VOMS endpoint logs

[stlammel]

Dear IAM team,
we had a user failing to get a VOMS extension. Trying to look at the
IAM logs, we didn't find any entry and believe access logs from the
IAM VOMS endpoint are not forwarded to CERN's OpenSearch.
Could they please be included? (Might be for Hannah and Berk if
IAM provides the logs already. But assistance maybe needed if this
was overlooked.)
Thanks,
cheers, Stephan

[balciiberk]

Hi Stephan,

Currently, the VOMS-AA logs at CERN aren't pushed to OpenSearch. It's already on my to-do list to add them but currently, voms-aa provides logs only on the DEBUG log level. There is no log on the INFO level. And on the DEBUG mode, there are 50+ logs per proxy request including the proxy itself which shouldn't be pushed to OpenSearch. I'm currently waiting for this to be changed before adding them to OpenSearch.

I will contact you by email to learn the details about the user you mentioned to debug the issue.

Cheers,
Berk

[stlammel]

Thanks Berk!
Yes, let's improve the logging before pushing it to OpenSearch.
I think a one record for a successful/failed VOMS access with source host, user/cert, and success/failure reason would do.

• Stephan

[maarten-litmaath]

Hallo Stephan,
if that user still has a problem, I could have a look: please e-mail the details in that case.

[stlammel]

Thanks Maarten! It turned out the user had his certifcate expired. But he reported the voms-proxy-init succeeding at other locations thus us not suspecting the obvious...

• Stephan