Event Pipeline Activity Log

The event pipeline (EP) activity log records each time an EP runs. Each entry shows the event that triggered the run, the EP policy and EP that ran, the secret or user the event occurred on, when the event occurred, how long the run took, and the result. From any entry, you can open the run details to see what each task in the EP did.

Use the activity log to troubleshoot why an EP did or did not run, and to match EP runs against audit records and other logs.

Opening the Activity Log

The activity log is available at three levels:

  • All EP policies: Go to Settings > Event Pipelines, and click the Activity tab.

  • One EP policy: On the Policies tab, click the title of the EP policy card, and then click the Activity tab. Alternatively, click the EP policy card, and then click the View policy activity button in the panel on the right.

  • One EP: On the Pipelines tab, click the EP card, and then click the View pipeline activity button in the panel on the right.

Viewing the activity log requires the View Pipelines or Administer Pipelines role permission. The View policy activity and View pipeline activity buttons appear only for users with Administer Pipelines. Users with only View Pipelines can use the Activity tabs. See Permissions.

Activity Log Columns

Each row represents one EP that ran in response to one event. When an EP policy contains several EPs, one event produces one row for each EP, and those rows share the same run ID.

Column Description
Run ID The unique identifier for the EP policy run. Click it to open the run details. See Viewing Run Details.
Status The result of the EP run, such as Success, Failed, or Skipped.
Policy name The EP policy that ran.
Pipeline name The EP that ran.
Trigger The event action that triggered the run.
Type The type of item the event occurred on: a secret or a user.
Item name The secret or user the event occurred on. Click the name to open the secret or user.
Start date The date and time the triggering event occurred, shown as an absolute date and time. This is the time of the event, not the time the EP began processing. To see when processing began, open the run details. See Timestamps.
Duration How long the EP took to run, from the start of processing to the end, in a format such as 1m3.250s or 450ms. Time spent waiting in the queue is not included. The column is empty for skipped runs and shows a processing message while the run is in progress.

The log is sorted by Start date, newest first. Click a column heading to change the sort. The Run ID and Duration columns cannot be sorted.

Filtering the Activity Log

Use the filters above the log to narrow the entries. When you set more than one filter, the log shows only the entries that match all of them.

Filter Description
Status Shows All entries, or only Success, Failed, or Skipped entries.
Policy name Shows entries whose EP policy name contains the text you type.
Pipeline name Shows entries whose EP name contains the text you type.
Trigger Shows entries whose triggering event action contains the text you type.
Item name Shows entries whose secret name or user display name contains the text you type.
Type Shows All entries, or only entries for a Secret or a User.
Date range Shows entries whose triggering event occurred within the range. Preset ranges include the last 7, 30, and 90 days, last week, and last month. The end date includes the whole day.

The text filters match any part of the value. Characters such as % and _ are matched literally, not as wildcards.

Viewing Run Details

Click a Run ID to open the run details. The page heading shows the triggering event and the item it occurred on, in the form Triggered by <event> on <item>. Below the heading, the page shows these times for the run:

  • Queued: When the run was added to the processing queue.

  • Start date: When processing began.

  • Duration: How long processing took.

A grid lists each task the EP ran, with these columns:

  • Pipeline: The EP the task belongs to. Click the name to open the EP. The EP opens in its current configuration, which might have changed since the run.

  • Task name: The task that ran.

  • Status: The result of the task.

  • Notes: What the task did, or why it failed or was skipped. See Task Notes.

  • Duration: How long the task took to run.

Task Notes

When a task fails or is skipped, the Notes column shows the error or the reason. When a task succeeds, the Notes column shows output for these tasks:

Task Notes on Success
Tasks that send email, such as Send Email to List [OUTPUT:email] recipients: followed by the addresses the email was sent to. The entry lists recipients only. It does not confirm delivery.
Post Slack Message (WebHook) [OUTPUT:webhook] url: followed by the full webhook URL and the HTTP status code that Slack returned. Anyone who can view the activity log can see the webhook URL.
Run Script [OUTPUT:script] ran successfully. The script's output is not recorded.
Update Secret with a script [OUTPUT:script] fields updated: followed by the names of the secret fields the script updated.

For other tasks that succeed, and for tasks that ran before this output was recorded, the Notes column shows N/A.

Timestamps

The activity log shows absolute dates and times, such as the date and time an event occurred, rather than relative values such as 20 minutes ago.

Log Retention and Skipped Policies

Two advanced settings control what the activity log contains:

  • Event Pipeline Activity Log entries removed after (days): Entries older than this many days are removed from the log. Default value: 90.

  • Event Pipelines Log Skipped Policies: When true, the log also records EP policy runs that were skipped because of filters. Default value: False.

See Configuring Advanced Settings.