ExamFinch.com My Study

Study guide

14.3 Leveraging the IdentityIQ Console for Debugging

Practice this exam

SailPoint Certified IdentityIQ Engineer Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: The IdentityIQ Engineer Exam

1.1 Exam Format, Official Blueprint, and Study Strategy

2 Chapter 2: Infrastructure, Installation, and Extended Attributes

2.1 IdentityIQ Infrastructure Components 2.2 Installation Steps and Procedures 2.3 Creating Extended Attributes and the Objects That Support Them

3 Chapter 3: Build, Deployment, Patching, Access, and Email

3.1 Ongoing Build and Deployment 3.2 Installing Patches and Performing Upgrades 3.3 Configuring End-User Access 3.4 Email Server Settings and Email Redirection

4 Chapter 4: Lifecycle Manager Configuration, Provisioning Policies, and Workflows

4.1 Configuring Lifecycle Manager 4.2 Identity Provisioning Policies 4.3 Configuring LCM Workflows

5 Chapter 5: Lifecycle Events, QuickLinks, Batch Requests, and Rapid Setup

5.1 Lifecycle Events and Their Workflows 5.2 QuickLinks and QuickLink Populations 5.3 Configuring and Using Batch Requests 5.4 Rapid Setup in Lifecycle Events and Identity Operations

6 Chapter 6: Certification Campaigns and Certification Rules

6.1 Configuring and Scheduling Certification Campaigns 6.2 The Purpose of Common Certification Rules

7 Chapter 7: Policies and Policy Violations

7.1 Configuring and Leveraging Policies 7.2 Responding to Policy Violations

8 Chapter 8: Reporting, Advanced Analytics, and Auditing

8.1 Executing and Leveraging Reports 8.2 Leveraging Advanced Analytics 8.3 Configuring and Using Auditing

9 Chapter 9: Rules, Rule Libraries, and the SailPoint API

9.1 The Purpose and Use of Rule Libraries 9.2 Rule Input and Output Arguments 9.3 Common SailPoint API Objects and Methods

10 Chapter 10: Workflow Development

10.1 Workflow Variables, Transitions, and Step Conditions 10.2 Workflow Steps That Generate Work Items 10.3 The Different Workflow Step Usages 10.4 Leveraging Sub-Workflows

11 Chapter 11: Email Templates, Branding, and Localization

11.1 Customizing and Using Email Templates 11.2 Branding the SailPoint User Interface 11.3 Localizing the SailPoint UI

12 Chapter 12: Application Definitions, Connector Settings, and Rapid Setup Aggregation

12.1 Configuring Application Definitions 12.2 Configuring Common Connector Settings 12.3 Configuring Rapid Setup Aggregation Settings

13 Chapter 13: Data-Loading Tasks and Application and Connector Rules

13.1 Scheduling Tasks for Data Loading and Processing 13.2 Common Application Rule Types 13.3 Common Connector Rule Types

14 Chapter 14: Debugging with log4j, Syslog, and the IdentityIQ Console

14.1 Configuring and Leveraging log4j 14.2 Configuring and Leveraging Syslog 14.3 Leveraging the IdentityIQ Console for Debugging

15 Chapter 15: Debug Pages and the Administrator Console

15.1 Leveraging the Debug Pages for Debugging 15.2 Leveraging the Administrator Console for Debugging

16 Chapter 16: Role Model and Identity Attribute Mappings

16.1 Default Role Models and Role Types 16.2 Configuring Roles and Role Options 16.3 Configuring Identity Attribute Mappings

17 Chapter 17: Data Objects, Relationships, and Group Types

17.1 Common IdentityIQ Data Objects 17.2 Relationships Between Common Data Object Models 17.3 The Difference Between Group Types

14.3 Leveraging the IdentityIQ Console for Debugging

Key Takeaways Explain This Topic AI

Start the console from WEB-INF/bin with iiq console (-j adds command history on UNIX); it requires the System Administrator capability and tries spadmin/admin first.

Enter any command with no arguments to see its syntax; command names are case sensitive, and output can be redirected with > file or piped to OS tools.

connectorDebug tests a connector (test, iterate, get, auth) directly, outside aggregation.

rule and workflow commands run a rule or workflow with inputs from an XML Map file; validate checks a workflow or rule, and parse validates XML against the DTD.

run with sync makes a task finish in the console and print errors there; listLocks and breakLocks work on Identity locks.

Last updated: September 2026

Leveraging the IdentityIQ Console for Debugging

Objective 6.3 is leverage IdentityIQ console for debugging . The console runs on the server against the same database as the web application, so you can inspect objects, run rules and tasks, test connectors, and reload logging, often faster and more precisely than in the UI.

  • Launching cd identityiq_home/WEB-INF/bin
  • ./iiq console -j # UNIX; -j enables JLine command history
  • iiq console -u amy.cox -p secret # explicit credentials

The console requires the System Administrator capability.

It first tries spadmin / admin and prompts for credentials if that fails.

Authentication is disabled when there are no identities , which is the state before init.xml is imported during installation.

Command-line options include -c "<command>" (run one command and exit), -f <file> (run commands from a file and exit), and -e <services> / -heartbeat (start background services such as Heartbeat or Task in the console process).

Syntax Basics

Enter a command with no arguments to see its usage . For example, workflow prints usage: workflow name [varfile] .

Command names are case sensitive. Parameters are not.

Redirect output with > file , for example get identity Adam.Kennedy > adam.xml .

Pipe to operating-system tools, for example list workitem | grep manual or list policy | wc -l on UNIX.

source file runs a script of commands, and echo helps annotate scripted runs.

  • Commands for Debugging
  • Objects
  • Command Use
  • list <class> [filter] List objects, with name filters such as ent* , *xxx , *xxx*
  • count <class> / summary / classes Counts and available classes
  • get <class> <name> Print an object's XML

checkout <class> <name> <file> [-clean] / checkin <file> Pull one object to a file and save it back. Checking in a role with approve launches role approval.

import [-noids] <file> / export [-clean] <file> [classes] Move objects (section 3.1)

delete <class> <name> Deletes the object and its owned objects . It cannot be undone and is not recommended in production unless Support directs it.

  • oconfig Lists extended attributes by class (section 2.3)
  • Tasks and Workflows

run <task> [trace] [profile] [sync] runs a task. sync keeps control in the console until it finishes and prints errors there. trace and profile add execution detail.

runTaskWithArguments "<task>" arg1=val1,... runs a task with simple arguments, always synchronously.

tasks lists schedules, restart restarts a failed task, and terminateOrphans marks orphaned pending TaskResults as Terminated.

workflow <name> [varfile] launches a workflow with variables from an XML Map file and prints the WorkflowCase.

validate validates a workflow or a rule .

event <identity> <workflow> [seconds] schedules a workflow for an identity.

list workflowcase / get workflowcase "<name>" inspect in-flight workflows.

Tests

rule <name> [varfile] runs a rule with inputs from an XML Map. Support also uses this to run BeanShell against the database for cleanup.

parse <file> validates XML against the IdentityIQ DTD. It prints nothing if the file is valid.

warp <file> parses XML into an object and prints it.

sql "<statement>" / sql -f <file> runs one SQL statement. Updates and deletes cannot be undone . hql runs a Hibernate query.

connectorDebug <app> <method> tests connectors directly:

test – can a connection be made?

iterate [account|group] [-q] – read records natively. -q returns only the count and time.

get account|group <nativeIdentity> – fetch one object's ResourceObject XML.

auth – test pass-through authentication, if the application's features include AUTHENTICATION.

Locks, Services, and Logging

listLocks identity / breakLocks identity show or force-release identity locks. Use them with caution. lock / unlock act on a single object.

service list|start|stop|run manages console background services: Cache, SMListener, ResourceEvent, Heartbeat, Task (Quartz scheduler), and Request (request processor). status reports the task and request schedulers.

logConfig reloads log4j2.properties (section 14.1). about , properties , and threads give environment and thread information. clearCache clears the object cache. meter times each command.

Console Safety Rules

The console acts directly on the production database with administrator rights, so treat it as a sharp tool:

Prefer read-only commands such as get , list , count , connectorDebug ... test , and parse when investigating.

Checkout before you change. Keep a copy of any object before a checkin or import so you can roll back. The Debug pages and the console have no undo.

Avoid delete , sql updates, and breakLocks in production unless SailPoint Support or a tested runbook calls for them. Deletes also remove owned objects, and SQL changes bypass IdentityIQ's own logic and auditing.

Record what you ran. Script repeatable actions in a file and run them with source or -f , so the steps are reviewable.

Debugging Scenarios

  • Problem Console approach
  • Aggregation returns nothing connectorDebug HR test , then connectorDebug HR iterate -q to count source records

One account looks wrong connectorDebug AD get account "<DN>" to compare raw data with the Link ( get link ... )

  • A rule misbehaves rule "ACME Correlation" vars.xml with a crafted input Map
  • A workflow fails at step 5 validate the workflow, then run it with workflow "<name>" vars.xml and trace on
  • An edited XML file will not import parse file.xml to find the DTD error
  • An identity is stuck "locked" listLocks identity , then unlock identity <name> if safe