---
title: SCIM logging
description: How the PingDirectory HTTP access log identifies SCIM-invoked LDAP operations with the origin=scim attribute.
component: pingdirectory
version: 11.0
page_id: pingdirectory:managing_scim_11_and_20_servlet_extensions:pd_proxy_scim_logging
canonical_url: https://docs.pingidentity.com/pingdirectory/11.0/managing_scim_11_and_20_servlet_extensions/pd_proxy_scim_logging.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: July 15, 2024
page_aliases: ["pingdirectory_server_administration_guide:pd_ds_scim_logging.adoc"]
---

# SCIM logging

The PingDirectory server already provides a detailed HTTP log publisher to capture the SCIM and HTTP request details. To be able to correlate this data to the internal LDAP operations that are invoked behind the scenes, the Access Log Publisher will use "`origin=scim`" in access log messages that are generated by the SCIM servlet.

For example, you will see a message for operations invoked by replication:

```
[30/Oct/2012:18:45:10.490 -0500] MODIFY REQUEST conn=-3 op=190 msgID=191
origin="replication" dn="uid=user.3,ou=people,dc=example,dc=com"
```

Likewise for SCIM messages, you will see a message like this:

```
[30/Oct/2012:18:45:10.490 -0500] MODIFY REQUEST conn=-3 op=190 msgID=191
origin="scim" dn="uid=user.3,ou=people,dc=example,dc=com"
```