title: Log Analysis & Diagnostics category: Troubleshooting tags: troubleshooting, logs, diagnostics, errors, debugging priority: Normal

Log Analysis & Diagnostics

This guide explains how to use IdentityCenter's logging and diagnostic tools to identify, investigate, and resolve issues. Effective log analysis is the foundation of all troubleshooting.

The Logging Page

Navigate to /admin/logging to access the centralized log viewer. The Logging page provides:

• Real-time log entries from all application components
• Filtering by log level, date range, and source component
• Full-text search across log messages
• Export functionality for support tickets

Log Levels

IdentityCenter uses standard .NET log levels, from most verbose to least:

Important: The default production configuration logs at the Information level and above. This provides a good balance between visibility and performance.

Filtering Logs

By Level

Select one or more log levels to display. Common filter strategies:

By Date Range

1. Set the Start Date and End Date to narrow results to the time window of interest
2. For recent issues, use the quick-select buttons (Last Hour, Last 24 Hours, Last 7 Days)
3. When investigating a specific sync run failure, use the run's start and end timestamps

By Source Component

Logs are tagged with the source component that generated them. Common components:

Searching Log Messages

Use the search bar on the Logging page to find entries containing specific text:

• Error codes: Search for specific LDAP error codes like LdapException or CONSTRAINT_ATT_TYPE
• Object identifiers: Search for a specific object's DN or GUID to trace its processing
• Method names: Search for FastBulkUpsertObjectsAsync to find bulk operation logs
• Exception types: Search for TimeoutException, SqlException, or LdapException

Search tips:

• Searches are case-insensitive
• Use specific terms to reduce noise (e.g., LDAP timeout dc01 instead of just timeout)
• Combine search with level filters for best results

Common Error Patterns

Database Errors

LDAP Errors

Application Errors

Exporting Logs for Support Tickets

When contacting support, export relevant logs:

1. Navigate to /admin/logging
2. Filter to the relevant time window and log levels (include at least Warning, Error, and Critical)
3. Click Export to download the filtered log entries
4. Attach the exported file to your support ticket

What to include in a support ticket:

Log Retention Policies

Log retention is configured in LoggingSettings within the Configuration Center:

Recommendations by environment:

Tip: If you need to retain logs longer for compliance, consider forwarding them to an external SIEM or log aggregation system before they are purged.

Application Logs vs. Audit Logs vs. Sync Logs

IdentityCenter maintains three distinct log types. Knowing which to check saves time:

When to Check Each

• "The sync failed" -- Start with Sync Audit Logs for the specific run, then check Application Logs for detailed error messages
• "Settings changed unexpectedly" -- Check Change Audit Logs to see who modified the configuration
• "The application is slow" -- Check Application Logs for Warning-level entries about slow queries or timeouts
• "Email notifications stopped" -- Check Application Logs filtered to the EmailQueueProcessingJob component
• "A user lost access" -- Check Change Audit Logs for recent changes, then Sync Audit Logs for any sync-related modifications

Adjusting Log Verbosity for Debugging

When you need more detail to diagnose an issue:

Step 1: Increase Verbosity

1. Navigate to Administration > Configuration > Logging Settings
2. Set the log level for the relevant component to Debug or Trace
3. Save the configuration

Step 2: Reproduce the Issue

1. Perform the action that triggers the error
2. Note the exact time for log filtering

Step 3: Capture the Logs

1. Navigate to /admin/logging
2. Filter to the time window and the Debug/Trace levels
3. Export the results

Step 4: Reset Verbosity

1. Return to Logging Settings
2. Set the component back to Information (the production default)
3. Save the configuration

Important: Do not leave Debug or Trace level enabled in production. These levels generate a high volume of log entries that can impact database performance and fill storage quickly.

The Sync Audit Logs Page

Navigate to /admin/sync-project-runs for sync-specific diagnostics:

1. View all sync runs with status, duration, and object counts
2. Click a run to see step-by-step execution details
3. View per-object errors for failed items
4. Compare successful and failed runs side by side

Key fields in sync run details:

Best Practices

1. Review Error and Critical logs daily -- Set up a routine to check for new errors each morning
2. Do not leave Debug level enabled in production -- It generates excessive data and impacts performance
3. Use specific filters -- Broad searches through all logs are slow and produce too much noise
4. Correlate timestamps -- When investigating an issue, align timestamps across Application Logs, Sync Logs, and any external system logs
5. Archive before purging -- Export important logs before they reach the retention cutoff
6. Set up alerts -- Configure notifications for Critical-level log entries so you are informed immediately

Next Steps

• Common Issues & Solutions
• Troubleshooting Sync Errors
• Troubleshooting Connection Issues
• Performance Tuning
• Troubleshooting Email Delivery
• Configuration Reference