There was a question on how do i identify who logged in and logged out of my vRealize Automation 8.x recently
The easiest way to identify this is through vRealize Loginsight . Usually customer want's to know about this for audit purposes
Login Events
Flow
1. Request reaches out to connector for authentication
2. Password based authentication begins with AD
3. Authentication succeeds in connector
4. Horizon states that the login succeeded
5. vRA recieves the authentication information which then authorizes the users and displays respective services
connector.log
2022-04-06T06:39:25,393 INFO (Thread-3) [IDM;-;10.104.75.48;] com.vmware.horizon.directory.ldap.LdapDirectoryService - Password-based authentication: arun@cap.org - BEGIN
2022-04-06T06:39:25,432 INFO (Thread-3) [IDM;-;10.104.75.48;] com.vmware.horizon.directory.ldap.dc.service.context.JNDIContextFetcher - LDAP Context env Json Values: {
"java.naming.factory.initial" : "com.sun.jndi.ldap.LdapCtxFactory",
"javax.security.sasl.server.authentication" : "true",
"com.sun.jndi.ldap.connect.timeout" : "5000",
"java.naming.ldap.attributes.binary" : "objectGUID pae-IconData objectSid securityIdentifier",
"javax.security.sasl.strength" : "high,medium,low",
"javax.security.sasl.qop" : "auth-conf,auth-int,auth",
"com.sun.jndi.ldap.read.timeout" : "600000",
"java.naming.provider.url" : "ldap://ad.cap.org:389",
"java.naming.security.authentication" : "GSSAPI"
}
2022-04-06T06:39:25,439 INFO (Thread-3) [IDM;-;10.104.75.48;] com.vmware.horizon.directory.ldap.LdapDirectoryService - Password-based authentication: arun@cap.org - SUCCESS
2022-04-06T06:39:25,439 INFO (Thread-3) [IDM;-;10.104.75.48;] com.vmware.horizon.adapters.passwordAdapter.PasswordIdpAdapter - Login: arun - SUCCESS
2022-04-06T06:39:25,440 INFO (Thread-3) [IDM;-;10.104.75.48;] com.vmware.horizon.connector.controller.AdapterLoginController - samlRequestInfo: SamlRequestInfo[acsUrl=https://idm.cap.org/SAAS/auth/saml/response,relayState=df3e88a2-e213-41f0-97cc-f9826732fc73,nameId=<null>,requestId=_cf2c85aa30e8d7be47485fb87f6c9988,authnContextClassRefList=[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]]
2022-04-06T06:39:25,440 INFO (Thread-3) [IDM;-;10.104.75.48;] com.vmware.horizon.connector.controller.IdPInitiatedSSOController - samlRequestInfo: SamlRequestInfo[acsUrl=https://idm.cap.org/SAAS/auth/saml/response,relayState=df3e88a2-e213-41f0-97cc-f9826732fc73,nameId=<null>,requestId=_cf2c85aa30e8d7be47485fb87f6c9988,authnContextClassRefList=[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]]
horizon.log
2022-04-06T06:39:25,861 INFO (Thread-8) [IDM;-;10.104.75.48;] com.vmware.horizon.components.authentication.monitoring.LoginMetricsPublisher - Login succeeded.
identity-service-app.log
2022-04-06T06:39:26.008Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-2' user='' org='' trace='dae05107-bd99-4b3e-886f-005dc3c08164'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:74 - POST https://idm.cap.org/SAAS/API/1.0/oauth2/token?grant_type=authorization_code
2022-04-06T06:39:26.088Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='pool-4-thread-3' user='' org='' trace='dae05107-bd99-4b3e-886f-005dc3c08164'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:74 - POST https://idm.cap.org/SAAS/API/1.0/oauth2/token?grant_type=client_credentials
2022-04-06T06:39:26.129Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='dae05107-bd99-4b3e-886f-005dc3c08164'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:74 - POST https://idm.cap.org/SAAS/jersey/manager/api/scim/Groups/.search
2022-04-06T06:39:27.091Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='5ba4e9dc-16cf-4760-9436-1ccea66197c3'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/profile HTTP/1.1" 200 301 8080 65 ms
2022-04-06T06:39:27.403Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='5c6f8238-4292-4d05-8b15-c725f529c8a8'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user?expand HTTP/1.1" 200 295 8080 188 ms
2022-04-06T06:39:27.457Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-2' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='db7f5f63-4426-470b-9646-e401eefe0506'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/configuration/api/public HTTP/1.1" 200 196 8080 183 ms
2022-04-06T06:39:27.462Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='5fd3557f-5cab-43b6-8e29-a70a25ee758e'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/orgs?expand=1 HTTP/1.1" 200 290 8080 207 ms
2022-04-06T06:39:27.468Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-1' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='f83d5aee-adf0-4a83-9508-629968620459'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/profile HTTP/1.1" 200 301 8080 194 ms
2022-04-06T06:39:27.473Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='7615046f-ef57-455a-9147-e9676faa874e'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user HTTP/1.1" 200 295 8080 199 ms
2022-04-06T06:39:27.645Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='193e19bc-38c5-4e54-9f1f-e6d124b24c01'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/orgs?expand=1 HTTP/1.1" 200 290 8080 135 ms
2022-04-06T06:39:27.661Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-1' user='' org='' trace='6d6aef4c-b10e-4dc8-a74e-8eeb944a8683'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /cs
p/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 2 ms
2022-04-06T06:39:27.717Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-2' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='67d01c4c-3c95-4786-b9a0-aeb5d89512c4'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/slc/api/definitions/?expand=1 HTTP/1.1" 200 9395 8080 191 ms
2022-04-06T06:39:27.757Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='afcdf509-00ed-4443-855f-f82b661d8e1a'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/orgs/c2eae67a-ff6d-4dae-9fd3-6594352a1f8a/roles HTTP/1.1" 200 362 8080 231 ms
2022-04-06T06:39:27.758Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='' org='' trace='b467fc16-0519-4e64-8a43-fee8e3954e76'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /cs
p/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 1 ms
2022-04-06T06:39:27.795Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-1' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='3766d64e-66ac-43f6-8db8-6fc730ec65a0'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/orgs/c2eae67a-ff6d-4dae-9fd3-6594352a1f8a/service-roles HTTP/1.1" 200 1471 8080 269 ms
2022-04-06T06:39:27.797Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='bd4749e0-c0d2-4a29-85e0-e7304471b02c'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/portal/api/orgs/c2eae67a-ff6d-4dae-9fd3-6594352a1f8a/services HTTP/1.1" 200 4175 8080 156 ms
2022-04-06T06:39:27.810Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-1' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='08c3dfa7-1daf-437e-bcca-5980650d0ffc'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/slc/api/principal/org/service-families HTTP/1.1" 200 31 8080 95 ms
2022-04-06T06:39:27.816Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='b2b88069-cf36-4b08-9865-c9065925a53e'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/slc/api/orgs/c2eae67a-ff6d-4dae-9fd3-6594352a1f8a/services HTTP/1.1" 200 8401 8080 101 ms
2022-04-06T06:39:27.865Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='9f01081b-8c72-4029-ac6f-cd4d02b40f42'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/orgs/c2eae67a-ff6d-4dae-9fd3-6594352a1f8a/roles HTTP/1.1" 200 362 8080 61 ms
2022-04-06T06:39:27.910Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='a4f38830-1146-4a7f-b5a7-34c7fd1eb5ec'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/orgs/c2eae67a-ff6d-4dae-9fd3-6594352a1f8a/service-roles HTTP/1.1" 200 1471 8080 64 ms
2022-04-06T06:39:27.977Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='0700a87d-6e1f-4a44-b346-d9f9d3eb35d1'] reactor.netty.http.se
rver.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:27 +0000] "GET /csp/gateway/am/api/loggedin/user/orgs/c2eae67a-ff6d-4dae-9fd3-6594352a1f8a/roles HTTP/1.1" 200 362 8080 65 ms
2022-04-06T06:39:28.070Z ERROR identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a)' org='c2eae67a-ff6d-4dae-9fd3-6594352a1f8a' trace='a746ddea-1a89-4003-8d6b-18883b8e01df'] c.v.i.c.RestResponse
EntityExceptionHandler.logBriefError:213 - Handling bad request exception: org.springframework.web.server.ResponseStatusException: 404 NOT_FOUND "No matching handler"
thrown at org.springframework.web.reactive.DispatcherHandler.lambda$createNotFoundError$3:159
Picking up certain keywords like the one shown below we can determine the login event
Filters would be as follows
text
"GET /csp/gateway/configuration/api/public HTTP/1.1" 200
namespace
prelude
app
identity-service-app
Logout Events
Flow
1. Identity Service App revokes the token
2. Horizon records the logout event
identity-service-app.log
2022-04-06T06:39:29.460Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-1' user='' org='' trace='5ebd1ebb-a410-49f0-bc1c-a46275cd2588'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:74 - GET https://idm.cap.org/SAAS/jersey/manager/api/scim/Users/92aa3ece-b78c-4a11-9c43-7f2b0ef9c462
2022-04-06T06:39:29.550Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-1' user='' org='' trace='5ebd1ebb-a410-49f0-bc1c-a46275cd2588'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.40 - - [06/Apr/2022:06:39:29 +0000] "POST /csp/gateway/am/api/auth/authorize HTTP/1.1" 200 2225 8080 187 ms
2022-04-06T06:39:31.265Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='3364bcbe-3f2e-4243-a8ef-878bc79368c4'] reactor.netty.http.server.AccessLog.info:270 - 127.0.0.1 - - [06/Apr/2022:06:39:31 +0000] "GET /identity/status HTTP/1.1" 200 634 8080 2 ms
2022-04-06T06:39:32.524Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='44c96c60-babb-48da-9029-1678465bef55'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:32 +0000] "GET /csp/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 2 ms
2022-04-06T06:39:34.394Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='' org='' trace='65d3b1ba-4dde-4399-b11c-37fb95d0be82'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.1 - - [06/Apr/2022:06:39:34 +0000] "GET /identity/healthcheck HTTP/1.1" 200 1362 8080 1 ms
2022-04-06T06:39:37.536Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='b3b39ce9-34ee-4cda-b3c7-1659155835a7'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:37 +0000] "GET /csp/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 1 ms
2022-04-06T06:39:37.661Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='140664d5-f71e-40c0-88e1-a7818c49bc57'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:37 +0000] "GET /csp/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 2 ms
2022-04-06T06:39:38.364Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='aaf4ce29-8707-496f-a5be-088f006abad8'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:38 +0000] "GET /csp/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 3 ms
2022-04-06T06:39:39.394Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-1' user='' org='' trace='7428b6fa-a3c5-42ce-b8db-46d585e79dee'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.1 - - [06/Apr/2022:06:39:39 +0000] "GET /identity/healthcheck HTTP/1.1" 200 1362 8080 1 ms
2022-04-06T06:39:42.543Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='f7a2d487-b26e-4842-8d32-c8aa188fa0a8'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:42 +0000] "GET /csp/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 3 ms
2022-04-06T06:39:44.398Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='parallel-1' user='' org='' trace='3a88d87d-e7d7-4d4f-9547-8de6f777e759'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:74 - POST https://idm.cap.org/SAAS/API/1.0/oauth2/token?grant_type=client_credentials
2022-04-06T06:39:44.440Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='3a88d87d-e7d7-4d4f-9547-8de6f777e759'] com.vmware.identity.rest.RestClient.lambda$logRequest$1:74 - GET https://idm.cap.org/SAAS/API/1.0/REST/system/health/heartbeat
2022-04-06T06:39:44.448Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-2' user='' org='' trace='3a88d87d-e7d7-4d4f-9547-8de6f777e759'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.1 - - [06/Apr/2022:06:39:44 +0000] "GET /identity/healthcheck HTTP/1.1" 200 1362 8080 55 ms
2022-04-06T06:39:46.357Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='pool-4-thread-8' user='' org='' trace='ed4efb33-32b0-46af-a5ab-73ab2850e4d6'] com.vmware.identity.common.AuditLogger.audit:28 - Revoking token 34a3793c-2db8-4a1c-b1a6-e96432650507 for user arun (91fb23fd-6ce1-4f69-a556-ce2ceffbef4a) in c2eae67a-ff6d-4dae-9fd3-6594352a1f8a organization.
2022-04-06T06:39:46.362Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-4' user='' org='' trace='ed4efb33-32b0-46af-a5ab-73ab2850e4d6'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.40 - - [06/Apr/2022:06:39:46 +0000] "POST /csp/gateway/am/api/auth/logout HTTP/1.1" 200 58 8080 10 ms
2022-04-06T06:39:46.441Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='a9376843-e852-4daf-9f86-ccb073310817'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:46 +0000] "GET /csp/gateway/discovery?logout HTTP/1.1" 302 0 8080 1 ms
2022-04-06T06:39:47.550Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='8fa0f70e-2c73-4323-bc72-d6ba1399ecfa'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:47 +0000] "GET /csp/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 2 ms
2022-04-06T06:39:47.709Z INFO identity-service [host='identity-service-app-6954fb5598-gk6ll' thread='reactor-http-epoll-3' user='' org='' trace='babb7ae3-3380-4196-b513-8116bb71dba6'] reactor.netty.http.server.AccessLog.info:270 - 10.244.0.18 - - [06/Apr/2022:06:39:47 +0000] "GET /csp/gateway/am/api/auth/discovery?username=service_type&state=aHR0cHM6Ly9zcy5jYXAub3JnL2lkZW50aXR5L2FwaS9jb3JlL2F1dGhuL2NzcA%3D%3D&redirect_uri=https%3A%2F%2Fss.cap.org%2Fidentity%2Fapi%2Fcore%2Fauthn%2Fcsp&client_id=ssc-NTnLPaiCwQ HTTP/1.1" 200 246 8080 3 ms
horizon.log
2022-04-06T06:39:46,761 INFO (Thread-8) [IDM;344d8070-fe39-4c6e-8eaa-a22640e83f5f;10.104.75.48;] com.vmware.horizon.service.controller.auth.LoginController - Logout request. Invalidating session for request: https://idm.cap.org/SAAS/auth/logout with query string:dest=https%3A%2F%2Fvra.cap.org
connector.log
*** No Information would be available here **
Filters for logout event would be like
text
Revoking token
namespace
prelude
app
identity-service-app
If screenshots are not clear , then download this PDF and use it
Comments