All About Common Auditing and Reporting Service

Common Auditing and Reporting Service(CARS) is capable of collecting events from Master Policy Server and WebSEAL and can process the data so that reports can be viewed through Tivoli Common reporting package or any other third party reporting products.

CARS can be deployed in clustered and non clustered environments. Installation and configuration of CARS is not straight forward and there are few steps that need to be verified/corrected post CARS configuration to ensure it functions as expected.

CARS is better known to work on AIX because its an IBM component and they probably unit test their code on AIX :)

Here are few things that we need to verify post CARS Configuration:

1. Ensure stored procedures run properly. From DB2 command line, execute the stored procedures to make sure they are running properly
2. Run Test Connection on eventxml data source. In a clustered environment, its important that the data source connection is successful on both nodes.
3. Make sure DB2 client is installed on both the nodes in a clustered environment
4. If MPS/WebSEAL tries to talk to CARS over SSL:

• Ensure that CARS application roles are mapped to the user id that MPS and WebSEAL use to communicate to CARS.
• After running amauditcfg on MPS and WebSEAL, verify if clientPassword is set in the config file( clientUsername, clientPassword, key database path, stash file path are mandatory if MPS/WebSEAL tries to talk to CARS over SSL).
• Ensure application security is enabled on the deployment manager profile where CARS cluster resides.

Happy auditing :)