Useful System Log Queries Skip to main content
https://support.okta.com/help/oktaarticledetailpage?childcateg=&id=ka02a000000bnjzsai&source=documentation&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fdocumentation%2fknowledge_article%2fuseful-system-log-queries
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Useful System Log Queries
Published: Jun 30, 2017   -   Updated: Jun 22, 2018

The table below provides System Log 2.0 queries for common use cases.  For more about the system log, please check out our System Log Guide.
 
Use CaseQuery
Password resets for userseventType eq "user.account.reset_password"
Find Rate Limit errosdisplayMessage eq "Rate limit violation"
Application Assignment application.user_membership.add
Application AccesseventType eq "user.authentication.sso"
User Creationuser.lifecycle.create
User Locked Outuser.account.lock
Self Service Unlockself_service.account_unlock
Sign-in Successuser.authentication.sso
Suspicious Activityoutcome.reason eq "Authentication failed: bad username or password"
Application AccesseventType eq "user.authentication.sso"