You can include these metadata, client, and app elements in traffic logs.
Element hierarchy
Each section described here has child elements. If there is a disagreement in settings, the most specific setting is used.
For example, if the metadata element is set to false but the exchange ID is set to true, then only the exchange ID is logged. If the metadata element is set to true but the exchange ID is set to false, then all metadata elements except the exchange ID are logged.
Limitations
The traffic logs have the following limitations:
- If a request or response body is chunked, only the first chunk is logged by traffic logging.
- Request and response bodies are not decoded.
Metadata elements
You can include metadata elements in the API, engine, and audit traffic logs. These elements provide general information about the logged event.
| Item | Description |
|---|---|
|
|
Section setting for all metadata elements. |
|
|
Identifies the ID for a specific request/response pair. |
|
|
Specifies the ID of the requested application. |
|
|
Specifies the name of the requested application. |
|
|
Specifies the ID of the requested resource. |
|
|
Specifies the name of the requested resource. |
|
|
Specifies the path prefix of the requested application or resource. |
|
|
Indicates the pattern type of the path prefix, |
|
|
Mechanism used for authentication. Engine Auditing - Cookie (WAM session), OAuth, unknown (for example, pass-through or static assets). Pass-through assets are Resources with no policies or Web session configured. Admin Auditing - Basic, OAuth, Cookie, unknown ( unknown displays only in an authentication failure). |
|
|
IP address of the requesting client. |
|
|
Name of the rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log. |
|
|
Type of rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log. |
|
|
The Java class of rule that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log. |
|
|
Name of the containing rule set that failed. If no rule failure occurred, this field is blank. This element is applicable only to the engine log. |
|
|
PingAccess host name or IP address. |
|
|
Backend target that processed the request and generated a response to the PingAccess engine. This variable is unset when the response is generated by a target host protected by PingAccess. |
|
|
Name of the resource used to fulfill the request. This element is applicable only to the engine log. |
|
|
Subject of the transaction. |
|
|
The PingFederate tracking ID. This element can be used to help correlate audit information in the PingAccess audit log with information recorded in the PingFederate audit log. The value of this depends on whether the application type is If the application type is If the application type is |
The following example shows the metadata section with all elements set to true.
<!-- AUDIT.metadata is the section setting for the following fields: -->
<!-- AUDIT.exchangeId to AUDIT.trackingId -->
<KeyValuePair key=”AUDIT.metadata” value=”true”/>
<KeyValuePair key=”AUDIT.exchangeId” value=”true”/>
<KeyValuePair key=”AUDIT.applicationId” value=”true”/>
<KeyValuePair key=”AUDIT.applicationName” value=“true”/>
<KeyValuePair key=”AUDIT.resourceId” value=”true”/>
<KeyValuePair key=”AUDIT.resourceName” value=”true”/>
<KeyValuePair key=”AUDIT.pathPrefix” value=”true”/>
<KeyValuePair key=”AUDIT.pathPrefixType” value=”true”/>
<KeyValuePair key=”AUDIT.authMech” value=”true”/>
<KeyValuePair key=”AUDIT.client” value=”true”/>
<KeyValuePair key=”AUDIT.failedRuleName” value=”true”/>
<KeyValuePair key=”AUDIT.failedRuleType” value=”true”/>
<KeyValuePair key=”AUDIT.failedRuleClass” value=”true”/>
<KeyValuePair key=”AUDIT.failedRuleSetName” value=”true”/>
<KeyValuePair key=”AUDIT.host” value=”true”/>
<KeyValuePair key=”AUDIT.targetHost” value=”true”/>
<KeyValuePair key=”AUDIT.resource” value=”true”/>
<KeyValuePair key=”AUDIT.subject” value=”true”/>
<KeyValuePair key=”AUDIT.trackingId” value=”true”/>
HTTP client elements
Client elements provide information about requests made to PingAccess by clients, and the response sent back to the client. For example, a user making a call to the PingAccess administrative API is considered client traffic. You can include client elements in the API, engine, and audit traffic logs.
| Item | Description |
|---|---|
|
|
Section setting for all client elements. |
|
|
Date and time of the beginning of the request. |
|
|
Total elapsed time of the request and response. |
|
|
Method used in the request. |
|
|
The portion of the URL after the host and port. |
|
|
HTTP version used by the request. |
|
|
List of all cookies in the request. Parent element for
|
|
|
Information about the request cookie with the specified name. You can include this element multiple times for different cookie names. |
|
|
List of all headers in the request. Parent element for
|
|
|
Information about the request header with the specified name. You can include this element multiple times for different header names. |
|
|
List of all parameters and values parsed from the request query string. Parent
element for
|
|
|
Information about the request query string with the specified name. You can include this element multiple times for different query string names. |
|
|
Mime type of posted request data. |
|
|
Posted request data, in plain text. |
|
|
Size, in bytes, of the header from the start of the request to the body. |
|
|
Size, in bytes, of the request body. |
|
|
Response status code. |
|
|
Response status description. |
|
|
HTTP version used by the response. |
|
|
List of all cookies in the response. Parent element for
|
|
|
Information about the response cookie with the specified name. You can include this element multiple times for different cookie names. |
|
|
List of all headers in the response. Parent element for
|
|
|
Information about the response header with the specified name. You can include this element multiple times for different header names. |
|
|
Size, in bytes, of the response content. |
|
|
Mime type of the response content. |
|
|
Response body. |
|
|
Redirect target URL from the location response header. |
|
|
Size, in bytes, of the header from the start of the response to the body. |
|
|
Size, in bytes, of the response body. |
The following example shows the client section with all elements set to true.
<!-- AUDIT.http-client is the section setting for the following fields: -->
<!-- AUDIT.http-client-started-date-time to AUDIT.http-client-response-body-size -->
<KeyValuePair key=”AUDIT.http-client” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-started-date-time” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-time” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-method” value=”true”/>
<!-- Note: “AUDIT.http-client-request-target” is the target part of the url -->
<KeyValuePair key=”AUDIT.http-client-request-target” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-http-version” value=”true”/>
<!-- Sets the default value for all client request cookies. -->
<!-- This overrides AUDIT.http-client and is overridden by individual cookie values. -->
<KeyValuePair key=”AUDIT.http-client-request-cookies” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-cookie-{cookie}” value=”true”/>
<!-- Sets the default value for all client request headers. -->
<!-- This overrides AUDIT.http-client and is overridden by individual header values. -->
<KeyValuePair key=”AUDIT.http-client-request-headers” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-header-{header}” value=”true”/>
<!-- Sets the default value for all client request query strings. -->
<!-- This overrides AUDIT.http-client and is overridden by individual query strings. -->
<KeyValuePair key=”AUDIT.http-client-request-query-strings” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-query-string-{query}” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-post-data-mime-type” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-post-data-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-headers-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-request-body-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-status-code” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-status-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-http-version” value=”true”/>
<!-- Sets the default value for all client response cookies. -->
<!-- This overrides AUDIT.http-client and is overridden by individual cookie values. -->
<KeyValuePair key=”AUDIT.http-client-response-cookies” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-cookie-{cookie}” value=”true”/>
<!-- Sets the default value for all client response headers. -->
<!-- This overrides AUDIT.http-client and is overridden by individual header values. -->
<KeyValuePair key=”AUDIT.http-client-response-headers” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-header-{header}” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-content-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-content-mime-type” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-content-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-redirect-url” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-headers-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-client-response-body-size” value=”true”/>
HTTP app elements
App elements provide information about requests made by PingAccess to other tools or services such as PingFederate, and the response sent back to PingAccess. For example, PingAccess making a call to a protected resource is considered app traffic. You can include app elements in the engine and audit traffic logs.
| Item | Description |
|---|---|
|
|
Section setting for all app elements. |
|
|
Date and time of the beginning of the request. |
|
|
Total elapsed time of the request and response. |
|
|
Method used in the request. |
|
|
The portion of the URL after the host and port. |
|
|
HTTP version used by the request. |
|
|
List of all cookies in the request. Parent element for
|
|
|
Information about the request cookie with the specified name. You can include this element multiple times for different cookie names. |
|
|
List of all headers in the request. Parent element for
|
|
|
Information about the request header with the specified name. You can include this element multiple times for different header names. |
|
|
List of all parameters and values parsed from the request query string. Parent
element for
|
|
|
Information about the request query string with the specified name. You can include this element multiple times for different query string names. |
|
|
Mime type of posted data. |
|
|
Posted data, in plain text. |
|
|
Size, in bytes, of the header from the start of the request to the body. |
|
|
Size, in bytes, of the request body. |
|
|
Response status code. |
|
|
Response status description. |
|
|
HTTP version used by the response. |
|
|
List of all cookies in the response. Parent element for
|
|
|
Information about the response cookie with the specified name. You can include this element multiple times for different cookie names. |
|
|
List of all headers in the response. Parent element for
|
|
|
Information about the response header with the specified name. You can include this element multiple times for different header names. |
|
|
Size, in bytes, of the response content. |
|
|
Mime type of the response content. |
|
|
Response body. |
|
|
Redirect target URL from the location response header. |
|
|
Size, in bytes, of the header from the start of the response to the body. |
|
|
Size, in bytes, of the response body. |
The following example shows the app section with all elements set to true.
<!-- AUDIT.http-app is the section setting for the following fields: -->
<!-- AUDIT.http-app-started-date-time to AUDIT.http-app-response-body-size -->
<KeyValuePair key=”AUDIT.http-app” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-started-date-time” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-time” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-method” value=”true”/>
<!-- Note: “AUDIT.http-app-request-target” is the target part of the url -->
<KeyValuePair key=”AUDIT.http-app-request-target” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-http-version” value=”true”/>
<!-- Sets the default value for all app request cookies. -->
<!-- This overrides AUDIT.http-app and is overridden by individual cookie values. -->
<KeyValuePair key=”AUDIT.http-app-request-cookies” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-cookie-{cookie}” value=”true”/>
<!-- Sets the default value for all app request headers. -->
<!-- This overrides AUDIT.http-app and is overridden by individual header values. -->
<KeyValuePair key=”AUDIT.http-app-request-headers” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-header-{header}” value=”true”/>
<!-- Sets the default value for all app request query strings. -->
<!-- This overrides AUDIT.http-app and is overridden by individual query strings. -->
<KeyValuePair key=”AUDIT.http-app-request-query-strings” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-query-string-{query}” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-post-data-mime-type” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-post-data-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-headers-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-request-body-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-status-code” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-status-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-http-version” value=”true”/>
<!-- Sets the default value for all app response cookies. -->
<!-- This overrides AUDIT.http-app and is overridden by individual cookie values. -->
<KeyValuePair key=”AUDIT.http-app-response-cookies” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-cookie-{cookie}” value=”true”/>
<!-- Sets the default value for all app response headers. -->
<!-- This overrides AUDIT.http-app and is overridden by individual header values. -->
<KeyValuePair key=”AUDIT.http-app-response-headers” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-header-{header}” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-content-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-content-mime-type” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-content-text” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-redirect-uri” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-headers-size” value=”true”/>
<KeyValuePair key=”AUDIT.http-app-response-body-size” value=”true”/>