Re: Documenting the kerberos KDC log file format

2017-01-31 Thread Benjamin Kaduk
On Tue, Jan 31, 2017 at 12:44:20AM -0600, Benjamin Kaduk wrote: > On Mon, Jan 30, 2017 at 11:01:46PM -0700, Todd Grayson wrote: > > Has anyone seen a good writeup of the krb5kdc.log file output format? For > > the types of log file output statements that it writes out. So for example > > the AS_RE

Studying kerberos interaction patterns through krb5kdc log file (and client log) analysis

2017-01-31 Thread Todd Grayson
Howdy, Has anyone seen or worked on pulling together tools for analyzing kerberos krb5kdc.log files in a way that allows for the analysis (graphing even) of service and user AS and TGS interactions over a window of time. I found the historical MIT mail list discussion "krb5kdc log analysis tool/s

Re: Documenting the kerberos KDC log file format

2017-01-31 Thread Todd Grayson
Yeah I'm looking for the REQ layout, the other message types are variable to the point where they are being filtered out (altho I pause dropping FD closing down messages...) so something like the following, note authtime field is a mystery (or something is really really broken in the logs I'm look

Re: Documenting the kerberos KDC log file format

2017-01-31 Thread Benjamin Kaduk
On Mon, Jan 30, 2017 at 11:01:46PM -0700, Todd Grayson wrote: > Has anyone seen a good writeup of the krb5kdc.log file output format? For > the types of log file output statements that it writes out. So for example > the AS_REQ and TGS_REQ and follow up "closing down" lines representing a > full c