2.1 Vault Server Configuration Files & DBParm.ini Tuning

2.1 Vault Server Configuration Files & DBParm.ini Tuning

Quick Answer: The CyberArk Digital Vault server is centrally governed by DBParm.ini, located in C:\Program Files (x86)\PrivateArk\Server\Conf\DBParm.ini. Any modifications to core parameters—such as IdleTime, AllowNonStandardFWAddresses, BackupServers, DebugLevel, and SIEM Syslog directives—require a complete restart of the PrivateArk Server service to take effect. Client components connect to the Vault over TCP port 1858 guided by client-side Vault.ini descriptors.

---

PrivateArk Server Directory Architecture

The CyberArk Digital Vault is deployed on a hardened Windows Server host with strict isolation. Core binaries, configuration files, and logs reside under C:\Program Files (x86)\PrivateArk\Server\, while encrypted database files and Safe containers reside on an isolated dedicated storage partition (such as D:\PrivateArk\Safes\).

PAM administrators and exam candidates must master two key directories within the PrivateArk Server tree:

The Server\Conf Directory

The Conf folder stores the operational parameters, cryptographic pointers, and security policies governing the Vault:

• DBParm.ini: The master initialization file governing database tuning, network listener parameters, firewall rules, syslog routing, and disaster recovery access lists.
• license.xml: The digital license file dictating licensed user quotas (EPVUser, CPM, PSM, AppProvider), managed account limits, feature entitlements (such as PTA or SSH Key management), and expiration dates.
• parm.ini: Contains database initialization parameters and memory buffer allocations.
• PKeys\: A secured subdirectory holding critical server keys, recovery public keys, and cryptographic references required during server bootstrap and key exchange.
• Syslog Translator Files (*.xsl): Extensible Stylesheet Language transformation files (e.g., SplunkGen.xsl, ArcSight.xsl, QRadar.xsl, RFC5424.xsl) mapping raw Vault audit events into structured SIEM formats.

The Server\Logs Directory

The Logs directory contains all active operational logs, security audits, and diagnostic trace streams:

• italog.log: The primary operational and audit log of the Digital Vault. Every administrative logon, safe creation, authentication failure, license alert, and service state change is written chronologically with message codes.
• trace.d*: Diagnostic trace files capturing low-level protocol exchanges, database query executions, and internal thread states. These files rotate automatically based on size and are essential when troubleshooting with CyberArk Support.
• pm.log: Performance monitoring log tracking hardware utilization, memory consumption, and thread concurrency.
• console.log: Captures standard output and error streams generated during the bootstrap and shutdown phases of the PrivateArk Server service.

---

DBParm.ini: Master Configuration & Operational Tuning

DBParm.ini is the definitive configuration source for the PrivateArk Server service. Every operational parameter is evaluated when the server starts. On the PAM-DEF exam, remember: any edit made to DBParm.ini requires a restart of the PrivateArk Server service before changes become active in memory.

Critical DBParm.ini Parameters

1. IdleTime

Defines the maximum inactivity duration (in minutes) permitted for direct client and component connections communicating via the PrivateArk protocol before the Vault automatically drops the session.

• Default: 20 minutes (configurable from 1 to 1440).
• Security Impact: When an administrative PrivateArk Client session remains idle beyond this threshold, the Vault severs the TCP session, requiring re-authentication to prevent unauthorized access at unattended terminals.

2. AllowNonStandardFWAddresses

Regulates the Vault host's integrated Windows Firewall engine.

• Mechanism: Baseline hardening causes the Vault to take full control of the local Windows Firewall, strictly blocking inbound traffic on TCP port 1858 except from IP addresses registered as components during installation.
• Parameter Function: Setting AllowNonStandardFWAddresses=Yes instructs the Vault firewall engine to permit connections from non-standard IP addresses or dynamic subnets (such as administrative jump hosts or secondary backup nodes) without manually modifying local firewall rules.

3. BackupServers

Specifies an explicit IP address whitelist of authorized backup machines and Disaster Recovery (DR) Vaults.

• Syntax: Comma-separated IPv4 addresses (e.g., BackupServers=10.0.5.21,10.0.5.22).
• Security Mechanism: To prevent rogue replication of encrypted credential stores, the Vault validates the source IP of any replication request. If a server running the PAReplicate utility or the CyberArk Disaster Recovery service attempts synchronization from an unlisted IP, the Vault terminates the connection and logs an unauthorized replication attempt in italog.log.

4. DebugLevel

Controls diagnostic logging verbosity in trace.d* and italog.log.

• Syntax: Accepts numeric values or subsystem trace flags such as PE(1) (protocol engine) and PERF(1,2) (performance metrics).
• Operational Rule: In production, DebugLevel must remain set to 0 or minimal protocol tracing (PE(1)). Excessive debug levels consume storage rapidly, risking disk partition exhaustion on the C:\ drive and service failure.

---

SIEM & Syslog Integration in DBParm.ini

Enterprise compliance mandates real-time audit streaming from the Vault into a Security Information and Event Management (SIEM) platform (e.g., Splunk, IBM QRadar, ArcSight, Microsoft Sentinel).

High-Yield Vault Audit Message Codes

• Code 7: User logon to the Vault (records source IP, username, and auth method).
• Code 8: User logoff from the Vault.
• Code 295: Password or file object retrieved from a Safe (crucial for tracking credential access).
• Code 296: Password object updated or added to a Safe.
• Code 308: Safe created, modified, or deleted.
• Code 361: Credential verification, change, or reconciliation completed by CPM.

Specifying SyslogMessageCodeFilter=7,295,296,308,361 forwards critical authentication, Safe, and credential events while filtering out routine operational chatter.

---

Client Component Configuration: The Role of Vault.ini

While DBParm.ini governs the Vault host, all distributed CyberArk components—including PVWA, CPM, PSM, AAM, DR, and PACLI utilities—rely on a client-side configuration file named Vault.ini.

Key Vault.ini Parameters

1. ServerVaultName: The logical identity of the Vault instance matching license definitions.
2. ServerIP: Comma-separated list of Vault IP addresses arranged by priority (e.g., 10.0.1.10,10.0.2.10). Components connect to the first address; if the primary Vault fails to respond within the Timeout threshold, the client fails over to the DR Vault.
3. ServerPort: The PrivateArk listening port, defaulting to TCP port 1858. All client-to-Vault communication is encapsulated in encrypted RPC envelopes over this single port.
4. Timeout: Inactivity threshold (in seconds) before aborting a connection attempt and initiating failover.
5. NumOfRecordsPerChunk: Optimizes bulk query transfers between components and the Vault database.

---

Comparative Summary: DBParm.ini vs. Vault.ini