Log Stream Filters

You can filter your log streams so only select events and event categories are delivered. To configure a log stream's filter:

  1. Go to Dashboard > Monitoring > Streams.

  2. Select a log stream and go to the Settings tab.

  3. Enable or disable filters in the Filter By Event Category menu.

  4. Click Save.

Authentication event filters

Filter Description
Login - Failure Failed login events
Login - Notification Login notification events
Login - Success Successful login events
Logout - Failure Failed logout events
Logout - Success Successful logout events
Signup - Failure Failed signup events
Signup - Success Successful signup events
Silent Authentication - Failure Failed silent authentication events
Silent Authentication - Success Successful silent authentication events
Token Exchange - Failure Failed token exchange events
Token Exchange - Success Successful token exchange events

Login - Failure

Event Code Description
f Failed login
fc Failed connector login
fco Origin is not in the application's Allowed Origins list
fcoa Failed cross-origin authentication
fens Failed native social login
fp Incorrect password
fu Invalid email or username

Login - Notification

Event Code Description
w Warnings during login

Login - Success

Event Code Description
s Successful login
scoa Successful cross-origin authentication
sens Successful native social login

Logout - Failure

Event Code Description
flo User logout failed
oidc_backchannel_logout_failed Failed OIDC back-channel logout request

Logout - Success

Event Code Description
oidc_backchannel_logout_succeeded Successful OIDC back-channel logout request
slo User successfully logged out

Signup - Failure

Event Code Description
fs User signup failed

Signup - Success

Event Code Description
ss Successful user signup

Silent Authentication - Failure

Event Code Description
fsa Failed silent authentication

Silent Authentication - Success

Event Code Description
ssa Successful silent authentication

Token Exchange - Failure

Event Code Description
feacft Failed exchange of Authorization Code for Access Token
feccft Failed exchange of Access Token for a Client Credentials Grant
fede Failed exchange of Device Code for Access Token
feoobft Failed exchange of Password and OOB Challenge for Access Token
feotpft Failed exchange of Password and OTP Challenge for Access Token
fepft Failed exchange of Password for Access Token
fepotpft Failed exchange of Passwordless OTP for Access Token
fercft Failed exchange of Password and MFA Recovery code for Access Token
ferrt Failed exchange of Rotating Refresh Token
fertft Failed exchange of Refresh Token for Access Token

Token Exchange - Success

Event Code Description
seacft Successful exchange of Authorization Code for Access Token
seccft Successful exchange of Access Token for a Client Credentials Grant
sede Successful exchange of Device Code for Access Token
seoobft Successful exchange of Password and OOB Challenge for Access Token
seotpft Successful exchange of Password and OTP Challenge for Access Token
sepft Successful exchange of Password for Access Token
sercft Successful exchange of Password and MFA Recovery code for Access Token
sertft Successful exchange of Refresh Token for Access Token

Management API event filters

Filter Description
Management API - Failure Failed Management API events
Management API - Success Successful Management API events

Management API - Failure

Event Code Description
fapi Failed Management API operation

Management API - Success

Event Code Description
sapi Successful Management API operation
mgmt_api_read API GET operation returning secrets completed successfully

System event filters

Filter Description
System - Notification System notification events

System - Notification

Event Code Description
admin_update_launch Auth0 Update Launched
api_limit The maximum number of requests to the Authentication or Management APIs in given time has reached
coff AD/LDAP Connector is offline
con AD/LDAP Connector is online and working
depnote Deprecation Notice
fcpro Failed to provision a AD/LDAP connector
fui Failed to import users
limit_delegation Rate limit exceeded to /delegation endpoint
limit_mu An IP address is blocked with 100 failed login attempts using different usernames, all with incorrect passwords in 24 hours, or 50 sign-up attempts per minute from the same IP address
limit_wc An IP address is blocked with 10 failed login attempts into a single account from the same IP address
sys_os_update_start Auth0 OS Update Started
sys_os_update_end Auth0 OS Update Ended
sys_update_start Auth0 Update Started
sys_update_end Auth0 Update Ended

User/Behavioral event filters

Filter Description
User/Behavioral - Failure Failed user/behavioral events
User/Behavioral - Notification User/behavioral notification events
User/Behavioral - Success Successful user/behavioral events

User/Behavioral - Failure

Event Code Description
fce Failed to change user email
fcp Failed to change password
fcpn Failed to change phone number
fcpr Failed change password request
fcu Failed to change username
fd Failed to generate delegation token
fdeaz Device authorization request failed
fdecc User did not confirm device
fdu Failed user deletion
fn Failed to send email notification
fv Failed to send verification email
fvr Failed to process verification email request

User/Behavioral - Notification

Event Code Description
cs Passwordless login code has been sent
du User has been deleted
gd_enrollment_complete A first time MFA user has successfully enrolled using one of the factors
gd_start_enroll Multi-factor authentication enroll has started
gd_unenroll Device used for second factor authentication has been unenrolled
gd_update_device_account Device used for second factor authentication has been updated
ublkdu User block setup by anomaly detection has been released

User/Behavioral - Success

Event Code Description
sce Successfully changed user email
scp Successfully changed password
scpn Successfully changed phone number
scpr Successful change password request
scu Successfully changed username
sdu User successfully deleted
srrt Successfully revoked a Refresh Token
sui Successfully imported users
sv Successfully consumed email verification link
svr Successfully called verification email endpoint, verification email in queue.

Other

This category contains unclassified events.

Miscellaneous

Event Code Description
cls Passwordless login code or link has been sent
fpar Failed pushed authorization request (PAR)
resource_cleanup Resources exceeding defined limits have been removed

Multi-factor authentication

The following unclassified events relate to multi-factor authentication (MFA):

Event Code Description
gd_auth_email_verification Email verification confirmed successfully
gd_auth_fail_email_verification Email verification failed
gd_auth_failed Mutli-factor authentication failed
gd_auth_rejected User rejected MFA request via push notification
gd_auth_succeed Multi-factor authentication succeeded
gd_recovery_failed User entered an invalid recovery code while attempting to authenticate
gd_recovery_succeed User successfully authenticated using a recovery code
gd_sent_email Email for MFA successfully sent
gd_send_email_failure Email for MFA failed to send
gd_send_email_verification Email verification successfully sent
gd_send_pn Push notification for MFA successfully sent
gd_send_pn_failure Push notification for MFA failed
gd_send_sms SMS for MFA successfully sent
gd_send_sms_failure SMS for MFA failed to send
gd_send_voice Voice call for MFA successfully sent
gd_send_voice_failure Voice call for MFA failed to send
gd_start_auth Second factor authentication event started for MFA
gd_start_enroll_failed Multi-factor authentication enrollment failed
gd_tenant_update MFA tenant settings have been updated
gd_webauthn_challenge_failed User failed to verify Webauthn factor
gd_webauthn_enrollment_failed Webauthn enrollment failed
mfar User prompted to complete MFA