Useful System Log Queries Skip to main content
https://support.okta.com/help/oktaarticledetailpage?childcateg=&id=ka02a000000bnjzsai&source=documentation&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fdocumentation%2fknowledge_article%2fuseful-system-log-queries
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Average Rating:
Useful System Log Queries
Published: Jun 30, 2017   -   Updated: Jun 30, 2017

The table below provides System Log 2.0 queries for common use cases.  For more about the system log, please check out our System Log Guide.
 
Use CaseQuery
Password resets for userseventType eq "user.account.reset_password"
Find Rate Limit errosdisplayMessage eq "Rate limit violation"
Application Assignment application.user_membership.add
Application AccesseventType eq "user.authentication.sso"
User Creationuser.lifecycle.create
User Locked Outuser.account.lock
Self Service Unlockself_service.account_unlock
Sign-in Successuser.authentication.sso
Suspicious Activityoutcome.reason eq "Authentication failed: bad username or password"
Application AccesseventType eq "user.authentication.sso"


 

Post a Comment

Comments

  • Isaac Brumer on November 13, 2017

    @Peter McCarthy: You can find a more comprehensive list of events in the Event API reference
    https://developer.okta.com/docs/api/resources/events.html#action-objecttypes

  • Peter McCarthy on August 16, 2017

    Is there a list of Event Types somewhere? That would be a huge help with searching through the System Log.