GET Log

Returns event information from the Trust Protection Platform log.

NOTE Parameter names and values differ from those in POST Log. Here are the differences:

GET Log and POST Log data types differ
Parameter	GET Log	POST Log
Id	Id is mixed case. Example: Id=43646975	ID is upper case. Example ID: 43646975
Severity	Severity takes a string. Example, Severity=Alert	Severity takes an integer that represents event severity. Example, for an Alert, specify Severity: 2

Requirements

Permissions: The caller must have View permission and Read permission to the default SQL channel object. The component parameter also requires View permission and Read permission to the component DN.
Token scope: Any valid scope, such as Agent, Certificate, or SSH

Headers

Content type: Content-Type:application/json.
Token: The bearer access token that you received. For example, Authorization:Bearer 4MyGeneratedBearerTknz==. For more information, see Passing a bearer token in your API calls.

Parameters

Input parameters
Name	Description
Component	(Optional) The Distinguished Name (DN) of an object that originated the event. For example: Component=\\VED\\Policy\\DataCenter1\\Cert1.
FromTime	(Optional) Valid only for GET Log. The UTC start time for retrieving event occurrences. Use the ISO 8601 format, for example FromTime=YYYY-MM-DDTHH:MM:SS.mmmmmmmZ.
Grouping	(Optional) An integer that corresponds to a set of events that involved the Component. For example Grouping=-496258952
Id	(Optional)The high bits that are shared among all Event IDs logged by this component. For example: Id=65538.
Limit	(Optional) Available only for GET Log. The number of events to return from the event log. The default is 100 and there is no maximum value. For example: Limit=100.
Offset	(Optional) Available only for GET Log. The number of events to skip after the Limit value. For example: Offset=2.
Order	(Optional) Available only for GET Log. The default sort order is by most recent ServerTimestamp. A comma separated set of sort preferences and fields. Any field is sortable except the Name field. Specify a sort preference followed by the field name: To sort fields in ascending order, either omit a sort symbol or use the plus (+) symbol. For example, Order=Id,+Severity sorts in ascending order by Event ID and then by Severity. To sort fields in descending order, use the minus (-) symbol. For example, order=-Id,-Severity sorts in descending order by Event ID and then by Severity. To mix sort, use a combination of plus or minus symbols. For example, +Order=Id,-Severity sorts in ascending order by Event ID and then descending order by Severity.
Severity	(Optional) A string value for one of these event severities: Emergency, Alert, Critical, Error, Warning, Notice, Info. Omit Debug because these events do not appear in the event log. For example, Severity=Alert.
Text1	Corresponds with Value1. A string variable that may be referenced by the event translation as defined by the log schema. For example, Text1=Heavy job.
Text2	A second string variable that may be referenced by the event translation as defined by the log schema. For example, Text2=Nightly job.
ToTime	(Optional) Available only for GET Log. The UTC end time for retrieving a range of event occurrences. For a range of events, set a FromTimethat occurred prior to the ToTime. Use the ISO 8601 format, for example ToTime=YYYY-MM-DDTHH:MM:SS.mmmmmmmZ.
Value1	Corresponds with Text1. An integer variable that may be referenced by the event translation as defined by the log schema. . For example: Value1=Job in progress.
Value2	Corresponds with Text2. A second integer variable that may be referenced by the event translation as defined by the log schema. For example: Value1=Job complete.

Returns

HTTP 200: The following message body:

Response description
Name	Description
LogEvents	An array of log events by ServerTimestamp. The newest log entry appears first. ClientTimestamp: The time that the client generated the event. Component: A string that identifies a Distinguished Name (DN) of an object. For events that occur in a subsystem other than Config, such as a Secret Store, the component may be blank. ComponentId: The component ID that originated the event. ComponentSubsystem: The component subsystem that originated the event. Data: The event stack trace. Otherwise, Null. Grouping: An integer that correlates to a set of events that involve the Component. Id: A hexadecimal value that corresponds to an Event Id. Name: The event name. ServerTimestamp: The time the Log server received the event. Severity: A string value for one of these event severities: Emergency, Alert, Critical, Error, Warning, Notice, Info, Debug. SourceIP: The IP address of the client that originated the event. Text1: A string variable that contains all or part of an event message. Text2: An additional string variable, if present, that appears as part of an event message. Value1: An integer variable. If present, appears as part of an event message. Value2: An additional integer variable. If present, appears as part of an event message.

Example 1: Get the two most recent log entries

Request for Example 1

GET https://tpp.venafi.example/vedsdk/Log?limit=2
Authorization:Bearer 4MyGeneratedBearerTknz==

Response for Example 1

HTTP/1.1 200 OK
{
   "LogEvents":[
      {
         "ClientTimestamp":"2018-02-08T21:15:32.0000000Z",
         "Component":"\\VED\\Identity\\AD1",
         "ComponentId":303,
         "ComponentSubsystem":"Config",
         "EventId":268960006,
         "Grouping":26,
         "Id":247136,
         "Name":"IdentityAD - Recovery Set Completed",
         "ServerTimestamp":"2018-02-08T21:15:33.0000000Z",
         "Severity":"Debug",
         "SourceIP":"172.16.1.100",
         "Text1":"AD+AD1",
         "Text2":"AD+AD1 Domain venafi.example",
         "Value1":0,
         "Value2":0
      },
      {
         "ClientTimestamp":"2018-02-08T21:15:32.0000000Z",
         "Component":"\\VED\\Identity\\AD1",
         "ComponentId":303,
         "ComponentSubsystem":"Config",
         "EventId":268960004,
         "GroupId":26,
         "Id":247135,
         "Name":"IdentityAD - Recover Controller Succeeded",
         "ServerTimestamp":"2018-02-08T21:15:33.0000000Z",
         "Severity":"Debug",
         "SourceIP":"172.16.1.100",
         "Text1":"AD+AD1 Domain venafi.example",
         "Text2":"PM-SSH-VED.venafi.example",
         "Value1":1,
         "Value2":0
      }
   ]
}

Example 2: Gather events for a particular time range

Request for Example 2

GET https://tpp.venafi.example/vedsdk/Log?FromTime=2018-05-04T00:00:00.0000000Z&ToTime=2018-05-04T23:59:59.0000000Z
Authorization:Bearer 4MyGeneratedBearerTknz==

Response for Example 2

HTTP/1.1 200 OK
{
   "LogEvents":[
      {
         "ClientTimestamp":"2018-0504T23:45:26.0000000Z",
         "Component":"\\VED\\Engines\\UX-TPP-1",
         "ComponentId":13,
         "ComponentSubsystem":"Config",
         "Grouping":0,
         "Id":851969,
         "Name":"Certificate Authority Driver Name Missing",
         "ServerTimestamp":"2018-05-12T21:39:24.0000000Z",
         "Severity":"Critical",
         "SourceIP":"192.168.7.198",
         "Text1":"",
         "Text2":null,
         "Value1":0,
         "Value2":0
      },
      {
         "ClientTimestamp":"2018-0504T16:25:26.0000000Z",
         "Component":"\\VED\\Secret Store",
         "ComponentId":5,
         "ComponentSubsystem":"Config",
         "Grouping":5282563,
         "Id":196618,
         "Name":"Secret Store - Retrieve Secret",
         "ServerTimestamp":"2018-0504T16:45:25.0000000Z",
         "Severity":"Info",
         "SourceIP":"192.168.7.198",
         "Text1":"admin",
         "Text2":"Null:Null",
         "Value1":5607,
         "Value2":0
      }
   ]
}