diff --git a/hooks/keystone_context.py b/hooks/keystone_context.py
index 8d0d40cd..83653712 100644
--- a/hooks/keystone_context.py
+++ b/hooks/keystone_context.py
@@ -134,3 +134,14 @@ class KeystoneContext(context.OSContextGenerator):
             resolve_address(ADMIN),
             api_port('keystone-admin')).rstrip('v2.0')
         return ctxt
+
+
+class KeystoneLoggingContext(context.OSContextGenerator):
+
+    def __call__(self):
+        ctxt = {}
+        debug = config('debug')
+        if debug and debug.lower() in ['yes', 'true']:
+            ctxt['root_level'] = 'DEBUG'
+
+        return ctxt
diff --git a/hooks/keystone_utils.py b/hooks/keystone_utils.py
index 58123c3e..fda9f4f1 100644
--- a/hooks/keystone_utils.py
+++ b/hooks/keystone_utils.py
@@ -100,6 +100,7 @@ API_PORTS = {
 }
 
 KEYSTONE_CONF = "/etc/keystone/keystone.conf"
+KEYSTONE_LOGGER_CONF = "/etc/keystone/logging.conf"
 KEYSTONE_CONF_DIR = os.path.dirname(KEYSTONE_CONF)
 STORED_PASSWD = "/var/lib/keystone/keystone.passwd"
 STORED_TOKEN = "/var/lib/keystone/keystone.token"
@@ -125,6 +126,10 @@ BASE_RESOURCE_MAP = OrderedDict([
                      context.BindHostContext(),
                      context.WorkerConfigContext()],
     }),
+    (KEYSTONE_LOGGER_CONF, {
+        'contexts': [keystone_context.KeystoneLoggingContext()],
+        'services': BASE_SERVICES,
+    }),
     (HAPROXY_CONF, {
         'contexts': [context.HAProxyContext(singlenode_mode=True),
                      keystone_context.HAProxyContext()],
diff --git a/templates/icehouse/logging.conf b/templates/icehouse/logging.conf
new file mode 100644
index 00000000..7ccbf598
--- /dev/null
+++ b/templates/icehouse/logging.conf
@@ -0,0 +1,69 @@
+[loggers]
+keys=root,access
+
+[handlers]
+keys=production,file,access_file,devel
+
+[formatters]
+keys=minimal,normal,debug
+
+
+###########
+# Loggers #
+###########
+
+[logger_root]
+{% if root_level -%}
+level={{ root_level }}
+{% else -%}
+level=WARNING
+{% endif -%}
+handlers=file
+
+[logger_access]
+level=INFO
+qualname=access
+handlers=access_file
+
+
+################
+# Log Handlers #
+################
+
+[handler_production]
+class=handlers.SysLogHandler
+level=ERROR
+formatter=normal
+args=(('localhost', handlers.SYSLOG_UDP_PORT), handlers.SysLogHandler.LOG_USER)
+
+[handler_file]
+class=handlers.WatchedFileHandler
+level=WARNING
+formatter=normal
+args=('error.log',)
+
+[handler_access_file]
+class=handlers.WatchedFileHandler
+level=INFO
+formatter=minimal
+args=('access.log',)
+
+[handler_devel]
+class=StreamHandler
+level=NOTSET
+formatter=debug
+args=(sys.stdout,)
+
+
+##################
+# Log Formatters #
+##################
+
+[formatter_minimal]
+format=%(message)s
+
+[formatter_normal]
+format=(%(name)s): %(asctime)s %(levelname)s %(message)s
+
+[formatter_debug]
+format=(%(name)s): %(asctime)s %(levelname)s %(module)s %(funcName)s %(message)s
diff --git a/unit_tests/test_keystone_contexts.py b/unit_tests/test_keystone_contexts.py
index 70b44b34..a10426f4 100644
--- a/unit_tests/test_keystone_contexts.py
+++ b/unit_tests/test_keystone_contexts.py
@@ -119,3 +119,13 @@ class TestKeystoneContexts(CharmTestCase):
         msg = "Multiple networks configured but net_type" \
               " is None (os-public-network)."
         mock_log.assert_called_with(msg, level="WARNING")
+
+    @patch.object(context, 'config')
+    def test_keystone_logger_context(self, mock_config):
+        ctxt = context.KeystoneLoggingContext()
+
+        mock_config.return_value = None
+        self.assertEqual({}, ctxt())
+
+        mock_config.return_value = 'True'
+        self.assertEqual({'root_level': 'DEBUG'}, ctxt())