Element hierarchy

Each section described here has child elements. If there is a disagreement in settings, the most specific setting is used.

For example, if the metadata element is set to false but the exchange ID is set to true, then only the exchange ID is logged. If the metadata element is set to true but the exchange ID is set to false, then all metadata elements except the exchange ID are logged.

Limitations

The traffic logs have the following limitations:

  • If a request or response body is chunked, only the first chunk is logged by traffic logging.
  • Request and response bodies are not decoded.

Metadata elements

You can include metadata elements in the API, engine, and audit traffic logs. These elements provide general information about the logged event.

Item Description

AUDIT.metadata

Section setting for all metadata elements.

AUDIT.exchangeId

Identifies the ID for a specific request/response pair.

AUDIT.applicationId

Specifies the ID of the requested application.

AUDIT.applicationName

Specifies the name of the requested application.

AUDIT.resourceId

Specifies the ID of the requested resource.

AUDIT.resourceName

Specifies the name of the requested resource.

AUDIT.pathPrefix

Specifies the path prefix of the requested application or resource.

AUDIT.pathPrefixType

Indicates the pattern type of the path prefix, Wildcard or Regex.

AUDIT.authMech

Mechanism used for authentication. Engine Auditing - Cookie (WAM session), OAuth, unknown (for example, pass-through or static assets). Pass-through assets are Resources with no policies or Web session configured. Admin Auditing - Basic, OAuth, Cookie, unknown ( unknown displays only in an authentication failure).

AUDIT.client

IP address of the requesting client.

AUDIT.failedRuleName

Name of the rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log.

AUDIT.failedRuleType

Type of rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log.

AUDIT.failedRuleClass

The Java class of rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log.

AUDIT.failedRuleSetName

Name of the containing rule set that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log.

AUDIT.host

PingAccess host name or IP address.

AUDIT.targetHost

Backend target that processed the request and generated a response to the PingAccess engine. This variable is unset when the response is generated by a target host protected by PingAccess.

AUDIT.resource

Name of the resource used to fulfill the request. This element is applicable only to the engine log.

AUDIT.subject

Subject of the transaction.

AUDIT.trackingId

The PingFederate tracking ID. This element can be used to help correlate audit information in the PingAccess audit log with information recorded in the PingFederate audit log.

The value of this depends on whether the application type is Web or API.

If the application type is Web, the value is presented as tid:<Session_Identifier>. The <Session_Identifier> can be used by the PingFederate Session Revocation API to revoke the session without disabling the user in the identity store.

If the application type is API, the value is presented as atid:<Hash>. The <Hash> value is derived from the OAuth Access token for the session, and only serves as an identifier; it cannot be used for session revocation.

The following example shows the metadata section with all elements set to true.

                <!-- AUDIT.metadata is the section setting for the following fields: -->
                <!-- AUDIT.exchangeId to AUDIT.trackingId -->
                <KeyValuePair key=”AUDIT.metadata” value=”true”/>
                <KeyValuePair key=”AUDIT.exchangeId” value=”true”/>
                <KeyValuePair key=”AUDIT.applicationId” value=”true”/>
                <KeyValuePair key=”AUDIT.applicationName” value=“true”/>
                <KeyValuePair key=”AUDIT.resourceId” value=”true”/>
                <KeyValuePair key=”AUDIT.resourceName” value=”true”/>
                <KeyValuePair key=”AUDIT.pathPrefix” value=”true”/>
                <KeyValuePair key=”AUDIT.pathPrefixType” value=”true”/>
                <KeyValuePair key=”AUDIT.authMech” value=”true”/>
                <KeyValuePair key=”AUDIT.client” value=”true”/>
                <KeyValuePair key=”AUDIT.failedRuleName” value=”true”/>
                <KeyValuePair key=”AUDIT.failedRuleType” value=”true”/>
                <KeyValuePair key=”AUDIT.failedRuleClass” value=”true”/>
                <KeyValuePair key=”AUDIT.failedRuleSetName” value=”true”/>
                <KeyValuePair key=”AUDIT.host” value=”true”/>
                <KeyValuePair key=”AUDIT.targetHost” value=”true”/>
                <KeyValuePair key=”AUDIT.resource” value=”true”/>
                <KeyValuePair key=”AUDIT.subject” value=”true”/>
                <KeyValuePair key=”AUDIT.trackingId” value=”true”/>

HTTP client elements

Client elements provide information about requests made to PingAccess by clients, and the response sent back to the client. For example, a user making a call to the PingAccess administrative API is considered client traffic. You can include client elements in the API, engine, and audit traffic logs.

Item Description

AUDIT.http-client

Section setting for all client elements.

AUDIT.http-client-started-date-time

Date and time of the beginning of the request.

AUDIT.http-client-time

Total elapsed time of the request and response.

AUDIT.http-client-request-method

Method used in the request.

AUDIT.http-client-request-target

The portion of the URL after the host and port.

AUDIT.http-client-request-http-version

HTTP version used by the request.

AUDIT.http-client-request-cookies

List of all cookies in the request. Parent element for AUDIT.http-client-request-cookie-{cookie}.

AUDIT.http-client-request-cookie-{cookie}

Information about the request cookie with the specified name. You can include this element multiple times for different cookie names.

AUDIT.http-client-request-headers

List of all headers in the request. Parent element for AUDIT.http-client-request-header-{header}.

AUDIT.http-client-request-header-{header}

Information about the request header with the specified name. You can include this element multiple times for different header names.

AUDIT.http-client-request-query-strings

List of all parameters and values parsed from the request query string. Parent element for AUDIT.http-client-request-query-string-{query}.

AUDIT.http-client-request-query-string-{query}

Information about the request query string with the specified name. You can include this element multiple times for different query string names.

AUDIT.http-client-request-post-data-mime-type

Mime type of posted request data.

AUDIT.http-client-request-post-data-text

Posted request data, in plain text.

AUDIT.http-client-request-headers-size

Size, in bytes, of the header from the start of the request to the body.

AUDIT.http-client-request-body-size

Size, in bytes, of the request body.

AUDIT.http-client-response-status-code

Response status code.

AUDIT.http-client-response-status-text

Response status description.

AUDIT.http-client-response-http-version

HTTP version used by the response.

AUDIT.http-client-response-cookies

List of all cookies in the response. Parent element for AUDIT.http-client-response-cookie-{cookie}.

AUDIT.http-client-response-cookie-{cookie}

Information about the response cookie with the specified name. You can include this element multiple times for different cookie names.

AUDIT.http-client-response-headers

List of all headers in the response. Parent element for AUDIT.http-client-response-header-{header}.

AUDIT.http-client-response-header-{header}

Information about the response header with the specified name. You can include this element multiple times for different header names.

AUDIT.http-client-response-content-size

Size, in bytes, of the response content.

AUDIT.http-client-response-content-mime-type

Mime type of the response content.

AUDIT.http-client-response-content-text

Response body.

AUDIT.http-client-response-redirect-url

Redirect target URL from the location response header.

AUDIT.http-client-response-headers-size

Size, in bytes, of the header from the start of the response to the body.

AUDIT.http-client-response-body-size

Size, in bytes, of the response body.

The following example shows the client section with all elements set to true.

                <!-- AUDIT.http-client is the section setting for the following fields: -->
                <!-- AUDIT.http-client-started-date-time to AUDIT.http-client-response-body-size -->
                <KeyValuePair key=”AUDIT.http-client” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-started-date-time” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-time” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-method” value=”true”/>
                <!-- Note: “AUDIT.http-client-request-target” is the target part of the url -->
                <KeyValuePair key=”AUDIT.http-client-request-target” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-http-version” value=”true”/>
                <!-- Sets the default value for all client request cookies. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual cookie values. -->
                <KeyValuePair key=”AUDIT.http-client-request-cookies” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-cookie-{cookie}” value=”true”/>
                <!-- Sets the default value for all client request headers. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual header values. -->
                <KeyValuePair key=”AUDIT.http-client-request-headers” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-header-{header}” value=”true”/>
                <!-- Sets the default value for all client request query strings. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual query strings. -->
                <KeyValuePair key=”AUDIT.http-client-request-query-strings” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-query-string-{query}” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-post-data-mime-type” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-post-data-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-headers-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-request-body-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-status-code” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-status-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-http-version” value=”true”/>
                <!-- Sets the default value for all client response cookies. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual cookie values. -->
                <KeyValuePair key=”AUDIT.http-client-response-cookies” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-cookie-{cookie}” value=”true”/>
                <!-- Sets the default value for all client response headers. -->
                <!-- This overrides AUDIT.http-client and is overridden by individual header values. -->
                <KeyValuePair key=”AUDIT.http-client-response-headers” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-header-{header}” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-content-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-content-mime-type” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-content-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-redirect-url” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-headers-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-client-response-body-size” value=”true”/>

HTTP app elements

App elements provide information about requests made by PingAccess to other tools or services such as PingFederate, and the response sent back to PingAccess. For example, PingAccess making a call to a protected resource is considered app traffic. You can include app elements in the engine and audit traffic logs.

Item Description

AUDIT.http-app

Section setting for all app elements.

AUDIT.http-app-started-date-time

Date and time of the beginning of the request.

AUDIT.http-app-time

Total elapsed time of the request and response.

AUDIT.http-app-request-method

Method used in the request.

AUDIT.http-app-request-target

The portion of the URL after the host and port.

AUDIT.http-app-request-http-version

HTTP version used by the request.

AUDIT.http-app-request-cookies

List of all cookies in the request. Parent element for AUDIT.http-app-request-cookie-{cookie}.

AUDIT.http-app-request-cookie-{cookie}

Information about the request cookie with the specified name. You can include this element multiple times for different cookie names.

AUDIT.http-app-request-headers

List of all headers in the request. Parent element for AUDIT.http-app-request-header-{header}.

AUDIT.http-app-request-header-{header}

Information about the request header with the specified name. You can include this element multiple times for different header names.

AUDIT.http-app-request-query-strings

List of all parameters and values parsed from the request query string. Parent element for AUDIT.http-app-request-query-string-{query}.

AUDIT.http-app-request-query-string-{query}

Information about the request query string with the specified name. You can include this element multiple times for different query string names.

AUDIT.http-app-request-post-data-mime-type

Mime type of posted data.

AUDIT.http-app-request-post-data-text

Posted data, in plain text.

AUDIT.http-app-request-headers-size

Size, in bytes, of the header from the start of the request to the body.

AUDIT.http-app-request-body-size

Size, in bytes, of the request body.

AUDIT.http-app-response-status-code

Response status code.

AUDIT.http-app-response-status-text

Response status description.

AUDIT.http-app-response-http-version

HTTP version used by the response.

AUDIT.http-app-response-cookies

List of all cookies in the response. Parent element for AUDIT.http-app-response-cookie-{cookie}.

AUDIT.http-app-response-cookie-{cookie}

Information about the response cookie with the specified name. You can include this element multiple times for different cookie names.

AUDIT.http-app-response-headers

List of all headers in the response. Parent element for AUDIT.http-app-response-header-{header}.

AUDIT.http-app-response-header-{header}

Information about the response header with the specified name. You can include this element multiple times for different header names.

AUDIT.http-app-response-content-size

Size, in bytes, of the response content.

AUDIT.http-app-response-content-mime-type

Mime type of the response content.

AUDIT.http-app-response-content-text

Response body.

AUDIT.http-app-response-redirect-uri

Redirect target URL from the location response header.

AUDIT.http-app-response-headers-size

Size, in bytes, of the header from the start of the response to the body.

AUDIT.http-app-response-body-size

Size, in bytes, of the response body.

The following example shows the app section with all elements set to true.

                <!-- AUDIT.http-app is the section setting for the following fields: -->
                <!-- AUDIT.http-app-started-date-time to AUDIT.http-app-response-body-size -->
                <KeyValuePair key=”AUDIT.http-app” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-started-date-time” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-time” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-method” value=”true”/>
                <!-- Note: “AUDIT.http-app-request-target” is the target part of the url -->
                <KeyValuePair key=”AUDIT.http-app-request-target” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-http-version” value=”true”/>
                <!-- Sets the default value for all app request cookies. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual cookie values. -->
                <KeyValuePair key=”AUDIT.http-app-request-cookies” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-cookie-{cookie}” value=”true”/>
                <!-- Sets the default value for all app request headers. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual header values. -->
                <KeyValuePair key=”AUDIT.http-app-request-headers” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-header-{header}” value=”true”/>
                <!-- Sets the default value for all app request query strings. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual query strings. -->
                <KeyValuePair key=”AUDIT.http-app-request-query-strings” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-query-string-{query}” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-post-data-mime-type” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-post-data-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-headers-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-request-body-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-status-code” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-status-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-http-version” value=”true”/>
                <!-- Sets the default value for all app response cookies. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual cookie values. -->
                <KeyValuePair key=”AUDIT.http-app-response-cookies” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-cookie-{cookie}” value=”true”/>
                <!-- Sets the default value for all app response headers. -->
                <!-- This overrides AUDIT.http-app and is overridden by individual header values. -->
                <KeyValuePair key=”AUDIT.http-app-response-headers” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-header-{header}” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-content-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-content-mime-type” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-content-text” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-redirect-uri” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-headers-size” value=”true”/>
                <KeyValuePair key=”AUDIT.http-app-response-body-size” value=”true”/>