Element hierarchy

Each section described here has child elements. If there is a disagreement in settings, the most specific setting is used.

For example, if the metadata element is set to false but the exchange ID is set to true, then only the exchange ID is logged. If the metadata element is set to true but the exchange ID is set to false, then all metadata elements except the exchange ID are logged.

Limitations

The traffic logs have the following limitations:

  • If a request or response body is chunked, only the first chunk is logged by traffic logging.
  • Request and response bodies are not decoded.

Metadata elements

You can include metadata elements in the API, engine, and audit traffic logs. These elements provide general information about the logged event.

Item Description
AUDIT.metadata Section setting for all metadata elements.
AUDIT.exchangeId Identifies the ID for a specific request/response pair.
AUDIT.applicationId Specifies the ID of the requested application.
AUDIT.applicationName Specifies the name of the requested application.
AUDIT.resourceId Specifies the ID of the requested resource.
AUDIT.resourceName Specifies the name of the requested resource.
AUDIT.pathPrefix Specifies the path prefix of the requested application or resource.
AUDIT.pathPrefixType Indicates the pattern type of the path prefix, Wildcard or Regex.
AUDIT.authMech Mechanism used for authentication. Engine Auditing - Cookie (WAM session), OAuth, unknown (for example, pass-through or static assets). Pass-through assets are Resources with no policies or Web session configured. Admin Auditing - Basic, OAuth, Cookie, unknown ( unknown displays only in an authentication failure).
AUDIT.client IP address of the requesting client.
AUDIT.failedRuleName Name of the rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log.
AUDIT.failedRuleType Type of rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log.
AUDIT.failedRuleClass The Java class of rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log.
AUDIT.failedRuleSetName Name of the containing rule set that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log.
AUDIT.host PingAccess host name or IP address.
AUDIT.targetHost Backend target that processed the request and generated a response to the PingAccess engine. This variable is unset when the response is generated by a target host protected by PingAccess.
AUDIT.resource Name of the resource used to fulfill the request. This element is applicable only to the engine log.
AUDIT.subject Subject of the transaction.
AUDIT.trackingId The PingFederate tracking ID. This element can be used to help correlate audit information in the PingAccess audit log with information recorded in the PingFederate audit log.

The value of this depends on whether the application type is Web or API.

If the application type is Web, the value is presented as tid:<Session_Identifier>. The <Session_Identifier> can be used by the PingFederate Session Revocation API to revoke the session without disabling the user in the identity store.

If the application type is API, the value is presented as atid:<Hash>. The <Hash> value is derived from the OAuth Access token for the session, and only serves as an identifier; it cannot be used for session revocation.

The following example shows the metadata section with all elements set to true.

                <!-- AUDIT.metadata is the section setting for the following fields: -->
                <!-- AUDIT.exchangeId to AUDIT.trackingId -->
                <KeyValuePair key=”AUDIT.metadata” value=”true”/>
                <KeyValuePair key=”AUDIT.exchangeId” value=”true”/>
                <KeyValuePair key=”AUDIT.applicationId” value=”true”/>
                <KeyValuePair key=”AUDIT.applicationName” value=“true”/>
                <KeyValuePair key=”AUDIT.resourceId” value=”true”/>
                <KeyValuePair key=”AUDIT.resourceName” value=”true”/>
                <KeyValuePair key=”AUDIT.pathPrefix” value=”true”/>
                <KeyValuePair key=”AUDIT.pathPrefixType” value=”true”/>
                <KeyValuePair key=”AUDIT.authMech” value=”true”/>
                <KeyValuePair key=”AUDIT.client” value=”true”/>
                <KeyValuePair key=”AUDIT.failedRuleName” value=”true”/>
                <KeyValuePair key=”AUDIT.failedRuleType” value=”true”/>
                <KeyValuePair key=”AUDIT.failedRuleClass” value=”true”/>
                <KeyValuePair key=”AUDIT.failedRuleSetName” value=”true”/>
                <KeyValuePair key=”AUDIT.host” value=”true”/>
                <KeyValuePair key=”AUDIT.targetHost” value=”true”/>
                <KeyValuePair key=”AUDIT.resource” value=”true”/>
                <KeyValuePair key=”AUDIT.subject” value=”true”/>
                <KeyValuePair key=”AUDIT.trackingId” value=”true”/>

HTTP client elements

Client elements provide information about requests made to PingAccess by clients, and the response sent back to the client. For example, a user making a call to the PingAccess administrative API is considered client traffic. You can include client elements in the API, engine, and audit traffic logs.

Item Description
AUDIT.http-client Section setting for all client elements.
AUDIT.http-client-started-date-time Date and time of the beginning of the request.
AUDIT.http-client-time Total elapsed time of the request and response.
AUDIT.http-client-request-method Method used in the request.
AUDIT.http-client-request-target The portion of the URL after the host and port.
AUDIT.http-client-request-http-version HTTP version used by the request.
AUDIT.http-client-request-cookies List of all cookies in the request. Parent element for AUDIT.http-client-request-cookie-{cookie}.
AUDIT.http-client-request-cookie-{cookie} Information about the request cookie with the specified name. You can include this element multiple times for different cookie names.
AUDIT.http-client-request-headers List of all headers in the request. Parent element for AUDIT.http-client-request-header-{header}.
AUDIT.http-client-request-header-{header} Information about the request header with the specified name. You can include this element multiple times for different header names.
AUDIT.http-client-request-query-strings List of all parameters and values parsed from the request query string. Parent element for AUDIT.http-client-request-query-string-{query}.
AUDIT.http-client-request-query-string-{query} Information about the request query string with the specified name. You can include this element multiple times for different query string names.
AUDIT.http-client-request-post-data-mime-type Mime type of posted request data.
AUDIT.http-client-request-post-data-text Posted request data, in plain text.
AUDIT.http-client-request-headers-size Size, in bytes, of the header from the start of the request to the body.
AUDIT.http-client-request-body-size Size, in bytes, of the request body.
AUDIT.http-client-response-status-code Response status code.
AUDIT.http-client-response-status-text Response status description.
AUDIT.http-client-response-http-version HTTP version used by the response.
AUDIT.http-client-response-cookies List of all cookies in the response. Parent element for AUDIT.http-client-response-cookie-{cookie}.
AUDIT.http-client-response-cookie-{cookie} Information about the response cookie with the specified name. You can include this element multiple times for different cookie names.
AUDIT.http-client-response-headers List of all headers in the response. Parent element for AUDIT.http-client-response-header-{header}.
AUDIT.http-client-response-header-{header} Information about the response header with the specified name. You can include this element multiple times for different header names.
AUDIT.http-client-response-content-size Size, in bytes, of the response content.
AUDIT.http-client-response-content-mime-type Mime type of the response content.
AUDIT.http-client-response-content-text Response body.
AUDIT.http-client-response-redirect-url Redirect target URL from the location response header.
AUDIT.http-client-response-headers-size Size, in bytes, of the header from the start of the response to the body.
AUDIT.http-client-response-body-size Size, in bytes, of the response body.

The following example shows the client section with all elements set to true.

                <!-- AUDIT.http-client is the section setting for the following fields: -->
                <!-- AUDIT.http-client-started-date-time to AUDIT.http-client-response-body-size -->
                <KeyValuePair key=”AUDIT.http-client” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-started-date-time” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-time” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-method” value=”true”/>
                <!-- Note: “AUDIT.http-client-request-target” is the target part of the url -->
                <KeyValuePair key=”AUDIT.http-client-request-target” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-http-version” value=”true”/>
                <!-- Sets the default value for all client request cookies. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual cookie values. -->
                <KeyValuePair key=”AUDIT.http-client-request-cookies” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-cookie-{cookie}” value=”true”/>
                <!-- Sets the default value for all client request headers. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual header values. -->
                <KeyValuePair key=”AUDIT.http-client-request-headers” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-header-{header}” value=”true”/>
                <!-- Sets the default value for all client request query strings. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual query strings. -->
                <KeyValuePair key=”AUDIT.http-client-request-query-strings” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-query-string-{query}” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-post-data-mime-type” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-post-data-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-headers-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-body-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-status-code” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-status-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-http-version” value=”true”/>
                <!-- Sets the default value for all client response cookies. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual cookie values. -->
                <KeyValuePair key=”AUDIT.http-client-response-cookies” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-cookie-{cookie}” value=”true”/>
                <!-- Sets the default value for all client response headers. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual header values. -->
                <KeyValuePair key=”AUDIT.http-client-response-headers” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-header-{header}” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-content-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-content-mime-type” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-content-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-redirect-url” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-headers-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-body-size” value=”true”/>

HTTP app elements

App elements provide information about requests made by PingAccess to other tools or services such as PingFederate, and the response sent back to PingAccess. For example, PingAccess making a call to a protected resource is considered app traffic. You can include app elements in the engine and audit traffic logs.

Item Description
AUDIT.http-app Section setting for all app elements.
AUDIT.http-app-started-date-time Date and time of the beginning of the request.
AUDIT.http-app-time Total elapsed time of the request and response.
AUDIT.http-app-request-method Method used in the request.
AUDIT.http-app-request-target The portion of the URL after the host and port.
AUDIT.http-app-request-http-version HTTP version used by the request.
AUDIT.http-app-request-cookies List of all cookies in the request. Parent element for AUDIT.http-app-request-cookie-{cookie}.
AUDIT.http-app-request-cookie-{cookie} Information about the request cookie with the specified name. You can include this element multiple times for different cookie names.
AUDIT.http-app-request-headers List of all headers in the request. Parent element for AUDIT.http-app-request-header-{header}.
AUDIT.http-app-request-header-{header} Information about the request header with the specified name. You can include this element multiple times for different header names.
AUDIT.http-app-request-query-strings List of all parameters and values parsed from the request query string. Parent element for AUDIT.http-app-request-query-string-{query}.
AUDIT.http-app-request-query-string-{query} Information about the request query string with the specified name. You can include this element multiple times for different query string names.
AUDIT.http-app-request-post-data-mime-type Mime type of posted data.
AUDIT.http-app-request-post-data-text Posted data, in plain text.
AUDIT.http-app-request-headers-size Size, in bytes, of the header from the start of the request to the body.
AUDIT.http-app-request-body-size Size, in bytes, of the request body.
AUDIT.http-app-response-status-code Response status code.
AUDIT.http-app-response-status-text Response status description.
AUDIT.http-app-response-http-version HTTP version used by the response.
AUDIT.http-app-response-cookies List of all cookies in the response. Parent element for AUDIT.http-app-response-cookie-{cookie}.
AUDIT.http-app-response-cookie-{cookie} Information about the response cookie with the specified name. You can include this element multiple times for different cookie names.
AUDIT.http-app-response-headers List of all headers in the response. Parent element for AUDIT.http-app-response-header-{header}.
AUDIT.http-app-response-header-{header} Information about the response header with the specified name. You can include this element multiple times for different header names.
AUDIT.http-app-response-content-size Size, in bytes, of the response content.
AUDIT.http-app-response-content-mime-type Mime type of the response content.
AUDIT.http-app-response-content-text Response body.
AUDIT.http-app-response-redirect-uri Redirect target URL from the location response header.
AUDIT.http-app-response-headers-size Size, in bytes, of the header from the start of the response to the body.
AUDIT.http-app-response-body-size Size, in bytes, of the response body.

The following example shows the app section with all elements set to true.

                <!-- AUDIT.http-app is the section setting for the following fields: -->
                <!-- AUDIT.http-app-started-date-time to AUDIT.http-app-response-body-size -->
                <KeyValuePair key=”AUDIT.http-app” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-started-date-time” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-time” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-method” value=”true”/>
                <!-- Note: “AUDIT.http-app-request-target” is the target part of the url -->
                <KeyValuePair key=”AUDIT.http-app-request-target” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-http-version” value=”true”/>
                <!-- Sets the default value for all app request cookies. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual cookie values. -->
                <KeyValuePair key=”AUDIT.http-app-request-cookies” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-cookie-{cookie}” value=”true”/>
                <!-- Sets the default value for all app request headers. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual header values. -->
                <KeyValuePair key=”AUDIT.http-app-request-headers” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-header-{header}” value=”true”/>
                <!-- Sets the default value for all app request query strings. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual query strings. -->
                <KeyValuePair key=”AUDIT.http-app-request-query-strings” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-query-string-{query}” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-post-data-mime-type” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-post-data-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-headers-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-body-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-status-code” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-status-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-http-version” value=”true”/>
                <!-- Sets the default value for all app response cookies. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual cookie values. -->
                <KeyValuePair key=”AUDIT.http-app-response-cookies” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-cookie-{cookie}” value=”true”/>
                <!-- Sets the default value for all app response headers. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual header values. -->
                <KeyValuePair key=”AUDIT.http-app-response-headers” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-header-{header}” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-content-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-content-mime-type” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-content-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-redirect-uri” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-headers-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-body-size” value=”true”/>