The daily edition.

Scope: Rocket Enterprise Developer / Enterprise Server 12.0, UNIX documentation set (enterprisedevelopereclux_ug_120). Everything below comes from the 12.0 UNIX manual pages cited inline.

What security tracing gives you

When a signon fails or an access check returns an unexpected result, the first diagnostic question is where the External Security Facility (ESF) decision was made and why. The Security Tracing page says security trace messages can be written to three places:

• the region's console.log
• the MFDS journal.log
• the AUX trace

Where you configure it

Detailed security tracing is set in the relevant Configuration Text areas, at two scopes, per the Security Tracing page:

• MFDS, and globally for all regions (the "security" button in the left-hand pane), through either of these:
  • the default Enterprise Server Security tab
  • each Security Manager definition
• Individual regions, through the region's Security tab (from the Server > Properties tabs).

The page also states that the options available for Security Manager tracing depend on the External Security Manager (ESM) module that manager uses. So there is no single universal trace switch: what you can turn on for an MLDAP-based manager is not necessarily what another module offers. In addition, the security AUX trace flag (saf) can be enabled for region-specific security tracing.

The MFDS startup nuance

The documentation notes that problems with initial access to MFDS (for example, when starting a region) are logged in the MFDS journal. The catch is that trace must first be set up in the ESM for those messages to be output. If you wait until a startup-time access problem occurs before configuring tracing, there will be nothing detailed to read. Configure the ESM trace before you reproduce the problem.

A related, deliberately noisy option: cache tracing

If you use the MLDAP ESM module with caching, the Understanding LDAP Caching page explains the following:

• Caching is enabled by positive values for Cache Limit and Cache TTL in the Security Manager definition, and setting either to 0 disables it.
• The cache serves ESF Verify (authenticate a user) and Auth (authorize resource access) requests; ESF Admin requests bypass it.
• Each cache is private to that Security Manager and process, and is shared only between threads in a single process.
• On process termination of ESF, the module logs message 1095 with cache performance information.
• There is also an optional cache tracing configuration setting. It produces extensive information about cache activity, so the page says to use it with care. The page points to MLDAP ESM Module Custom Configuration Information for that setting; I did not retrieve the exact setting name from that long page, so check it there rather than relying on this article.

Because cache entries can be evicted by expiry, least-recently-used pressure, staleness after a module-made change, or an ESF Update flush, a surprising authorization result during tracing is worth comparing against these four eviction causes before assuming a rule is wrong.

Do not leave it on

Two pages agree on the operational rule. Security Tracing says security tracing can have a significant effect on performance, so it should not be left on in a production system. Hardening ESF: Summary adds a security reason: tracing might provide attackers with useful information, so avoid leaving it enabled, particularly in production.

A practical workflow (interpretation)

This sequence is my reading of the documented behavior, not a tested procedure:

1. Decide the narrowest scope that covers the problem: one region's Security tab, or the Security Manager definition if several regions share it.
2. Enable only the trace options your ESM module offers, and the saf AUX flag if you need region-specific detail.
3. Reproduce the problem, then read console.log, the MFDS journal.log or the AUX trace as appropriate.
4. Turn tracing back off.

Takeaway

Security trace output can go to console.log, the MFDS journal.log and the AUX trace; it is configured per Security Manager, globally, or per region; the available options depend on the ESM module; and it must be switched off again afterwards because of both its performance cost and the information it may expose.