Kerberos
Audit events in the Kerberos category are focused on the success or failure of kerberos credential access. Audit events are recorded when programs access the KCM (Kerberos Cache Manager) credential cache.
Kerberos Audit Event Log Sample
Sep 29 11:27:22 AbelRedhat5 adclient[8002]: INFO
AUDIT_TRAIL|Centrify Suite|Kerberos|1.0|200|Initializing
KCM credential cache succeeded|5|user=root pid=8584
utc=1538191642025 CentrifyEventID=63200 DASessID=N/A
DAInst=N/A status=SUCCESS service=kcm process=adclient
pid=8002 ccache=1001 principal=user1@ABEL.TEST
Kerberos Audit Events
Kerberos Audit Events
| Event ID | Description | Parameters |
|---|---|---|
| 63100 | Generating new KCM credential cache name succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name |
| 63101 | Generating new KCM credential cache name failed | process: process name pid: process id reason: error message |
| 63200 | Initializing KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name principal: principal name |
| 63201 | Initializing KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name principal: principal name reason: error message |
| 63300 | Destroying KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name |
| 63301 | Destroying KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |
| 63400 | Updating KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name principal: user principal services: service principal |
| 63401 | Updating KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |
| 63500 | Retrieving credential in the given KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: ccache name |
| 63501 | Retrieving credential in the given KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |
| 63600 | Reading principal in the given KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name principal: principal name |
| 63601 | Reading principal in the given KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |
| 63700 | Iterating credentials in the given KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name |
| 63701 | Iterating credentials in the given KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |
| 63800 | Reading credentials in the given KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name |
| 63801 | Reading credentials in the given KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |
| 63900 | Removing credentials from KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name principal: user principal services: service principal |
| 63901 | Removing credentials from KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |
| 64000 | Iterating KCM credential caches succeeded added in release 18.11 | |
| 64100 | Reading KCM credential caches succeeded | process: process name pid: process id |
| 64101 | Reading KCM credential caches failed added in release 18.11 | process: process name pid: process id reason: error message |
| 64200 | Changing the ownership for the given credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name uid: uid gid: gid |
| 64201 | Changing the ownership for the given credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |
| 64300 | Reading status for the given KCM credential cache succeeded added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name |
| 64301 | Reading status for the given KCM credential cache failed added in release 18.11 | process: process name pid: process id ccache: Kerberos credential cache name reason: error message |