Each Access Manager event contains the following details:
EventID
Description
Originator Title
Target Title
Subtarget Title
Text1 Title
Text2 Title
Text3 Title
Value1 Title
Value1 Type
Group Title
Data Length
Data Type values stored.
Each field contains a single character token (such as B, U, Y, and so on) that represent the data fields of the audit event, with each letter representing a different data field. The mapping of the character tokens to data fields is found in the nids_en.lsc file. You can find this file in /etc/ folder inside AC/AG/IDP.
Audit events are device-specific. You can select events for the following devices:
Administration Console: Click Auditing.
Identity Server: Click Devices > Identity Servers > Edit > Auditing and > Logging.
Access Gateway: Click Devices > Access Gateways > Edit > Auditing.
Topics include:
NIDS: Logged Out an Authentication that Was Provided to a Remote Consumer (002e0007)
NIDS: Provided an Authentication to a Remote Consumer (002e0009)
NIDS: Failed to Provide an Authentication to a Remote Consumer (002e000b)
NIDS: Connection to User Store Replica Reestablished (002e0013)
NIDS: Brokered an Authentication from Identity Provider to Service Provider (002E001C)
NIDS: Web service Request for authentication Failed (002e001E)
NIDS: OAuth2 client has been registered successfully (002e0036)
NIDS: OAuth2 client has been modified successfully (002e0037)
NIDS: OAuth2 client has been deleted successfully (002e0038)
Access Gateway: Identity Injection Policy Evaluation (002e0323)
Access Gateway: Form Fill Authentication Failed (0x002e050f)
Access Gateway: All WebServers for a Service is Down (0x002e0516)
Management Communication Channel: Health Change (0x002e0601)
Management Communication Channel: Device Imported (0x002e0602)
Management Communication Channel: Device Deleted (0x002e0603)
Management Communication Channel: Device Configuration Changed (0x002e0604)