User History - Missing Failed Login Log Events

Overview

Not all logs associated with a user are visible when looking at their history tab in the Dashboard.

Applies To

  • Dashboard
  • Monitoring
  • Logs

Cause

The history tab only shows log events that contain a “user_id” attribute that matches the currently viewed user account.

This is because a user can have multiple accounts with the same email address, but the user_id should be unique.

Some log events, such as types “fu”, ”f”, ”limit_wc”, “pwd_leak“ and “pla“ do not currently contain user_id values.

Solution

When trying to troubleshoot a user’s issues and relevant failures are missing from the user’s history tab, try performing a search in Monitoring > Logs using another known identifier such as IP or user_name (this will normally be the same as their email address unless usernames are in use on the connection).

Related References