Ccg log not showing provisioning Plan

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi good morning

I always enable AD and JDBC source logs with this request:

{
    "clientId": null,
    "durationMinutes": 700,
    "rootLevel": "DEBUG",
    "logLevels": {
        "veniam_0": "TRACE",
        "ut_9": "TRACE",
        "sailpoint.connector.JDBCConnector": "TRACE",
        "sailpoint.connector.ADLDAPConnector": "TRACE",
        "sailpoint.connector.LDAPConnector": "TRACE"
    }
}

log.error and log.info work well but ccg logs are not showing anymore the Provisioning Plan info. It used to show something like this:

<ProvisioningPlan nativeIdentity=\"uprueba\">\n  
  <AccountRequest application=\"TEST - JDBC - DBs [source]\" op=\"Create\">\n    
    <AttributeRequest name=\"comsum\" op=\"Add\" value=\"N\"\/>\n    
    <AttributeRequest name=\"perfil\" op=\"Add\" value=\"PI1\"\/>\n 
<\/AccountRequest>\n    
<Attributes>\n    <Map>\n      <entry key=\"accessRequestType\" value=\"GRANT_ACCESS\"\/>\n

Do uyou still see the provisioning plan/account requests/attribute requests info on logs?

2

Hi @jsayago,

Iterate the account request and print it, it won’t print directly when we pass variable of plan or provisioning plan in logs, toXML() method works in IIQ, but it won’t work in ISC.

Thank You.

3

Hi @jsayago,

In ISC you cannot print provisioning plan in ccg.log. If you want to see the plan for active directory you can enable IQService logs and check there.
For JDBC you cannot get the plan. If you have a local version of IIQ you can test it there and deploy the changes in ISC which will be easier for you to complete the implementation.

Thanks,
Uday

4

As previously mentioned, you can not get the provisioning plan in ccg.log for a JDBC connector. However, you can easily setup a JDBC Provision connector rule to print your desired outcome.

5

I added log.info(“Plan” + plan.toMap()) on the connector rule (provisioning rule) and it worked but what I don’t understand is why a couple of weeks ago I could see all the info related to the operation on the logs before the execution of the rule.
For example I used to see the following lines prior to the execution of the rule itself:

<ProvisioningPlan nativeIdentity="uprueba">\n
<AccountRequest …

I discovered in an old log this line: “level”:“DEBUG”,“IdentityIQ” just before the provisioning info and now the level is INFO

{"stack":"ccg","pod":"se01-useast1","connector-logging":"151","Operation":"Modify","clusterId":"4225","utilities":"1.8.1","buildNumber":"984","apiUsername":"0e31edb2-ffc5-4553-aef5-ad4412c8f581","orgType":"","file":"JDBCConnector.java","encryption":"1.8.1","messageType":"provision","connector-bundle-identityiq":"213","line_number":879,"@version":1,"CB_version":"349","cloud-modules-api":"1477","logger_name":"sailpoint.connector.JDBCConnector","mantis-client":"1.8.1","class":"sailpoint.connector.JDBCConnector","ParentOperation":"ProvisioningOperation","atlas-api":"1823","va-gateway-client":"48","tracing":"1.8.1","clientId":"0e31edb2-bee5-4813-aef5-ad3332c8f778","request_milliseconds":"551","source_host":"1321218f2fff0","method":"provision","org":"partner5234","level":"DEBUG","IdentityIQ":"8.3p4 Build 1527a593753-20230805-223436","message":"<?xml version='1.0' encoding='UTF-8'?>\n<!DOCTYPE ProvisioningPlan PUBLIC \"sailpoint.dtd\" \"sailpoint.dtd\">\n<ProvisioningPlan nativeIdentity=\"ATE_MFEFEWA\">\n  <AccountRequest application=\"ABA lef<C3><B3>nica 2 [source]\" nativeIdentity=\"195252226\" op=\"Modify\">\n    <AttributeRequest name=\"uid\" op=\"Add\" value=\"ATE_MFEAEWF\"\/>\n    <ProvisioningResult status=\"failed\">\n

Do u know how can I restore the level of IdentityIQ module log to DEBUG?

6

No clue on what might have happened in that case. To change the debugging level just edit the /sailpoint/ccg/log4j.properties file. Here you can set whatever level you desire.

7

I created a second post as we have also noticed this and several other logs missing from the CCG logs that were previously there. I included some of the old logs I had that we are not currently seeing.

8

Is your cluster set to Debug? Log level on connector set via API?
I can confirm that I am still seeing the provisioning plan being printed out in the CCG log for a JDBC connector.

9

Good morning
Yes, debugging is enabled on the cluster where the connector executes
image

Log level is set via API to trace:
image

10

Best to open a support ticket for this.
It’s strange that you can’t see it being printed in the logs.