diff --git a/base/ca/shared/conf/CS.cfg b/base/ca/shared/conf/CS.cfg

index 63cb299..2d5d962 100644

--- a/base/ca/shared/conf/CS.cfg

+++ b/base/ca/shared/conf/CS.cfg

@@ -911,7 +911,7 @@ log.instance.SignedAudit._007=## $ pki-server ca-audit-event-enable/disable 

 log.instance.SignedAudit._008=##

 log.instance.SignedAudit.bufferSize=512

 log.instance.SignedAudit.enable=true

-log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,AUDIT_LOG_SHUTDOWN,AUDIT_LOG_SIGNING,AUDIT_LOG_STARTUP,AUTH,AUTHORITY_CONFIG,AUTHZ,CERT_PROFILE_APPROVAL,CERT_REQUEST_PROCESSED,CERT_SIGNING_INFO,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,CLIENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CMC_REQUEST_RECEIVED,CMC_RESPONSE_SENT,CMC_SIGNED_REQUEST_SIG_VERIFY,CMC_USER_SIGNED_REQUEST_SIG_VERIFY,CONFIG_ACL,CONFIG_AUTH,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_ENCRYPTION,CONFIG_ROLE,CONFIG_SERIAL_NUMBER,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KEY,CRL_SIGNING_INFO,DELTA_CRL_GENERATION,FULL_CRL_GENERATION,KEY_GEN_ASYMMETRIC,LOG_PATH_CHANGE,OCSP_GENERATION,OCSP_SIGNING_INFO,PROFILE_CERT_REQUEST,PROOF_OF_POSSESSION,RANDOM_GENERATION,ROLE_ASSUME,SECURITY_DATA_ARCHIVAL_REQUEST,SECURITY_DOMAIN_UPDATE,SELFTESTS_EXECUTION,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED

+log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,AUDIT_LOG_SIGNING,AUDIT_LOG_STARTUP,AUTH,AUTHORITY_CONFIG,AUTHZ,CERT_PROFILE_APPROVAL,CERT_REQUEST_PROCESSED,CERT_SIGNING_INFO,CERT_STATUS_CHANGE_REQUEST,CERT_STATUS_CHANGE_REQUEST_PROCESSED,CLIENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CMC_REQUEST_RECEIVED,CMC_RESPONSE_SENT,CMC_SIGNED_REQUEST_SIG_VERIFY,CMC_USER_SIGNED_REQUEST_SIG_VERIFY,CONFIG_ACL,CONFIG_AUTH,CONFIG_CERT_PROFILE,CONFIG_CRL_PROFILE,CONFIG_ENCRYPTION,CONFIG_ROLE,CONFIG_SERIAL_NUMBER,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KEY,CRL_SIGNING_INFO,DELTA_CRL_GENERATION,FULL_CRL_GENERATION,KEY_GEN_ASYMMETRIC,LOG_PATH_CHANGE,OCSP_GENERATION,OCSP_SIGNING_INFO,PROFILE_CERT_REQUEST,PROOF_OF_POSSESSION,RANDOM_GENERATION,ROLE_ASSUME,SCHEDULE_CRL_GENERATION,SECURITY_DOMAIN_UPDATE,SELFTESTS_EXECUTION,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED

 log.instance.SignedAudit.filters.CMC_SIGNED_REQUEST_SIG_VERIFY=(Outcome=Failure)

 log.instance.SignedAudit.filters.CMC_USER_SIGNED_REQUEST_SIG_VERIFY=(Outcome=Failure)

 log.instance.SignedAudit.filters.DELTA_CRL_GENERATION=(Outcome=Failure)

diff --git a/base/java-tools/man/man1/PKICertImport.1 b/base/java-tools/man/man1/PKICertImport.1

new file mode 100644

index 0000000..c1bd6e3

--- /dev/null

+++ b/base/java-tools/man/man1/PKICertImport.1

@@ -0,0 +1,74 @@

+.\" First parameter, NAME, should be all caps

+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection

+.\" other parameters are allowed: see man(7), man(1)

+.TH PKICertImport 1 "Jan 30, 2019" "version 10.6" "PKI certificate import tool" Dogtag Team

+.\" Please adjust this date whenever revising the man page.

+.\"

+.\" Some roff macros, for reference:

+.\" .nh        disable hyphenation

+.\" .hy        enable hyphenation

+.\" .ad l      left justify

+.\" .ad b      justify to both left and right margins

+.\" .nf        disable filling

+.\" .fi        enable filling

+.\" .br        insert line break

+.\" .sp <n>    insert n+1 empty lines

+.\" for man page specific macros, see man(7)

+.SH NAME

+PKICertImport \- Used to safely validate and import certificates into the NSS database.

+

+.SH SYNOPSIS

+.PP

+\fBUsage: PKICertImport -d <location of nssdb> -i <location of certificate> -n <nickname for certificate> -t <trust flags> -u <usage flags> [-h <hardware token name>] [-f <password file>] [-a]\fP

+

+Validate and import a certificate into the specified NSS database. Verifies signature, trust chain, trust, and usage flags. If a certificate is not valid, it will not be added to the NSS DB or specified hardware token.

+

+.SH DESCRIPTION

+.PP

+The certificate import utility validates signature, trust chain, trust, and usage flags before importing a certificate into the specified NSS database. This ensures that no certificate is used before its authenticity has been verified. Unlike \fBcertutil\fP, only one invocation is necessary to both validate and import certificates.

+.PP

+See \fBcertutil\fP for more information about the parameters to \fBPKICertImport\fP.

+

+.SH OPTIONS

+.PP

+\fBPKICertImport\fP parameters:

+.PP

+.TP

+.B --ascii, -a

+The certificate is encoded in ASCII (PEM) format instead of binary format. Optional.

+

+.TP

+.B --database, -d <location of NSS db>

+The directory containing the NSS database. This is usually the client's personal directory. Required.

+

+.TP

+.B --password, -f <location of password file>

+The path to a file containing the password to the NSS database. Optional.

+

+.TP

+.B --hsm, -h <hardware token name>

+Name of the token. By default it takes 'internal'. Optional.

+

+.TP

+.B --certificate, -i <location of certificate>

+Path to the certificate to import. Required.

+

+.TP

+.B --nickname, -n <nickname for the certificate>

+Nickname for the certificate in the NSS DB. Required.

+

+.TP

+.B --trust, -t <NSS trust flags>

+Trust flags for the certificate. See \fBcertutil\fP for more information about the available trust flags. Required.

+

+.TP

+.B --usage, -u <NSS usage flags>

+Usage to validate the certificate against. See \fBcertutil\fP for more information about available usage flags. Required.

+

+.SH AUTHORS

+Alexander Scheel <ascheel@redhat.com>.

+

+.SH COPYRIGHT

+Copyright (c) 2019 Red Hat, Inc. This is licensed under the GNU General Public

+License, version 2 (GPLv2). A copy of this license is available at

+http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.

diff --git a/base/kra/shared/conf/CS.cfg b/base/kra/shared/conf/CS.cfg

index 8bfb0fb..f21f305 100644

--- a/base/kra/shared/conf/CS.cfg

+++ b/base/kra/shared/conf/CS.cfg

@@ -306,7 +306,7 @@ log.instance.SignedAudit._007=## $ pki-server kra-audit-event-enable/disable 

 log.instance.SignedAudit._008=##

 log.instance.SignedAudit.bufferSize=512

 log.instance.SignedAudit.enable=true

-log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,ASYMKEY_GENERATION_REQUEST,ASYMKEY_GENERATION_REQUEST_PROCESSED,AUDIT_LOG_SHUTDOWN,AUDIT_LOG_SIGNING,AUDIT_LOG_STARTUP,AUTH,AUTHZ,CLIENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CONFIG_ACL,CONFIG_AUTH,CONFIG_DRM,CONFIG_ENCRYPTION,CONFIG_ROLE,CONFIG_SERIAL_NUMBER,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KEY,KEY_GEN_ASYMMETRIC,LOG_PATH_CHANGE,RANDOM_GENERATION,ROLE_ASSUME,SECURITY_DATA_ARCHIVAL_REQUEST,SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED,SECURITY_DATA_RECOVERY_REQUEST,SECURITY_DATA_RECOVERY_REQUEST_PROCESSED,SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE,SELFTESTS_EXECUTION,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED,SYMKEY_GENERATION_REQUEST,SYMKEY_GENERATION_REQUEST_PROCESSED

+log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,ASYMKEY_GENERATION_REQUEST,ASYMKEY_GENERATION_REQUEST_PROCESSED,AUDIT_LOG_SIGNING,AUDIT_LOG_STARTUP,AUTH,AUTHZ,CLIENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CONFIG_ACL,CONFIG_AUTH,CONFIG_DRM,CONFIG_ENCRYPTION,CONFIG_ROLE,CONFIG_SERIAL_NUMBER,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KEY,KEY_GEN_ASYMMETRIC,LOG_PATH_CHANGE,RANDOM_GENERATION,ROLE_ASSUME,SCHEDULE_CRL_GENERATION,SECURITY_DATA_ARCHIVAL_REQUEST,SECURITY_DATA_ARCHIVAL_REQUEST_PROCESSED,SECURITY_DATA_RECOVERY_REQUEST,SECURITY_DATA_RECOVERY_REQUEST_PROCESSED,SECURITY_DATA_RECOVERY_REQUEST_STATE_CHANGE,SELFTESTS_EXECUTION,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED,SYMKEY_GENERATION_REQUEST,SYMKEY_GENERATION_REQUEST_PROCESSED

 log.instance.SignedAudit.filters.ASYMKEY_GENERATION_REQUEST=(Outcome=Failure)

 log.instance.SignedAudit.filters.ASYMKEY_GENERATION_REQUEST_PROCESSED=(Outcome=Failure)

 log.instance.SignedAudit.filters.KEY_GEN_ASYMMETRIC=(Outcome=Failure)

diff --git a/base/ocsp/shared/conf/CS.cfg b/base/ocsp/shared/conf/CS.cfg

index 2fd546a..4c584e9 100644

--- a/base/ocsp/shared/conf/CS.cfg

+++ b/base/ocsp/shared/conf/CS.cfg

@@ -222,7 +222,7 @@ log.instance.SignedAudit._007=## $ pki-server ocsp-audit-event-enable/disable 

 log.instance.SignedAudit._008=##

 log.instance.SignedAudit.bufferSize=512

 log.instance.SignedAudit.enable=true

-log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,AUDIT_LOG_SHUTDOWN,AUDIT_LOG_SIGNING,AUDIT_LOG_STARTUP,AUTH,AUTHZ,CLIENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CONFIG_ACL,CONFIG_AUTH,CONFIG_ENCRYPTION,CONFIG_OCSP_PROFILE,CONFIG_ROLE,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KEY,KEY_GEN_ASYMMETRIC,LOG_PATH_CHANGE,OCSP_ADD_CA_REQUEST_PROCESSED,OCSP_GENERATION,OCSP_REMOVE_CA_REQUEST_PROCESSED,OCSP_SIGNING_INFO,RANDOM_GENERATION,ROLE_ASSUME,SELFTESTS_EXECUTION,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED

+log.instance.SignedAudit.events=ACCESS_SESSION_ESTABLISH,ACCESS_SESSION_TERMINATED,AUDIT_LOG_SIGNING,AUDIT_LOG_STARTUP,AUTH,AUTHZ,CLIENT_ACCESS_SESSION_ESTABLISH,CLIENT_ACCESS_SESSION_TERMINATED,CONFIG_ACL,CONFIG_AUTH,CONFIG_ENCRYPTION,CONFIG_OCSP_PROFILE,CONFIG_ROLE,CONFIG_SIGNED_AUDIT,CONFIG_TRUSTED_PUBLIC_KEY,KEY_GEN_ASYMMETRIC,LOG_PATH_CHANGE,OCSP_ADD_CA_REQUEST_PROCESSED,OCSP_GENERATION,OCSP_REMOVE_CA_REQUEST_PROCESSED,OCSP_SIGNING_INFO,RANDOM_GENERATION,ROLE_ASSUME,SCHEDULE_CRL_GENERATION,SELFTESTS_EXECUTION,SERVER_SIDE_KEYGEN_REQUEST,SERVER_SIDE_KEYGEN_REQUEST_PROCESSED

 log.instance.SignedAudit.filters.RANDOM_GENERATION=(Outcome=Failure)

 log.instance.SignedAudit.expirationTime=0

 log.instance.SignedAudit.fileName=[PKI_INSTANCE_PATH]/logs/[PKI_SUBSYSTEM_TYPE]/signedAudit/ocsp_cert-ocsp_audit

diff --git a/base/server/cms/src/com/netscape/cms/logging/LogFile.java b/base/server/cms/src/com/netscape/cms/logging/LogFile.java

index 564f1bb..780ca01 100644

--- a/base/server/cms/src/com/netscape/cms/logging/LogFile.java

+++ b/base/server/cms/src/com/netscape/cms/logging/LogFile.java

@@ -870,7 +870,7 @@ public class LogFile implements ILogEventListener, IExtendedPluginInfo {

      * 

      *

      * 

-     * 
signed.audit LOGGING_SIGNED_AUDIT_AUDIT_LOG_SHUTDOWN used at audit function shutdown

+     * 
signed.audit AUDIT_LOG_SHUTDOWN used at audit function shutdown

      * 

      */

     public synchronized void shutdown() {

diff --git a/base/server/cmsbundle/src/audit-events.properties b/base/server/cmsbundle/src/audit-events.properties

index ddc278e..64548da 100644

--- a/base/server/cmsbundle/src/audit-events.properties

+++ b/base/server/cmsbundle/src/audit-events.properties

@@ -8,1286 +8,1758 @@

 #

 #   Event: <event type>

 #   Description: <event description>

+#     <use 2 spaces to indent long description>

 #   Applicable subsystems: <comma-separated list of subsystems>

 #   Enabled by default: <Yes|No>

 #   Fields:

 #   - <field name>: <field description>

+#       <use 2 spaces to indent long description>

 #

 # Note: In the actual event definition there should be exactly 1 space

 # after the # sign.

 #

 # Common fields:

-# - Outcome: must be "success" or "failure"

-# - SubjectID: must be the UID of the user responsible for the operation

-#             "$System$" if system-initiated operation (e.g. log signing)

+# - Outcome: "Success" or "Failure"

+# - SubjectID: The UID of the user responsible for the operation

+#     "$System$" or "SYSTEM" if system-initiated operation (e.g. log signing).

 #

 #########################################################################

-# Selectable Signed Audit Events

+# Required Audit Events

+#

+# Event: ACCESS_SESSION_ESTABLISH with [Outcome=Failure]

+# Description: This event is used when access session failed to establish.

+# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Enabled by default: Yes

+# Fields:

+# - ClientIP: Client IP address.

+# - ServerIP: Server IP address.

+# - SubjectID: Client certificate subject DN.

+# - Outcome: Failure

+# - Info: Failure reason.

+#

+LOGGING_SIGNED_AUDIT_ACCESS_SESSION_ESTABLISH_FAILURE=\

+<type=ACCESS_SESSION_ESTABLISH>:[AuditEvent=ACCESS_SESSION_ESTABLISH]{0} access session establish failure

+#

+# Event: ACCESS_SESSION_ESTABLISH with [Outcome=Success]

+# Description: This event is used when access session was established successfully.

+# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Enabled by default: Yes

+# Fields:

+# - ClientIP: Client IP address.

+# - ServerIP: Server IP address.

+# - SubjectID: Client certificate subject DN.

+# - Outcome: Success

+#

+LOGGING_SIGNED_AUDIT_ACCESS_SESSION_ESTABLISH_SUCCESS=\

+<type=ACCESS_SESSION_ESTABLISH>:[AuditEvent=ACCESS_SESSION_ESTABLISH]{0} access session establish success

+#

+# Event: ACCESS_SESSION_TERMINATED

+# Description: This event is used when access session was terminated.

+# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Enabled by default: Yes

+# Fields:

+# - ClientIP: Client IP address.

+# - ServerIP: Server IP address.

+# - SubjectID: Client certificate subject DN.

+# - Info: The TLS Alert received from NSS

+# - Outcome: Success

+# - Info: The TLS Alert received from NSS

+#

+LOGGING_SIGNED_AUDIT_ACCESS_SESSION_TERMINATED=\

+<type=ACCESS_SESSION_TERMINATED>:[AuditEvent=ACCESS_SESSION_TERMINATED]{0} access session terminated

+#

+# Event: AUDIT_LOG_SIGNING

+# Description: This event is used when a signature on the audit log is generated (same as "flush" time).

+# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Enabled by default: Yes

+# Fields:

+# - SubjectID: Predefined to be "$System$" because this operation

+#     associates with no user.

+# - Outcome: Success

+# - sig: The base-64 encoded signature of the buffer just flushed.

+#

+LOGGING_SIGNED_AUDIT_AUDIT_LOG_SIGNING_3=[AuditEvent=AUDIT_LOG_SIGNING][SubjectID={0}][Outcome={1}] signature of audit buffer just flushed: sig: {2}

 #

 # Event: AUDIT_LOG_STARTUP

-# - used at audit function startup

+# Description: This event is used at audit function startup.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

 # Enabled by default: Yes

+# Fields:

+# - SubjectID: $System$

+# - Outcome:

 #

 LOGGING_SIGNED_AUDIT_AUDIT_LOG_STARTUP_2=<type=AUDIT_LOG_STARTUP>:[AuditEvent=AUDIT_LOG_STARTUP][SubjectID={0}][Outcome={1}] audit function startup

 #

-# Event: AUDIT_LOG_SHUTDOWN

-# - used at audit function shutdown

+# Event: AUTH with [Outcome=Failure]

+# Description: This event is used when authentication fails.

+#   In case of SSL-client auth, only webserver env can pick up the SSL violation.

+#   CS authMgr can pick up certificate mismatch, so this event is used.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

 # Enabled by default: Yes

+# Fields:

+# - SubjectID:

+# - Outcome: Failure

+#     (obviously, if authentication failed, you won't have a valid SubjectID, so

+#     in this case, SubjectID should be $Unidentified$)

+# - AuthMgr: The authentication manager instance name that did

+#     this authentication.

+# - AttemptedCred: The credential attempted and failed.

 #

-LOGGING_SIGNED_AUDIT_AUDIT_LOG_SHUTDOWN_2=<type=AUDIT_LOG_SHUTDOWN>:[AuditEvent=AUDIT_LOG_SHUTDOWN][SubjectID={0}][Outcome={1}] audit function shutdown

+LOGGING_SIGNED_AUDIT_AUTH_FAIL=<type=AUTH>:[AuditEvent=AUTH]{0} authentication failure

 #

-# Event: CIMC_CERT_VERIFICATION

-# - used for verifying CIMC system certificates

+# Event: AUTH with [Outcome=Success]

+# Description: This event is used when authentication succeeded.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

-# Enabled by default: No

-# - CertNickName is the cert nickname

+# Enabled by default: Yes

+# Fields:

+# - SubjectID: id of user who has been authenticated

+# - Outcome: Success

+# - AuthMgr: The authentication manager instance name that did

+#     this authentication.

 #

-LOGGING_SIGNED_AUDIT_CIMC_CERT_VERIFICATION_3=<type=CIMC_CERT_VERIFICATION>:[AuditEvent=CIMC_CERT_VERIFICATION][SubjectID={0}][Outcome={1}][CertNickName={2}] CIMC certificate verification

+LOGGING_SIGNED_AUDIT_AUTH_SUCCESS=<type=AUTH>:[AuditEvent=AUTH]{0} authentication success

 #

-# Event: ROLE_ASSUME

-# - used when user assumes a role (in current CS that's when one accesses a

-#     role port)

+# Event: AUTHZ with [Outcome=Failure]

+# Description: This event is used when authorization has failed.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

 # Enabled by default: Yes

-# Role must be be one of the valid roles, by default: "Administrators",

-#     "Certificate Manager Agents", and "Auditors"

-#     note that customized role names can be used once configured

+# Fields:

+# - SubjectID: id of user who has failed to be authorized for an action

+# - Outcome: Failure

+# - aclResource: The ACL resource ID as defined in ACL resource list.

+# - Op: One of the operations as defined with the ACL statement

+#    e.g. "read" for an ACL statement containing "(read,write)".

+# - Info:

 #

-LOGGING_SIGNED_AUDIT_ROLE_ASSUME=<type=ROLE_ASSUME>:[AuditEvent=ROLE_ASSUME]{0} assume privileged role

+LOGGING_SIGNED_AUDIT_AUTHZ_FAIL=<type=AUTHZ>:[AuditEvent=AUTHZ]{0} authorization failure

 #

-# Event: CONFIG_CERT_POLICY

-# - used when configuring certificate policy constraints and extensions

-# Applicable subsystems: CA

-# Enabled by default: No

-# ParamNameValPairs must be a name;;value pair

-# (where name and value are separated by the delimiter ;;)

-# separated by + (if more than one name;;value pair) of config params changed

+# Event: AUTHZ with [Outcome=Success]

+# Description: This event is used when authorization is successful.

+# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Enabled by default: Yes

+# Fields:

+# - SubjectID: id of user who has been authorized for an action

+# - Outcome: Success

+# - aclResource: The ACL resource ID as defined in ACL resource list.

+# - Op: One of the operations as defined with the ACL statement

+#     e.g. "read" for an ACL statement containing "(read,write)".

 #

-LOGGING_SIGNED_AUDIT_CONFIG_CERT_POLICY_3=<type=CONFIG_CERT_POLICY>:[AuditEvent=CONFIG_CERT_POLICY][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] certificate policy constraint or extension configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_AUTHZ_SUCCESS=<type=AUTHZ>:[AuditEvent=AUTHZ]{0} authorization success

 #

-# Event: CONFIG_CERT_PROFILE

-# - used when configuring certificate profile

-#    (general settings and certificate profile)

-#    (extensions and constraints policies are to be obsoleted but do it anyway)

+# Event: CERT_PROFILE_APPROVAL

+# Description: This event is used when an agent approves/disapproves a certificate profile set by the

+#   administrator for automatic approval.

 # Applicable subsystems: CA

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

+# Fields:

+# - SubjectID: id of the CA agent who approved the certificate enrollment profile

+# - Outcome:

+# - ProfileID: One of the profiles defined by the administrator

+#     and to be approved by an agent.

+# - Op: "approve" or "disapprove".

 #

-LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE_3=<type=CONFIG_CERT_PROFILE>:[AuditEvent=CONFIG_CERT_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] certificate profile configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CERT_PROFILE_APPROVAL_4=<type=CERT_PROFILE_APPROVAL>:[AuditEvent=CERT_PROFILE_APPROVAL][SubjectID={0}][Outcome={1}][ProfileID={2}][Op={3}] certificate profile approval

 #

-# Event: CONFIG_CRL_PROFILE

-# - used when configuring  CRL profile

-#    (extensions, frequency, CRL format)

+# Event: CERT_REQUEST_PROCESSED

+# Description: This event is used when certificate request has just been through the approval process.

 # Applicable subsystems: CA

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

+# Fields:

+# - SubjectID: The UID of the agent who approves, rejects, or cancels

+#     the certificate request.

+# - Outcome:

+# - ReqID: The request ID.

+# - InfoName: "certificate" (in case of approval), "rejectReason"

+#     (in case of reject), or "cancelReason" (in case of cancel)

+# - InfoValue: The certificate (in case of success), a reject reason in

+#     text, or a cancel reason in text.

+# - CertSerialNum:

 #

-LOGGING_SIGNED_AUDIT_CONFIG_CRL_PROFILE_3=<type=CONFIG_CRL_PROFILE>:[AuditEvent=CONFIG_CRL_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] CRL profile configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CERT_REQUEST_PROCESSED=<type=CERT_REQUEST_PROCESSED>:[AuditEvent=CERT_REQUEST_PROCESSED]{0} certificate request processed

 #

-# Event: CONFIG_OCSP_PROFILE

-# - used when configuring OCSP profile

-#    (everything under Online Certificate Status Manager)

-# Applicable subsystems: OCSP

+# Event: CERT_SIGNING_INFO

+# Description: This event indicates which key is used to sign certificates.

+# Applicable subsystems: CA

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

+# Fields:

+# - SubjectID: $System$

+# - Outcome: Success

+# - SKI: Subject Key Identifier of the certificate signing certificate

+# - AuthorityID: (applicable only to lightweight CA)

 #

-LOGGING_SIGNED_AUDIT_CONFIG_OCSP_PROFILE_3=<type=CONFIG_OCSP_PROFILE>:[AuditEvent=CONFIG_OCSP_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] OCSP profile configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CERT_SIGNING_INFO=<type=CERT_SIGNING_INFO>:[AuditEvent=CERT_SIGNING_INFO]{0} certificate signing info

 #

-# Event: CONFIG_AUTH

-# - used when configuring authentication

-# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Event: CERT_STATUS_CHANGE_REQUEST

+# Description: This event is used when a certificate status change request (e.g. revocation)

+#   is made (before approval process).

+# Applicable subsystems: CA

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

-#   --- Password MUST NOT be logged ---

+# Fields:

+# - SubjectID: id of uer who performed the action

+# - Outcome:

+# - ReqID: The request ID.

+# - CertSerialNum: The serial number (in hex) of the certificate to be revoked.

+# - RequestType: "revoke", "on-hold", "off-hold"

 #

-LOGGING_SIGNED_AUDIT_CONFIG_AUTH_3=<type=CONFIG_AUTH>:[AuditEvent=CONFIG_AUTH][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] authentication configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CERT_STATUS_CHANGE_REQUEST=<type=CERT_STATUS_CHANGE_REQUEST>:[AuditEvent=CERT_STATUS_CHANGE_REQUEST]{0} certificate revocation/unrevocation request made

 #

-# Event: CONFIG_ROLE

-# - used when configuring role information (anything under users/groups)

-#       add/remove/edit a role, etc)

-# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Event: CERT_STATUS_CHANGE_REQUEST_PROCESSED

+# Description: This event is used when certificate status is changed (revoked, expired, on-hold,

+#   off-hold).

+# Applicable subsystems: CA

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

+# Fields:

+# - SubjectID: The UID of the agent that processed the request.

+# - Outcome:

+# - ReqID: The request ID.

+# - RequestType: "revoke", "on-hold", "off-hold"

+# - Approval: "complete", "rejected", or "canceled"

+#     (note that "complete" means "approved")

+# - CertSerialNum: The serial number (in hex).

+# - RevokeReasonNum: One of the following number:

+#     reason number       reason

+#     --------------------------------------

+#     0              Unspecified

+#     1              Key compromised

+#     2              CA key compromised (should not be used)

+#     3              Affiliation changed

+#     4              Certificate superceded

+#     5              Cessation of operation

+#     6              Certificate is on-hold

+# - Info:

 #

-LOGGING_SIGNED_AUDIT_CONFIG_ROLE=<type=CONFIG_ROLE>:[AuditEvent=CONFIG_ROLE]{0} role configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CERT_STATUS_CHANGE_REQUEST_PROCESSED=<type=CERT_STATUS_CHANGE_REQUEST_PROCESSED>:[AuditEvent=CERT_STATUS_CHANGE_REQUEST_PROCESSED]{0} certificate status change request processed

 #

-# Event: CONFIG_ACL

-# - used when configuring ACL information

+# Event: CLIENT_ACCESS_SESSION_ESTABLISH with [Outcome=Failure]

+# Description: This event is when access session failed to establish when Certificate System acts as client.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

+# Fields:

+# - ClientHost: Client hostname.

+# - ServerHost: Server hostname.

+# - ServerPort: Server port.

+# - SubjectID: SYSTEM

+# - Outcome: Failure

+# - Info:

 #

-LOGGING_SIGNED_AUDIT_CONFIG_ACL_3=<type=CONFIG_ACL>:[AuditEvent=CONFIG_ACL][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] ACL configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_ESTABLISH_FAILURE=\

+<type=CLIENT_ACCESS_SESSION_ESTABLISH>:[AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH]{0} access session failed to establish when Certificate System acts as client

 #

-# Event: CONFIG_SIGNED_AUDIT

-# - used when configuring signedAudit

+# Event: CLIENT_ACCESS_SESSION_ESTABLISH with [Outcome=Success]

+# Description: This event is used when access session was established successfully when

+#   Certificate System acts as client.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

+# Fields:

+# - ClientHost: Client hostname.

+# - ServerHost: Server hostname.

+# - ServerPort: Server port.

+# - SubjectID: SYSTEM

+# - Outcome: Success

 #

-LOGGING_SIGNED_AUDIT_CONFIG_SIGNED_AUDIT=<type=CONFIG_SIGNED_AUDIT>:[AuditEvent=CONFIG_SIGNED_AUDIT]{0} signed audit configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS=\

+<type=CLIENT_ACCESS_SESSION_ESTABLISH>:[AuditEvent=CLIENT_ACCESS_SESSION_ESTABLISH]{0} access session establish successfully when Certificate System acts as client

 #

-# Event: CONFIG_ENCRYPTION

-# - used when configuring encryption (cert settings and SSL cipher preferences)

+# Event: CLIENT_ACCESS_SESSION_TERMINATED

+# Description: This event is used when access session was terminated when Certificate System acts as client.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

+# Fields:

+# - ClientHost: Client hostname.

+# - ServerHost: Server hostname.

+# - ServerPort: Server port.

+# - SubjectID: SYSTEM

+# - Outcome: Success

+# - Info: The TLS Alert received from NSS

 #

-LOGGING_SIGNED_AUDIT_CONFIG_ENCRYPTION_3=<type=CONFIG_ENCRYPTION>:[AuditEvent=CONFIG_ENCRYPTION][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] encryption configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CLIENT_ACCESS_SESSION_TERMINATED=\

+<type=CLIENT_ACCESS_SESSION_TERMINATED>:[AuditEvent=CLIENT_ACCESS_SESSION_TERMINATED]{0} access session terminated when Certificate System acts as client

 #

-# Event: CONFIG_TRUSTED_PUBLIC_KEY

-# - used when

-#      1. "Manage Certificate" is used to edit the trustness of certificates

-#         and deletion of certificates

-#      2. "Certificate Setup Wizard" is used to import CA certificates into the

-#         certificate database (Although CrossCertificatePairs are stored

-#         within internaldb, audit them as well)

-# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Event: CMC_REQUEST_RECEIVED

+# Description: This event is used when a CMC request is received.

+# Applicable subsystems: CA

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

+# Fields:

+# - SubjectID: The UID of user that triggered this event.

+#     If CMC requests is signed by an agent, SubjectID should

+#     be that of the agent.

+#     In case of an unsigned request, it would bear $Unidentified$.

+# - Outcome:

+# - CMCRequest: Base64 encoding of the CMC request received

 #

-LOGGING_SIGNED_AUDIT_CONFIG_TRUSTED_PUBLIC_KEY=<type=CONFIG_TRUSTED_PUBLIC_KEY>:[AuditEvent=CONFIG_TRUSTED_PUBLIC_KEY]{0} certificate database configuration

+LOGGING_SIGNED_AUDIT_CMC_REQUEST_RECEIVED_3=<type=CMC_REQUEST_RECEIVED>:[AuditEvent=CMC_REQUEST_RECEIVED][SubjectID={0}][Outcome={1}][CMCRequest={2}] CMC request received

 #

-# Event: CONFIG_DRM

-# - used when configuring DRM

-#     (Key recovery scheme, change of any secret component)

-# Applicable subsystems: KRA

+# Event: CMC_RESPONSE_SENT

+# Description: This event is used when a CMC response is sent.

+# Applicable subsystems: CA

 # Enabled by default: Yes

-# ParamNameValPairs must be a name;;value pair

-#    (where name and value are separated by the delimiter ;;)

-#    separated by + (if more than one name;;value pair) of config params changed

-#   --- secret component (password) MUST NOT be logged ---

+# Fields:

+# - SubjectID: The UID of user that triggered this event.

+# - Outcome:

+# - CMCResponse: Base64 encoding of the CMC response sent

 #

-LOGGING_SIGNED_AUDIT_CONFIG_DRM_3=<type=CONFIG_DRM>:[AuditEvent=CONFIG_DRM][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] DRM configuration parameter(s) change

+LOGGING_SIGNED_AUDIT_CMC_RESPONSE_SENT_3=<type=CMC_RESPONSE_SENT>:[AuditEvent=CMC_RESPONSE_SENT][SubjectID={0}][Outcome={1}][CMCResponse={2}] CMC response sent

 #

-# Event: SELFTESTS_EXECUTION

-# - used when self tests are run

-# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Event: CMC_SIGNED_REQUEST_SIG_VERIFY

+# Description: This event is used when agent signed CMC certificate requests or revocation requests

+#   are submitted and signature is verified.

+# Applicable subsystems: CA

 # Enabled by default: Yes

+# Fields:

+# - SubjectID: the user who signed the CMC request (success case)

+# - Outcome:

+# - ReqType: The request type (enrollment, or revocation).

+# - CertSubject: The certificate subject name of the certificate request.

+# - SignerInfo: A unique String representation for the signer.

 #

-LOGGING_SIGNED_AUDIT_SELFTESTS_EXECUTION_2=<type=SELFTESTS_EXECUTION>:[AuditEvent=SELFTESTS_EXECUTION][SubjectID={0}][Outcome={1}] self tests execution (see selftests.log for details)

+LOGGING_SIGNED_AUDIT_CMC_SIGNED_REQUEST_SIG_VERIFY=<type=CMC_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_SIGNED_REQUEST_SIG_VERIFY]{0} agent signed CMC request signature verification

 #

-# Event: AUDIT_LOG_DELETE

-# - used AFTER audit log gets expired (authz should not allow,

-#    but in case authz gets compromised.  Make sure it is written

-#    AFTER the log expiration happens)

-# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

-# Enabled by default: No

-# LogFile must be the complete name (including the path) of the

-#    signedAudit log that is attempted to be deleted

+# Event: CMC_USER_SIGNED_REQUEST_SIG_VERIFY

+# Description: This event is used when CMC (user-signed or self-signed) certificate requests or revocation requests

+#   are submitted and signature is verified.

+# Applicable subsystems: CA

+# Enabled by default: Yes

+# Fields:

+# - SubjectID: the user who signed the CMC request (success case)

+# - Outcome:

+# - ReqType: The request type (enrollment, or revocation).

+# - CertSubject: The certificate subject name of the certificate request.

+# - CMCSignerInfo: A unique String representation for the CMC request signer.

+# - info:

 #

-LOGGING_SIGNED_AUDIT_LOG_DELETE_3=<type=AUDIT_LOG_DELETE>:[AuditEvent=AUDIT_LOG_DELETE][SubjectID={0}][Outcome={1}][LogFile={2}] signedAudit log deletion

+LOGGING_SIGNED_AUDIT_CMC_USER_SIGNED_REQUEST_SIG_VERIFY_FAILURE=<type=CMC_USER_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY]{0} User signed CMC request signature verification failure

+LOGGING_SIGNED_AUDIT_CMC_USER_SIGNED_REQUEST_SIG_VERIFY_SUCCESS=<type=CMC_USER_SIGNED_REQUEST_SIG_VERIFY>:[AuditEvent=CMC_USER_SIGNED_REQUEST_SIG_VERIFY]{0} User signed CMC request signature verification success

 #

-# Event: LOG_PATH_CHANGE

-# - used when log file name (including any path changes) for any of

-#    audit, system, transaction, or other customized log file

-#    change is attempted (authz should not allow, but make sure it's

-#    written after the attempt)

+# Event: CONFIG_ACL

+# Description: This event is used when configuring ACL information.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

 # Enabled by default: Yes

-# LogType must be "System", "Transaction", or "SignedAudit"

-# toLogFile must be the name (including any path changes) that the user is

-#    attempting to change to

+# Fields:

+# - SubjectID: id of administrator who performed the action

+# - Outcome:

+# - ParamNameValPairs: A name-value pair

+#     (where name and value are separated by the delimiter ;;)

+#     separated by + (if more than one name-value pair) of config params changed.

 #

-LOGGING_SIGNED_AUDIT_LOG_PATH_CHANGE_4=<type=LOG_PATH_CHANGE>:[AuditEvent=LOG_PATH_CHANGE][SubjectID={0}][Outcome={1}][LogType={2}][toLogFile={3}] log path change attempt

+LOGGING_SIGNED_AUDIT_CONFIG_ACL_3=<type=CONFIG_ACL>:[AuditEvent=CONFIG_ACL][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] ACL configuration parameter(s) change

 #

-# Event: LOG_EXPIRATION_CHANGE

-# - used when log expiration time change is attempted (authz should not

-#    allow, but make sure it's written after the attempt)

+# Event: CONFIG_AUTH

+# Description: This event is used when configuring authentication.

 # Applicable subsystems: CA, KRA, OCSP, TKS, TPS

-# Enabled by default: No

-# LogType must be "System", "Transaction", or "SignedAudit"

-# ExpirationTime must be the amount of time (in seconds) that is

-#    attempted to be changed to

+# Enabled by default: Yes

+# Fields:

+# - SubjectID: id of administrator who performed the action

+# - Outcome:

+# - ParamNameValPairs: A name-value pair

+#     (where name and value are separated by the delimiter ;;)

+#     separated by + (if more than one name-value pair) of config params changed.

+#     --- Password MUST NOT be logged ---

 #

-# -- feature disabled --

-#LOGGING_SIGNED_AUDIT_LOG_EXPIRATION_CHANGE_4=<type=LOG_EXPIRATION_CHANGE>:[AuditEvent=LOG_EXPIRATION_CHANGE][SubjectID={0}][Outcome={1}][LogType={2}][ExpirationTime={3}] log expiration time change attempt

+LOGGING_SIGNED_AUDIT_CONFIG_AUTH_3=<type=CONFIG_AUTH>:[AuditEvent=CONFIG_AUTH][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] authentication configuration parameter(s) change

 #

-# Event: SERVER_SIDE_KEYGEN_REQUEST

-# - used when server-side key generation request is made

-#    This is for tokenkeys

-# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Event: CONFIG_CERT_PROFILE

+# Description: This event is used when configuring certificate profile

+#   (general settings and certificate profile).

+# Applicable subsystems: CA

 # Enabled by default: Yes

-# EntityID must be the representation of the subject that will be on the certificate when issued

+# Fields:

+# - SubjectID: id of administrator who performed the action

+# - Outcome:

+# - ParamNameValPairs: A name-value pair

+#     (where name and value are separated by the delimiter ;;)

+#     separated by + (if more than one name-value pair) of config params changed.

 #

-LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST=<type=SERVER_SIDE_KEYGEN_REQUEST>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST]{0} server-side key generation request

+LOGGING_SIGNED_AUDIT_CONFIG_CERT_PROFILE_3=<type=CONFIG_CERT_PROFILE>:[AuditEvent=CONFIG_CERT_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] certificate profile configuration parameter(s) change

 #

-# Event: SERVER_SIDE_KEYGEN_REQUEST_PROCESSED

-# - used when server-side key generation request has been processed.

-#    This is for tokenkeys

-# Applicable subsystems: CA, KRA, OCSP, TKS, TPS

+# Event: CONFIG_CRL_PROFILE

+# Description: This event is used when configuring CRL profile

+#   (extensions, frequency, CRL format).

+# Applicable subsystems: CA

 # Enabled by default: Yes

-# EntityID must be the representation of the subject that will be on the certificate when issued

-# PubKey must be the base-64 encoded public key associated with

-#    the private key to be archived

+# Fields:

+# - SubjectID: id of administrator who performed the action

+# - Outcome:

+# - ParamNameValPairs: A name-value pair

+#     (where name and value are separated by the delimiter ;;)

+#     separated by + (if more than one name-value pair) of config params changed.

 #

-LOGGING_SIGNED_AUDIT_SERVER_SIDE_KEYGEN_REQUEST_PROCESSED=<type=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED>:[AuditEvent=SERVER_SIDE_KEYGEN_REQUEST_PROCESSED]{0} server-side key generation request processed

+LOGGING_SIGNED_AUDIT_CONFIG_CRL_PROFILE_3=<type=CONFIG_CRL_PROFILE>:[AuditEvent=CONFIG_CRL_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] CRL profile configuration parameter(s) change

 #

-# Event: KEY_RECOVERY_REQUEST

-# - used when key recovery request is made

-# Applicable subsystems: CA, OCSP, TKS, TPS, TPS

-# Enabled by default: No

-# RecoveryID must be the recovery request ID

-# PubKey must be the base-64 encoded public key associated with

-#    the private key to be recovered

+# Event: CONFIG_DRM

+# Description: This event is used when configuring KRA.

+#   This includes key recovery scheme, change of any secret component.

+# Applicable subsystems: KRA

+# Enabled by default: Yes

+# Fields:

+# - SubjectID: id of administrator who performed the action

+# - Outcome:

+# - ParamNameValPairs A name-value pair

+#     (where name and value are separated by the delimiter ;;)

+#     separated by + (if more than one name-value pair) of config params changed.

+#     --- secret component (password) MUST NOT be logged ---

 #

-LOGGING_SIGNED_AUDIT_KEY_RECOVERY_REQUEST_4=<type=KEY_RECOVERY_REQUEST>:[AuditEvent=KEY_RECOVERY_REQUEST][SubjectID={0}][Outcome={1}][RecoveryID={2}][PubKey={3}] key recovery request made

+LOGGING_SIGNED_AUDIT_CONFIG_DRM_3=<type=CONFIG_DRM>:[AuditEvent=CONFIG_DRM][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] DRM configuration parameter(s) change

 #

-# Event: KEY_RECOVERY_AGENT_LOGIN

-# - used when DRM agents login as recovery agents to approve

-#       key recovery requests

-# Applicable subsystems: KRA

-# Enabled by default: No

-# RecoveryID must be the recovery request ID

-# RecoveryAgent must be the recovery agent the DRM agent is

-#       logging in with

+# Event: CONFIG_OCSP_PROFILE

+# Description: This event is used when configuring OCSP profile

+#   (everything under Online Certificate Status Manager).

+# Applicable subsystems: OCSP

+# Enabled by default: Yes

+# Fields:

+# - SubjectID: id of administrator who performed the action

+# - Outcome:

+# - ParamNameValPairs: A name-value pair

+#     (where name and value are separated by the delimiter ;;)

+#     separated by + (if more than one name-value pair) of config params changed.

 #

-LOGGING_SIGNED_AUDIT_KEY_RECOVERY_AGENT_LOGIN_4=<type=KEY_RECOVERY_AGENT_LOGIN>:[AuditEvent=KEY_RECOVERY_AGENT_LOGIN][SubjectID={0}][Outcome={1}][RecoveryID={2}][RecoveryAgent={3}] key recovery agent login

+LOGGING_SIGNED_AUDIT_CONFIG_OCSP_PROFILE_3=<type=CONFIG_OCSP_PROFILE>:[AuditEvent=CONFIG_OCSP_PROFILE][SubjectID={0}][Outcome={1}][ParamNameValPairs={2}] OCSP profile configuration parameter(s) change

 #

-# Event: KEY_GEN_ASYMMETRIC

-# - used when asymmetric keys are generated

-#   (like when CA certificate requests are generated -

-#      e.g. CA certificate change over, renewal with new key, etc.)

+# Event: CONFIG_ROLE