--- title: Access Log Filtering Criteria description: A set of rules which determine whether a log record should be logged or not. All the specified rules must match for this overall filtering criteria to match. component: pingds version: 8.1 page_id: pingds:configref:objects-access-log-filtering-criteria canonical_url: https://docs.pingidentity.com/pingds/8.1/configref/objects-access-log-filtering-criteria.html section_ids: dependencies: Dependencies access_log_filtering_criteria_properties: Access Log Filtering Criteria properties basic_properties: Basic properties connection-client-address-equal-to: connection-client-address-equal-to connection-client-address-not-equal-to: connection-client-address-not-equal-to connection-port-equal-to: connection-port-equal-to connection-protocol-equal-to: connection-protocol-equal-to log-record-type: log-record-type request-target-dn-equal-to: request-target-dn-equal-to request-target-dn-not-equal-to: request-target-dn-not-equal-to response-entry-size-greater-than: response-entry-size-greater-than response-etime-greater-than: response-etime-greater-than response-etime-less-than: response-etime-less-than response-etime-processing-greater-than: response-etime-processing-greater-than response-etime-processing-less-than: response-etime-processing-less-than response-etime-queueing-greater-than: response-etime-queueing-greater-than response-etime-queueing-less-than: response-etime-queueing-less-than response-result-code-equal-to: response-result-code-equal-to response-result-code-not-equal-to: response-result-code-not-equal-to search-response-is-indexed: search-response-is-indexed search-response-nentries-greater-than: search-response-nentries-greater-than search-response-nentries-less-than: search-response-nentries-less-than user-dn-equal-to: user-dn-equal-to user-dn-not-equal-to: user-dn-not-equal-to user-is-member-of: user-is-member-of user-is-not-member-of: user-is-not-member-of --- # Access Log Filtering Criteria A set of rules which determine whether a log record should be logged or not. All the specified rules must match for this overall filtering criteria to match. ## Dependencies The following objects depend on Access Log Filtering Criteria: * [Access Log Publisher](objects-access-log-publisher.html) ## Access Log Filtering Criteria properties You can use configuration expressions to set property values at startup time. For details, see [Property value substitution](expressions.html). | Basic Properties | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [connection-client-address-equal-to](#connection-client-address-equal-to) [connection-client-address-not-equal-to](#connection-client-address-not-equal-to) [connection-port-equal-to](#connection-port-equal-to) [connection-protocol-equal-to](#connection-protocol-equal-to) [log-record-type](#log-record-type) [request-target-dn-equal-to](#request-target-dn-equal-to) [request-target-dn-not-equal-to](#request-target-dn-not-equal-to) [response-entry-size-greater-than](#response-entry-size-greater-than) [response-etime-greater-than](#response-etime-greater-than) [response-etime-less-than](#response-etime-less-than) [response-etime-processing-greater-than](#response-etime-processing-greater-than) [response-etime-processing-less-than](#response-etime-processing-less-than) [response-etime-queueing-greater-than](#response-etime-queueing-greater-than) [response-etime-queueing-less-than](#response-etime-queueing-less-than) [response-result-code-equal-to](#response-result-code-equal-to) [response-result-code-not-equal-to](#response-result-code-not-equal-to) [search-response-is-indexed](#search-response-is-indexed) [search-response-nentries-greater-than](#search-response-nentries-greater-than) [search-response-nentries-less-than](#search-response-nentries-less-than) [user-dn-equal-to](#user-dn-equal-to) [user-dn-not-equal-to](#user-dn-not-equal-to) [user-is-member-of](#user-is-member-of) [user-is-not-member-of](#user-is-not-member-of) | ### Basic properties Use the `--advanced` option to access advanced properties. ### connection-client-address-equal-to | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | *Synopsis* | Filters log records associated with connections which match at least one of the specified client host names or address masks. | | *Description* | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. | | *Default value* | None | | *Allowed values* | An IP address mask. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### connection-client-address-not-equal-to | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | *Synopsis* | Filters log records associated with connections which do not match any of the specified client host names or address masks. | | *Description* | Valid values include a host name, a fully qualified domain name, a domain name, an IP address, or a subnetwork with subnetwork mask. | | *Default value* | None | | *Allowed values* | An IP address mask. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### connection-port-equal-to | | | | ----------------------- | ---------------------------------------------------------------------------------------------- | | *Synopsis* | Filters log records associated with connections to any of the specified listener port numbers. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 1.Upper limit: 65535. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### connection-protocol-equal-to | | | | ----------------------- | ------------------------------------------------------------------------------------------- | | *Synopsis* | Filters log records associated with connections which match any of the specified protocols. | | *Description* | Typical values include "ldap", or "ldaps". | | *Default value* | None | | *Allowed values* | The protocol name as reported in the access log. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### log-record-type | | | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters log records based on their type. | | *Default value* | None | | *Allowed values* | * abandon: Abandon operations * add: Add operations * bind: Bind operations * compare: Compare operations * connect: Client connections * delete: Delete operations * disconnect: Client disconnections * extended: Extended operations * modify: Modify operations * rename: Rename operations * search: Search operations * tls: TLS handshakes * unbind: Unbind operations | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### request-target-dn-equal-to | | | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation log records associated with operations which target entries matching at least one of the specified DN patterns. | | *Description* | Valid DN filters are strings composed of zero or more wildcards. A double wildcard \*\* replaces one or more RDN components (as in uid=dmiller,\*\*,dc=example,dc=com). A simple wildcard \* replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj\*,ou=people,dc=example,dc=com). To match the root DN, use two double quote characters with no space in between (""). | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### request-target-dn-not-equal-to | | | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation log records associated with operations which target entries matching none of the specified DN patterns. | | *Description* | Valid DN filters are strings composed of zero or more wildcards. A double wildcard \*\* replaces one or more RDN components (as in uid=dmiller,\*\*,dc=example,dc=com). A simple wildcard \* replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj\*,ou=people,dc=example,dc=com). To match the root DN, use two double quote characters with no space in between (""). | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-entry-size-greater-than | | | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations which target one or more entries whose encoded size is bigger than the specified size. | | *Description* | Frequent operations on large entries may impact performance. It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | 0 KB | | *Allowed values* | Uses [size syntax](size-syntax.html). | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-etime-greater-than | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations whose total response time, including queuing and processing time, took longer than the specified number of milli-seconds to complete. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-etime-less-than | | | | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations whose total response time, including queuing and processing time, took less than the specified number of milli-seconds to complete. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-etime-processing-greater-than | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations whose processing time was greater than the specified number of milli-seconds. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-etime-processing-less-than | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations whose processing time was less than the specified number of milli-seconds. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-etime-queueing-greater-than | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations whose queuing time was greater than the specified number of milli-seconds. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-etime-queueing-less-than | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations whose queuing time was less than the specified number of milli-seconds. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-result-code-equal-to | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations which include any of the specified result codes. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### response-result-code-not-equal-to | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters operation response log records associated with operations which do not include any of the specified result codes. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### search-response-is-indexed | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters search operation response log records associated with searches which were either indexed or unindexed. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | truefalse | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### search-response-nentries-greater-than | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters search operation response log records associated with searches which returned more than the specified number of entries. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### search-response-nentries-less-than | | | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters search operation response log records associated with searches which returned less than the specified number of entries. | | *Description* | It is recommended to only use this criteria in conjunction with the "combined" output mode of the access logger, since this filter criteria is only applied to response log messages. | | *Default value* | None | | *Allowed values* | An integer.Lower limit: 0. | | *Multi-valued* | No | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### user-dn-equal-to | | | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters log records associated with users matching at least one of the specified DN patterns. | | *Description* | Valid DN filters are strings composed of zero or more wildcards. A double wildcard \*\* replaces one or more RDN components (as in uid=dmiller,\*\*,dc=example,dc=com). A simple wildcard \* replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj\*,ou=people,dc=example,dc=com). To match the anonymous user, use two double quote characters with no space in between (""). | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### user-dn-not-equal-to | | | | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters log records associated with users which do not match any of the specified DN patterns. | | *Description* | Valid DN filters are strings composed of zero or more wildcards. A double wildcard \*\* replaces one or more RDN components (as in uid=dmiller,\*\*,dc=example,dc=com). A simple wildcard \* replaces either a whole RDN, or a whole type, or a value substring (as in uid=bj\*,ou=people,dc=example,dc=com). To match the anonymous user, use two double quote characters with no space in between (""). | | *Default value* | None | | *Allowed values* | A string. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### user-is-member-of | | | | ----------------------- | ---------------------------------------------------------------------------------------------------- | | *Synopsis* | Filters log records associated with users which are members of at least one of the specified groups. | | *Default value* | None | | *Allowed values* | A valid DN. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No | ### user-is-not-member-of | | | | ----------------------- | ----------------------------------------------------------------------------------------------- | | *Synopsis* | Filters log records associated with users which are not members of any of the specified groups. | | *Default value* | None | | *Allowed values* | A valid DN. | | *Multi-valued* | Yes | | *Required* | No | | *Admin action required* | None | | *Advanced* | No | | *Read-only* | No |