Logs in SailPoint IIQ

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Hi,

Can someone help me with some documentation on where I can find the available loggers in SailPoint and purpose of those loggers, so that I can use them based on need.

Connector Logs are straight forward; we can derive them from Connector Class. Wondering, how can I find any other logs like to monitor a task run like perform maintaince and refresh identity, etc.

Appreciate your support in sharing any sources/documentation related to this.

Thanks for reading!

2

@sarvanmarri There isn’t a single master document that lists every possible logger because IIQ uses standard Log4j2, meaning virtually every underlying Java class in the product can act as a logger. However, you can easily track down the loggers you need using these two methods:

1. The Default log4j2.properties File (Your Best Reference) The best “documentation” available is actually the out-of-the-box log4j2.properties file located in your IIQ installation at WEB-INF/classes/log4j2.properties. SailPoint ships this file with dozens of commonly used, commented-out loggers categorized by feature (e.g., provisioning, rules, tasks) along with brief comments explaining their purpose.

2. Finding Task-Specific Loggers via Debug For monitoring specific background tasks like Perform Maintenance or Refresh Identity, the logger name corresponds directly to the Java class executing the task. You can find this by opening the TaskDefinition object in the Debug page and looking at the executor attribute.

For the specific tasks you mentioned:

  • Refresh Identity: The task executor is sailpoint.task.IdentityRefreshExecutor.

    • Pro-tip: The heavy lifting of the refresh actually happens in the Identitizer API. To see the detailed breakdown of what is happening to the identities, you should also enable sailpoint.api.Identitizer.

  • Perform Maintenance: The task executor is sailpoint.task.PerformMaintenanceExecutor. The underlying API executing the database cleanup is sailpoint.api.PerformMaintenance.

If you are ever unsure of the exact class, you can enable logging at the package level to trace the execution and then narrow it down. For example, setting sailpoint.task to DEBUG will output logs for all task executors, allowing you to find the specific class name in the log output.

3

Hi @sarvanmarri,

A good place to start is the log4j2.properties file under:

WEB-INF/classes/log4j2.properties

The default IIQ file already contains a SailPoint loggers (troubleshooting) section, where you can find loggers for specific IIQ components. For example:

# Identity Refresh
logger.idRefreshExecutor.name=sailpoint.task.IdentityRefreshExecutor
logger.idRefreshExecutor.level=trace

# Aggregation
logger.aggregator.name=sailpoint.api.Aggregator
logger.aggregator.level=trace

# Provisioning
logger.provisioner.name=sailpoint.api.Provisioner
logger.provisioner.level=info

For broader task troubleshooting, you can also enable:

logger.spTask.name=sailpoint.task
logger.spTask.level=debug

So rather than looking for a separate log file for every task, identify the class/package responsible for the operation and enable its logger temporarily.

For example, for an Identity Refresh issue, sailpoint.task.IdentityRefreshExecutor is a useful starting point. After changing the logging level, reload the logging configuration from Debug → Logging (or restart the application server if required), reproduce the issue, and then revert the logger to avoid unnecessary DEBUG/TRACE volume.

The log4j2.properties file itself is a useful reference because SailPoint has already listed many of the commonly useful troubleshooting loggers there.

4

Hi @sarvanmarri

For logger details in IIQ, Navigate to the below file

WEB-INF/classes/log4j2.properties (or log4j.properties before version 8.x). The default file includes many commented-out loggers for common areas.

You can refer this URL for Best Practices for Logging:

Best Practices For Logging | IDMWORKS

There are some commonly used loggers listed below:

Perform Maintenance sailpoint.api.Terminator (deletions)
Refresh Identity Cube sailpoint.task.IdentityRefreshExecutor, sailpoint.api.Identitizer, sailpoint.api.EntitlementCorrelator (role detection/assignment)
Account aggregation sailpoint.api.Aggregator, plus the connector class
Provisioning sailpoint.api.Provisioner, sailpoint.provisioning.PlanCompiler, sailpoint.provisioning.PlanEvaluator
Workflows sailpoint.WorkflowTrace (step-by-step trace), sailpoint.api.Workflower
Policies / scoring sailpoint.api.Interrogator, sailpoint.api.ScoreKeeper
Certifications sailpoint.api.Certificationer