Audit Logs: Overview
This is an overview of all available audit logs.
Log reference
The following is a list of all event logs that the system may issue. For more details about each log event, what attributes that the event may provide etc, follow the link for the event. For information about the legacy logs, see the article Events and Logging
| Log id | Description | Severity |
|---|---|---|
| auth_authenticators_anonymousassignment_failed | An event that signals a user authentication with AnonymousAssignmentAgnostic has failed. | 6 WARNING |
| auth_authenticators_anonymousassignment_successful | An event that signals an anonymous assignment authenticator has been successfully executed. | 4 NOTICE |
| auth_authenticators_assignment_failed | An event that signals a user authentication with AssignmentAgnostic has failed. | 6 WARNING |
| auth_authenticators_assignment_successful | An event that signals an assignment authenticator has been successfully executed. | 4 NOTICE |
| auth_authenticators_authselector_selected | An event that signals an authenticator has been selected in the AuthSelector list of authenticators | 4 NOTICE |
| auth_authenticators_authselector_successful | An event that signals an authenticator selected in the AuthSelector list of authenticators has been successfully executed | 4 NOTICE |
| auth_authenticators_bankid_failed | An event that signals a user authentication with BankIDAuthenticator has failed. | 6 WARNING |
| auth_authenticators_bankid_successful | An event that signals a BankID authenticator has been successfully executed. | 4 NOTICE |
| auth_authenticators_dispatch_selected | An event that signals that the dispatch expressions have been parsed and an authenticator to continue executing has been selected | 3 INFO |
| auth_authenticators_dispatch_successful | An event that signals an authenticator directed to by this dispatch has been successfully executed | 4 NOTICE |
| auth_authenticators_dynamic_failed | An event that signals a user authentication with a dynamic authenticator has failed | 6 WARNING |
| auth_authenticators_dynamic_rerouted | An event that signals a user was rerouted (usually for mTLS purposes) via the DynamicAuthenticator | 3 INFO |
| auth_authenticators_dynamic_successful | An event that signals a user authentication with a dynamic authenticator was successful | 4 NOTICE |
| auth_authenticators_fido_failed | An event that signals a user authentication with FIDO has failed | 6 WARNING |
| auth_authenticators_fido_successful | An event that signals a user authentication with FIDO was successful | 4 NOTICE |
| auth_authenticators_freja_failed | An event that signals a user authentication with Freja has failed. | 6 WARNING |
| auth_authenticators_freja_successful | An event that signals a user authentication with Freja was successful. | 4 NOTICE |
| auth_authenticators_nias_failed | An event that signals a user authentication with NetID Access Server (Nias) has failed. | 6 WARNING |
| auth_authenticators_nias_successful | An event that signals a user authentication with NetID Access Server (Nias) was successful. | 4 NOTICE |
| auth_authenticators_relay_failed | An event that signals a user authentication with RelayAuthenticator has failed. | 6 WARNING |
| auth_authenticators_relay_session_created | An event that signals a relay session was created by a relay authenticator | 4 NOTICE |
| auth_authenticators_relay_successful | An event that signals a user authentication RelayAuthenticator was successful. | 4 NOTICE |
| auth_authenticators_rpbroker_auth_started | An event that signals the auth request to the OP has been sent | 3 INFO |
| auth_authenticators_rpbroker_failed | An event that signals a user authentication with the RPBroker authenticator has failed | 6 WARNING |
| auth_authenticators_rpbroker_successful | An event that signals a user authentication with RPBroker was successful | 4 NOTICE |
| auth_authenticators_rpbroker_token_started | An event that signals the token fetch from RPBroker has started | 3 INFO |
| auth_authenticators_rpbroker_userinfo | An event that signals the userinfo fetch from RPBroker has started | 3 INFO |
| auth_authenticators_sequence_successful | An event that signals a user authentication with a SequenceAuthenticator was successful | 4 NOTICE |
| auth_authenticators_siths_failed | An event that signals a user authentication with Siths eID has failed. | 6 WARNING |
| auth_authenticators_siths_successful | An event that signals a user authentication with Siths eID was successful. | 4 NOTICE |
| auth_authenticators_spbroker_auth_started | An event that signals a SAML AuthnRequest has been sent to the IdP | 3 INFO |
| auth_authenticators_spbroker_failed | An event that signals a user authentication with the SPBroker authenticator has failed | 6 WARNING |
| auth_authenticators_spbroker_successful | An event that signals a user authentication with SPBroker was successful | 4 NOTICE |
| auth_authenticators_ssoperformed | An event that signals that SSO has been performed and the authenticator has been skipped with loaded state. | 4 NOTICE |
| auth_authenticators_winsso_failed | An event that signals a user authentication with the WindowsSSO authenticator has failed | 6 WARNING |
| auth_authenticators_winsso_successful | An event that signals a user authentication with WindowsSSO was successful | 4 NOTICE |
| auth_authenticators_winsso_used_fallback | An event that signals a user authentication with WindowsSSO was unsuccessful, used fallback authenticator instead | 4 NOTICE |
| auth_entrypoints_baduseragent_relaycreated | An outdated browser has been detected that does not support modern javascript. To complete authentication a relay session was created.. | 6 WARNING |
| auth_entrypoints_internal_auth_started | An internal authentication has been initialized | 3 INFO |
| auth_entrypoints_internal_auth_successful | An internal authentication has been successful | 4 NOTICE |
| auth_entrypoints_oidc_auth_failed | An OIDC / OAuth authentication has failed | 6 WARNING |
| auth_entrypoints_oidc_auth_started | A new OIDC / OAuth Authentication flow has started | 3 INFO |
| auth_entrypoints_oidc_auth_successful | An OIDC / OAuth Authentication has been successfully completed | 4 NOTICE |
| auth_entrypoints_oidc_client_auth_failed | An OIDC / OAuth client authentication has failed | 6 WARNING |
| auth_entrypoints_oidc_consent_accepted | OIDC Consent has been accepted by the user | 3 INFO |
| auth_entrypoints_oidc_consent_declined | OIDC Consent has been declined by the user | 6 WARNING |
| auth_entrypoints_oidc_consent_prompted | OIDC Consent has been prompted to the user | 3 INFO |
| auth_entrypoints_oidc_introspection_performed | An OIDC / OAuth token introspection has been performed | 3 INFO |
| auth_entrypoints_oidc_logout | An OIDC Logout has been performed | 4 NOTICE |
| auth_entrypoints_oidc_logout_backchannel_request | An OIDC backchannel logout request has been sent | 3 INFO |
| auth_entrypoints_oidc_revocation_performed | An OIDC / OAuth token revocation has been performed | 4 NOTICE |
| auth_entrypoints_oidc_token_failed | An OIDC / OAuth token endpoint fetch has failed | 6 WARNING |
| auth_entrypoints_oidc_token_success | An OIDC / OAuth token endpoint fetch has succeded | 3 INFO |
| auth_entrypoints_oidc_userinfo_failed | An OIDC user info endpoint request has failed (invalid access token) | 6 WARNING |
| auth_entrypoints_oidc_userinfo_successful | An OIDC user info endpoint request has been successful | 3 INFO |
| auth_entrypoints_relay_alreadyclaimed | The relay authentication session has already been claimed | 3 INFO |
| auth_entrypoints_relay_consentgiven | Consent has been given from the user for the relay authentication session | 3 INFO |
| auth_entrypoints_relay_incorrectotp | The relay authentication session has been successfully finished | 3 INFO |
| auth_entrypoints_relay_stateupdated | The state for a relay authentication session has been updated | 3 INFO |
| auth_entrypoints_relay_successful | The relay authentication session has been successfully finished | 4 NOTICE |
| auth_entrypoints_saml_auth_failed | A SAML Authentication has failed | 6 WARNING |
| auth_entrypoints_saml_auth_started | A new SAML Authentication flow has started | 3 INFO |
| auth_entrypoints_saml_auth_successful | A SAML Authentication has been successfully completed | 4 NOTICE |
| auth_entrypoints_saml_logout_chain_request | A SAML SLO chain request has started | 3 INFO |
| auth_entrypoints_saml_logout_chain_response | A SAML SLO chain response has been received | 3 INFO |
| auth_entrypoints_saml_logout_started | A SAML Logout has started | 3 INFO |
| auth_entrypoints_saml_logout_successful | A SAML Logout has finished successfully | 4 NOTICE |
| auth_logout_external | An external logout request has been sent to an identity provider | 4 NOTICE |
| auth_logout_local | A user has logged out and their session has been destroyed. | 4 NOTICE |
| auth_samlsp_logoutreceived | A SAML SP received a logout request and ended the session | 3 INFO |
| core_bankid_auth_started | An event that signals that a BankID Auth transaction has started | 4 NOTICE |
| core_bankid_cancelled | An event that signals that a BankID transaction has been cancelled | 4 NOTICE |
| core_bankid_failed | An event that signals that a BankID transaction has failed | 6 WARNING |
| core_bankid_phoneauth_started | An event that signals that a BankID PhoneAuth transaction has started | 4 NOTICE |
| core_bankid_phonesign_started | An event that signals that a BankID PhoneSign transaction has started | 4 NOTICE |
| core_bankid_sign_started | An event that signals that a BankID Sign transaction has started | 4 NOTICE |
| core_bankid_success | An event that signals that a BankID transaction has completed successfully | 4 NOTICE |
| core_certificate_validationfailed | An event that signals that a certificate validation has failed | 6 WARNING |
| core_client_device_rooteddevicedetected | A client device, running ex. One Touch, that has been rooted was detected | 4 NOTICE |
| core_freja_auth_started | An event that signals that a Freja eID auth transaction has started | 4 NOTICE |
| core_freja_cancelled | An event that signals that a Freja transaction has been cancelled | 4 NOTICE |
| core_freja_failed | An event that signals that a Freja transaction has failed | 6 WARNING |
| core_freja_sign_started | An event that signals that a Freja sign transaction has started | 4 NOTICE |
| core_freja_success | An event that signals that a Freja transaction has completed successfully | 4 NOTICE |
| core_internaluser_passwordchanged | An event that signals an internal users password was changed | 4 NOTICE |
| core_nias_auth_started | An event that signals that a NiAS auth transaction has started | 4 NOTICE |
| core_nias_failed | An event that signals that a Nias transaction has failed | 6 WARNING |
| core_nias_sign_started | An event that signals that a NiAS sign transaction has started | 4 NOTICE |
| core_nias_success | An event that signals that a NiAS transaction has completed successfully | 4 NOTICE |
| core_server_config_updated | An event that signals the server configuration has been updated by a user. | 4 NOTICE |
| core_server_events_purged | An event that signals that events were purged. | 4 NOTICE |
| core_server_license_expired | An event that signals the license in use has expired. | 10 EMERGENCY |
| core_server_run_started | An event that signals the server has started. | 4 NOTICE |
| core_server_run_startfailed | An event that signals the server has failed to start. | 10 EMERGENCY |
| core_server_run_starting | An event that signals the server is starting. | 4 NOTICE |
| core_server_run_stopped | An event that signals the server has stopped. | 4 NOTICE |
| core_server_schedule_done | An event that signals a scheduled job has been performed. | 4 NOTICE |
| core_server_schedule_failed | An event that signals a scheduled job has failed. | 7 ERROR |
| core_siths_auth_started | An event that signals that a SITHs eID auth transaction has started | 4 NOTICE |
| core_siths_cancelled | An event that signals that a SITHs eID transaction has been cancelled | 4 NOTICE |
| core_siths_failed | An event that signals that a SITHs eID transaction has failed | 6 WARNING |
| core_siths_sign_started | An event that signals that a SITHs eID sign transaction has started | 4 NOTICE |
| core_siths_success | An event that signals that a SITHs eID transaction has completed successfully | 4 NOTICE |
| core_token_checkin | A token checkin was done (ex. One Touch has retrieved the pending assignment(s) | 3 INFO |
| core_token_hardware_assignedtouser | An event that signals that a hardware token has been assigned to a user | 4 NOTICE |
| core_token_hardware_unassignedfromuser | An event that signals that a hardware token has been unassigned from a user | 4 NOTICE |
| eaptlsradius_authenticators_failed | An event that signals an EAP TLS RADIUS authentication failed | 6 WARNING |
| eaptlsradius_authenticators_onetouch_successful | An event that signals an EAP TLS RADIUS username, password and OneTouch authentication was successful | 4 NOTICE |
| eaptlsradius_authenticators_successful | An event that signals an EAP TLS RADIUS authentication was successful | 4 NOTICE |
| hwtoken_imported | An event that signals a hardware token was imported. | 4 NOTICE |
| messagingapns_certificate_expired | An event that signals a certificate used for push notifications has expired. | 8 CRITICAL |
| messagingapns_certificate_notyetvalid | An event that signals a certificate used for push notifications is not yet valid. | 8 CRITICAL |
| messagingapns_certificate_warning | An event that signals a certificate used for push notifications is about to expire. | 6 WARNING |
| neotp_failure | An event that signals a failed OTP response. | 6 WARNING |
| neotp_success | An event that signals a successful OTP response. | 4 NOTICE |
| oidc_discovery_failed | An event that signals that OIDC Discovery data has failed to load. | 6 WARNING |
| oidc_discovery_loaded | An event that signals that OIDC Discovery data has loaded. | 3 INFO |
| oidc_idtoken_failed | An event that signals that an OIDC id token has failed validation. | 6 WARNING |
| oidc_idtoken_validated | An event that signals that an OIDC id token has been successfully validated. | 4 NOTICE |
| pipes_authentication_failed_incrementlockcounter | Authentication failed, lockout counter has incremented | 4 NOTICE |
| pipes_authentication_failed_incrementlogincounter | Authentication failed, lockout counter has incremented | 4 NOTICE |
| pipes_authentication_failed_locked_permanently | Authentication failed, user is now permanently locked | 6 WARNING |
| pipes_authentication_failed_locked_temporarily | Authentication failed, user is now temporarily locked | 4 NOTICE |
| pipes_database_connection_established | Database connection established | 3 INFO |
| pipes_database_connection_failed | Database connection failed | 6 WARNING |
| pipes_http_request_delivered | Http request has been delivered | 3 INFO |
| pipes_mail_delivered | Mail (SMTP) has been delivered | 4 NOTICE |
| pipes_mail_failed | Mail (SMTP) has failed to deliver | 4 NOTICE |
| pipes_otp_delivery_failed | OTP delivery failed | 6 WARNING |
| pipes_otp_delivery_success | OTP delivery success | 4 NOTICE |
| pipes_otp_validation_failed | OTP validation failed | 4 NOTICE |
| pipes_otp_validation_success | OTP validation success | 4 NOTICE |
| pipes_pdf_signed | A PDF file has been signed | 4 NOTICE |
| pipes_pipe_failure | Pipe failed | 6 WARNING |
| pipes_pipe_success | Pipe executed succesfully | 4 NOTICE |
| pipes_sms_delivered | SMS has been delivered | 4 NOTICE |
| pipes_sms_failed | SMS has failed to deliver | 4 NOTICE |
| pipes_token_autoenrolled | A hardware token was auto enrolled | 4 NOTICE |
| pipes_token_consumed | Prefetch token removed, all codes used up | 4 NOTICE |
| pipes_token_revoked | A token was revoked | 4 NOTICE |
| pipes_token_validation_failed | Token validation failed | 4 NOTICE |
| pipes_token_validation_success | Token validation success | 3 INFO |
| pipes_valve_failure | Valve failed | 6 WARNING |
| pipes_valve_success | Valve executed succesfully | 4 NOTICE |
| pipes_xml_signed | An XML file has been signed | 4 NOTICE |
| pki_onetouch_anonymousassignment_registered | A OneTouch anonymous assignment has been registered and tied to a user | 3 INFO |
| pki_onetouch_assignment_created | OneTouch authentication started | 3 INFO |
| pki_onetouch_assignment_rejected | OneTouch assignment rejected | 6 WARNING |
| pki_onetouch_assignment_successful | OneTouch authentication successful | 4 NOTICE |
| pki_onetouch_incorrectpincode | A OneTouch incorrect pincode attempt has been made | 4 NOTICE |
| pki_onetouch_profile_activatebiometric | A OneTouch profile has had biometric authentication activated which may sometimes be used instead of a pin code | 4 NOTICE |
| pki_onetouch_profile_activated | A OneTouch profile has now been activated and is ready for use | 4 NOTICE |
| pki_onetouch_profile_created | A OneTouch profile has been created and now needs to be activated | 4 NOTICE |
| pki_onetouch_profile_deleted | A OneTouch profile has been deleted | 6 WARNING |
| pki_onetouch_profile_pinupdated | A OneTouch profile has had its pincode updated | 4 NOTICE |
| pkienroll_failed | An event that signals a PKI enrollment has failed. | 4 NOTICE |
| pkienroll_started | An event that signals a PKI enrollment has been started. | 4 NOTICE |
| prism_enrolloath_tokenactivated | An event that signals an OATH token has been activated. | 4 NOTICE |
| prism_enrollpki_tokenactivated | An event that signals a PKI token has been activated (through legacy portal). | 4 NOTICE |
| prism_fido_enrolled | An event that signals a FIDO token has been enrolled for a user. | 4 NOTICE |
| prism_fido_removed | An event that signals a FIDO token has been removed for a user. | 4 NOTICE |
| prism_myapps_application_accessdenied | An event that signals that access has been denied to an application. | 6 WARNING |
| prism_myapps_application_accessgranted | An event that signals that access has been granted to an application. | 4 NOTICE |
| prism_pwdreset_failed | An event that signals that a password reset has failed. | 6 WARNING |
| prism_pwdreset_success | An event that signals that a password reset has been successful. | 4 NOTICE |
| prism_token_activated | An event that signals a token has been activated. | 4 NOTICE |
| prism_token_deactivated | An event that signals a token has been deactivated. | 4 NOTICE |
| prism_token_enrolled | An event that signals a token has been enrolled. | 4 NOTICE |
| prism_token_enrolledandactivated | An event that signals a token has been enrolled and activated. | 4 NOTICE |
| prism_token_revoked | An event that signals that a token has been revoked. | 4 NOTICE |
| prism_user_locked | An event that signals a user has been locked. | 6 WARNING |
| prism_user_unlocked | An event that signals a user has been unlocked. | 4 NOTICE |
| radius_authenticators_failed | An event that signals a RADIUS authentication failed | 6 WARNING |
| radius_authenticators_onetouch_failed | An event that signals a RADIUS username, password & OneTouch authentication has failed | 6 WARNING |
| radius_authenticators_onetouch_successful | An event that signals a RADIUS username, password & OneTouch authentication was successful | 4 NOTICE |
| radius_authenticators_usernamepassword_successful | An event that signals a RADIUS username & Password authentication was successful | 4 NOTICE |
| radius_authenticators_usernamepasswordotp_successful | An event that signals a RADIUS username, password and OTP authentication was successful | 4 NOTICE |
| radiusproxy_authenticators_onetouch_failed | An event that signals a RADIUS proxy & OneTouch authentication has failed | 6 WARNING |
| radiusproxy_authenticators_onetouch_successful | An event that signals a RADIUS proxy & OneTouch authentication was successful | 4 NOTICE |
| radiusproxy_authenticators_passthrough_failed | An event that signals a RADIUS proxy passthrough authentication failed | 6 WARNING |
| radiusproxy_authenticators_passthrough_ok | An event that signals a RADIUS proxy passthrough was done successfully - another operation will follow | 4 NOTICE |
| radiusproxy_authenticators_passthrough_started | An event that signals a RADIUS proxy authentication started | 4 NOTICE |
| saml_incoming_assertion_failed | An event that signals that an incoming assertion has failed validation. | 6 WARNING |
| saml_incoming_assertion_success | An event that signals that an incoming assertion has been validated. | 4 NOTICE |
| saml_incoming_authnrequest_failed | An event that signals that an incoming AuthnRequest has failed to be validated. | 6 WARNING |
| saml_incoming_authnrequest_success | An event that signals that an incoming AuthnRequest has been successfully validated. | 3 INFO |
| saml_incoming_logoutrequest_failed | An event that signals that an incoming LogoutRequest has failed to be validated. | 6 WARNING |
| saml_incoming_logoutrequest_success | An event that signals that an incoming LogoutRequest has been successfully validated. | 3 INFO |
| saml_incoming_logoutresponse_failed | An event that signals that an incoming LogoutResponse has failed to be validated. | 6 WARNING |
| saml_incoming_logoutresponse_success | An event that signals that an incoming LogoutResponse has been successfully validated. | 3 INFO |
| saml_metadata_failed | An event that signals that SAML Metadata has failed to load. | 6 WARNING |
| saml_metadata_loaded | An event that signals that SAML Metadata has loaded. | 3 INFO |
| saml_outgoing_assertion_failed | An event that signals that an outgoing assertion has failed to be created. | 4 NOTICE |
| saml_outgoing_assertion_success | An event that signals that an outgoing assertion has been created. | 3 INFO |
| saml_outgoing_authnrequest_failed | An event that signals that an outgoing AuthnRequest has failed to be created. | 4 NOTICE |
| saml_outgoing_authnrequest_success | An event that signals that an outgoing AuthnRequest has been created. | 3 INFO |
| saml_outgoing_logoutrequest_failed | An event that signals that an outgoing LogoutRequest has failed to be created. | 4 NOTICE |
| saml_outgoing_logoutrequest_success | An event that signals that an outgoing LogoutRequest has been successfully created. | 3 INFO |
| saml_outgoing_logoutresponse_failed | An event that signals that an outgoing LogoutResponse has failed to be created. | 6 WARNING |
| saml_outgoing_logoutresponse_success | An event that signals that an outgoing LogoutResponse has been successfully created. | 3 INFO |
| schedule_scheduledjob_failed | An event that signals a scheduled job has failed. | 7 ERROR |
| schedule_scheduledjob_performed | An event that signals a scheduled job has been performed. | 3 INFO |
| shared_csrf_failed | An event that signals a Cross Site Request Forgery (CSRF) Token could not be verified | 3 INFO |
| shared_legacy_onetouch_enrolled | A user has enrolled via OneTouch v1 | 4 NOTICE |
| shared_legacy_userauthentication_failed | Legacy user authentication has failed | 6 WARNING |
| shared_legacy_userauthentication_success | Legacy user authentication successful | 4 NOTICE |
| store_cluster_migration_completed | Migration between cluster members of the store has been completed | 4 NOTICE |
| store_cluster_migration_failed | Migration between cluster members of the store has failed | 8 CRITICAL |
| store_cluster_migration_started | Migration between cluster members of the store has been started | 4 NOTICE |
| store_config_apicall | The configuration store's external API has been called | 3 INFO |
| store_server_cluster_joined | An event that signals the server node has joined a cluster. | 4 NOTICE |
| store_server_cluster_left | An event that signals the server node has left a cluster. | 4 NOTICE |
| store_server_config_reloaded | An event that signals the server configuration has been reloaded. | 4 NOTICE |
| store_server_config_reloadfailed | An event that signals the server configuration has failed to reload. | 9 ALERT |