When an end user uses the help links in the End User Help Form, Okta sends an email notification to the configured Technical contact for the tenant. Each event is logged within the System Log. Administrators can use specific queries to search for these events.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• System Logs
• Sign-in Page
• End User Help Form

What System Log queries locate End User Help Form events?

The following System Log queries can be used to search for end-user help form notifications that were sent out:

• Request help with using the system:
  • debugContext.debugData.category eq "email.user.REQUEST_HELP"
• The user cannot Log in:
  • debugContext.debugData.category eq "email.user.LOCKED_OUT" 
• Report a potential security issue:
  • debugContext.debugData.category eq "email.user.SECURITY_ALERT"
• Request access to an application:
  • debugContext.debugData.category eq "email.user.REQUEST_APP"
• Send feedback about the system:
  • debugContext.debugData.category eq "email.user.SEND_FEEDBACK"
• Report a bug in the system:
  • debugContext.debugData.category eq "email.user.REPORT_BUG"

Example with the "Cannot log in" email notification from the End User Help Form, sent to the configured technical contact ( System Log Query:  debugContext.debugData.category eq "email.user.LOCKED_OUT" )

Related References

• What is the End User Help Form Used For
• How to Disable the End User Help Form from the Sign-in Page
• Receiving Emails with [Okta Site] in the Subject after Administrator Disables End User Help Form