Ticketing System (TS) audit logs in Google Distributed Cloud (GDC) air-gapped let you track user authentication activity for ticketing applications. These security logs record the user identity, login mode, event outcome, timestamp, source IP address, session ID, and assigned roles for successful and failed application sign-in attempts.
Application login
Application login operations include:
- Application sign in success
- Application sign in failure
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | user |
(Also present: user_id=8e3e...) |
|
Target / Mode |
mode |
(Also relevant: url=/login.do) |
|
Action / Event |
event |
|
| Event timestamp |
Time
|
(Epoch milliseconds, corresponds to Thu, 01 Dec 2022 18:12:15.020 GMT) |
| Source of action | source_ip, host, http_uagent |
Source IP: Host: User Agent: |
| Outcome | event |
|
| Other useful fields | session_id, user_roles, log_type |
Session ID: User Roles: Log Type: Host: |
Example log
Time=1669936335020 host=as1 Default-thread-23 event="LOGIN_SUCCESS" authentication_multi_factor_enabled="false" mode="login" authentication_parameter1="user_name=jimmy.watchcommander" user_roles="sn_request_read" log_type="SECLOG" session_id="5307B5" source_ip="10.253.168.66" tx_num="2985" url="/login.do" domain="global" http_last_time="1668193688784" jsession_id="A6F412" http_uagent="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" user="jimmy.watchcommander" user_id="8e3e1d3b872a5910f91431dd0ebb357c" http_time_zone="America/New_York" user_group="[c92a31ea979d5910ea2a7b021153af00, 9a293b0897155110ea2a7b021153af84]" http_browser="chrome"