The Okta System Log contains details of all logged events for an organization, including user authentication, password resets, rate limit errors, user lifecycle information, and other activity. Use the System Log as the primary tool for troubleshooting Okta issues or reviewing environment activity.
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Monitoring and Reports
- System Log
Review the following topics covered in this guide.
- How is the Okta System Log accessed?
- What are the basic functions of the Okta System Log?
- How is a basic search performed?
- How is an advanced search performed?
- How are events filtered by a specific IP address?
- How are searches saved?
How is the Okta System Log accessed?
Navigate to the System Log within the Okta Admin Console by following these steps.
- Navigate to the Okta Admin Console.
- Go to Reports > System Log.
What are the basic functions of the Okta System Log?
Review the following primary methods for viewing and monitoring events in an organization.
The events table lists all events and includes information about time, actor, target, and more. The events table can be used to perform the following actions:
-
- View more data about an event by clicking the right arrow on the corresponding row.
- Filter events by time, event info, actor, or targets in the table by clicking the column header.
- Download the entire table by clicking the Download CSV file link.
- Toggle between the table view and a geolocation view, which displays events on a map.
Clicking the map pin displays events on the map and tracks whether a specific event occurred from a blocked geographic location.
Events can be filtered in the System Log using various parameters and operators. By default, the filters display all events for the last seven days.
Clicking Show event trends by category will sort all events matching the System Log search query into the following categories:
-
- Count of events per target.
- Count of events per actor.
- Count of events per event type.
Hovering the mouse pointer over a chart column to display the events and the corresponding counts triggered by the search query (for example, IP address eq <value>).
The default limit for the Okta System Log is 20 events. To display more than 20 events and avoid repeatedly clicking Show more, follow the steps below:
-
- Navigate to the URL and locate
limit=20after thetimezone. - Increase this number up to 1000.
- For example, changing the limit from 20 to 100 displays 100 events for the System Log search query when clicking Show more.
- Navigate to the URL and locate
How is a basic search performed?
Specify a time range and enter a search string to perform a basic search in the System Log.
- Specify a time range using the From, To, and Time Zone fields.
NOTE: Okta retains events for 90 days. Specifying a longer range results in an error. - Enter a string to search all events.
- Press the Enter key or click the Search icon.
Review the following table for a list of commonly used custom queries.
| Use case | Query |
|---|---|
| Password resets for users | eventType eq "user.account.reset_password" |
| Find Rate Limit errors | displayMessage eq "Rate limit violation" |
| Application Assignment | application.user_membership.add |
| Application Access | eventType eq "user.authentication.sso" |
| User Creation | user.lifecycle.create |
| User Locked Out | user.account.lock |
| Self Service Unlock | self_service.account_unlock |
|
Sign-in Success |
|
|
Suspicious Activity |
|
How is an advanced search performed?
Apply advanced filters and selection criteria to perform an advanced search.
- Click Advanced Filters.
- Enter the selection criteria.
-
Click Apply Filter.
Review the Operators documentation for more details.
How are events filtered by a specific IP address?
Filter the System Log to view all events associated with a specific IP address by following these steps.
- In the Events table, click the right arrow for the event to view the Actor, Client, Event, Request, and Target info about that event.
- Expand Client or Request > IPChain.
- Hover over the IP address to display the Filter icon.
- Click the Filter icon to sort the event list.
- Click Reset Filters to clear any custom filters and return to the default filters.
Click hyperlinked values in other fields in the System Log to filter by them.
How are searches saved?
Save searches to reuse, modify, or delete them later by following these steps.
- After performing a System Log search, click Save.
- Enter a name for the customized search.
- Click Save as new. The customized search appears on the Reports page.
