Enabling policy query debug logging in the Policy Editor

You can configure the granularity of policy query audit log entries when developing and testing policy queries in external policy decision point (PDP) mode.

About this task

Policy queries enable you to pose open-ended authorization questions to the JSON PDP API with the /query endpoint. For example, instead of being limited to questions like "Can John Smith edit account1?" you can ask "Which accounts can John Smith edit?" or "Which actions can John Smith perform on account1?"

When testing query requests, you can enrich the level of detail in the policy query audit log for enhanced debugging capabilities.

By default, the policy query audit log file is located at PingAuthorize-PAP/logs/query-audit.log.

In debug mode, a policy query audit log entry includes the following fields:

requestId: A unique identifier the query request.
permutationId: A unique identifier for a query permutation.

A query permutation is a combination of query attributes used for a decision in the final query response. Use this identifier and the requestId for increased visibility of query request information across your logging system. For example, a logged call to an external information point would include identifiers for the request and permutation that invoked that service.
permutation: A query permutation as an array of JSON objects containing each query attribute and its value.
response: The complete, high-verbosity response for a query permutation’s associated decision, including expanded errors and other helpful information.

This field includes details about resolution, processing, and policy dependencies of each attribute involved in the permutation’s corresponding decision, along with details about any external service used in that decision.

These fields could change in future PingAuthorize releases.

Steps

Stop the Policy Editor.
```
$ bin/stop-server
```
In the PingAuthorize-PAP/config/configuration.yml file, change the policy query audit log level to DEBUG:
```
logging:
  level: "INFO"
  loggers:
    QUERY_AUDIT_LOG:
      level: "DEBUG"
```
Save your changes and restart the Policy Editor.
```
$ bin/start-server
```

You can now view detailed processing, resolution, and policy dependency information for each possible combination of the attributes included in the query request, as well as each combination’s corresponding decision response.

You can also enable policy query debug logging for decisions executed in embedded PDP mode. Learn more in Troubleshooting policy queries.