Portal.config file on a server with the Keyfactor Command Service installed—once for the main logging section, once for the alert logging section, and once for the audit logging section. The default number of files to retain is 10 for the main log and the synchronization log but 14 for the alert log and audit log. The alert and audit logs are small by default, and retaining a larger number of them shouldn't create a disk space issue.

• archiveAboveSize="52428800"

  The maximum file size of each log file. Once a log file reaches this size (50 MB by default), it will be rotated to archive even if the end of the day has not been reached.

• name="*" minlevel="Info" writeTo="logfile"

  The level of log detail that should be generated. This line applies to all the logs in the portal file. The default "Info" level logs error and some informational data but at a minimal level to avoid generating large log files. For troubleshooting, it may be desirable to set the logging level to "Debug" or "Trace". Available log levels (in order of increasing verbosity) are:

  • OFF – No logging
  • FATAL – Log severe errors that cause early termination
  • ERROR – Log severe errors and other runtime errors or unexpected conditions that may not cause early termination
  • WARN – Log errors and use of deprecated APIs, poor use of APIs, "almost" errors, and other runtime situations that are undesirable or unexpected but not necessarily "wrong"
  • INFO – Log all of the above plus runtime events (startup/shutdown)
  • DEBUG – Log all of the above plus detailed information on the flow through the system
  • TRACE – Maximum log information—this option can generate VERY large log files

The ClasssicAPI file logs activity related to invoking the ClassicAPI from Keyfactor Command. The fields you may wish to edit are:

• fileName="C:\Keyfactor\logs\Command_ClassicAPI_Log.txt"

  The path and file name of the active Keyfactor Command classic API log file.

  Important:  If you choose to change the path for storage of the log files, you will need to create the new directory (e.g. D:\KeyfactorLogs) and grant both the service account under which the Keyfactor Command Service is running and the service account under which the IIS application pool for Keyfactor Command is running full control permissions on this directory. These roles may be served by the same service account.

• archiveFileName="C:\Keyfactor\logs\Command_ClassicAPI_Log_Archive_{#}.txt"

  The path and file name of previous days’ Keyfactor Command classic API log files. Keyfactor Command rotates log files daily and names the previous files using this naming convention.

• fileName="C:\Keyfactor\logs\Command_Alert_Log.txt"

  The path and file name of the active Keyfactor Command classic API log file for alerting events. This entry is found on servers with the Keyfactor Command Service installed. Info level messages are written to this log whenever alerts (certificate expiration, pending certificate request, issued certificate, denied certificate request, or revocation monitoring) are run either as scheduled tasks or as tests. The log messages include the type of alert (e.g. expiration alert), the recipient of the alert (if an email was scheduled to be sent), and the alert subject line. You can change the level of logging in the log line that references writeTo="alertlogfile". These logs are generated separately to allow for separate tracking and log shipping of alerting events. By default, the alert log filename/location for all components is the same to allow for a central source for tracking alert events.

• archiveFileName="C:\Keyfactor\logs\Command_Alert_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command classic API log files for alert events.

• fileName="C:\Keyfactor\logs\Command_Audit_Log.txt"

  The path and file name of the active Keyfactor Command classic API log file for auditable events. These logs are generated separately from the general classic API events to allow for separate tracking auditable events. By default, the audit log filename/location for all components is the same to allow for a central source for tracking auditable events across the platform.

• archiveFileName="C:\Keyfactor\logs\Command_Audit_Log_Archive_{#}.txt""

  The path and file name of previous days’ Keyfactor Command classic API log files for auditable events.

• name="EmailAlertLogger" minlevel="Info" writeTo="alertlogfile"

  The level of log detail that should be generated for alert events and written to the alert logs.

• maxArchiveFiles="10"

  The number of archive files to retain before deletion. This field is listed multiple times in the Nlog_ClassicAPI.config file —once for the main logging section, once for the alert logging section, and once for the audit logging section. The default number of files to retain is 10 for the main log and the synchronization log but 14 for the alert log and audit log. The alert and audit logs are small by default, and retaining a larger number of them shouldn't create a disk space issue.

• archiveAboveSize="52428800"

  The maximum file size of each log file. Once a log file reaches this size (50 MB by default), it will be rotated to archive even if the end of the day has not been reached.

• name="*" minlevel="Info" writeTo="logfile"

  The level of log detail that should be generated. This line applies to all the logs of the classicAPI file. The default "Info" level logs error and some informational data but at a minimal level to avoid generating large log files. For troubleshooting, it may be desirable to set the logging level to "Debug" or "Trace". Available log levels (in order of increasing verbosity) are:

  • OFF – No logging
  • FATAL – Log severe errors that cause early termination
  • ERROR – Log severe errors and other runtime errors or unexpected conditions that may not cause early termination
  • WARN – Log errors and use of deprecated APIs, poor use of APIs, "almost" errors, and other runtime situations that are undesirable or unexpected but not necessarily "wrong"
  • INFO – Log all of the above plus runtime events (startup/shutdown)
  • DEBUG – Log all of the above plus detailed information on the flow through the system
  • TRACE – Maximum log information—this option can generate VERY large log files

Figure 516: Nlog_ClassicAPI.config