Log Stream Filters

You can filter your log streams so only select logs and log categories are delivered. To configure a log stream’s filter:

1. Go to Dashboard > Monitoring > Streams.
2. Select a log stream and go to the Settings tab.
3. Enable or disable filters in the Filter By Event Category menu.
4. Click Save.

Actions event filters

Filter	Description
Action Execution - Failure	Failed Action execution events

Action Execution - Failure

Event Code	Description
actions_execution_failed	Execution of an Action failed

Authentication event filters

Filter	Description
Login - Failure	Failed login events
Login - Notification	Login notification events
Login - Success	Successful login events
Logout - Failure	Failed logout events
Logout - Success	Successful logout events
Signup - Failure	Failed signup events
Signup - Success	Successful signup events
Silent Authentication - Failure	Failed silent authentication events
Silent Authentication - Success	Successful silent authentication events
Token Exchange - Failure	Failed token exchange events
Token Exchange - Success	Successful token exchange events

Login - Failure

Event Code	Description
f	Failed login
fc	Failed connector login
fco	Origin is not in the application’s Allowed Origins list
fcoa	Failed cross-origin authentication
fens	Failed native social login
fp	Incorrect password
fu	Invalid email or username

Login - Notification

Event Code	Description
w	Warnings during login

Login - Success

Event Code	Description
s	Successful login
scoa	Successful cross-origin authentication
sens	Successful native social login

Logout - Failure

Event Code	Description
flo	User logout failed
oidc_backchannel_logout_failed	Failed OIDC back-channel logout request

Logout - Success

Event Code	Description
oidc_backchannel_logout_succeeded	Successful OIDC back-channel logout request
slo	User successfully logged out

Signup - Failure

Event Code	Description
fs	User signup failed

Signup - Success

Event Code	Description
ss	Successful user signup

Silent Authentication - Failure

Event Code	Description
fsa	Failed silent authentication

Silent Authentication - Success

Event Code	Description
ssa	Successful silent authentication

Token Exchange - Failure

Event Code	Description
feacft	Failed exchange of Authorization Code for Access Token
feccft	Failed exchange of Access Token for a Client Credentials Grant
fede	Failed exchange of Device Code for Access Token
feoobft	Failed exchange of Password and OOB Challenge for Access Token
feotpft	Failed exchange of Password and OTP Challenge for Access Token
fepft	Failed exchange of Password for Access Token
fepotpft	Failed exchange of Passwordless OTP for Access Token
fercft	Failed exchange of Password and MFA Recovery code for Access Token
ferrt	Failed exchange of Rotating Refresh Token
fertft	Failed exchange of Refresh Token for Access Token

Token Exchange - Success

Event Code	Description
seacft	Successful exchange of Authorization Code for Access Token
seccft	Successful exchange of Access Token for a Client Credentials Grant
sede	Successful exchange of Device Code for Access Token
seoobft	Successful exchange of Password and OOB Challenge for Access Token
seotpft	Successful exchange of Password and OTP Challenge for Access Token
sepft	Successful exchange of Password for Access Token
sercft	Successful exchange of Password and MFA Recovery code for Access Token
sertft	Successful exchange of Refresh Token for Access Token

Management API event filters

Filter	Description
Management API - Failure	Failed Management API events
Management API - Success	Successful Management API events

Management API - Success

Event Code	Description
sapi	Successful Management API operation
mgmt_api_read	API GET operation returning secrets completed successfully

System event filters

Filter	Description
System - Notification	System notification events

System - Notification

Event Code	Description
admin_update_launch	Auth0 Update Launched
api_limit	The maximum number of requests to the Authentication or Management APIs in given time has reached
coff	AD/LDAP Connector is offline
con	AD/LDAP Connector is online and working
depnote	Deprecation Notice
fcpro	Failed to provision a AD/LDAP connector
fui	Failed to import users
limit_delegation	Rate limit exceeded to /delegation endpoint
limit_mu	An IP address is blocked with 100 failed login attempts using different usernames, all with incorrect passwords in 24 hours, or 50 sign-up attempts per minute from the same IP address
limit_wc	An IP address is blocked with 10 failed login attempts into a single account from the same IP address
sys_os_update_start	Auth0 OS Update Started
sys_os_update_end	Auth0 OS Update Ended
sys_update_start	Auth0 Update Started
sys_update_end	Auth0 Update Ended

User/Behavioral event filters

Filter	Description
User/Behavioral - Failure	Failed user/behavioral events
User/Behavioral - Notification	User/behavioral notification events
User/Behavioral - Success	Successful user/behavioral events

User/Behavioral - Failure

Event Code	Description
fce	Failed to change user email
fcp	Failed to change password
fcpn	Failed to change phone number
fcpr	Failed change password request
fcu	Failed to change username
fd	Failed to generate delegation token
fdeaz	Device authorization request failed
fdecc	User did not confirm device
fdu	Failed user deletion
fn	Failed to send email notification
fv	Failed to send verification email
fvr	Failed to process verification email request

User/Behavioral - Notification

Event Code	Description
cs	Passwordless login code has been sent
gd_enrollment_complete	A first time MFA user has successfully enrolled using one of the factors
gd_start_enroll	Multi-factor authentication enroll has started
gd_unenroll	Device used for second factor authentication has been unenrolled
gd_update_device_account	Device used for second factor authentication has been updated
ublkdu	User block setup by anomaly detection has been released

User/Behavioral - Success

Event Code	Description
sce	Successfully changed user email
scp	Successfully changed password
scpn	Successfully changed phone number
scpr	Successful change password request
scu	Successfully changed username
sdu	User successfully deleted
srrt	Successfully revoked a Refresh Token
sui	Successfully imported users
sv	Successfully consumed email verification link
svr	Successfully called verification email endpoint, verification email in queue.

Other

SCIM Events

Event Code	Description
sscim	Successful SCIM operation
fscim	Failed SCIM operation

Other Events

This category contains unclassified events.