Logging for the Cloud Authentication ServiceLogging for the Cloud Authentication Service

SecurID generates log messages for the following components:

Cloud Authentication Service (user, admin, and system events)
Identity router deployed in your virtual environment
SecurID app

Logs for the Cloud Authentication ServiceLogs for the Cloud Authentication Service

The Cloud Authentication Service generates messages for user and system events automatically, without configuration. For example:

A user event message is generated when an access policy requires a user to provide additional authentication credentials, or when an authentication is unsuccessful.
A system event message is generated when the Cloud Authentication Service purges users who were pending deletion.
An audit log message is generated by the Cloud Administration Console that describes a Super Admin activity.

You can view the messages through the User Event Monitor and System Event Monitor in the Cloud Administration Console. For a complete list of event messages, see:

For a complete list of administration log messages, see:

Administration Log Messages for the Cloud Authentication Service

Logs for the Identity RouterLogs for the Identity Router

SecurID provides the following identity router logs:

The audit log captures real-time audit events (user, system, or both) on the identity router. Use the audit log to review errors and notifications about application portal sign-in, additional authentication, or user attempts to access protected applications. You can configure SecurID to send all audit logs to a syslog server, where they are consolidated from all identity routers and are easy to access. For instructions, see Configure Audit Logging in the Cloud Administration Console.
The system log captures real-time system data on the identity router. Use this log to troubleshoot or debug identity router issues such as problems connecting to an LDAP directory server, or problems integrating SecurID with a new application.
The RADIUS logs capture real-time audit events for the built-in RADIUS server on the identity router if RADIUS is enabled. Use these logs to review errors and notifications about RADIUS authentication and communication with RADIUS clients. The /var/log/radius directory of the identity router log bundle contains the RADIUS log files (radius.log, radiusj.log, and radius-audit.log).

Note: radius.log is deprecated and contains only older log events. symplified.log contains all new RADIUS authentication events.

You can generate and download a bundle of identity router logs, which includes the audit, system, and RADIUS logs, and other logs and configuration files. For in-depth troubleshooting, you can temporarily enable debug-level logging, and then generate and download the log data collected during the period of debug-level logging. Debug-level logging is not available for RADIUS. For more information, see Identity Router Logging.

Logs for the SecurID AppLogs for the SecurID App

The SecurID app generates logs on the users' devices. Log messages are generated automatically by app and user events for registration and additional authentication.

Users can email the log files from the More screen.