Enabling Connector Logging in Identity Security Cloud

Overview

This set of instructions details how to enable logging in Identity Security Cloud via REST API.

Process

The process for enabling logging is as follows:

1. Identify VA Cluster - Identify the VA cluster to enable logging on.
2. Get Logging Config - Get the logging configurations for the existing VA cluster.
3. Update Logging Config - Update the VA cluster to enable logging levels.
4. Observe Logging Changes - See the changes to the logging levels.

Identify VA Cluster

First, we need to select the Virtual Appliance cluster that we intend to enable logging on. This is done by calling the following REST API:

GET /v2025/managed-clusters

If successful, this API will provide a response which looks like this:

[
{
"id": "2c9180866166b5b0016167c32ef31a66",
"name": "Development Cluster",
"description": "Development Cluster",
"clientType": "CCG",
"ccgVersion": "373_535_70.2.0",
"pinnedConfig": true,
"logConfiguration": null
},
{
"id": "2c9180846a93ce60016ab29f039944de",
"name": "Cloud Cluster",
"description": "Cloud Cluster",
"clientType": "CCG",
"ccgVersion": "373_535_70.2.0",
"pinnedConfig": true,
"logConfiguration": {
"clientId": null,
"durationMinutes": 60,
"expiration": "2020-12-15T19:13:36.079Z",
"rootLevel": "INFO",
"logLevels": {
"sailpoint.connector.ADLDAPConnector": "DEBUG"
}
}
}
]

Note: Notice in the example above how one cluster has a log configuration and the other doesn’t. This is because we’ve already set logging on one of the clusters already. This is just to illustrate examples.

Identify the cluster by name or description which you want to enable logging on. Make sure to copy the id attribute of the VA cluster you are interested in as you will use it in the next step.

Get Logging Config

Next, we’ll want to get the VA cluster’s logging config. This is done by calling:

GET /v2025/managed-clusters/{id}/log-config

Where {id} is the VA cluster ID from the Identify VA Cluster step.

If there is no logging config, then you should receive a 204 No Content response. If there is a logging config, then API will provide a response which looks like this:

{
"clientId": null,
"durationMinutes": 60,
"expiration": "2020-12-15T19:13:36.079Z",
"rootLevel": "INFO",
"logLevels": {
"sailpoint.connector.ADLDAPConnector": "DEBUG"
}
}

Where:

• durationMinutes is the number of minutes to enable the logging.
• rootLevel is the default level for all logs. See Logging Levels for more details.
• logLevels is a map object with logging classes as keys, and logging levels as values.
  • For keys, see the Logging Classes section for commonly used logging classes.
  • For values, see the Logging Levels section for more details.

This can be used in the next section to modify the existing configurations.

Update Logging Config

Next, we’ll update the VA cluster configuration to update the logging settings. The logging REST API we’ll use is the following:

PUT /v2025/managed-clusters/{id}/log-config

Where {id} is the VA cluster ID from the Identify VA Cluster step.

This API also expects a JSON body of the updated logging configuration. It can be based on the previous step, Get Logging Config if there is already a configuration you are modifying, or you can craft a new logging configuration. Either way, the JSON body should look something like this:

{
"durationMinutes": 60,
"rootLevel": "INFO",
"logLevels": {
"sailpoint.connector.ADLDAPConnector": "DEBUG"
}
}

Note: Since this is a JSON body, this API expects a Content-Type: application/json header.

Where:

• durationMinutes is the number of minutes to enable the logging. You have to give this a value.
• rootLevel is the default level for all logs. See Logging Levels for more details.
• logLevels is a map object with logging classes as keys, and logging levels as values.
  • For keys, see the Logging Classes section for commonly used logging classes.
  • For values, see the Logging Levels section for more details.

Once this is sent, we should see a response.

If successful, this API will provide a response which looks like this:

{
"clientId": null,
"durationMinutes": 60,
"expiration": "2020-12-15T19:13:36.079Z",
"rootLevel": "INFO",
"logLevels": {
"sailpoint.connector.ADLDAPConnector": "DEBUG"
}
}

At this point, there is nothing more to configure. The expiration setting should provide guidance around how long this logging change will be enabled for.

Observe Logging Changes

After you have made the logging changes to the VA cluster, it should take about 5 minutes for the updates to be picked up. Once picked up the VA logs should show the desired output in the ccg.log.

Note: These VA logging changes are not instant! They may take around 5 minutes to propagate.

Reference

Logging Levels

Available values for logging levels are as follows:

Logging Level Description

ERROR: Designates error events that might still allow the connector to continue.

WARN: Designates potentially harmful situations.

INFO: Designates information messages that highlight process at a coarse-grain level.

DEBUG: Very verbose. Fine grain logging levels used for development and debugging.

TRACE: Most verbose. Finer grain logging levels than debugging.

Note: The root level should never be set to trace.

Logging Classes

Connector

Logging Class