ExamFinch.com My Study

Study guide

14.2 Configuring and Leveraging Syslog

Practice this exam

SailPoint Certified IdentityIQ Engineer Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: The IdentityIQ Engineer Exam

1.1 Exam Format, Official Blueprint, and Study Strategy

2 Chapter 2: Infrastructure, Installation, and Extended Attributes

2.1 IdentityIQ Infrastructure Components 2.2 Installation Steps and Procedures 2.3 Creating Extended Attributes and the Objects That Support Them

3 Chapter 3: Build, Deployment, Patching, Access, and Email

3.1 Ongoing Build and Deployment 3.2 Installing Patches and Performing Upgrades 3.3 Configuring End-User Access 3.4 Email Server Settings and Email Redirection

4 Chapter 4: Lifecycle Manager Configuration, Provisioning Policies, and Workflows

4.1 Configuring Lifecycle Manager 4.2 Identity Provisioning Policies 4.3 Configuring LCM Workflows

5 Chapter 5: Lifecycle Events, QuickLinks, Batch Requests, and Rapid Setup

5.1 Lifecycle Events and Their Workflows 5.2 QuickLinks and QuickLink Populations 5.3 Configuring and Using Batch Requests 5.4 Rapid Setup in Lifecycle Events and Identity Operations

6 Chapter 6: Certification Campaigns and Certification Rules

6.1 Configuring and Scheduling Certification Campaigns 6.2 The Purpose of Common Certification Rules

7 Chapter 7: Policies and Policy Violations

7.1 Configuring and Leveraging Policies 7.2 Responding to Policy Violations

8 Chapter 8: Reporting, Advanced Analytics, and Auditing

8.1 Executing and Leveraging Reports 8.2 Leveraging Advanced Analytics 8.3 Configuring and Using Auditing

9 Chapter 9: Rules, Rule Libraries, and the SailPoint API

9.1 The Purpose and Use of Rule Libraries 9.2 Rule Input and Output Arguments 9.3 Common SailPoint API Objects and Methods

10 Chapter 10: Workflow Development

10.1 Workflow Variables, Transitions, and Step Conditions 10.2 Workflow Steps That Generate Work Items 10.3 The Different Workflow Step Usages 10.4 Leveraging Sub-Workflows

11 Chapter 11: Email Templates, Branding, and Localization

11.1 Customizing and Using Email Templates 11.2 Branding the SailPoint User Interface 11.3 Localizing the SailPoint UI

12 Chapter 12: Application Definitions, Connector Settings, and Rapid Setup Aggregation

12.1 Configuring Application Definitions 12.2 Configuring Common Connector Settings 12.3 Configuring Rapid Setup Aggregation Settings

13 Chapter 13: Data-Loading Tasks and Application and Connector Rules

13.1 Scheduling Tasks for Data Loading and Processing 13.2 Common Application Rule Types 13.3 Common Connector Rule Types

14 Chapter 14: Debugging with log4j, Syslog, and the IdentityIQ Console

14.1 Configuring and Leveraging log4j 14.2 Configuring and Leveraging Syslog 14.3 Leveraging the IdentityIQ Console for Debugging

15 Chapter 15: Debug Pages and the Administrator Console

15.1 Leveraging the Debug Pages for Debugging 15.2 Leveraging the Administrator Console for Debugging

16 Chapter 16: Role Model and Identity Attribute Mappings

16.1 Default Role Models and Role Types 16.2 Configuring Roles and Role Options 16.3 Configuring Identity Attribute Mappings

17 Chapter 17: Data Objects, Relationships, and Group Types

17.1 Common IdentityIQ Data Objects 17.2 Relationships Between Common Data Object Models 17.3 The Difference Between Group Types

14.2 Configuring and Leveraging Syslog

Key Takeaways Explain This Topic AI

IdentityIQ Syslog stores WARN, ERROR, and FATAL events, with stack traces, in the database; it is unrelated to the operating system's syslog service.

Syslog is enabled on Global Settings > IdentityIQ Configuration > Miscellaneous, where you set the lowest stored level (FATAL, ERROR, or WARN) and the days before deletion.

The incident code shown in a UI error banner is searched in Advanced Analytics > Syslog to retrieve the full stack trace.

Each Syslog event records the Server, which makes it especially useful in multi-host clusters.

The Perform Maintenance task's Prune syslog events option deletes events older than the configured age.

Last updated: September 2026

Configuring and Leveraging Syslog

Objective 6.2 is configure and leverage Syslog . In IdentityIQ, Syslog means a database record of errors , stored as syslog events , that administrators can search from the UI. It is not the Unix syslog daemon or a remote syslog server, which is a common source of confusion. The documentation describes a syslog event as "a capture of an error in the system, including the stack trace of the error."

Why Syslog Exists

Log files live on each server's disk, rotate away, and are often out of reach for administrators. Syslog puts the most important events, warnings, errors, and fatal errors , into the database, where anyone with the right access can search them. Each record includes the server that produced it, the user , and the stack trace . SailPoint notes that the Syslog search page is "used primarily to determine specific support information that SailPoint IdentityIQ support engineers can use for troubleshooting."

Configuration

Go to gear icon > Global Settings > IdentityIQ Configuration > Miscellaneous > Syslog Settings :

  • Setting Meaning
  • Enable syslog Turns capture on

Level at which syslog events will be stored The lowest level stored: FATAL , ERROR , or WARN . Lower levels, such as INFO and DEBUG, are never stored in Syslog. They go only to Log4j appenders (section 14.1).

Days before syslog event deletion How long events are kept before they become eligible for purging

The Perform Maintenance task's Prune syslog events option deletes events older than that age. Choosing WARN captures more detail but grows the table faster, so pick the level that fits your retention period and support needs.

From Incident Code to Stack Trace

When something fails in the UI, IdentityIQ shows a banner such as:

"The system has encountered a serious error while processing your request. Please report the following incident code to your system administrator: <incident code>"

The documented procedure:

Note the incident code . Codes are specific to your environment.

Go to Intelligence > Advanced Analytics and choose the Syslog search type.

Enter the Incident Code and run the search.

Open the event to see its stack trace . Attach it to a SailPoint Support case if you need to escalate.

Syslog Search Criteria

  • Field Use
  • Incident Code The ID shown at the end of a UI error message
  • Server The host where the exception happened, which is vital in clustered environments
  • Level WARN, ERROR, or FATAL
  • Username The user, or a system process, performing the action
  • Classname The Java class that raised the exception
  • Message The exception message
  • Line / Thread Name Where and in which thread the error occurred
  • Start Date / End Date A time window

Like other Advanced Analytics searches, you can choose Fields to Display , save a Syslog search, or save it as a report and schedule it. A daily "errors on the task servers in the last 24 hours" report is a cheap early-warning system.

Using Syslog in a Debugging Routine

Situation Syslog helps by… Pair it with…

A user reports a UI error Finding the exact stack trace by incident code The Debug pages (section 15.1) to inspect the objects involved

A task ended with errors overnight Listing ERROR events by date, server, and class Task results and the Administrator Console (section 15.2)

  • An intermittent problem on one node Filtering by Server log4j DEBUG on that node only (section 14.1)
  • A custom rule throws exceptions Filtering by Classname or Message The rule's own named logger
  • Worked Example: An Overnight Task Failure

The nightly Identity Refresh finished with errors, and the task result says only that some identities failed.

In Advanced Analytics > Syslog , set the date range to last night and Level to ERROR.

Sort or filter by Classname . Most errors point to a custom rule class and the same Message , a null pointer.

The Server column shows that every error came from one task host, so the problem is data or code, not a single failing node. Open one event's stack trace to find the rule and line.

Turn on the rule's DEBUG logger on that host (section 14.1), refresh one affected identity from the console, and read the log to see which attribute was null.

Fix the rule, rerun the refresh, and save the Syslog search as a daily report so the next regression is caught the same morning.

Syslog, Log Files, and Audit Compared

Source Contains Best for

Syslog (database) WARN, ERROR, and FATAL events with stack traces Finding and sharing errors from the UI, by incident code

  • Log4j log files Every level you enable, per host Detailed step-by-step diagnosis
  • Audit events (section 8.3) Business actions you chose to audit Who did what, for compliance
  • Common Misconceptions

"Enable syslog forwards events to our SIEM." No. It stores events in IdentityIQ's own database. Getting data to a SIEM uses other features, such as audit exports or log appenders.

"Syslog will show my debug statements." No. Only WARN, ERROR, and FATAL are stored.

"Syslog keeps events forever." Not if Perform Maintenance prunes them after the configured number of days.