- During module provisioning, the ACK server generates audit logs for all events relating to Matter certificates, such as certificate signing requests (CSRs). You must upload these logs to Amazon at least every 24 hours. After two days of logs not uploaded, the server stops operating to remind you to upload the logs.
-
Amazon uses control logs to track the encoded identifier of a device or a multi-device package to enable Frustration Free Setup (FFS).
There are two types of control logs: device and bundle. You generate device control log files that define individual devices during module provisioning. Bundle control log files define package groupings of devices sold as a multi-device package. Devices sold within a bundle have a device control log file and a bundle control log file. You generate the device control log during module programming and the bundle control log during pre-shipment.
Prerequisites
Contact your ACK support engineer to create audit log and control log Amazon Web Services (AWS) S3 buckets for your Amazon vendor ID associated with your AWS developer account. Provide the canonical ID of your AWS developer account. You can use these buckets for all ACK products under the same developer account.Upload audit logs
Provisioning generates a new audit log file each day. The audit log file name has the following format:AUDIT_LOG_<device-type>_YYYYMMDD.txt and resides in the audit_logs_upload folder under the data folder on the server. You pass the data folder name to the ACK server on startup. The server archives the previous days audit log in a zip file in the same folder.
To upload an audit log to Amazon
- Navigate to the
audit_logs_uploadfolder under the data folder on your server. - Move all zip files in the
audit_logs_uploadfolder to a temporary folder or USB drive. - Copy the audit log for the current day to the temporary folder or USB drive.
- To access the audit log S3 bucket, complete the following steps:
- Sign in to the AWS console with your Amazon developer account.
- Navigate to the audit log bucket with your vendor ID:
https://s3.console.aws.amazon.com/s3/buckets/<lowercase-vendor-id>-audit-logs.
To view your Amazon vendor ID, open Customer Details.
<div markdown=“span” class=“alert alert-success” role=“alert”> Tip: To find your audit log bucket later, bookmark this link.</div> - Create a folder for your device type ID, if the folder doesn’t exist.
- On a machine with internet access, upload the files to the audit log bucket.
- Verify the upload succeeded, and then store the results in the database.
Automate audit log upload
To make sure that audit logs upload to the S3 bucket at least every 24 hours, you can automate the process by using the AWS CLI. To automate the audit log upload to Amazon- Sign in to the AWS console with your Amazon developer account.
- In the AWS Identity and Access Management (IAM) console, create an IAM user with S3 write permission, and then create an access key and copy its secret. For more details, see Identity and Access Management for Amazon S3.
- In a terminal window, at the command prompt, enter the following command to configure the CLI with the S3 access key.
At the prompt, enter the IAM account access key and secret.
- To upload the audit log file, in a terminal window, enter the following command at the command prompt.
Generate and upload control logs
In this step, you generate and upload control logs from your server. You can create control logs for locked modules only. You upload the control logs to the SFTP endpoint created in Step 4: Set up the server. To confirm the upload succeeded, view the feedback file. For more details about the format of control logs, see Control Log Specification. To generate and upload control logs- Stop the ACK server so that it doesn’t modify the data during the upload.
- To generate control logs on your server, in a terminal window, run the following command at the command prompt.
- To copy the generated logs to a USB drive or temporary file location, at the command prompt, run the following command.
- To copy the files to the SFTP endpoint and receive feedback files, enter the following command at the command prompt.
Use the upload and feedback endpoints that you created on the FFS > Control Logs console.
- Within 30 minutes, download and view the feedback files for errors.
- Verify the upload succeeded, and then store the results in the database and remove the feedback files from the endpoint.
- If the upload failed, review the logs, correct any errors, and then repeat steps 4 and 5.
Automate control log upload
The ACK SDK tool package has a reference implementation that stores control logs of 500 devices at a time for batch upload. You can find thecontrol_logs_help.py file in matter\server_tools\helper in your acksdktools directory.
