How to turn on debug log in WebSEAL

~ Anton Khitrenovich

You can turn on debug logging with “trace” utility from “pdadmin” shell via “server task” call. Here is the general format of the call:

server task <instance>-<host> trace set <component> <level> file path=<path>

The parts in the angle brackets should be replaced with appropriate values:

  • <instance> – the name of WebSEAL instance
  • <host> – hostname of the server that runs WebSEAL
  • <component> – name of the component to turn logging on for (see below)
  • <level> – log level to use (1 to 9, where 1 is the most detailed; use 0 to turn logging off)
  • <path> – filename of the log file to fill with the information

The list of the components can be obtained with “trace list” command. Among the useful WebSEAL-related components:

  • pdweb – trace all WebSEAL-related information
  • pdweb.debug – list of HTTP header going trough WebSEAL
  • pdweb.snoop – same, but including message body
  • pdweb.snoop.client – same, but only for data sent between WebSEAL and the web client
  • pdweb.snoop.jct – same, for data sent between WebSEAL and the actual web servers (aka “junctions”)
In the example below you can see how to turn on debugging of the web traffic that goes through WebSEAL. The log will go to “C:\pdweb.debug” file. [ Update (April 2013): How to open the ‘pdadmin’ shell. ]
C:\>pdadmin
pdadmin> login
Enter User ID: sec_master
Enter Password: ********
pdadmin sec_master> server task default-webseald-tameb trace set pdweb.debug 2 file path=C:\pdweb.debug
pdadmin sec_master>

You can read more about “server task trace” in the TAMeb documentation.

Published by Anton Khitrenovich

4 thoughts on “How to turn on debug log in WebSEAL”

  2. – log level to use (1 to 9, where 1 is the most detailed; use 0 to turn logging off)
    Are you sure? if 0 is off and you open a ticket with IBM they ask for 9… I would bet that 9 is the most detail.

    Reply

    1. Could be, and it makes sense to me now, given that 0 is no logging at all – but I see that I had emphasized that back in 2011, likely because it was as counter-intuitive back than as it sounds to me now. Anyway, I didn’t have to touch WebSEAL for more than 10 years, so can neither confirm not deny…

      Reply

Leave a Reply