--- title: Log sources description: Advanced Identity Cloud makes browsing the audit and debug logs easier by storing them in various sources. component: pingoneaic page_id: pingoneaic:tenants:audit-debug-log-sources canonical_url: https://docs.pingidentity.com/pingoneaic/tenants/audit-debug-log-sources.html keywords: ["Monitoring", "Tenants", "Troubleshooting"] page_aliases: ["pingoneaic::audit-debug-logs.adoc#sources"] section_ids: view_log_sources: View log sources log-source-descriptions: Log source descriptions am-sources: AM sources environment-access: Environment changes idm-sources: IDM sources ws-federation-sources: WS-Federation sources --- # Log sources Advanced Identity Cloud makes browsing the audit and debug logs easier by storing them in various sources. ## View log sources | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------- | | | You need to [get an API key and secret](../developer-docs/authenticate-to-rest-api-with-api-key-and-secret.html) before you can view log sources. | To view a list of the available log sources, use the `/monitoring/logs/sources` endpoint. Example request: ```bash $ curl \ --request GET 'https:///monitoring/logs/sources' \ --header 'x-api-key: ' \ --header 'x-api-secret: ' ``` Example response showing available sources in a `result` array: ```json { "result": [ "am-access", (1) "am-activity", "am-authentication", "am-config", "am-core", "am-everything", "environment-access", (2) "idm-access", (3) "idm-activity", "idm-authentication", "idm-config", "idm-core", "idm-everything", "idm-recon", "idm-sync", "ws-activity", (4) "ws-config", "ws-core", "ws-everything" ], "resultCount": 18, "pagedResultsCookie": null, "totalPagedResultsPolicy": "NONE", "totalPagedResults": 1, "remainingPagedResults": 0 } ``` | | | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | **1** | Start of log sources for AM audit events. Learn more in [AM sources](#am-sources). | | **2** | Log source for environment configuration changes. Learn more in [Environment changes](#environment-access). | | **3** | Start of log sources for IDM audit events. Learn more in [IDM sources](#idm-sources). | | **4** | Start of log sources for WS-Federation\[[1](#_footnotedef_1 "View footnote.")] audit events. Learn more in [WS-Federation sources](#ws-federation-sources). | ## Log source descriptions ### AM sources | Source | Type | Description | | ----------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | am-access | Audit | Captures all incoming Advanced Identity Cloud access calls as audit events. This includes who, what, when, and the output for every access request.Audit events:* AM-ACCESS-ATTEMPT * AM-ACCESS-OUTCOME> **Collapse: Show example** > > ```json > { > "payload": { > "_id": "92c9b6a4-f36f-438a-b1d4-c6e6bd909da6-783933", > "client": { > "ip": "198.51.101.0" > }, > "component": "OAuth", > "eventName": "AM-ACCESS-ATTEMPT", > "http": { > "request": { > "headers": { > "content-type": [ > "application/x-www-form-urlencoded" > ], > "host": [ > "" > ], > "user-agent": [ > "Apache-HttpClient/4.5.13 (Java/11.0.11)" > ], > "x-forwarded-for": [ > "198.51.101.0, 203.0.116.0, 192.0.3.255" > ], > "x-forwarded-proto": [ > "https" > ] > }, > "method": "POST", > "path": "https:///am/oauth2/realms/root/realms/alpha/access_token", > "secure": true > } > }, > "level": "INFO", > "realm": "/alpha", > "request": { > "detail": { > "client_id": "RCSClient", > "grant_type": "client_credentials", > "scope": "fr:idm:*" > } > }, > "source": "audit", > "timestamp": "", > "topic": "access", > "transactionId": "1634116808645-2e50ecbf0df5407a6870-226587/0" > }, > "timestamp": "", > "type": "application/json" > } > ```> **Collapse: Access log format** > > * `_id` > > A universally unique identifier (UUID) for the message object, such as `a568d4fe-d655-49a8-8290-bfc02095bec9-491`. > > * `timestamp` > > The timestamp when Advanced Identity Cloud logged the message, in UTC format to millisecond precision: `yyyy-MM-ddTHH:mm:ss.msZ`. For example: `2015-11-14T00:16:04.653Z` > > * `eventName` > > The name of the audit event. For example, `AM-ACCESS-ATTEMPT` and `AM-ACCESS-OUTCOME`. > > * `transactionId` > > The UUID of the transaction, which identifies an external request when it comes into the system boundary. Any events generated while handling that request are assigned that transaction ID, so you could see the same transaction ID for different audit event topics. For example, `9c9e8d5c-2941-4e61-9c3c-8a990088e801`. > > * `userId` > > The universal identifier for authenticated users. For example, `id=scarter,ou=user,o=shop,ou=services,dc=example,dc=com`. > > * `trackingIds` > > A unique random string generated as an alias for each Advanced Identity Cloud session ID and OAuth 2.0 token. > > When Advanced Identity Cloud generates an access or grant token, it also generates a unique random value and logs it as an alias. In this way, you can trace an access token back to its originating grant token, trace the grant token back to the session in which it was created, and then trace how the session was authenticated. An example of a `trackingIds` property in an OAuth 2.0/OpenID Connect 1.0 environment is: > > ``` > [ "1979edf68543ead001", "8878e51a-f2aa-464f-b1cc-b12fd6daa415", "3df9a5c3-8d1e-4ee3-93d6-b9bbe58163bc" ] > ``` > > * `client.host` > > The client hostname. This field is populated only if reverse DNS lookup is enabled. > > * `client.ip` > > The client IP address. > > * `client.port` > > The client port number. > > * `request.protocol` > > The protocol associated with the request operation. > > Possible values: `CREST`, `PLL`, `SAML2`. > > * `request.operation` > > The request operation. For common REST operations, possible values are: `READ`, `ACTION`, `QUERY`. > > For PLL operations, possible values are: `LoginIndex`, `SubmitRequirements`, `GetSession`, `REQUEST_ADD_POLICY_LISTENER`. > > * `request.detail` > > Detailed information about the request operation. For example: > > * `{"action":"idFromSession"}` > > * `{"action":"validateGoto"}` > > * `{"action":"validate"}` > > * `{"action":"logout"}` > > * `{"action":"schema"}` > > * `{"action":"template"}` > > The following examples show different authentication flows: > > * For an OAuth 2.0 app journey flow: > > ```json > { > "oAuth2Client":"myClient", > "configuredService":"oauth2Tree" > } > ``` > > * For a SAML 2.0 app journey flow: > > ```json > { > "spEntity":"serviceprovider1", > "idpEntity":"identityprovider1", > "configuredService":"samlTree" > } > ``` > > * For a SAML 2.0 flow where Advanced Identity Cloud is the hosted IdP and the user has successfully authenticated: > > ```json > { > "spEntity": "serviceprovider1", > "flowInitiator": "IDP", > "idpEntity": "identityprovider1", > "userID": "id=bjensen,ou=user,o=alpha,ou=services,dc=example,dc=com", > "nameID": "V5Xa3AO+5xbxUfPSF73imsTYu3Rm" > } > ``` > > * `http.method` > > The HTTP method requested by the client. For example, `GET`, `POST`, `PUT`. > > * `http.path` > > The path of the HTTP request; for example, `https:////am/json/realms/root/realms/alpha/authenticate`. > > * `http.queryParameters` > > The HTTP query parameter string. For example: > > * `{ "_action": [ "idFromSession" ] }` > > * `{ "_queryFilter": [ "true" ] }` > > * `{ "_action": [ "validate" ] }` > > * `{ "_action": [ "logout" ] }` > > * `{ "realm": [ "/shop" ] }` > > * `{ "_action": [ "validateGoto" ] }` > > * `http.request.headers` > > The HTTP header for the request. > > > **Collapse: Example** > > > > ```json > > { > > "accept": [ > > "application/json" > > ], > > "accept-api-version": [ > > "protocol=1.0,resource=2.1" > > ], > > "content-type": [ > > "application/json" > > ], > > "host": [ > > "example.forgeblocks.com" > > ], > > "origin": [ > > "https://example.forgeblocks.com" > > ], > > "user-agent": [ > > "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/120.0" > > ], > > "x-forwarded-for": [ > > "188.39.235.130, 34.117.102.58, 10.154.0.3" > > ], > > "x-forwarded-proto": [ > > "https" > > ], > > "x-requested-with": [ > > "forgerock-sdk" > > ] > > } > > ``` > > * `http.request.cookies` > > A JSON map of key-value pairs and appears as its own property to allow for denylisting fields or values. > > * `http.response.cookies` > > Not used in Advanced Identity Cloud. > > * `response.status` > > The response status of the request. For example, `SUCCESS`, `FAILURE`, or null. > > * `response.statusCode` > > The response status code, depending on the protocol. For common REST, HTTP failure codes are displayed but HTTP success codes aren't. For PLL endpoints, PLL error codes are displayed. > > * `response.detail` > > The message associated with `response.statusCode`. For example, the `response.statusCode` of `401` has a `response.detail` of `{ "reason": "Unauthorized" }`. > > * `response.elapsedTime` > > The time to execute the access event, usually in millisecond precision. > > * `response.elapsedTimeUnits` > > The elapsed time units of the response. For example, `MILLISECONDS`. > > * `component` > > The Advanced Identity Cloud service utilized; for example, `Server Info`, `Users`, `Config`, `Session`, `Authentication`, `Policy`, `OAuth`, `SAML2`, `Web Policy Agent`, or `Java Policy Agent`. > > * `realm` > > The realm where the operation occurred. For example, (`"/alpha"`).> **Collapse: Show schema** > > ```json > { > "access": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "description": "The unique identifier for the message object", > "type": "string" > }, > "timestamp": { > "description": "The time at which the event occurred, used by all topics", > "type": "string" > }, > "eventName": { > "description": "The name of the event, used by all topics", > "type": "string" > }, > "transactionId": { > "description": "The transaction ID of the event, used by all topics", > "type": "string" > }, > "userId": { > "description": "The ID of the user responsible for the event, used by all topics", > "type": "string" > }, > "trackingIds": { > "description": "The tracking IDs of the event, used by all topics", > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "server": { > "type": "object", > "properties": { > "ip": { > "description": "The server ip address for an access event.ip", > "type": "string" > }, > "port": { > "description": "The server port for an access event", > "type": "integer" > } > } > }, > "client": { > "type": "object", > "properties": { > "ip": { > "description": "The client IP address for an access event", > "type": "string" > }, > "port": { > "description": "The client port for an access event", > "type": "integer" > } > } > }, > "request": { > "type": "object", > "properties": { > "protocol": { > "description": "The request protocol for an access event", > "type": "string" > }, > "operation": { > "description": "The operation that triggered an activity or config event", > "type": "string" > }, > "detail": { > "description": "The request detail for an access event", > "type": "object" > } > } > }, > "http": { > "type": "object", > "properties": { > "request": { > "description": "The http request for an access event", > "type": "object", > "properties": { > "secure": { > "description": "The http secure property for an access event", > "type": "boolean" > }, > "method": { > "description": "The http method for an access event", > "type": "string" > }, > "path": { > "description": "The http path for an access event", > "type": "string" > }, > "queryParameters": { > "description": "Http query parameters", > "type": "object", > "additionalProperties": { > "type": "array", > "items": { > "type": "string" > } > } > }, > "headers": { > "description": "The http headers for an access event", > "type": "object", > "additionalProperties": { > "type": "array", > "items": { > "type": "string" > } > } > }, > "cookies": { > "description": "The http cookies for an access event", > "type": "object", > "additionalProperties": { > "type": "string" > } > } > } > }, > "response": { > "description": "The http response for an access event", > "type": "object", > "properties": { > "headers": { > "description": "The http request headers for an access event", > "type": "object", > "additionalProperties": { > "type": "array", > "items": { > "type": "string" > } > } > } > } > } > } > }, > "response": { > "type": "object", > "properties": { > "status": { > "description": "The response status for an access event", > "type": "string" > }, > "statusCode": { > "description": "The response status code for an access event", > "type": "string" > }, > "detail": { > "description": "The response detail for an access event", > "type": "object" > }, > "elapsedTime": { > "description": "The response elapsedTime for an access event", > "type": "integer" > }, > "elapsedTimeUnits": { > "description": "The response elapsed time units for an access event", > "type": "string" > } > } > } > } > } > } > } > ``` | | am-activity | Audit | Captures state changes to objects that were created, updated, or deleted by Advanced Identity Cloud end users. This includes session, user profile, and device profile changes.Audit events:* AM-SELFSERVICE-REGISTRATION-COMPLETED * AM-SELFSERVICE-PASSWORDCHANGE-COMPLETED * AM-SESSION-CREATED * AM-SESSION-IDLE\_TIME\_OUT * AM-SESSION-MAX\_TIMED\_OUT * AM-SESSION-LOGGED\_OUT * AM-SESSION-DESTROYED * AM-SESSION-PROPERTY\_CHANGED * AM-IDENTITY-CHANGE * AM-GROUP-CHANGE> **Collapse: Show example** > > ```json > { > "timestamp": "", > "payload": { > "_id": "3fc956b8-00a1-4e10-b8aa-72295d003bfb-195032", > "objectId": "3fc956b8-00a1-4e10-b8aa-72295d003bfb-195023", > "transactionId": "cf2a721c-9cec-4224-bdd1-3a33e1f8ed56/4", > "level": "INFO", > "eventName": "AM-SESSION-CREATED", > "timestamp": "", > "component": "Session", > "source": "audit", > "topic": "activity", > "trackingIds": [ > "3fc956b8-00a1-4e10-b8aa-72295d003bfb-195023" > ], > "realm": "/", > "userId": "id=amadmin,ou=user,ou=am-config", > "runAs": "id=amadmin,ou=user,ou=am-config", > "operation": "CREATE" > }, > "type": "application/json" > } > ```> **Collapse: Activity log format** > > * `_id` > > A universally unique identifier (UUID) for the message object, such as `a568d4fe-d655-49a8-8290-bfc02095bec9-487`. > > * `changedFields` > > Not used. > > * `component` > > The Advanced Identity Cloud service utilized. For example, `Session` or `ID Repo`. > > * `eventName` > > The name of the audit event. For example, `AM-SESSION_CREATED`, `AM-SESSION-LOGGED_OUT`, `AM-NEW-CONNECTION-FACTORY`. > > * `level` > > The activity log level, `INFO` by default. > > * `objectId` > > The unique identifier of the object that was created, updated, or deleted. For logging sessions, the session `trackingId` is used in this field. > > * `operation` > > The stage change operation performed on the object. For example, `CREATE` or `UPDATE`. > > - `runAs` > > The user to run the activity as, used in delegated administration. > > - `transactionId` > > The UUID of the transaction, which identifies an external request when it comes into the system boundary. Any events generated while handling that request are assigned that transaction ID, so you could see the same transaction ID for different audit event topics. For example, `9c9e8d5c-2941-4e61-9c3c-8a990088e801`. > > - `trackingIds` > > An array containing the following: > > * A random context ID that identifies the session > > * A random string generated from an OAuth 2.0/OIDC 1.0 flow that could track an access token ID or a grant token ID. > > For example, `[ "c120669f-f636-467d-8da0-590d72aeaf08-181706" ]`. > > - `userId` > > The universal identifier for authenticated users. For example, `id=fe32c8fe-38a2-4159-a220-9385350f3aca,ou=user,ou=am-config`. > > - `timestamp` > > The timestamp when Advanced Identity Cloud} logged the message, in UTC format to millisecond precision: `yyyy-MM-ddTHH:mm:ss.msZ`. For example: `2015-11-14T00:16:04.652Z` > > - `type` > > The data type,`application/json` by default. > > - source\` > > The source of these logs, `am-activity`.> **Collapse: Show schema** > > ```json > { > "activity": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "description": "The unique identifier for the message object", > "type": "string" > }, > "timestamp": { > "description": "The time at which the event occurred, used by all topics", > "type": "string" > }, > "eventName": { > "description": "The name of the event, used by all topics", > "type": "string" > }, > "transactionId": { > "description": "The transaction ID of the event, used by all topics", > "type": "string" > }, > "userId": { > "description": "The ID of the user responsible for the event, used by all topics", > "type": "string" > }, > "trackingIds": { > "description": "The tracking IDs of the event, used by all topics", > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "runAs": { > "description": "What the change that triggered an activity or config event was run as", > "type": "string" > }, > "objectId": { > "description": "The object ID of the change that triggered an activity or config event", > "type": "string" > }, > "operation": { > "description": "The operation that triggered an activity or config event", > "type": "string" > }, > "before": { > "description": "The state before an activity or config event occurred", > "type": "object" > }, > "after": { > "description": "The state after an activity or config event occurred", > "type": "object" > }, > "changedFields": { > "description": "The changed fields after an activity or config event occurred", > "type": "array", > "items": { > "id": "1", > "type": "string" > } > }, > "revision": { > "description": "The revision for an activity or config event", > "type": "string" > } > } > } > } > } > ``` | | am-authentication | Audit | Captures when and how a user authenticated and related audit events.Advanced Identity Cloud records an authentication audit event for each authentication node and the journey outcome. A node can provide extra data in the standard audit event, which is logged when an authentication node completes.Audit events:- AM-BACK-CHANNEL-INITIALIZE - AM-LOGOUT - AM-LOGIN-COMPLETED - AM-LOGIN-MODULE-COMPLETED - AM-NODE-LOGIN-COMPLETED Advanced Identity Cloud logs this audit event each time an authentication node completes. > **Collapse: Show example** > > ```json > { > "type": "application/json", > "timestamp": "", > "payload": { > "topic": "authentication", > "eventName": "AM-NODE-LOGIN-COMPLETED", > "transactionId": "ad56bedd-7dab-45d1-84d9-505b0b64fd6d/6", > "principal": [ > "amadmin" > ], > "timestamp": "", > "component": "Authentication", > "source": "audit", > "realm": "/", > "entries": [ > { > "info": { > "authLevel": "0", > "displayName": "Page Node", > "nodeId": "83a9d86e-d6f5-11ea-87d0-0242ac130003", > "nodeOutcome": "outcome", > "treeName": "FRLogin", > "nodeType": "PageNode" > } > } > ], > "level": "INFO", > "trackingIds": [ > "3fc956b8-00a1-4e10-b8aa-72295d003bfb-184020" > ], > "_id": "3fc956b8-00a1-4e10-b8aa-72295d003bfb-184022" > } > } > ``` - AM-TREE-LOGIN-STARTED * Disabled by default in Advanced Identity Cloud. - AM-TREE-LOGIN-COMPLETED * If authentication completes successfully, the event has a `result` of `SUCCESS`. * If authentication fails, the event has a `result` of `FAILED`. * If the authentication ends in an *exception*, the event has a `result` of `FAILED` with the following additional field: ```bash exception: "An exception occurred during the authentication process" ``` These exceptions let you troubleshoot authentication journeys that failed due to misconfiguration.Learn more about `am-authentication` properties in [Authentication log format](https://docs.pingidentity.com/pingam/8/security-guide/sec-maint-audit-ref.html#authentication-log-format).> **Collapse: Authentication log format** > > * `_id` > > A universally unique identifier (UUID) for the message object, such as `a568d4fe-d655-49a8-8290-bfc02095bec9-485`. > > * `timestamp` > > The timestamp when Advanced Identity Cloud} logged the message, in UTC format to millisecond precision: `yyyy-MM-ddTHH:mm:ss.msZ`. For example: `2015-11-14T00:16:04.640Z` > > * `eventName` > > The name of the audit event. For example, `AM-LOGOUT` and `AM-NODE-LOGIN-COMPLETED`. > > * `transactionId` > > The UUID of the transaction, which identifies an external request when it comes into the system boundary. Any events generated while handling that request are assigned that transaction ID, so you could see the same transaction ID for different audit event topics. For example, `9c9e8d5c-2941-4e61-9c3c-8a990088e801`. > > * `user.id` > > The universal identifier for authenticated users. For example, `id=scarter,ou=user,o=shop,ou=services,dc=example,dc=com`. > > * `trackingIds` > > An array containing a unique random context ID. > > * For OAuth 2.0/OIDC flows, this field identifies the session and a random string generated that can track an access token ID or a grant token ID. > > * For authentication journeys, this field identifies the journey. > > * `result` > > The result of the authentication journey. Possible values are `SUCCESSFUL` or `FAILED`. > > * `principal` > > The array of accounts used to authenticate. For example `[ "tenantadmin" ]` or `[ "scarter" ]`. > > * `context` > > Not used > > * `entries` > > A JSON representation of the authentication journey or node. Advanced Identity Cloud} creates an event as each node completes and a final event at the end of the journey. > > Example: > > ```json > { > "entries":[ > { > "info":{ > "nodeOutcome":"true", > "treeName":"Example", > "displayName":"Data Store Decision", > "nodeType":"DataStoreDecisionNode", > "nodeId":"e5ec495a-2ae2-4eca-8afb-9781dea04170", > "authLevel":"0" > } > } > ] > } > ``` > > * `component` > > The Advanced Identity Cloud} service utilized. For example, `Authentication`. > > * `realm` > > The realm where the operation occurred. For example, (`"/alpha"`).> **Collapse: Show schema** > > ```json > { > "authentication": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "description": "The unique identifier for the message object", > "type": "string" > }, > "timestamp": { > "description": "The time at which the event occurred, used by all topics", > "type": "string" > }, > "eventName": { > "description": "The name of the event, used by all topics", > "type": "string" > }, > "transactionId": { > "description": "The transaction ID of the event, used by all topics", > "type": "string" > }, > "userId": { > "description": "The ID of the user responsible for the event, used by all topics", > "type": "string" > }, > "trackingIds": { > "description": "The tracking IDs of the event, used by all topics", > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "result": { > "description": "The result of the authentication event", > "type": "string" > }, > "principal": { > "description": "The principal responsible for the authentication event", > "type": "array", > "items": { > "type": "string" > } > }, > "context": { > "description": "The context of an authentication event", > "type": "object", > "properties": {} > }, > "entries": { > "description": "The entries for an authentication event", > "type": "array", > "items": { > "type": "object", > "properties": { > "moduleId": { > "description": "The module ID for the authentication event", > "type": "string" > }, > "result": { > "description": "The result of the module authentication event", > "type": "string" > }, > "info": { > "description": "The entries information for an authentication event", > "type": "object", > "properties": {} > } > } > } > } > } > } > } > } > ``` | | am-config | Audit | Captures access management configuration changes for Advanced Identity Cloud with a timestamp and by whom.Configuration changes can only be performed in development environments, so these logs are empty in staging and production environments.Audit events:* AM-CONFIG-CHANGE> **Collapse: Show example** > > ```json > { > "payload": { > "_id": "92c9b6a4-f36f-438a-b1d4-c6e6bd909da6-822860", > "eventName": "AM-CONFIG-CHANGE", > "level": "INFO", > "objectId": "ou=Office365,ou=dashboardApp,ou=default,ou=GlobalConfig,ou=1.0,ou=dashboardService,ou=services,ou=am-config", > "operation": "CREATE", > "runAs": "id=bd220328-9762-458b-b05a-982ac3c7fc54,ou=user,ou=am-config", > "source": "audit", > "timestamp": "", > "topic": "config", > "trackingIds": [ > "92c9b6a4-f36f-438a-b1d4-c6e6bd909da6-821644" > ], > "transactionId": "1634122041174-2e50ecbf0df5407a6870-229391/0", > "userId": "id=bd220328-9762-458b-b05a-982ac3c7fc54,ou=user,ou=am-config" > }, > "timestamp": "", > "type": "application/json" > } > ```> **Collapse: Config log format** > > * `_id` > > A universally unique identifier (UUID) for the message object. For example, `6a568d4fe-d655-49a8-8290-bfc02095bec9-843`. > > * `timestamp` > > The timestamp when Advanced Identity Cloud logged the message, in UTC format to millisecond precision: `yyyy-MM-ddTHH:mm:ss.msZ`. For example, `2015-11-14T00:21:03.490Z` > > * `eventName` > > The name of the audit event. For example, `AM-CONFIG-CHANGE`. > > * `transactionId` > > The UUID of the transaction, which identifies an external request when it comes into the system boundary. Any events generated while handling the request will be assigned that transaction ID, so you could see the same transaction ID for different audit event topics. For example, `301d1a6e-67f9-4e45-bfeb-5e4047a8b432`. > > * `user.id` > > Not used. > > You can determine the value for this field by linking to the access event using the same `transactionId`. > > * `trackingIds` > > Not used. > > * `runAs` > > The user to run the activity as. Can be used in delegated administration. > > * `objectId` > > The identifier of a system object that has been created, modified, or deleted. For example, `ou=SamuelTwo,ou=default,ou=OrganizationConfig,ou=1.0, ou=iPlanetAMAuthSAML2Service,ou=services,o=shop,ou=services,dc=example,dc=com`. > > * `operation` > > The state change operation invoked: `CREATE`, `MODIFY`, or `DELETE`. > > * `before` > > The JSON representation of the object prior to the activity. > > Example: > > ```json > { > "sunsmspriority":[ > "0" > ], > "objectclass":[ > "top", > "sunServiceComponent", > "organizationalUnit" > ], > "ou":[ > "SamuelTwo" > ], > "sunserviceID":[ > "serverconfig" > ] > } > ``` > > * `after` > > The JSON representation of the object after the activity. > > Example: > > ```json > { > "sunKeyValue":[ > "forgerock-am-auth-saml2-auth-level=0", > "forgerock-am-auth-saml2-meta-alias=/sp", > "forgerock-am-auth-saml2-entity-name=http://", > "forgerock-am-auth-saml2-authn-context-decl-ref=", > "forgerock-am-auth-saml2-force-authn=none", > "forgerock-am-auth-saml2-is-passive=none", > "forgerock-am-auth-saml2-login-chain=", > "forgerock-am-auth-saml2-auth-comparison=none", > "forgerock-am-auth-saml2-req-binding= urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", > "forgerock-am-auth-saml2-binding= urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact", > "forgerock-am-auth-saml2-authn-context-class-ref=", > "forgerock-am-auth-saml2-slo-relay=http://", > "forgerock-am-auth-saml2-allow-create=false", > "forgerock-am-auth-saml2-name-id-format= urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" > ] > } > ``` > > * `changedFields` > > The fields that were changed. For example, `[ "sunKeyValue" ]`. > > * `revision` > > Not used. > > * `component` > > Not used. > > * `realm` > > The realm where the operation occurred. For example, (`"/alpha"`).> **Collapse: Show schema** > > ```json > { > "config": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "description": "The unique identifier for the message object", > "type": "string" > }, > "timestamp": { > "description": "The time at which the event occurred, used by all topics", > "type": "string" > }, > "eventName": { > "description": "The name of the event, used by all topics", > "type": "string" > }, > "transactionId": { > "description": "The transaction ID of the event, used by all topics", > "type": "string" > }, > "userId": { > "description": "The ID of the user responsible for the event, used by all topics", > "type": "string" > }, > "trackingIds": { > "description": "The tracking IDs of the event, used by all topics", > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "runAs": { > "description": "What the change that triggered an activity or config event was run as", > "type": "string" > }, > "objectId": { > "description": "The object ID of the change that triggered an activity or config event", > "type": "string" > }, > "operation": { > "description": "The operation that triggered an activity or config event", > "type": "string" > }, > "before": { > "description": "The state before an activity or config event occurred", > "type": "object" > }, > "after": { > "description": "The state after an activity or config event occurred", > "type": "object" > }, > "changedFields": { > "description": "The changed fields after an activity or config event occurred", > "type": "array", > "items": { > "id": "1", > "type": "string" > } > }, > "revision": { > "description": "The revision for an activity or config event", > "type": "string" > } > } > } > } > } > } > ``` | | am-core | Debug | Captures access management debug logs for Advanced Identity Cloud. Use am-core when debugging anything in access management without capturing audit events. am-core also captures logging in authentication scripts.Development and sandbox environments provide DEBUG level logs, with logs in several areas tuned to INFO or WARNING.To reduce log volumes, staging and production environments only provide WARNING level logs and above.To troubleshoot and view the latest entries in the stored logs, you can tail am-core source. Learn more in [Tail logs](audit-debug-logs-pull.html#tail-logs). | | am-everything | Audit, Debug | Captures all access management audit and debug logs for Advanced Identity Cloud.This includes all the logs captured in `am-access`, `am-activity`, `am-authentication`, `am-config`, and `am-core`. | ### Environment changes | Source | Type | Description | | ------------------ | ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | environment-access | Audit | Captures all modifications made to the environment, including ESVs, promotions, and configuration changes, as audit events.This log source specifically covers Advanced Identity Cloud's core environment and doesn't include access logs from AM, IDM, or WS-Federation services.Audit events:* ENVIRONMENT-ACCESS-OUTCOME * ESV-ACCESS-OUTCOME * PROMO-ACCESS-OUTCOME * LOG-ACCESS-OUTCOME> **Collapse: Show example** > > ```json > { > "payload": { > "_id": "3fcd63b4-a139-423b-8b05-26dc1b635995", > "client": { > "ip": "10.67.67.63", > "port": "54056" > }, > "eventName": "ENVIRONMENT-ACCESS-OUTCOME", > "http": { > "request": { > "headers": { > "accept": [ > "/" > ], > "accept-encoding": [ > "gzip,deflate" > ], > "user-agent": [ > "node-fetch/1.0 (+https://github.com/bitinn/node-fetch)" > ] > }, > "method": "GET", > "path": "http://org-environment.org-environment:8080/environment/custom-domains/alpha", > "secure": false > } > }, > "msg": "", > "response": { > "elapsedTime": 43, > "elapsedTimeUnits": "MILLISECONDS", > "status": "SUCCESS", > "statusCode": 200 > }, > "server": { > "ip": "10.67.67.68", > "port": "8080" > }, > "severity": "info", > "source": "audit", > "timestamp": "2025-10-30T13:53:35.30291233Z", > "topic": "access", > "transactionId": "529d242d-24f2-475f-b677-946130b93988/0/4" > }, > "source": "environment-access", > "timestamp": "2025-10-30T13:53:35.30311657Z", > "type": "application/json" > } > ```> **Collapse: Log format** > > * `_id` > > A universally unique identifier (UUID) for the message object, such as `e47da30d-5385-4db7-8ead-be6de7381a6a`. > > * `timestamp` > > The timestamp when Advanced Identity Cloud logged the message, in UTC format to nanosecond precision: `yyyy-MM-ddTHH:mm:ss.SSSSSSSSSZ`. For example, `2025-11-03T12:17:36.533249455Z` > > * `eventName` > > The name of the audit event. For example, `ENVIRONMENT-ACCESS-OUTCOME`, `PROMO-ACCESS-OUTCOME`, `ESV-ACCESS-OUTCOME`, or `LOG-ACCESS-OUTCOME`. > > * `transactionId` > > The UUID of the transaction, which identifies an external request when it comes into the system boundary. Any events generated while handling that request are assigned that transaction ID, so you could see the same transaction ID for different audit event topics. > > For example, `3a351e01-2eea-495d-b0ea-ede8888b7b17/0`. The first part is a unique ID for the entire transaction, while the `/0` suffix is an incrementing index for each event within that transaction. > > * `userId` > > The identifier for the authenticated administrator who performed the action. For example, `4f01d1f4-9b22-4810-aff8-4335bc047e9c`. > > * `trackingIds` > > A unique random identifier that links an administrative API call to the OAuth 2.0 bearer token used for authentication. This allows tracing an environment change back to the specific administrative session that authorized it. For example, `["3cfe01fe-d0d8-41d5-a6d2-c94718489294-1219818"]`. > > * `client.ip` > > The client IP address from which the administrative request originated. > > * `client.port` > > The client port number. > > * `request.detail` > > Information about the request operation. For example, `"auth_type" : "bearer_token"`. > > * `http.method` > > The HTTP method requested by the client. For example, `GET`, `POST`, `PUT`. > > * `http.path` > > The path of the HTTP request. For example, `https:///environment/certificates`. > > * `http.queryParameters` > > The HTTP query parameter string. For example: > > * `{ "_onlyPending" : [ "false"] }` > > * `{ "_action" : [ "create"] }` > > * `http.request.headers` > > The HTTP header for the request. > > > **Collapse: Example** > > > > ```json > > { > > "accept": [ > > "application/json" > > ], > > "accept-api-version": [ > > "protocol=1.0,resource=1.0" > > ], > > "accept-encoding" : [ > > "gzip, deflate" > > ], > > "content-type": [ > > "application/json" > > ], > > "user-agent": [ > > "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" > > ], > > "x-forwarded-for" : [ > > "146.200.129.107, 34.120.62.48" > > ], > > "x-forwarded-proto" : [ > > "https" > > ], > > "x-real-ip" : [ > > "146.200.129.105" > > ] > > } > > ``` > > * `response.elapsedTime` > > The time to execute the access event, usually in millisecond precision. > > * `response.status` > > The response status of the request. For example, `SUCCESS`, `FAILURE`, or null. > > * `response.statusCode` > > The response status code, depending on the protocol. For example, `200` for success or `401` for unauthorized. > > * `response.elapsedTimeUnits` > > The elapsed time units of the response. For example, `MILLISECONDS`. > > * `server.ip` > > The server IP address. > > * `server.port` > > The server port number. | ### IDM sources | Source | Type | Description | | ------------------ | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | idm-access | Audit | Captures messages for the identity management REST endpoints and the invocation of scheduled tasks. This is the who, what, and output for every identity management access request in Advanced Identity Cloud.Audit events:* access> **Collapse: Show example** > > ```json > { > "payload": { > "_id": "32c02w2f-bafe-4bdf-a8e1-1ce94813c46b-123717", > "client": { > "ip": "198.51.101.0", > "port": 60572 > }, > "eventName": "access", > "http": { > "request": { > "headers": { > "host": [ > ":443" > ], > "user-agent": [ > "Blackbox Exporter/0.25.0" > ], > "x-forwarded-for": [ > "34.102.86.57, 34.97.113.137, 120.211.3.20" > ], > "x-forwarded-proto": [ > "https" > ], > "x-real-ip": [ > "34.102.86.57" > ] > }, > "method": "GET", > "path": "https:///openidm/info/ping", > "secure": true > } > }, > "level": "INFO", > "request": { > "operation": "READ", > "protocol": "CREST" > }, > "response": { > "elapsedTime": 10, > "elapsedTimeUnits": "MILLISECONDS", > "status": "SUCCESSFUL", > "statusCode": "200" > }, > "roles": [ > "internal/role/openidm-reg" > ], > "server": { > "ip": "10.68.2.21", > "port": 8080 > }, > "source": "audit", > "timestamp": "dateTime", > "topic": "access", > "transactionId": "6b3a1cbb-523d-48ae-bd11-1aca4b65c294/0", > "userId": "anonymous" > }, > "source": "idm-access", > "timestamp": "dateTime", > "type": "application/json" > } > ```> **Collapse: Show schema** > > IDM access logs use a base schema and add several identity management-specific fields. > > Base schema > > ```json > { > "access": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "description": "The unique identifier for the message object", > "type": "string" > }, > "timestamp": { > "description": "The time at which the event occurred, used by all topics", > "type": "string" > }, > "eventName": { > "description": "The name of the event, used by all topics", > "type": "string" > }, > "transactionId": { > "description": "The transaction ID of the event, used by all topics", > "type": "string" > }, > "userId": { > "description": "The ID of the user responsible for the event, used by all topics", > "type": "string" > }, > "trackingIds": { > "description": "The tracking IDs of the event, used by all topics", > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "server": { > "type": "object", > "properties": { > "ip": { > "description": "The server ip address for an access event.ip", > "type": "string" > }, > "port": { > "description": "The server port for an access event", > "type": "integer" > } > } > }, > "client": { > "type": "object", > "properties": { > "ip": { > "description": "The client IP address for an access event", > "type": "string" > }, > "port": { > "description": "The client port for an access event", > "type": "integer" > } > } > }, > "request": { > "type": "object", > "properties": { > "protocol": { > "description": "The request protocol for an access event", > "type": "string" > }, > "operation": { > "description": "The operation that triggered an activity or config event", > "type": "string" > }, > "detail": { > "description": "The request detail for an access event", > "type": "object" > } > } > }, > "http": { > "type": "object", > "properties": { > "request": { > "description": "The http request for an access event", > "type": "object", > "properties": { > "secure": { > "description": "The http secure property for an access event", > "type": "boolean" > }, > "method": { > "description": "The http method for an access event", > "type": "string" > }, > "path": { > "description": "The http path for an access event", > "type": "string" > }, > "queryParameters": { > "description": "Http query parameters", > "type": "object", > "additionalProperties": { > "type": "array", > "items": { > "type": "string" > } > } > }, > "headers": { > "description": "The http headers for an access event", > "type": "object", > "additionalProperties": { > "type": "array", > "items": { > "type": "string" > } > } > }, > "cookies": { > "description": "The http cookies for an access event", > "type": "object", > "additionalProperties": { > "type": "string" > } > } > } > }, > "response": { > "description": "The http response for an access event", > "type": "object", > "properties": { > "headers": { > "description": "The http request headers for an access event", > "type": "object", > "additionalProperties": { > "type": "array", > "items": { > "type": "string" > } > } > } > } > } > } > }, > "response": { > "type": "object", > "properties": { > "status": { > "description": "The response status for an access event", > "type": "string" > }, > "statusCode": { > "description": "The response status code for an access event", > "type": "string" > }, > "detail": { > "description": "The response detail for an access event", > "type": "object" > }, > "elapsedTime": { > "description": "The response elapsedTime for an access event", > "type": "integer" > }, > "elapsedTimeUnits": { > "description": "The response elapsed time units for an access event", > "type": "string" > } > } > } > } > } > } > } > ``` > > Identity management schema extensions > > ```json > { > "access": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "roles": { > "type": "array", > "items": { > "id": "0", > "type": "string" > } > } > } > } > } > } > ```Learn more about `idm-access` properties in [Access event topic properties](https://docs.pingidentity.com/pingidm/8/audit-guide/access-event-prop.html). | | idm-activity | Audit | Captures operations on internal (managed) and external (system) objects in Advanced Identity Cloud. idm-activity logs the changes to identity content, such as adding or updating users and changing passwords.Audit events:* activity> **Collapse: Show example** > > ```json > { > "timestamp": "", > "type": "application/json", > "payload": { > "_id": "eebf2abb-e4f1-428f-8fbb-8c18ed3f9559-218925", > "transactionId": "1630077288251-f5190abcb8c2d0d42c31-136380/0", > "message": "", > "timestamp": "", > "eventName": "activity", > "userId": "bd220328-9762-458b-b05a-982ac3c7fc54", > "revision": "00000000478fd92b", > "operation": "PATCH", > "changedFields": [], > "runAs": "bd220328-9762-458b-b05a-982ac3c7fc54", > "passwordChanged": true, > "status": "SUCCESS", > "objectId": "managed/alpha_user/e70c4476-1305-408a-9246-ac76c64ba039" > } > } > ```> **Collapse: Show schema** > > IDM activity logs use a base schema and add several identity management-specific fields. > > Base schema > > ```json > { > "activity": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "description": "The unique identifier for the message object", > "type": "string" > }, > "timestamp": { > "description": "The time at which the event occurred, used by all topics", > "type": "string" > }, > "eventName": { > "description": "The name of the event, used by all topics", > "type": "string" > }, > "transactionId": { > "description": "The transaction ID of the event, used by all topics", > "type": "string" > }, > "userId": { > "description": "The ID of the user responsible for the event, used by all topics", > "type": "string" > }, > "trackingIds": { > "description": "The tracking IDs of the event, used by all topics", > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "runAs": { > "description": "What the change that triggered an activity or config event was run as", > "type": "string" > }, > "objectId": { > "description": "The object ID of the change that triggered an activity or config event", > "type": "string" > }, > "operation": { > "description": "The operation that triggered an activity or config event", > "type": "string" > }, > "before": { > "description": "The state before an activity or config event occurred", > "type": "object" > }, > "after": { > "description": "The state after an activity or config event occurred", > "type": "object" > }, > "changedFields": { > "description": "The changed fields after an activity or config event occurred", > "type": "array", > "items": { > "id": "1", > "type": "string" > } > }, > "revision": { > "description": "The revision for an activity or config event", > "type": "string" > } > } > } > } > } > ``` > > Identity management schema extensions > > ```json > { > "activity": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "status": { > "type": "string" > }, > "message": { > "type": "string" > }, > "passwordChanged": { > "type": "boolean" > }, > "context": { > "type": "string" > }, > "provider": { > "type": "string" > } > } > } > } > } > ```Learn more about `idm-activity` properties in [Activity event topic properties](https://docs.pingidentity.com/pingidm/8/audit-guide/activity-event-prop.html). | | idm-authentication | Audit | Captures the results when authenticating to an `/openidm` endpoint to complete certain actions on an object.If an authentication session already exists in access management, authentication to identity management is not required. In this instance, the authentication logs would appear for am-authentication, with identity management logs in idm-access and idm-activity.Audit events:* authentication> **Collapse: Show schema** > > IDM authentication logs use a base schema and add several identity management-specific fields. > > Base schema > > ```json > { > "authentication": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "description": "The unique identifier for the message object", > "type": "string" > }, > "timestamp": { > "description": "The time at which the event occurred, used by all topics", > "type": "string" > }, > "eventName": { > "description": "The name of the event, used by all topics", > "type": "string" > }, > "transactionId": { > "description": "The transaction ID of the event, used by all topics", > "type": "string" > }, > "userId": { > "description": "The ID of the user responsible for the event, used by all topics", > "type": "string" > }, > "trackingIds": { > "description": "The tracking IDs of the event, used by all topics", > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "result": { > "description": "The result of the authentication event", > "type": "string" > }, > "principal": { > "description": "The principal responsible for the authentication event", > "type": "array", > "items": { > "type": "string" > } > }, > "context": { > "description": "The context of an authentication event", > "type": "object", > "properties": {} > }, > "entries": { > "description": "The entries for an authentication event", > "type": "array", > "items": { > "type": "object", > "properties": { > "moduleId": { > "description": "The module ID for the authentication event", > "type": "string" > }, > "result": { > "description": "The result of the module authentication event", > "type": "string" > }, > "info": { > "description": "The entries information for an authentication event", > "type": "object", > "properties": {} > } > } > } > } > } > } > } > } > ``` > > Identity management schema extensions > > ```json > { > "authentication": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "provider": { > "type": "string" > }, > "method": { > "type": "string" > } > } > } > } > } > ```Learn more about `idm-authentication` properties in [Authentication event topic properties](https://docs.pingidentity.com/pingidm/8/audit-guide/auth-event-prop.html). | | idm-config | Audit | Captures identity management configuration changes for Advanced Identity Cloud with a timestamp and by whom.Configuration changes can only be performed in development environments, so these logs are empty in staging and production environments.Audit events:* CONFIG> **Collapse: Show example** > > ```json > { > "payload": { > "_id": "f6a3a7b2-aaf3-426d-a998-a970f84bdf4b-1519486", > "changedFields": [ > "/mappings" > ], > "eventName": "CONFIG", > "objectId": "sync", > "operation": "UPDATE", > "revision": null, > "runAs": "bd220328-9762-458b-b05a-982ac3c7fc54", > "timestamp": "", > "transactionId": "1634054726312-2e50ecbf0df5407a6870-202437/0", > "userId": "bd220328-9762-458b-b05a-982ac3c7fc54" > } > } > ```> **Collapse: Show schema** > > ```json > { > "config": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "description": "The unique identifier for the message object", > "type": "string" > }, > "timestamp": { > "description": "The time at which the event occurred, used by all topics", > "type": "string" > }, > "eventName": { > "description": "The name of the event, used by all topics", > "type": "string" > }, > "transactionId": { > "description": "The transaction ID of the event, used by all topics", > "type": "string" > }, > "userId": { > "description": "The ID of the user responsible for the event, used by all topics", > "type": "string" > }, > "trackingIds": { > "description": "The tracking IDs of the event, used by all topics", > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "runAs": { > "description": "What the change that triggered an activity or config event was run as", > "type": "string" > }, > "objectId": { > "description": "The object ID of the change that triggered an activity or config event", > "type": "string" > }, > "operation": { > "description": "The operation that triggered an activity or config event", > "type": "string" > }, > "before": { > "description": "The state before an activity or config event occurred", > "type": "object" > }, > "after": { > "description": "The state after an activity or config event occurred", > "type": "object" > }, > "changedFields": { > "description": "The changed fields after an activity or config event occurred", > "type": "array", > "items": { > "id": "1", > "type": "string" > } > }, > "revision": { > "description": "The revision for an activity or config event", > "type": "string" > } > } > } > } > } > } > ```Learn more about `idm-config` properties in [Configuration event topic properties](https://docs.pingidentity.com/pingidm/8/audit-guide/config-event-prop.html). | | idm-core | Debug | Captures identity management debug logs for Advanced Identity Cloud. Use idm-core when debugging anything in identity management without capturing audit events.Development and sandbox environments provide FINE level logs, with logs in several areas tuned to INFO, WARNING and SEVERE.To reduce log volumes, staging and production environments only provide INFO and WARNING level logs and above.To troubleshoot and view the latest entries in the stored logs, you can tail idm-core source. Learn more in [Tail logs](audit-debug-logs-pull.html#tail-logs). | | idm-everything | Audit, Debug | Captures identity management audit and debug logs for Advanced Identity Cloud.This includes all the logs captured in `idm-access`, `idm-activity`, `idm-authentication`, `idm-config`, `idm-recon`, `idm-sync`, and `idm-core`. | | idm-recon | Audit | Captures reconciliation events for Advanced Identity Cloud.The corresponding audit topic for idm-recon is disabled by default in Advanced Identity Cloud. For reconciliation events to appear in the audit logs, you must [enable the recon event handler](audit-debug-logs-pull.html#update-audit-configuration).> **Collapse: Show schema** > > ```json > { > "recon": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "type": "string" > }, > "transactionId": { > "type": "string" > }, > "timestamp": { > "type": "string" > }, > "eventName": { > "type": "string" > }, > "userId": { > "type": "string" > }, > "trackingIds": { > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "action": { > "type": "string" > }, > "exception": { > "type": "string" > }, > "linkQualifier": { > "type": "string" > }, > "mapping": { > "type": "string" > }, > "message": { > "type": "string" > }, > "messageDetail": { > "type": "object", > "properties": {} > }, > "situation": { > "type": "string" > }, > "sourceObjectId": { > "type": "string" > }, > "sourceObject": { > "type": "object" > }, > "status": { > "type": "string" > }, > "targetObjectId": { > "type": "string" > }, > "targetObject": { > "type": "object" > }, > "reconciling": { > "type": "string" > }, > "ambiguousTargetObjectIds": { > "type": "string" > }, > "reconAction": { > "type": "string" > }, > "entryType": { > "type": "string" > }, > "reconId": { > "type": "string" > } > } > } > } > } > ```Learn more about `idm-recon` event properties in [Reconciliation event topic properties](https://docs.pingidentity.com/pingidm/8/audit-guide/recon-event-prop.html). | | idm-sync | Audit | Captures any changes to an object resulting in automatic sync (live sync and implicit sync) when a repository is mapped to Advanced Identity Cloud. This includes situations and the actions taken on each object, by account. The idm-activity log contains additional details about each action.> **Collapse: Show schema** > > ```json > { > "sync": { > "schema": { > "$schema": "http://json-schema.org/draft-04/schema#", > "id": "/", > "type": "object", > "properties": { > "_id": { > "type": "string" > }, > "transactionId": { > "type": "string" > }, > "timestamp": { > "type": "string" > }, > "eventName": { > "type": "string" > }, > "userId": { > "type": "string" > }, > "trackingIds": { > "type": "array", > "items": { > "id": "0", > "type": "string" > } > }, > "action": { > "type": "string" > }, > "exception": { > "type": "string" > }, > "linkQualifier": { > "type": "string" > }, > "mapping": { > "type": "string" > }, > "message": { > "type": "string" > }, > "messageDetail": { > "type": "object", > "properties": {} > }, > "situation": { > "type": "string" > }, > "sourceObjectId": { > "type": "string" > }, > "sourceObject": { > "type": "object" > }, > "status": { > "type": "string" > }, > "targetObjectId": { > "type": "string" > }, > "targetObject": { > "type": "object" > } > } > } > } > } > ```Learn more about `idm-sync` event properties in [Synchronization event topic properties](https://docs.pingidentity.com/pingidm/8/audit-guide/sync-event-prop.html). | ### WS-Federation sources The following log sources are available for WS-Federation\[[1](#_footnotedef_1 "View footnote.")]: | Source | Type | Description | | ------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ws-activity | Audit | Captures WS-Federation user authentication events.> **Collapse: Show example** > > ```json > { > "payload": { > "client": { > "ip": "10.100.2.27" > }, > "eventName": "AUTHN_ATTEMPT", > "logFile": "audit.log", > "request": { > "adapterId": "1731608547", > "connectionId": "urn:federation:MicrosoftOnline", > "protocol": "WSFED", > "role": "IdP" > }, > "response": { > "elapsedTime": "399", > "elapsedTimeUnits": "MILLISECONDS", > "status": "inprogress" > }, > "server": { > "hostname": "pingfederate-engine-bd49cb65d-kkqzc" > }, > "source": "audit", > "timestamp": "2024-12-03T19:37:39.024Z", > "topic": "activity", > "trackingId": "tid:JmiM3ipvXOC809styOOD13BAfeM", > "transactionId": "f5f1cb6d-3899-4f45-b399-19253531de55/0" > }, > "timestamp": "2024-12-03T19:37:39.024843174Z", > "type": "application/json", > "source": "ws-activity" > } > ```> **Collapse: Activity log format** > > * payload.client.ip > > The client IP address. > > * payload.eventName > > The name of the audit event (for example, `AUTHN_REQUEST`, `AUTHN_ATTEMPT`, `SSO`, `AUTHN_SESSION_CREATED`). > > * payload.request: > > * adapterId > > The adapter instance ID(s) that were invoked (for example, `1731608547`). > > * app > > The target application URL if available. > > * connectionId > > The federation realm ID (for example, `urn:federation:MicrosoftOnline`). > > * protocol > > The associated authentication protocol (`WSFED`). > > * subject > > The user name (for example, `bjensen@example.com`). > > * role > > The authentication role (`IdP`, `SP`). > > * payload.response: > > * status > > The status of the SSO request (`success`, `failure`, `inprogress`). > > * detail > > Additional description of the event if available. > > * elapsedTime > > The time to execute the access event, usually in millisecond precision (for example, `170`). > > * elapsedTimeUnits > > The elapsed time units of the response (for example, `MILLISECONDS`). > > * payload.server.hostname > > The hostname of the PingFederate container (for example, `pingfederate-engine-bd49cb65d-kkqzc`). > > * payload.topic > > A shortened version of this log source (`activity`). > > * payload.timestamp > > The timestamp when Advanced Identity Cloud logged the event, in UTC format to millisecond precision: `yyyy-MM-ddTHH:mm:ss.msZ` (for example, `2015-11-14T00:16:04.653Z`). > > * payload.trackingId > > A unique ID for a user session (for example, `tid:JmiM3ipvXOC809styOOD13BAfeM`). > > * payload.transactionId > > The UUID of the transaction, which identifies an external request when it comes into the system boundary. Any events generated while handling that request are assigned that transaction ID, so you could see the same transaction ID for different audit event topics (for example, `f5f1cb6d-3899-4f45-b399-19253531de55/0`). > > * timestamp > > Refer to the description of **payload.timestamp**. > > * type > > The log format (for example, `application/json`). > > * source > > This log source (`ws-activity`). | | ws-config | Audit | Captures WS-Federation configuration change events.> **Collapse: Show example** > > ```json > { > "payload": { > "client": { > "ip": "10.40.15.194" > }, > "http": { > "request": { > "method": "GET", > "path": "/configArchive/export" > } > }, > "logFile": "admin-api.log", > "request": { > "authType": "Bearer", > "partnerId": "pingfederate-resource-server", > "user": "pingfederate-resource-server" > }, > "response": { > "statusCode": "200" > }, > "source": "audit", > "timestamp": "2024-12-08T18:15:03.028Z", > "topic": "config" > }, > "timestamp": "2024-12-08T18:15:03.02886768Z", > "type": "application/json", > "source": "ws-config" > } > ```> **Collapse: Configuration log format** > > * payload.client.ip > > The client IP address. > > * payload.eventName > > The name of the administrative event (for example, `EXPORT`). > > * payload.http.request: > > * method > > The HTTP method for the request (for example, `POST`). > > * path > > The endpoint of the HTTP request. > > * payload.logFile > > The log file name that generated this log entry (for example, `admin-api.log` or `admin.log`). > > * payload.message > > Additional information of the event if available. > > * payload.request: > > * authType > > The type of authentication used (`Basic`, `Bearer`). > > * adminSessionId > > The unique administrative session ID. > > * component > > The configuration component (for example, `CONFIG_ARCHIVE`). > > * partnerId > > The federation realm ID (for example, `urn:federation:MicrosoftOnline`). > > * roles > > The administrative roles associated with this user (for example, `UserAdmin`). > > * user > > The administrative username (for example, `pingfederate-resource-server`). > > * payload.response.statusCode > > The HTTP status code for the response. > > * payload.timestamp > > The timestamp when Advanced Identity Cloud logged the event, in UTC format to millisecond precision: `yyyy-MM-ddTHH:mm:ss.msZ` (for example, `2015-11-14T00:16:04.653Z`). > > * payload.topic > > A shortened version of this log source (`config`). > > * timestamp > > Refer to the description of **payload.timestamp**. > > * type > > The log format (for example, `application/json`). > > * source > > This log source (`ws-config`). | | ws-core | Debug | Captures WS-Federation error and debug events.> **Collapse: Show example** > > ```json > { > "payload": { > "level": "INFO", > "logFile": "server.log", > "logger": "org.sourceid.websso.servlet.reqparam.ValidationHub", > "message": "Created 2 validators for parameter SpSessionAuthnAdapterId", > "timestamp": "2024-12-02T23:13:20.208Z" > }, > "timestamp": "2024-12-02T23:13:20.209188799Z", > "type": "application/json", > "source": "ws-core" > } > ```> **Collapse: Core log format** > > * payload.level > > The level of the error or debug event (`FATAL`, `ERROR`, `WARN`, `INFO`, `DEBUG`, `TRACE`). > > * payload.logFile > > The log file name that generated this log entry (for example, `server.log`). > > * payload.logger > > The Java class that generated this log entry (for example, `com.pingidentity.pf.admin.rest.filter.OAuth2AdminAuthHandler`). > > * payload.message > > A description of the event. > > * payload.timestamp > > The timestamp when Advanced Identity Cloud logged the event, in UTC format to millisecond precision: `yyyy-MM-ddTHH:mm:ss.msZ` (for example, `2015-11-14T00:16:04.653Z`). > > * timestamp > > Refer to the description of **payload.timestamp**. > > * type > > The log format (for example, `application/json`). > > * source > > This log source (`ws-core`). | | ws-everything | Audit, Debug | Captures WS-Federation audit and debug logs for Advanced Identity Cloud.This includes all the logs captured in `ws-activity`, `ws-config`, and `ws-core`. | *** [1](#_footnoteref_1). [WS-Federation/WS-Trust](../app-management/register-a-custom-application.html#sso-microsoft-365) is an [add-on capability](../product-information/add-on-capabilities.html).