Authentication Log

You have access to records of system activity involving logging in and out. High-level security events are logged for auditing purposes. The types of security events cover high-risk activities enabling the tracking and source identification of the event through analysis of logged source internet address, source session, user id, and event time.

Log entries are based on industry standards for identification and description of security events that may be the result of system attacks making them suitable for importing/use with third party tools for forensic analysis reporting. Additionally, the logs themselves provide the ability to identify specific events as immediately visible in the logs.

The Authentication Logs page includes a powerful Search filter, a Log Summary area for summarizing the events in the log, and a Message Detail pane at the bottom of the page for displaying event details, including handler class and type, user agent, and the log message.

In SaaS deployments, authentication logs are kept until explicitly deleted. The authentication provider log table is kept 10 days.

There are two ways to access the Authentication Logs page:

1. On the Administrator Panel, in the Integrations section, select Authentication. Then, select View Authentication Logs.
2. On the Administrator Panel, in the Tools and Utilities section, select Logs. Then, select Authentication Logs.

Authentication Logs page

The log shows all authentication events, including the event type, username, IP address, date, and the provider involved. Select an entry in the log table to show more information in the Message Detail window.

1. Use the Search filter to search for specific activity and filter by user, authentication provider, event type, and date.
2. Refresh the display so that the most current log entries appear that match the filter choice.
3. Clear Counts clears the message count indicators in the Log Summary section to aid in troubleshooting.
4. Purge Log removes all records from the log, which also clears the message count indicators in the Log Summary section.
5. Message Detail pane allows you to review event details including handler class and type, user agent, and the log message. Select an event in the Log Summary section to display the Message Detail for that event.

With REDIRECT type authentication providers, such as CAS or Shibboleth, some authentication events may not be logged as they occur on the authentication source server.

Event types

The log shows five events:

• Logins
• Logouts, additional information shows whether a logout was manual or due to session expiration.
• Login Attempts
• Messages
• Errors

Example log entries by scenario

The Message Detail window shows the detailed log message for an event. This table shows some example logs for common events.