Traffic logging reference
You can include these metadata, client, and app elements in PingAccess traffic logs.
Element hierarchy
Each section described here has child elements. If there is a disagreement in settings, the most specific setting is used.
For example, if the metadata element is set to false but the exchange ID is set to true, only the exchange ID is logged. If the metadata element is set to true but the exchange ID is set to false, all metadata elements except the exchange ID are logged.
Limitations
The traffic logs have the following limitations:
-
If a request or response body is chunked, only the first chunk is logged by traffic logging.
-
Request and response bodies are not decoded.
Metadata elements
You can include metadata elements in the API, engine, and audit traffic logs. These elements provide general information about the logged event.
Metadata element descriptions
| Item | Description |
|---|---|
|
The section setting for all metadata elements. |
|
Identifies the ID for a specific request-response pair. |
|
Specifies the ID of the requested application. |
|
Specifies the name of the requested application. |
|
Specifies the ID of the requested resource. |
|
Specifies the name of the requested resource. |
|
Specifies the path prefix of the requested application or resource. |
|
Indicates the pattern type of the path prefix, |
|
The mechanism used for authentication:
|
|
The Internet Protocol (IP) address of the requesting client. |
|
The name of the rule that failed. If there was no rule failure, this field is blank. This element is applicable only to the engine log. |
|
Type of rule that failed. If there was no rule failure, this field is blank. This element is applicable only to the engine log. |
|
The Java class of rule that failed. If there was no rule failure, this field is blank. This element is applicable only to the engine log. |
|
Name of the containing rule set that failed. If there was no rule failure, this field is blank. This element is applicable only to the engine log. |
|
The PingAccess host name or IP address. |
|
The backend target that processed the request and generated a response to the PingAccess engine. This variable is unset when the response is generated by a target host protected by PingAccess. |
|
The name of the resource used to fulfill the request. This element is applicable only to the engine log. |
|
The subject of the transaction. |
|
The PingFederate tracking ID. You can use this element to help correlate audit information in the PingAccess audit log with information recorded in the PingFederate audit log. This value depends on whether the application type is If the application type is If the application type is |
Metadata elements example
This example shows the metadata section with all elements set to true.
<!-- AUDIT.metadata is the section setting for the following fields: -->
<!-- AUDIT.exchangeId to AUDIT.trackingId -->
<KeyValuePair key=”AUDIT.metadata” value=”true”/>
<KeyValuePair key=”AUDIT.exchangeId” value=”true”/>
<KeyValuePair key=”AUDIT.applicationId” value=”true”/>
<KeyValuePair key=”AUDIT.applicationName” value=“true”/>
<KeyValuePair key=”AUDIT.resourceId” value=”true”/>
<KeyValuePair key=”AUDIT.resourceName” value=”true”/>
<KeyValuePair key=”AUDIT.pathPrefix” value=”true”/>
<KeyValuePair key=”AUDIT.pathPrefixType” value=”true”/>
<KeyValuePair key=”AUDIT.authMech” value=”true”/>
<KeyValuePair key=”AUDIT.client” value=”true”/>
<KeyValuePair key=”AUDIT.failedRuleName” value=”true”/>
<KeyValuePair key=”AUDIT.failedRuleType” value=”true”/>
<KeyValuePair key=”AUDIT.failedRuleClass” value=”true”/>
<KeyValuePair key=”AUDIT.failedRuleSetName” value=”true”/>
<KeyValuePair key=”AUDIT.host” value=”true”/>
<KeyValuePair key=”AUDIT.targetHost” value=”true”/>
<KeyValuePair key=”AUDIT.resource” value=”true”/>
<KeyValuePair key=”AUDIT.subject” value=”true”/>
<KeyValuePair key=”AUDIT.trackingId” value=”true”/>HTTP client elements
Client elements provide information about requests made to PingAccess by clients and the response sent back to the client. For example, a user making a call to the PingAccess administrative API is considered client traffic.
|
You can include client elements in the API, engine, and audit traffic logs. |
HTTP client element descriptions
| Item | Description |
|---|---|
|
The section setting for all client elements. |
|
The date and time of the beginning of the request. |
|
The total elapsed time of the request and response. |
|
The method used in the request. |
|
The portion of the Uniform Resource Locator (URL) after the host and port. |
|
The HTTP version used by the request. |
|
A list of all the cookies in the request. This is the parent element for |
|
Information about the request cookie with the specified name. You can include this element multiple times for different cookie names. |
|
A list of all the headers in the request. This is the parent element for |
|
Information about the request header with the specified name. You can include this element multiple times for different header names. |
|
A list of all the parameters and values parsed from the request query string. This is the parent element for |
|
Information about the request query string with the specified name. You can include this element multiple times for different query string names. |
|
The mime type of the posted request data. |
|
The posted request data in plain text format. |
|
The size, in bytes, of the header from the start of the request to the body. |
|
The size, in bytes, of the request body. |
|
The response status code. |
|
The response status description. |
|
The HTTP version used by the response. |
|
A list of all the cookies in the response. This is the parent element for |
|
Information about the response cookie with the specified name. You can include this element multiple times for different cookie names. |
|
A list of all the headers in the response. This is the parent element for |
|
Information about the response header with the specified name. You can include this element multiple times for different header names. |
|
The size, in bytes, of the response content. |
|
The mime type of the response content. |
|
The response body. |
|
The redirect target URL from the location response header. |
|
The size, in bytes, of the header from the start of the response to the body. |
|
The size, in bytes, of the response body. |
HTTP client elements example
This example shows the client section with all elements set to true.
<!-- AUDIT.http-client is the section setting for the following fields: -->
<!-- AUDIT.http-client-started-date-time to AUDIT.http-client-response-body-size -->
<KeyValuePair key=”AUDIT.http-client” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-started-date-time” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-time” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-method” value=”true”/>
<!-- Note: “AUDIT.http-client-request-target” is the target part of the url -->
<KeyValuePair key=”AUDIT.http-client-request-target” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-http-version” value=”true”/>
<!-- Sets the default value for all client request cookies. -->
<!-- This overrides AUDIT.http-client and is overridden by individual cookie values. -->
<KeyValuePair key=”AUDIT.http-client-request-cookies” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-cookie-{cookie}” value=”true”/>
<!-- Sets the default value for all client request headers. -->
<!-- This overrides AUDIT.http-client and is overridden by individual header values. -->
<KeyValuePair key=”AUDIT.http-client-request-headers” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-header-{header}” value=”true”/>
<!-- Sets the default value for all client request query strings. -->
<!-- This overrides AUDIT.http-client and is overridden by individual query strings. -->
<KeyValuePair key=”AUDIT.http-client-request-query-strings” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-query-string-{query}” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-post-data-mime-type” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-post-data-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-headers-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-body-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-status-code” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-status-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-http-version” value=”true”/>
<!-- Sets the default value for all client response cookies. -->
<!-- This overrides AUDIT.http-client and is overridden by individual cookie values. -->
<KeyValuePair key=”AUDIT.http-client-response-cookies” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-cookie-{cookie}” value=”true”/>
<!-- Sets the default value for all client response headers. -->
<!-- This overrides AUDIT.http-client and is overridden by individual header values. -->
<KeyValuePair key=”AUDIT.http-client-response-headers” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-header-{header}” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-content-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-content-mime-type” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-content-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-redirect-url” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-headers-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-body-size” value=”true”/>HTTP app elements
App elements provide information about requests made by PingAccess to other tools or services such as PingFederate, and the response sent back to PingAccess. For example, PingAccess making a call to a protected resource is considered app traffic.
|
You can include app elements in the engine and audit traffic logs. |
HTTP app element descriptions
| Item | Description |
|---|---|
|
The section setting for all app elements. |
|
The date and time of the beginning of the request. |
|
The total elapsed time of the request and response. |
|
The method used in the request. |
|
The portion of the URL after the host and port. |
|
The HTTP version used by the request. |
|
A list of all the cookies in the request. This is the parent element for |
|
Information about the request cookie with the specified name. You can include this element multiple times for different cookie names. |
|
A list of all the headers in the request. This is the parent element for |
|
Information about the request header with the specified name. You can include this element multiple times for different header names. |
|
A list of all the parameters and values parsed from the request query string. This is the parent element for |
|
Information about the request query string with the specified name. You can include this element multiple times for different query string names. |
|
The mime type of the posted data. |
|
The posted data in plain text format. |
|
The size, in bytes, of the header from the start of the request to the body. |
|
The size, in bytes, of the request body. |
|
The response status code. |
|
The response status description. |
|
The HTTP version used by the response. |
|
A list of all the cookies in the response. This is the parent element for |
|
Information about the response cookie with the specified name. You can include this element multiple times for different cookie names. |
|
A list of all the headers in the response. This is the parent element for |
|
Information about the response header with the specified name. You can include this element multiple times for different header names. |
|
The size, in bytes, of the response content. |
|
The mime type of the response content. |
|
The response body. |
|
The redirect target URL from the location response header. |
|
The size, in bytes, of the header from the start of the response to the body. |
|
The size, in bytes, of the response body. |
HTTP app elements example
This example shows the app section with all elements set to true.
<!-- AUDIT.http-app is the section setting for the following fields: -->
<!-- AUDIT.http-app-started-date-time to AUDIT.http-app-response-body-size -->
<KeyValuePair key=”AUDIT.http-app” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-started-date-time” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-time” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-method” value=”true”/>
<!-- Note: “AUDIT.http-app-request-target” is the target part of the url -->
<KeyValuePair key=”AUDIT.http-app-request-target” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-http-version” value=”true”/>
<!-- Sets the default value for all app request cookies. -->
<!-- This overrides AUDIT.http-app and is overridden by individual cookie values. -->
<KeyValuePair key=”AUDIT.http-app-request-cookies” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-cookie-{cookie}” value=”true”/>
<!-- Sets the default value for all app request headers. -->
<!-- This overrides AUDIT.http-app and is overridden by individual header values. -->
<KeyValuePair key=”AUDIT.http-app-request-headers” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-header-{header}” value=”true”/>
<!-- Sets the default value for all app request query strings. -->
<!-- This overrides AUDIT.http-app and is overridden by individual query strings. -->
<KeyValuePair key=”AUDIT.http-app-request-query-strings” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-query-string-{query}” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-post-data-mime-type” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-post-data-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-headers-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-body-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-status-code” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-status-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-http-version” value=”true”/>
<!-- Sets the default value for all app response cookies. -->
<!-- This overrides AUDIT.http-app and is overridden by individual cookie values. -->
<KeyValuePair key=”AUDIT.http-app-response-cookies” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-cookie-{cookie}” value=”true”/>
<!-- Sets the default value for all app response headers. -->
<!-- This overrides AUDIT.http-app and is overridden by individual header values. -->
<KeyValuePair key=”AUDIT.http-app-response-headers” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-header-{header}” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-content-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-content-mime-type” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-content-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-redirect-uri” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-headers-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-body-size” value=”true”/>