The Common Event Format (CEF) is an open logging standard. PingFederate provides an option of writing elements from the audit log, the provisioner audit log, or both at runtime to a syslog receiver for parsing and analysis using ArcSight from Micro Focus. Alternatively, administrators can write the information to a flat file in CEF; however, using syslog, when available, is recommended.

Note:

PingFederate is tested with ArcSight for interoperability using the default elements defined in log4j2.xml. Any additions to these elements may render your CEF logging incompatible with ArcSight.