Ccg log not showing provisioning Plan

Hi good morning

I always enable AD and JDBC source logs with this request:

{
    "clientId": null,
    "durationMinutes": 700,
    "rootLevel": "DEBUG",
    "logLevels": {
        "veniam_0": "TRACE",
        "ut_9": "TRACE",
        "sailpoint.connector.JDBCConnector": "TRACE",
        "sailpoint.connector.ADLDAPConnector": "TRACE",
        "sailpoint.connector.LDAPConnector": "TRACE"
    }
}

log.error and log.info work well but ccg logs are not showing anymore the Provisioning Plan info. It used to show something like this:

<ProvisioningPlan nativeIdentity=\"uprueba\">\n  
  <AccountRequest application=\"TEST - JDBC - DBs [source]\" op=\"Create\">\n    
    <AttributeRequest name=\"comsum\" op=\"Add\" value=\"N\"\/>\n    
    <AttributeRequest name=\"perfil\" op=\"Add\" value=\"PI1\"\/>\n 
<\/AccountRequest>\n    
<Attributes>\n    <Map>\n      <entry key=\"accessRequestType\" value=\"GRANT_ACCESS\"\/>\n

Do uyou still see the provisioning plan/account requests/attribute requests info on logs?

2 Likes

Hi @jsayago,

Iterate the account request and print it, it won’t print directly when we pass variable of plan or provisioning plan in logs, toXML() method works in IIQ, but it won’t work in ISC.

Thank You.

3 Likes

Hi @jsayago,

In ISC you cannot print provisioning plan in ccg.log. If you want to see the plan for active directory you can enable IQService logs and check there.
For JDBC you cannot get the plan. If you have a local version of IIQ you can test it there and deploy the changes in ISC which will be easier for you to complete the implementation.

Thanks,
Uday

1 Like

As previously mentioned, you can not get the provisioning plan in ccg.log for a JDBC connector. However, you can easily setup a JDBC Provision connector rule to print your desired outcome.

1 Like

I added log.info(“Plan” + plan.toMap()) on the connector rule (provisioning rule) and it worked but what I don’t understand is why a couple of weeks ago I could see all the info related to the operation on the logs before the execution of the rule.
For example I used to see the following lines prior to the execution of the rule itself:

<ProvisioningPlan nativeIdentity="uprueba">\n
<AccountRequest …

I discovered in an old log this line: “level”:“DEBUG”,“IdentityIQ” just before the provisioning info and now the level is INFO

{"stack":"ccg","pod":"se01-useast1","connector-logging":"151","Operation":"Modify","clusterId":"4225","utilities":"1.8.1","buildNumber":"984","apiUsername":"0e31edb2-ffc5-4553-aef5-ad4412c8f581","orgType":"","file":"JDBCConnector.java","encryption":"1.8.1","messageType":"provision","connector-bundle-identityiq":"213","line_number":879,"@version":1,"CB_version":"349","cloud-modules-api":"1477","logger_name":"sailpoint.connector.JDBCConnector","mantis-client":"1.8.1","class":"sailpoint.connector.JDBCConnector","ParentOperation":"ProvisioningOperation","atlas-api":"1823","va-gateway-client":"48","tracing":"1.8.1","clientId":"0e31edb2-bee5-4813-aef5-ad3332c8f778","request_milliseconds":"551","source_host":"1321218f2fff0","method":"provision","org":"partner5234","level":"DEBUG","IdentityIQ":"8.3p4 Build 1527a593753-20230805-223436","message":"<?xml version='1.0' encoding='UTF-8'?>\n<!DOCTYPE ProvisioningPlan PUBLIC \"sailpoint.dtd\" \"sailpoint.dtd\">\n<ProvisioningPlan nativeIdentity=\"ATE_MFEFEWA\">\n  <AccountRequest application=\"ABA lef<C3><B3>nica 2 [source]\" nativeIdentity=\"195252226\" op=\"Modify\">\n    <AttributeRequest name=\"uid\" op=\"Add\" value=\"ATE_MFEAEWF\"\/>\n    <ProvisioningResult status=\"failed\">\n

Do u know how can I restore the level of IdentityIQ module log to DEBUG?

1 Like

No clue on what might have happened in that case. To change the debugging level just edit the /sailpoint/ccg/log4j.properties file. Here you can set whatever level you desire.

1 Like

I created a second post as we have also noticed this and several other logs missing from the CCG logs that were previously there. I included some of the old logs I had that we are not currently seeing.

2 Likes

Is your cluster set to Debug? Log level on connector set via API?
I can confirm that I am still seeing the provisioning plan being printed out in the CCG log for a JDBC connector.

1 Like

Good morning
Yes, debugging is enabled on the cluster where the connector executes
image

Log level is set via API to trace:
image

1 Like

Best to open a support ticket for this.
It’s strange that you can’t see it being printed in the logs.

1 Like

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.