Keycyte PAM 3.2 · Administrator Guide
Log Types
Keycyte PAM keeps five audit logs. Each has its own page under the Logs menu.
| Menu item | Log | What it records |
|---|---|---|
| Logs > Client | Client log | What users do through the platform: session start and end, failed connections, sign-outs, administrator watches of sessions, MFA events and e-mail delivery. |
| Logs > System | System log | What administrators change in the Admin Panel: creating, editing and deleting objects, settings changes, session terminations, and calls to the Secrets API. |
| Logs > Password Manager | Password manager log | Password changes and verifications on vault accounts, with their result. |
| Logs > Access | Access log | Sign-in attempts to the Admin Panel and the Client Panel, successful and failed, and sign-outs. |
| Logs > Access Control | Access control log | Access requests: who asked for access to which server or account, for which period, and whether the request was allowed or denied. |
Working with a Log Page
All log pages work the same way:
- To search, type a word in Search Keyword and press Enter.
- To filter, click Advanced Filter, fill in the fields and click Apply. To remove the filters, click Clear Filters.
- To refresh the list, click Refresh.
Most rows can be expanded to show the full structured record, the same data that is sent to syslog.
Client Log
| Column | Description |
|---|---|
| Date Time | When the event happened. |
| Username | User the event belongs to. |
| Client IP | Browser address of the user. Empty for background events. |
| Category | Area of the event, for example connection, session, mfa or email. |
| Severity | INFO, WARNING or ERROR. |
| Message | Description of the event. |
Filters: Start Date, End Date, Username, Category, Severity, Event (event name, for example session_start) and Client IP.
System Log
| Column | Description |
|---|---|
| Date Time | When the change was made. |
| Username | Administrator (or service identity) that made the change. |
| Category | Area of the change. |
| Severity | INFO, WARNING or ERROR. |
| Type | Event name. |
| Message | Description of the change. |
The expanded record shows which object was changed and, for edits, the changed fields. Secret values are never written to the log.
Filters: Start Date, End Date, Username, Category, Severity and Event.
Password Manager Log
| Column | Description |
|---|---|
| Date Time | When the operation ran. |
| Username | User name of the vault account the operation ran on. |
| Operation | Operation performed. |
| Destination | Target system of the operation. |
| Severity | INFO, WARNING or ERROR. |
| Method | How the operation was performed. |
| Manager User | User who started the operation, or the system for scheduled rotations. |
| Message | Result or error message. |
Filters: Start Date, End Date, Manager User, Account, Operation and Severity.
Access Log
| Column | Description |
|---|---|
| Date Time | When the attempt happened. |
| Username | User name that was entered. |
| Client Address | Address the attempt came from. |
| Method | Result or authentication method of the attempt, for example success, failed, logout, keycyte or entra. |
| Type | User type. |
| Message | Details, for example Login successful, Invalid MFA code or Account temporarily locked. |
Filters: Start Date, End Date, Username, Method, Type and Client Address.
Access Control Log
| Column | Description |
|---|---|
| User | User who requested access. |
| Type | Server or Account. |
| Action | allow (approved), deny (rejected) or inactive (still waiting for an approver). |
| Request Date | When the request was made. |
| Start Date, End Date | Requested access period. |
| Reason | Reason the user gave. |
Filters: Start Date, End Date, User, Type and Action.