# System Log (https://docs.idra.zone/docs/admin/system-log)

Every sign-in, policy decision and admin change in IdRa: filters, transactions, export, retention and the list of event types.

**Reports → System Log** records every sign-in, policy decision and admin change in your organization. Click an event to see its detail.

## Find events

Filter by time range, event type, outcome and free text over the actor, target, type, reason and IP. Event type is a prefix: `user.session` matches `user.session.start` and `user.session.revoke`. The field suggests the types listed below.

## Transactions

Every event a single request or background job logs shares a transaction id. To see everything one action did, open an event and choose **Show this transaction**. The link form is `/admin/reports/system-log?transactionId=…`.

- For a request, the id is the response's `X-Request-Id`, so someone quoting that header leads straight to the events. IdRa always sets it: a client's own `X-Request-Id` is ignored, because a caller doesn't choose what the log says.
- For a background job, the id is the job's id, with type `JOB`. All retries of a job share it.
- A job a request queues has its own transaction.
- Events logged before this feature, and those outside any request or job, have no transaction in the console. In the API each one reports its own event id.

Choose a time range when filtering by transaction: the search isn't indexed, so long ranges in a large log are slow.

## Export and retention

**CSV** downloads what the filters match, up to 50,000 rows. The transaction is in the `data` column. Settings → Account sets how long events are kept, with a minimum of 7 days. **Privacy** tools can erase a person from retained events: see [Users](https://docs.idra.zone/docs/admin/users).

## System Log API

`GET /api/v1/logs` returns Okta-style `LogEvent` objects. See the [Admin API](https://docs.idra.zone/docs/admin-api).

| Field | Value |
|---|---|
| `displayMessage` | The message below. A type not listed reads as itself. |
| `transaction` | `id` and `type` (`WEB` or `JOB`) as above. |
| `access_request.approve` | Access request approved |
| `access_request.cancel` | Access request cancelled |
| `access_request.create` | Access request created |
| `access_request.deny` | Access request denied |
| `access_request.expire` | Access request expired |
| `access_request.revoke` | Granted access revoked |
| `api.authorization_server.client.link` | Client linked to authorization server |
| `api.authorization_server.client.unlink` | Client unlinked from authorization server |
| `api.authorization_server.create` | Authorization server created |
| `api.authorization_server.delete` | Authorization server deleted |
| `api.authorization_server.policy.create` | Authorization server policy created |
| `api.authorization_server.policy.delete` | Authorization server policy deleted |
| `api.authorization_server.policy.update` | Authorization server policy updated |
| `api.authorization_server.update` | Authorization server updated |
| `app.access` | User access to app evaluated |
| `app.assignment.add` | App assigned |
| `app.assignment.remove` | App assignment removed |
| `app.lifecycle.activate` | App activated |
| `app.lifecycle.create` | App created |
| `app.lifecycle.deactivate` | App deactivated |
| `app.lifecycle.delete` | App deleted |
| `app.lifecycle.update` | App updated |
| `app.oauth2.client.secret_rotate` | OAuth client secret rotated |
| `app.oauth2.client.update` | OAuth client updated |
| `app.oauth2.client_registration.token_create` | Client registration token created |
| `app.oauth2.client_registration.token_revoke` | Client registration token revoked |
| `app.oauth2.client_registration.update` | Client registration settings updated |
| `app.oauth2.token.grant` | OAuth token issued without a sign-in |
| `app.oauth2.token.revoke` | OAuth token revoked |
| `app.oauth_grant.create` | OAuth grant created |
| `app.oauth_grant.revoke` | OAuth grant revoked |
| `app.provisioning.group_push.add` | Group push added to app |
| `app.provisioning.group_push.remove` | Group push removed from app |
| `app.provisioning.push` | User pushed to app |
| `app.provisioning.update` | App provisioning settings updated |
| `app.saml.sso` | SAML sign-on to app |
| `app.universal_logout` | Universal logout sent to app |
| `client.device` | `Computer`, `Mobile`, `Tablet` or `Unknown`, from the user agent. An iPad that reports itself as a Mac reads as `Computer`. |
| `client.zone` | The name of a network zone matching the event's IP, country or ASN, or the string `"null"`. If several match, the first by name. Worked out from today's zones when the event is read, so editing a zone changes older events too. |
| `device.fleet.lock` | Fleet device lock requested |
| `device.fleet.refetch` | Fleet device refresh requested |
| `device.fleet.unlock` | Fleet device unlock requested |
| `device.fleet.wipe` | Fleet device wipe requested |
| `device.lifecycle.activate` | Device activated |
| `device.lifecycle.deactivate` | Device deactivated |
| `device.lifecycle.delete` | Device deleted |
| `device.lifecycle.suspend` | Device suspended |
| `device.mdm.create` | MDM integration created |
| `device.mdm.delete` | MDM integration deleted |
| `device.mdm.partial_sync` | MDM sync read only part of the inventory |
| `device.mdm.sync` | MDM integration synced |
| `device.mdm.sync_requested` | MDM sync requested |
| `device.mdm.update` | MDM integration updated |
| `device.mdm.webhook_rotate` | MDM webhook secret rotated |
| `directory.profile_attribute.create` | Profile attribute created |
| `directory.profile_attribute.delete` | Profile attribute deleted |
| `directory.profile_attribute.update` | Profile attribute updated |
| `event_hook.lifecycle.create` | Event hook created |
| `event_hook.lifecycle.delete` | Event hook deleted |
| `event_hook.lifecycle.update` | Event hook updated |
| `event_hook.lifecycle.verify` | Event hook verification attempted |
| `group.lifecycle.create` | Group created |
| `group.lifecycle.delete` | Group deleted |
| `group.lifecycle.update` | Group updated |
| `group.rule.apply` | Group rule applied |
| `group.rule.create` | Group rule created |
| `group.rule.delete` | Group rule deleted |
| `group.rule.update` | Group rule updated |
| `group.user_membership.add` | User added to group |
| `group.user_membership.remove` | User removed from group |
| `hook_key.lifecycle.create` | Hook key created |
| `hook_key.lifecycle.delete` | Hook key deleted |
| `inline_hook.invoke` | Inline hook called |
| `inline_hook.lifecycle.create` | Inline hook created |
| `inline_hook.lifecycle.delete` | Inline hook deleted |
| `inline_hook.lifecycle.update` | Inline hook updated |
| `log_stream.delivery.fail` | Log stream delivery started failing |
| `log_stream.lifecycle.create` | Log stream created |
| `log_stream.lifecycle.delete` | Log stream deleted |
| `log_stream.lifecycle.update` | Log stream updated |
| `log_stream.test` | Log stream test event |
| `pam.access_request.archive` | Access requests archived before their person was deleted |
| `pam.secret.create` | Secret created |
| `pam.secret.delete` | Secret deleted |
| `pam.secret.reveal` | Secret revealed |
| `pam.secret.update` | Secret updated |
| `pam.server.create` | Server created |
| `pam.server.delete` | Server deleted |
| `pam.server.update` | Server updated |
| `pam.ssh.ca_rotate` | SSH certificate authority rotated |
| `pam.ssh.cert_issue` | SSH certificate issued |
| `partner.app_grant.add` | App granted to partner |
| `partner.app_grant.remove` | App grant removed from partner |
| `partner.idp.delete` | Partner identity provider deleted |
| `partner.idp.update` | Partner identity provider updated |
| `partner.invitation.accept` | Partner invitation accepted |
| `partner.invitation.create` | Partner invitation created |
| `partner.invitation.revoke` | Partner invitation revoked |
| `partner.lifecycle.create` | Partner created |
| `partner.lifecycle.delete` | Partner deleted |
| `partner.lifecycle.update` | Partner updated |
| `partner.member.remove` | Partner member removed |
| `partner.member.update` | Partner member updated |
| `policy.admin_console.recover` | Admin Console Policy rules cleared by recovery |
| `policy.api_rule.create` | API access rule created |
| `policy.api_rule.delete` | API access rule deleted |
| `policy.api_rule.update` | API access rule updated |
| `policy.device_assurance.create` | Device assurance policy created |
| `policy.device_assurance.delete` | Device assurance policy deleted |
| `policy.device_assurance.update` | Device assurance policy updated |
| `policy.device_trust.update` | Device trust settings updated |
| `policy.lifecycle.create` | Policy created |
| `policy.lifecycle.delete` | Policy deleted |
| `policy.lifecycle.reorder` | Policies reordered |
| `policy.lifecycle.update` | Policy updated |
| `policy.rule.create` | Policy rule created |
| `policy.rule.delete` | Policy rule deleted |
| `policy.rule.reorder` | Policy rules reordered |
| `policy.rule.update` | Policy rule updated |
| `posture.check.update` | Posture check updated |
| `posture.connector.action` | Posture connector action run |
| `posture.connector.create` | Posture connector created |
| `posture.connector.delete` | Posture connector deleted |
| `posture.connector.sync` | Posture connector synced |
| `posture.connector.update` | Posture connector updated |
| `posture.finding.comment` | Comment added to finding |
| `posture.finding.comment.delete` | Comment deleted from finding |
| `posture.finding.ignore` | Finding ignored |
| `posture.finding.notify` | Finding notification sent |
| `posture.finding.open` | Finding opened |
| `posture.finding.remediate` | Finding remediation run |
| `posture.finding.reopen` | Finding reopened |
| `posture.finding.resolve` | Finding resolved |
| `posture.finding.ticket` | Ticket created for finding |
| `posture.finding.update` | Finding updated |
| `posture.identity.link` | Connector account linked to person |
| `posture.identity.unlink` | Connector account unlinked from person |
| `posture.run` | Posture checks run |
| `posture.settings.update` | Posture settings updated |
| `privacy.person.erase` | Person erased from the System Log |
| `privacy.person.export` | Person's data exported |
| `security.api_token.network_denied` | API token refused from this network |
| `security.authenticator.update` | Authenticator settings updated |
| `security.behavior_detection.update` | Behavior detection settings updated |
| `security.captcha.update` | CAPTCHA settings updated |
| `security.key.retire` | Signing key retired |
| `security.key.rotate` | Signing key rotated |
| `security.log.tamper_detected` | System Log no longer matches its checkpoints |
| `security.notifications.update` | Security notification settings updated |
| `security.ssf_receiver.create` | Shared Signals receiver created |
| `security.ssf_receiver.delete` | Shared Signals receiver deleted |
| `security.ssf_receiver.update` | Shared Signals receiver updated |
| `security.ssf_stream.create` | Shared Signals stream created |
| `security.ssf_stream.delete` | Shared Signals stream deleted |
| `security.ssf_stream.rotate` | Shared Signals stream credential rotated |
| `security.ssf_stream.subject_add` | Subject added to Shared Signals stream |
| `security.ssf_stream.subject_remove` | Subject removed from Shared Signals stream |
| `security.ssf_stream.update` | Shared Signals stream updated |
| `security.ssf_stream.verify` | Shared Signals stream verified |
| `security.threat.detected` | Threat detected |
| `security.threat.response` | Threat response run |
| `security.threat_insight.refresh` | ThreatInsight feed refreshed |
| `security.threat_insight.update` | ThreatInsight settings updated |
| `security.threat_protection.update` | Identity Threat Protection settings updated |
| `security.universal_logout.delete` | Universal logout configuration deleted |
| `security.universal_logout.update` | Universal logout configuration updated |
| `security.zone.create` | Network zone created |
| `security.zone.delete` | Network zone deleted |
| `security.zone.update` | Network zone updated |
| `settings.email_template.reset` | Email template reset |
| `settings.email_template.update` | Email template updated |
| `system.account.update` | Account settings updated |
| `system.api_token.create` | API token created |
| `system.api_token.revoke` | API token revoked |
| `system.branding.update` | Branding updated |
| `system.domain.add` | Custom domain added |
| `system.domain.cookie_domain` | Cookie domain changed |
| `system.domain.primary` | Primary domain changed |
| `system.domain.remove` | Custom domain removed |
| `system.domain.verify` | Custom domain verified |
| `system.idp.domain_proof.add` | Domain ownership proof started |
| `system.idp.domain_proof.remove` | Domain ownership proof removed |
| `system.idp.domain_proof.verify` | Domain ownership verified |
| `system.idp.lifecycle.create` | Identity provider created |
| `system.idp.lifecycle.delete` | Identity provider deleted |
| `system.idp.lifecycle.update` | Identity provider updated |
| `system.idp.linking.update` | Identity provider account linking updated |
| `system.idp.routing_rule.create` | Identity provider routing rule created |
| `system.idp.routing_rule.delete` | Identity provider routing rule deleted |
| `system.idp.routing_rule.update` | Identity provider routing rule updated |
| `system.log.checkpoint` | System Log checkpoint sealed |
| `system.log.verify` | System Log integrity verified |
| `system.oauth_token.use` | Service app token used on the management API |
| `system.retention.purge` | Expired log events and jobs purged |
| `system.scim.connection.create` | SCIM connection created |
| `system.scim.connection.revoke` | SCIM connection revoked |
| `system.scim.connection.rotate` | SCIM connection token rotated |
| `system.setup.complete` | Setup guide completed |
| `system.setup.dismiss` | Setup guide dismissed |
| `system.setup.start` | Setup guide started |
| `system.setup.step_done` | Setup step completed |
| `system.setup.step_skipped` | Setup step skipped |
| `user.account.clear_sessions` | User's sessions cleared |
| `user.account.privilege.grant` | Admin role granted to user |
| `user.account.privilege.revoke` | Admin role revoked from user |
| `user.account.report_suspicious_activity_by_enduser` | User reported suspicious activity |
| `user.account.reset_authenticators` | User's authenticators reset |
| `user.account.reset_password` | User's password reset |
| `user.account.unlock` | User account unlocked |
| `user.account.update_password` | User changed their password |
| `user.account.update_profile` | User profile updated |
| `user.authentication.auth_via_mfa` | User authenticated with a factor |
| `user.device.compliance_change` | User's device compliance changed |
| `user.import.activate` | Imported people activated |
| `user.import.complete` | People import completed |
| `user.import.start` | People import started |
| `user.lifecycle.activate` | User activated |
| `user.lifecycle.create` | User created |
| `user.lifecycle.deactivate` | User deactivated |
| `user.lifecycle.delete` | User deleted |
| `user.lifecycle.reactivate` | User reactivated |
| `user.lifecycle.suspend` | User suspended |
| `user.lifecycle.unsuspend` | User unsuspended |
| `user.mfa.factor.activate` | Factor enrolled |
| `user.mfa.factor.deactivate` | Factor removed |
| `user.mfa.factor.reset_all` | All of a user's factors reset |
| `user.mfa.okta_verify.deny_push` | User denied a push challenge |
| `user.mfa.verify` | User verified with MFA |
| `user.risk.change` | User risk level changed |
| `user.risk.detect` | User risk detected |
| `user.risk.reset` | User risk reset |
| `user.session.impersonation.end` | Impersonation ended |
| `user.session.impersonation.start` | Impersonation started |
| `user.session.revoke` | User session revoked |
| `user.session.start` | User signed in |
| `user.session.universal_logout` | User signed out everywhere by universal logout |