Debug Log Reporting

Plugin # 84239: Debugging Log Report. Logs generated by other plugins are reported by this plugin. Plugin debugging must be enabled in the scan policy for this plugin to run.

When logging is enabled, it writes a per-scan debug log file. The filename follows the pattern <calling-plugin>~AWS Secrets Manager. One log file is created per Settings plugin that invokes the integration:

  • logins.nasl~AWS Secrets Manager — Windows / SMB credential lookups.

  • ssh_settings.nasl~AWS Secrets Manager — SSH credential lookups.

  • database_settings.nasl~AWS Secrets Manager — Database credential lookups (PostgreSQL, MongoDB, Cassandra, DB2, MySQL, SQL Server, Oracle).

  • vmware_soap_settings.nasl~AWS Secrets Manager — VMware ESX / ESXi (SOAP API) credential lookups, processed by VMware SOAP API Settings (Plugin # 57395).

  • vmware_vcenter_settings.nasl~AWS Secrets Manager — VMware vCenter (vCenter API) credential lookups, processed by VMware vCenter Settings (Plugin # 63060).

  • nutanix_settings.nasl~AWS Secrets Manager — Nutanix Prism Central credential lookups.

What the logs contain

These log files contain the following information:

  • The full integration configuration (region, host, port, SSL settings, Kerberos / domain handling, escalation settings). Secret values, SecretString payload contents, password fields, and SSH keys are scrubbed.

  • AWS Signature Version 4 signing details (canonical headers, signed headers, credential scope, calculated signature).

  • Outgoing API request headers and the high-level success or failure of the GetSecretValue call.

  • Cache hits and misses keyed by the MD5 of the secret ID.

  • Errors raised by the integration.

Note: For authentication-issue troubleshooting, prefer the per-integration log above over the top-level scanner log — the integration log isolates AWS-specific signing and request data and applies the aws_secretsmanager::scrubber function so that secret values are redacted from the logged output.