Audits and logs

For security, troubleshooting, and regulatory compliance, agents are able to audit information for allowed and/or denied requests.

The agent audit logging service adheres to the log structure common across the Ping Identity Platform. Learn more in Audit the deployment.

Web Agent supports propagation of the transaction ID across the Ping Identity Platform, using the HTTP header X-ForgeRock-TransactionId. Consider configuring this header to prevent malicious actors from flooding the system with requests using the same transaction ID header to hide their tracks. Learn more in Trust transaction headers in AM’s Security guide.

Agent logs contain informational, error, and warning events, to troubleshoot and debug transactions and events that take place within the agent instance.

Protect logs from unauthorized access, and make sure they contain a minimum of sensitive or personally identifiable information that could be used in attacks.

Make sure Agent Debug Level is set to the lowest level of logging necessary. For example, consider logging at the ERROR or WARNING level, instead of TRACE or MESSAGE. Learn more in logging configuration properties.

The SSL key log file contains potentially sensitive TLS transaction data. Protect this file from unauthorized access.

Only enable TLS logging when troubleshooting TLS issues between the agent and AM, and remove the SSL key log file after you have completed troubleshooting. Learn more in TLS key logging.