### Log Statement Example for App Setup Unresponsiveness Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/trouble-shooting-guide.htm An example log message indicating an IOException when validating the Identity Provider host during application setup. ```log Mar 7 17:19:43 localhost.localdomain WEB_CONSOLE IOException occurred validating IDP host :IDP login URL ``` -------------------------------- ### Example az vm create command with populated parameters Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-vm-disk.htm An example of the az vm create command with sample values for parameters. ```bash az vm create --name "Upload-OAG-VHD" \ --resource-group "AccessGateway" --location "eastus" --image "ubuntults" \ --size "Standard_D2s_v3" --data-disk-sizes-gb 500 \ --authentication-type "password" --admin-username "okta" --admin-password "AlwaysOn@123 ``` -------------------------------- ### Nomination - Starting Examples Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit.htm Examples of log entries generated when the nomination starts on the admin node. ```log 2020-08-05T18:40:23.711-07:00 nodeB OAG ADMIN_CONSOLE CLUSTER MANAGER ADMIN NOMINATION INFO Mgmt console Event [USER="oag-mgmt"] OAG Version - 2020.6.3, Cluster Manager Version - 2020.1.5.20200803.174755 2020-08-05T18:40:23.711-07:00 nodeB OAG ADMIN_CONSOLE CLUSTER MANAGER ADMIN NOMINATION INFO Mgmt console Event [USER="oag-mgmt"] Starting authorized nomination process - OAG Version - 2020.6.3, Cluster Manager Version - 2020.1.5.20200803.174755 2020-08-05T18:40:23.905-07:00 nodeB ADMIN_CONSOLE CLUSTER MANAGER ADMIN NOMINATION INFO Send auth key to admin node [USER="oag-mgmt"] Sent nomination.authKey to admin node - existingadmin[.domain.tld] ``` -------------------------------- ### START event example Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-monitor.htm Example log entry for a service starting on an Access Gateway node. ```text 2020-03-27T21:19:24.158-05:00 example.myaccessgateway.com OAG_MONITOR MONITOR SERVICE INFO START [SERVICE="oag-admin"] Starting oag-admin. ``` -------------------------------- ### Example: Upload the disk file using AzCopy Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm An example of the `azcopy copy` command with specific values. ```bash sudo ./azcopy copy /datadrive/temp/oag.vhd "https://md-impexp-t4pdnf22n02h.blob.core.windows.net/p15jhr4gwqhl/abcd?sv=2017-04-17&sr=b&si=b1154122-1458-4f02-a226-1554c66938c0&sig=vGnmhmKMY92r3ecQLlAEXtEHzRCFTsa5rrIxNsQqaZY%3D" -blob-type PageBlob ``` -------------------------------- ### Example: Create a managed disk Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm An example of the `az disk create` command with specific values. ```bash az disk create -n Okta-AccessGatewayDisk --resource-group AccessGateway --location eastus --for-upload --upload-size-bytes 236246270464 --sku standard_lrs ``` -------------------------------- ### System start or stop examples Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-nginx.htm Examples of log entries for NGINX starting or stopping. ```log 2020-07-07-18:45:57 example.myaccessgateway.com systemd[1]: Stopped Access Gateway Reverse Proxy. ``` ```log 2020-07-07-18:45:57 example.myaccessgateway.com systemd[1]: Started Access Gateway Reverse Proxy. ``` ```log 2020-07-07-18:45:57 example.myaccessgateway.com systemd[1]: Failed to start Access Gateway Reverse Proxy. ``` -------------------------------- ### System start or stop example Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-cert-chain.htm Example log entries for when the client certificate validation service starts or stops. ```log 2021-01-20T10:54:58.075-06:00 example.myaccessgateway.com systemd Started Certificate Validation Service. ``` ```log 2021-01-22T13:10:55.000-06:00 oag.okta.com CERT VERIFIER Starting [Starting(Started) application | certificate loader | service | servlet | Tomcat] ``` ```log 2021-01-21T11:54:58.075-06:00 example.myaccessgateway.com systemd Stopped Certificate Validation Service. ``` -------------------------------- ### Create a file system on the disk Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-prepare-temp-disk.htm Create a pfile system on the disk using the sudo mkfs -t ext4 /dev/sdc1 command. ```bash sudo mkfs -t ext4 /dev/sdc1 mke2ds 1.44.1 . . . . . . Writing superblocsl and filesystem accounting information: done ``` -------------------------------- ### Sign in to Google Cloud Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-gcp-create-project-region-zone.htm Command to authenticate with Google Cloud. ```bash gcloud auth login ``` -------------------------------- ### Nomination - initiated example Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit.htm Example log entry for when a nomination starts on the admin node. ```log 2020-08-04T14:28:48.376-05:00 oag.nodeC.com ADMIN_CONSOLE CLUSTER MANAGER ADMIN NOMINATION INFO Arguments [USER="root"] Started nomination process with args: adminNode - oag.nodeA.com,nominatedNode - oag.nodeC.com, accessGatewayHostname - gw-admin.[domain.tld] ``` -------------------------------- ### Example: Create a Compute Engine image Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-gcp-create-vm.htm An example of creating a Compute Engine image, replacing placeholders with specific values. ```bash gcloud compute images create my-image-name --source-uri gs://my-bucket-name/my-tar-file-name.tar.gz ``` -------------------------------- ### Install Microsoft Azure CLI and AZCopy tools Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm Commands to install the Microsoft Azure command-line interface and Azcopy on a virtual machine. ```bash cd /datadrive/temp ``` ```bash curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash ``` ```bash sudo wget https://aka.ms/downloadazcopy-v10-linux ; sudo tar -xvf downloadazcopy-v10-linux ``` -------------------------------- ### Nomination - Existing admin enters maintenance mode example Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit-adminrenom.htm Log entry indicating the start of the Admin Node Nomination App on an existing admin node. ```log 2020-08-06T13:06:41.872-05:00 oag.nodeA.com ADMIN_CONSOLE CLUSTER MANAGER UPDATE ADMIN INFO Started Admin Node Nomination App [USER="oagha"] Started Admin Node Nomination App on admin node - existingadmin[.domain.tld] ``` -------------------------------- ### Curl example requests the node's status using the default endpoint Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/monitoring-basic.htm You make a GET request to a node's /basic_status endpoint to retrieve basic monitoring information. Include the following in your request: Host: Always monitoring.rest.service.oag. ```bash curl -k -X GET -H "Host:monitoring.rest.service.oag" https://gw.{gateway.tld}/basic_status ``` -------------------------------- ### Reboot and verify Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-prepare-temp-disk.htm Reboot the VM, reconnect, and then verify that the new file system is mounted. ```bash sudo shutdown -r now ssh okta@ip address df -h | grep sdc1 ``` -------------------------------- ### Initialize Google Cloud environment Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-gcp-cli.htm Commands to initialize the Google Cloud environment after installing the CLI. These may need modification based on your specific installation. ```bash # Linux/macOS: ./google-cloud-sdk/bin/gcloud init # Windows: gcloud init ``` -------------------------------- ### Example: AzCopy with concurrency setting Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm Example of using the `AZCOPY_CONCURRENCY_VALUE` environment variable to control AzCopy upload concurrency. ```bash export AZCOPY_CONCURRENCY_VALUE=AUTOsudo nohup ; sudo ./azcopy copy /datadrive/temp/oag.vhd \ "https://md-. . . VY1SlQ79TOnwoMaVHjaqkmVlU%3D" \ --blob-type PageBlob > /tmp/azcopy.log 2>&1 & ``` -------------------------------- ### Example: Grant access to a managed disk Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-create-and-populate-mdisk.htm An example of the `az disk grant-access` command with specific values. ```bash az disk grant-access -n Okta-AccessGatewayDisk --resource-group AccessGateway --access-level Write --duration-in-seconds 86400 ``` -------------------------------- ### Comment examples Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/advanced-oag-policy-development.htm Examples of how to create comments in the custom configuration. ```text #This is a comment. #This comment, preceded by a space. set $TEST "some value"; #this is also a valid comment. ``` -------------------------------- ### Create a mount point Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/deploy-msa-prepare-temp-disk.htm Create a mount point for the new disk using the mkdir command. ```bash sudo mkdir /datadrive ``` -------------------------------- ### USER_LOGIN Examples Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit.htm Examples of USER_LOGIN log entries for user login attempts. ```log 2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE AUTHN LOCAL INFO USER_LOGIN [SESSION_ID="" SUBJECT="" TYPE="LOCAL" RESULT="PASS" REASON="VALID_CREDENTIALS" REMOTE_IP="-" USER_AGENT="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"] User login success: user@ ``` ```log 2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE AUTHN LOCAL INFO USER_LOGIN [SESSION_ID=" " SUBJECT="" TYPE="LOCAL" RESULT="FAIL" REASON="INVALID_CREDENTIALS" REMOTE_IP="-" USER_AGENT=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"] User login failed: user@ ``` ```log 2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY ACCESS AUTHN SAML INFO USER_AUTHN [SESSION_ID=" " SESSION_AUTH=" " SUBJECT="" TYPE="SAML_2_0" SOURCE="IDP Source URL" SOURCE_TYPE="" SOURCE_DOMAIN="" SOURCE_AUTHN_TYPE="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" APP="Sample Header App" APP_DOMAIN="" RESULT="PASS" REASON="Valid SAML Assertion" REMOTE_IP="192.168.10.20" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"] User login:user@ ``` ```log 2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY ACCESS AUTHN SAML ERROR USER_AUTHN [TYPE="SAML_2_0" TRACKER_ID="" SOURCE="https:///app/template_saml_2_0/exkckwwaxvY3crKhn0h7/sso/saml" RESULT="FAIL" REASON="Invalid SAML Assertion" REMOTE_IP="192.168.10.192" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36"] Received an assertion that has expired. Check clock synchronization on IdP and SP. ``` -------------------------------- ### SYSTEM_KRB5_EVENT Examples Source: https://help.okta.com/oag/en-us/content/topics/access-gateway/oag-log-files-audit.htm Examples of SYSTEM_KRB5_EVENT log entries for Kerberos realm actions. ```log 2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE KRB5 - INFO SYSTEM_KRB5_EVENT [REALM="" REASON="CREATE" SESSION_ID="" SUBJECT="admin" REMOTE_IP="-" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"] Kerberos Realm: '' action: 'CREATE' ``` ```log 2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE KRB5 - INFO SYSTEM_KRB5_EVENT [REALM="" REASON="UPDATE" SESSION_ID="" SUBJECT="user@" REMOTE_IP="-" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"] Kerberos Realm: '' action: 'UPDATE' ``` ```log O2020-06-24T10:06:23.000-05:00 example.myaccessgateway.com ACCESS_GATEWAY WEB_CONSOLE KRB5 - INFO SYSTEM_KRB5_EVENT [REALM="" REASON="DELETE" SESSION_ID="" SUBJECT="user@" REMOTE_IP="-" USER_AGENT="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36"] Kerberos Realm: '' action: 'DELETE' ```