Sign-In Log

The sign-in log answers three questions: who signed in, from where, and what failed. It is written for every organization and no license is needed for it.

Where to find it

  • Employees > Sign-in log shows the entries of everyone.

  • The Sign-in history tab on an employee’s record shows the entries of that employee only.

Both screens show the same columns and offer the same filters, except that the employee’s own tab leaves out the filters for Employee and Login or identifier.

Who may open it

The role editor has an entity Sign-in log with the actions View and Export. It is granted for the whole organization only. Export includes View.

No role has this permission until an administrator grants it. Grant Sign-in log to the roles of the people who audit sign-ins, for example your security or IT staff. The main administrator sees the log without a grant. An employee who has no grant cannot see their own history.

For how to edit roles, see Roles & Permissions.

What is recorded

The log records every sign-in at every entry point, every failed check of a password, code, token or secret, and every block of repeated failures. It also records every sign-out, every session that expires or is ended by an administrator, every password change, reset request and reset, and every set-up, removal and method change of two-step verification.

The log shows the sign-in that created a session, and it shows every refusal.

Entries are never edited. They stay in the log until the retention period has passed.

Columns

Column What it shows

Time

When the event happened.

Event

The event type with Success or Failure. Below it come the failure reason, Blocked for N min for a block, and By with the name of the administrator who acted. A ×N badge means that N events were merged into this entry.

User

The employee, LDAP consumer or OAuth application the event is about, with a link to the employee. When no account matched, the login as typed is shown instead, and Not identified appears when nothing was presented.

Entry point

Where the credential was presented, with the kind of credential below it.

Source

The source IP address and a short name of the client program.

Event types

Event When it is recorded

Sign-in

A credential was presented and accepted or refused.

Sign-in blocked

Repeated failures started a block, see Blocking repeated failed sign-ins.

Sign-out

An employee logged out, ended one of their own sessions, or confirmed a sign-out that a connected application asked for.

Session ended by an administrator

An administrator ended a session of an employee.

Session expired

A session reached the end of its duration, or ended because the password expired.

Password changed

An employee changed their own password.

Password reset requested

A reset link was requested by the employee or sent by an administrator.

Password reset

A new password was set with a reset link.

Verification code sent

A code was mailed at sign-in or to turn on two-step verification.

Two-step verification set up

Two-step verification by e-mail code was turned on, backup codes were generated, or an authenticator app was confirmed.

Two-step verification removed

Two-step verification by e-mail code was turned off, or backup codes or an authenticator app were removed.

Two-step verification methods changed

The employee or an administrator chose other sign-in code methods.

Events dropped

Some events could not be recorded. The ×N badge gives their number.

Failure reasons

Reason Meaning

Unknown login

No account has the login as typed.

No employee for this account

The account exists without an employee record.

Organization disabled, Account disabled

The organization or the account is deactivated.

Password not accepted at this entry point

The password is right, but this entry point does not take it, for example the account password over LDAP for an employee who has two-step verification.

Wrong password or secret

The password or secret does not match.

Wrong verification code

A code or backup code was wrong, already used or expired.

Blocked after repeated failures

The attempt came during a block and the credential was not checked.

Attempt limit check unavailable

The attempt limit check could not run, so the attempt was refused without checking the credential.

Unknown token, Token expired

The token is not known, or its lifetime is over.

Not licensed

The credential belongs to a function that your license does not include.

Credential not accepted at this entry point

The credential is valid but is not taken here.

Token issued for another service

An OAuth access token is bound to another resource than the one it was presented to.

Token lacks the scope api

An OAuth access token given on an employee’s behalf and without the scope api was presented where that scope is required.

Password expired

The password was right and has expired. At web sign-in this leads to the new-password step.

Entry points and credentials

Entry point is where a credential was presented:

  • Web login

  • OAuth login form

  • LDAP bind

  • HTTP Basic

  • REST API

  • OAuth token endpoint

  • OAuth end-session endpoint

Credential is what was presented:

  • Password

  • LDAP consumer secret

  • Session token

  • Personal access token

  • Client secret

  • OAuth access token

  • Authorization code

  • OAuth refresh token

  • App password

  • E-mail code

  • Authenticator code

  • Backup code

Merged entries

Failures that name no account, such as unknown or expired tokens, are merged into one entry with the badge ×N. Every failure that presents a login or names an account keeps its own entry.

Filters

Open Filters above the list, set the fields and choose Apply Filter. Clear Filters resets them.

Filter What it matches

Employee

One or more employees.

Login or identifier

Part of the login as typed, in any letter case.

From, To

A period of days. The last day is included.

Event, Result, Failure reason, Entry point

One value of each list above.

Source address

A whole IP address.

How long entries are kept

The sign-in log is always written. Keep sign-in log for (days) in Settings > General sets how long entries are kept, from 90 to 3650 days, and the default is 365. Older entries are deleted automatically.

For all settings of this tab see Organization Settings.

Exporting

Export writes the entries that match the current filters to an XLSX file, which appears in Settings > Export Jobs as Sign-in log. A file holds at most 100,000 rows.

Choose Apply Filter first, because the export follows the filters that are applied. It needs the Export action. The button is also on the Sign-in history tab of an employee, where it exports the entries of that employee.

When more than 100,000 entries match, the export is refused with "Too many events to export: N, at most 100000. Narrow the search."

The file has one row per entry, the latest first, with these columns:

Column Content

Time (UTC)

The time in ISO 8601, in UTC.

Event, Result, Failure reason, Entry point, Credential

The values as fixed codes, for example WRONG_CREDENTIAL.

Principal type, Principal ID, Principal

Kind, ID and name of the employee, LDAP consumer or OAuth application the event is about.

Identifier

The login as typed.

Actor ID, Actor

ID and name of the administrator who acted.

Source address, User agent

The source IP address and the client program.

Block, minutes

The length of a block.

Attempts

The number of merged events in the row.

The column headings follow the interface language of the person who exports.

For integrators

The log is available over the REST API with the same permissions as the screens.

  • GET /authentication-events lists entries, the latest first. The search parameter accepts the keys occurredAt (epoch milliseconds, with >= and ⇐ for ranges), type, result, failureReason, entryPoint, credential, principalKind, principalId, identifier (contains, any letter case) and sourceAddress.

  • GET /authentication-events/{id} returns one entry.

  • POST /authentication-events/export starts an export with the same search and an optional fileName, and answers with an exportId that you follow under /export-jobs/{exportId}.

Related pages