Assured: The Isode Blog

R11 Audit Logging

I've talked about our new logging, which I've only discussed in theory before.  I'm now using the R11 pre-release on my laptop, and I'm blown away by the details (I guess I like strange stuff).   I just hope Isode customers will like it as much as I do.

The GUIs give a lot of control on audit logging.   The capability for multiple streams also applies for audit logging, so if you need multiple audit logs with different (potentially overlapping) information you can have this.

Some organizations need a lot of audit logging, and others prefer to keep it to a minimum (to save disk space and optimize performance).   The GUIs allow you to choose which audit events you want (either select the events you need, or start with all events and deselect ones you don't want).   

We developed for M-Switch, an extensible an esily parseable attribute/value format of event logging.  This is important, as there are often lots of parameters that you may wish to log with an event.  The aviation industry requires very very detailed logging, of pretty much everything associated with each message.  We're now using this format for the audit logs in all of our products. 

You can control which records you want recorded.   If you need message trace information, this can be audit logged.   Again, this flexibility will enable audit logging to be appropriately tuned to operational requirements. 

Steve

XMSConsole - Monitoring for M-Store X.400 and High Assurance Messaging

We introduced XMSConsole quietly in R10.6, and have done quite a bit more work for the version which ships in R11.  XMS Console allows you to monitor M-Store X.400 (our X.400 P7 Message Store), and provides management features such as backup/restore and mailbox management.

A key new feature of monitoring unread messages is shown below.

 

For some messaging applications, this feature might seem   strange.  However if you are managning messages that need urgent action, such as in Aviation or Military situations, it is important for the operator to know about unread messages, so that actions can be taken to get them processed.  See our white paper on High Assurance Messaging.

Steve

DConsole - first look at Isode's new Directory Console

As part of R11, we are adding a Directory Console, imaginatively named DConsole.  DConsole is designed to be run by an operator, and can monitor the status of multiple copies of M-Vault. It can also monitor replication agreements, either from consumer end, supplier end or both. 

From discussions with many customers, we believe that this tool is going to be a big help for running M-Vault based directory services, and are looking forward to feedback.

Steve

InfoSec 2005

Over the next 3 days Isode representatives will be appearing at the Infosecurity Europe 2005 exhibition at London's Olympia exhibition centre.

We'll be on the stand of our partner Appliansys (Stand 735) helping them to launch their new 'RelayBOX200' server appliance which uses M-Switch to provide plug-in anti-spam protection.

If you are visiting InfoSec, please visit the stand and introduce yourself.

Microsoft Marketing

Of late, I've been reading a lot of Microsoft documents.   One of the things that I've noticed is that they invariably prefix references to X.400 and X.500 with "legacy".   I wonder if this is an official policy?  Sometimes the legacy description is appropriate, but it is often gratuitous and misleading.   It is certainly irritating me!   Perhaps we should have an Isode policy of always prefixing Microsoft with "proprietary"

Steve

Isode and LEMONADE

In our latest whitepaper you'll have read about our involvement in the IETF's LEMONADE working group, seeking to address the problems encountered by low bandwidth/availability mobile devices accessing email.

Isode CEO, Steve Kille, will be presenting a paper on 'LEMONADE - Open Standards for Mobile Messaging' at the EEMA Annual Conference in Leuven Belgium on 18th May, expanding on LEMONADE and why we believe an Open Standards approach to the unique problems of mobile messaging is the only sensible strategy for the long-term.

You can find out more about the conference by visiting the EEMA website. After the talk has been given, the presentation will be added to our website's 'Events' page.

Release 10.6v4 now available

The latest Isode product set release, Version 10.6v4, is now available from http://www.isode.com/customer/binary/R10.6v4/ , links to R10.6v4 documentation can be found on the relevant platform download pages.

Details of the features and fixes in this release can be found in the Release Notes, located at: http://www.isode.com/customer/binary/R10.6v4/RELEASE_NOTES-R10.6v4.html . Please note that both Release Notes and binaries are located in the Customer Area of the Isode website, access to which requires a login and password. If you don't have one then please contact your account manager. If you don't have an account manager and are intending to evaluate Isode products, access to this release will be given once you have submitted your evaluation request to evaluate@isode.com

This release is the last one before the major R11 release. We'll be posting more about R11 over the coming weeks.

Log Streams and XML

In my previous blog on the new R11.0 logging system, I explained our four basic logging functions (event; audit; debug; pdu) and an outline of functionality.   

One of the key features of the new system is the ability to have multiple logging streams.   This is configured using XML, which I'll show in some examples below.  In simple configurations, configuration is more likely to be done with our GUIs which are built over this underlying configuration.

The following examples shows a number of features:

<log-stream name="Events" clear="yes">

<log-file>dsa-event.log</log-file>

<log-event action="on" level="error critical authfail fatal warning"/>

</log-stream>

This creates a log stream that is recorded into a file, and logs certain classes of errors.  This would be a typical setup where the log records all events that an operator would need to take notice of.

<log-stream name="Events" clear="yes">

<log-file>dsa-event.log</log-file>

<log-event action="on" level="error critical authfail fatal warning"/>

<log-event action="off" facility="DSA" level="*"/>

<log-event action="off" facility="DSA_DISP" level="*"/>

<log-event action="off" facility="DSA_SECURITY" level="*"/>

</log-stream>

This second example shows a system log stream, which maps to syslog on Unix and Windows Event Manager on Windows.   It is useful where system logging is used as a key part of system management framework, particularly where this data is fed to third party management tools such as Tivoli or HP Openview (which support syslog).

This example also shows independent control of logging for different "facilities", which are modules within products.   Different logging information can be sent to different streams, and you can have as many streams as you want.

<log-config>

<log-stream name="Events">

<log-event action="on" facility="PP" event="REPORT_DISCARD"/>

</log-stream>

</log-config>

This final example shows how specific control can be applied for an individual event.  This might be used to hide or enable events, which are of interest to an operator.  For example an ISP would probably not want to see connection failures, whereas a high assurance messaging provider would.   Special streams can also be created, which migh have special processing for certain key events, such as the one shown here (discard of a delivery report, which cannot be processed). 

Steve

New Logging for R11 - a quick overview

We are rapidly approaching release R11.0.   One of the areas that has me really excited is our new logging system, and in particular our new event logging.   This is a major overhaul, and gives a lot of benefits.   

The current single mechanism is being replaced with a system that has four logging capabilities, with flexible configuration options:

1. Audit logging. This is logging of activity, recorded for audit purposes (e.g., Adding and entry to the directory). Audit logs typically contain structured information. Log entries are written in an easily parseable extensible format, that can be easily analyzed.

2. Event logging. Isode defines a set of events which are logged. Event types are recorded in an XML repository, which is used by the M-Vault code and provides documentation of events. Events are numbered, in a structured manner which indicates severity and error type. There is fine grain control as to which events are logged and how they are handled. Events may be mapped to native event logging systems (Windows Event Manager or Syslog), or logged to files. Events may be viewed in an operator event viewer.

3. PDU logging. In order to debug protocol, PDUs (Protocol Data Units) may be written out into a file that is identified in the normal log file. This enables easy handling of binary PDUs, and means that PDUs can be accessed without having to parse log files. There is fine grain control to enable PDU logging (e.g., to/from a specific peer server).

4. Debug logging. This can be enabled to diagnose complex failures. Debug logging can be enabled selectively for specific modules. This logging is generally only useful in the context of the product source code, and so would typically be used in conjuction with Isode support.

 

Steve

MIXER and AMHS don't mix

Isode supports solutions for the Aviation Industry, to provide AFTN/AMHS Gateways, allowing conversion between the older AFTN standards and the X.400 based AMHS.

Some organizations are using email/AFTN gateways, which provide an interconnection between AFTN, and local email systems. 

Isode provides M-Switch MIXER, which converts between X.400 and Internet email according to the MIXER Internet Standard.  An "obvious" approach for an organization with an email/AFTN gateway is to handle AMHS integration using MIXER. 

This turns out to be a VERY bad idea.   In part, beasue there is no standard approach to email/AFTN integration, but more importantly because is would block client access to important AMHS features.   

More details are in the latter sections of the Isode White paper:   http://www.isode.com/whitepapers/amhs-delivery.html

Steve