Logs Tab Configuration
Introduction
Use this guide to configure the Logs tab in the Web Admin for each SecureAuth IdP realm.
This includes enabling or disabling audit, error, and debug logs.
Prerequisites
1. Create a New Realm for the target resource for which the configuration settings will apply, or open an existing realm for which configurations have already been started
2. Configure the Overview, Data, Workflow, Adaptive Authentication, Multi-Factor Methods, and Post Authentication tabs in the Web Admin before configuring the Logs tab
Logs Configuration Steps
 |
1. In the Log Options section, provide the Log Instance ID, e.g. the Application Name or the realm name (SecureAuth1)
2. Check which Audit, Debug, and Error Logs to enable
3. Select On or Remote Only from the Custom Errors dropdown to redirect end-users to a distinct page when a custom error occurs
4. Provide the URL for the Custom Error Redirect if On or Remote Only is selected in step 3
SysLog
 |
1. Provide the FQDN or IP Address of the Syslog Server
2. Provide the SysLog Port number
3. Select the Syslog RFC Spec from the dropdown as required by the Syslog
If RFC3164 is selected, then choose a Spec Format:
None Specified: normal RFC3164 formatting, for use in most implementations
LEEF: for use with IBM Security QRadar SIEM only
CEF: for use with HP ArcSight SIEM only
Log Database
 |
1. Provide the FQDN or the IP Address of the database in the Data Source field
2. Provide the Database Name in the Initial Catalog field
3. Select True from the Integrated Security dropdown if the webpage's ID is to be included in the Connection String
4. Select True form the Persist Security Info dropdown if access to username and password information is allowed
5. Provide the User ID of the Database
6. Provide the Password associated to the User ID
7. Click Generate Connection String, and the Connection String will auto-populate based on the previous fields
8. Click Test Connection to ensure that the integration is successful
9. Click Save to all Realms if these Database settings are to be used in each SecureAuth IdP realm
Reports
 |
5. Review the log Reports and Charts by downloading the information
6. Review the Error Logs, Audit Logs, and / or Certificate Logs as enabled here in the Web Admin as needed
Warning
Click Save once the configurations have been completed and before leaving the Logs page to avoid losing changes
Enhanced Logging
Key-Value Pair Properties
Key-value pair properties defined in the table below are pertinent to the structured data element of a syslog entry. Several of these properties are also logged in the header or message elements of the log entry but are difficult to parse or extract. These properties are outputted in their original location as well as in the structured data element.
Property | Description | Notes |
|---|---|---|
| Risk score based on IP Address evaluation and threat intelligence data | Applicable only to IP reputation log entries; also logged in the message element |
| For some authentication methods, this property may tell which method of 2FA was used. | Text string; possible values are:
|
| Category of the event being logged | Also logged in the header element |
| Integer | |
| Displays the response time of an application request | Applicable only to log entries with event ID9004x; also logged in the message element |
| Displays a unique identifier that shows the workflow for a specific request | An "Application End" log entry marks the end of a request and its corresponding RequestID |
| Displays result of an authentication attempt | Also logged in the message element |
| True / False |
Syslog Logging Event
Syslog generates a log entry when a user opens or saves a tab using the Web Admin tool. This tool provides information about the realm a user modified at the time the log entry was generated.
Property | Description | Notes |
|---|---|---|
| Describes the realm number that was opened in the Web Admin | This log entry type is generated when a user opens a realm (by clicking the sidebar in the Web Admin) or opens a tab in a realm (e.g. Workflow, Data) |
| Describes the realm number(s) where changes were saved in the Web Admin | The value of this key lists all realms that were saved to when the log entry was generated |
Information About Transaction Logs (20990)
Events recorded in Transaction Logs (20990) provide information that can assist in troubleshooting or analyzing end-user activity on the SecureAuth IdP appliance.
The table below provides details about common fields and values identified in transaction logs, and how to interpret that data.
Field / Description | Values / Description |
|---|---|
Reserved | |
Reserved | |
As specified by the Service Provider | |
As specified by the Service Provider | |
As specified by the Service Provider | |