Log Stream Filters

Log Stream Filters

You can filter your log streams so only select events and event categories are delivered. To configure a log stream's filter:

  1. Go to Dashboard > Monitoring > Streams.

  2. Select a log stream and go to the Settings tab.

  3. Enable or disable filters in the Filter By Event Category menu.

  4. Click Save.

Authentication event filters

Filter Description
Login - Failure Failed login events
Login - Notification Login notification events
Login - Success Successful login events
Logout - Failure Failed logout events
Logout - Success Successful logout events
Signup - Failure Failed signup events
Signup - Success Successful signup events
Silent Authentication - Failure Failed silent authentication events
Silent Authentication - Success Successful silent authentication events
Token Exchange - Failure Failed token exchange events
Token Exchange - Success Successful token exchange events

Login - Failure

Event Code Description
f Failed login
fc Failed connector login
fco Origin is not in the application's Allowed Origins list
fcoa Failed cross-origin authentication
fens Failed native social login
fp Incorrect password
fu Invalid email or username

Login - Notification

Event Code Description
w Warnings during login

Login - Success

Event Code Description
s Successful login
scoa Successful cross-origin authentication
sens Successful native social login

Logout - Failure

Event Code Description
flo User logout failed

Logout - Success

Event Code Description
slo User successfully logged out

Signup - Failure

Event Code Description
fs User signup failed

Signup - Success

Event Code Description
ss Successful user signup

Silent Authentication - Failure

Event Code Description
fsa Failed silent authentication

Silent Authentication - Success

Event Code Description
ssa Successful silent authentication

Token Exchange - Failure

Event Code Description
feacft Failed exchange of Authorization Code for Access Token
feccft Failed exchange of Access Token for a Client Credentials Grant
fede Failed exchange of Device Code for Access Token
feoobft Failed exchange of Password and OOB Challenge for Access Token
feotpft Failed exchange of Password and OTP Challenge for Access Token
fepft Failed exchange of Password for Access Token
fepotpft Failed exchange of Passwordless OTP for Access Token
fercft Failed exchange of Password and MFA Recovery code for Access Token
ferrt Failed exchange of Rotating Refresh Token
fertft Failed exchange of Refresh Token for Access Token

Token Exchange - Success

Event Code Description
seacft Successful exchange of Authorization Code for Access Token
seccft Successful exchange of Access Token for a Client Credentials Grant
sede Successful exchange of Device Code for Access Token
seoobft Successful exchange of Password and OOB Challenge for Access Token
seotpft Successful exchange of Password and OTP Challenge for Access Token
sepft Successful exchange of Password for Access Token
sercft Successful exchange of Password and MFA Recovery code for Access Token
sertft Successful exchange of Refresh Token for Access Token

Management API event filters

Filter Description
Management API - Failure Failed Management API events
Management API - Success Successful Management API events

Management API - Failure

Event Code Description
fapi Failed Management API operation

Management API - Success

Event Code Description
sapi Successful Management API operation
mgmt_api_read API GET operation returning secrets completed successfully

System event filters

Filter Description
System - Notification System notification events

System - Notification

Event Code Description
admin_update_launch Auth0 Update Launched
api_limit The maximum number of requests to the Authentication or Management APIs in given time has reached
coff AD/LDAP Connector is offline
con AD/LDAP Connector is online and working
depnote Deprecation Notice
fcpro Failed to provision a AD/LDAP connector
fui Failed to import users
limit_delegation Rate limit exceeded to /delegation endpoint
limit_mu An IP address is blocked with 100 failed login attempts using different usernames, all with incorrect passwords in 24 hours, or 50 sign-up attempts per minute from the same IP address
limit_wc An IP address is blocked with 10 failed login attempts into a single account from the same IP address
sys_os_update_start Auth0 OS Update Started
sys_os_update_end Auth0 OS Update Ended
sys_update_start Auth0 Update Started
sys_update_end Auth0 Update Ended

User/Behavioral event filters

Filter Description
User/Behavioral - Failure Failed user/behavioral events
User/Behavioral - Notification User/behavioral notification events
User/Behavioral - Success Successful user/behavioral events

User/Behavioral - Failure

Event Code Description
fce Failed to change user email
fcp Failed to change password
fcpn Failed to change phone number
fcpr Failed change password request
fcu Failed to change username
fd Failed to generate delegation token
fdeaz Device authorization request failed
fdecc User did not confirm device
fdu Failed user deletion
fn Failed to send email notification
fv Failed to send verification email
fvr Failed to process verification email request

User/Behavioral - Notification

Event Code Description
cs Passwordless login code has been sent
du User has been deleted
gd_enrollment_complete A first time MFA user has successfully enrolled using one of the factors
gd_start_enroll Multi-factor authentication enroll has started
gd_unenroll Device used for second factor authentication has been unenrolled
gd_update_device_account Device used for second factor authentication has been updated
ublkdu User block setup by anomaly detection has been released

User/Behavioral - Success

Event Code Description
sce Successfully changed user email
scp Successfully changed password
scpn Successfully changed phone number
scpr Successful change password request
scu Successfully changed username
sdu User successfully deleted
srrt Successfully revoked a Refresh Token
sui Successfully imported users
sv Successfully consumed email verification link
svr Successfully called verification email endpoint, verification email in queue.

Other

Contains events that are unclassified and are not categorized.