Secure Private Access (ZPA)
About Audit Log Fields
The Log Streaming Service can send audit log information to any third-party log analytics tool. By default, the audit log type includes the fields listed in the table below for each log template (i.e., CSV, JSON, TSV). While configuring your log receiver, you can edit the default log stream content to capture only specific fields, and create a Custom log template.
- View an example Audit Log
{"modifiedTime": "2020-07-13T20:53:10.000Z","creationTime":"2020-07-13T20:53:10.000Z","modifiedBy":11223344556677889,"requestID":"a12aa12a-1234-aab1-123ab123456a","auditOldValue":"","auditNewValue":"{\"id\":\"98765432100123456\",\"name\":\"app1.test.com\",\"applicationId\":\"12312312312312300\",\applicationPort\":\"443\",\"applicationProtocol\":\"HTTPS\",\"certificateId\":"10203040506070809\",\"domain\":\"app1.test.com\",\"enabled\":\"true\",\"hidden\":\"false\",\"path\":\"\\/\",\"portal\":\"false\",\"trustUntrustedCert\":\"true\"}","auditOperationType":"Create","objectType":"Browser Access","objectName":app1.test.com,"objectID":98765432100123456,"customerID":12345678901234567,"modifiedByUser":"zpaadmin@test.com", "clientAuditUpdate":"0"}
Close
The following table includes descriptions and supported field format specifications for each field within the template. To learn more about the format specifications listed for each field, including examples, see Log Field Format Specifications.
| Field | Description | Supported Field Format Specifications |
|---|---|---|
| modifiedTime | Time when an object is created, deleted, or updated |
|
| creationTime | Time when the log was generated |
|
| modifiedBy | The user ID for the admin that made the change |
|
| requestID | The ID for the associated configuration change, as related to the action that was made |
|
| auditOldValue |
The previous value that was changed if the action type is delete, sign out, or update. If the modified object is policy related, the value depends on the policy type. Then the expected values for this field are:
|
|
| auditNewValue |
The new value that was changed if the action type is create, sign in, or update. If the modified object is policy related, the value depends on the policy type. Then the expected values for this field are:
|
|
| auditOperationType |
The action performed. The expected values for this field:
|
|
| objectType |
The location within the ZPA Admin Portal where the Action was performed. This corresponds to the Resource Type in the Audit Log page. To learn more, see About Audit Logs. The expected values for this field are:
|
|
| objectName | The name of the object. This corresponds to the Resource Name in the Audit Log page. To learn more, see About Audit Logs. |
|
| objectID | The ID associated with the object name |
|
| customerID | The ZPA tenant ID of the customer. To learn more, see Configuring the Company Profile. |
|
| modifiedByUser | The username of the admin associated with the audit action |
|
| clientAuditUpdate | Indicates whether the logs are associated with admin or client credentials. The expected values for this field are 0 and 1. | %[OPT]d |