Kerberos: The Definitive Guide

Understanding the Logs

Now that you’ve set up the auditing mechanism on your Kerberos KDC and your KDC is busy logging all of its activity, you need to periodically review these logs for suspicious activity. Enabling the logging activity on your KDC is useless unless the logs are actually analyzed at some point, either automatically by a script that has preset thresholds for suspicious activity, or by hand. In this section, we’ll examine the log messages emitted by each Kerberos implementation covered in this book, and describe what each message means.

Each implementation has a dramatically different log format, but since there are only a few protocol exchanges in Kerberos, the number of different log messages is relatively low. Each log message can be directly connected to an exchange between the KDC and a Kerberos client.