IBM Cloud Docs
Logging for Event Notifications

Logging for Event Notifications

You can view and analyze Event Notifications logs by using the IBM® Log Analysis service and enabling platform logs in each region where you operate in IBM Cloud. IBM Log Analysis adds log management capabilities to your IBM Cloud® architecture.

Use the IBM Cloud Activity Tracker service to audit and track how users and applications interact with the Event Notifications service.

Platform logs

Platform logs are logs that are exposed by logging-enabled services and the platform in IBM Cloud.

  • Platform logs are regional.

    You can monitor logs from enabled services on the IBM Cloud in the region where the service is available.

  • You can configure one instance only of the Log Analysis service per region to collect platform logs in that location.

    You can have multiple Log Analysis instances in a location. However, only one instance in a location (region) can be configured to receive logs from enabled services in that IBM Cloud location.

  • To configure a Log Analysis instance, you must set on the platform logs configuration setting. Also, you must have the platform role editor or higher for the Log Analysis service in your account.

    To enable platform logs, see:

For more information about platform logs, see Configuring IBM Cloud platform logs.

Locations

The following table outlines the locations where you can view and analyze Event Notifications logs:

Table 1. The automatic collection of Container Registry service metrics in Americas locations
Locations in Americas Platform logs available
Dallas (us-south) Checkmark icon
Table 2. The automatic collection of Container Registry service metrics in Asia Pacific locations
Locations in Asia Pacific Platform logs available
Sydney (au-syd) Checkmark icon
Table 3. The automatic collection of Container Registry service metrics in Europe locations
Locations in Europe Platform logs available
Frankfurt (eu-de) Checkmark icon
Madrid (eu-es) Checkmark icon
London (eu-gb) Checkmark icon

Viewing logs

If a Log Analysis instance in a region is already enabled to collect platform logs, logs from the Event Notifications service in that region are collected automatically and available for analysis through this instance.

To view and analyze platform logs for an Event Notifications instance, check that the Log Analysis instance is provisioned in the same region where the Event Notifications instance that you want to monitor is available.

To start the Log Analysis web UI to view logs, see Navigating to the web UI.

Fields per log type

Table 4 outlines the fields that are included in each log record:

Table 4. Log record fields
Field Type Description
logSourceCRN Required Defines the account where the log is published.
saveServiceCopy Required Defines whether IBM saves a copy of the record for operational purposes.
resourceGroupId Required Defines the resource group that is associated with the Event Notifications instance.
message Required Description of the log that is generated.
msg_timestamp Required UTC timestamp of the message.
messageID Required ID of the log that is generated.
resolution Optional Guidance on how to proceed if you receive this log record.
documentsURL Optional More information on how to proceed if you receive this log record.
sourceID Required CRN of the IBM Cloud service that sends the notification through the Event Notifications service.
notificationID Optional ID of the notification that is sent to a destination.
destinationID Optional ID of the destination for which the status is being reported.
level Required Type of log. Valid values are INFO, WARN, ERROR

Log messages

The following table lists the message IDs that are generated by the Event Notifications service:

Table 5. Message IDs
Message ID Log type Description
event-notifications.00001I INFO A notification event from source <sourceID> has been received. CRN is used for IBM Cloud services. SourceID can be an IBM Cloud service or a human, for example
event-notifications.00002I INFO The notification ID <NOTIFICATION-ID> has been assigned to the event that is originated from source <sourceID>.
event-notifications.00003I INFO A notification event with ID <NOTIFICATION-ID> is published through the following topic IDs: [<LIST-OF-TOPIC-IDS>]
event-notifications.00004I INFO A notification request with ID <NOTIFICATION-ID> is processed by the following subscribers: [<LIST-OF-SUBSCRIPTIONS>]
event-notifications.00006I INFO No devices found for platform: push_chrome Valid platforms are [push_chrome, push_firefox, push_android, push_ios, push_safari]
event-notifications.00007I INFO An SMS is dispatched to the following numbers: [<LIST-OF-TELEPHONE-NUMBERS].
event-notifications.00008I INFO An email is sent to each of the following destinataries: [<LIST-OF-EMAIL-ADDRESSES>]
event-notifications.00009I INFO The Webhook is successfully served. Response from the Webhook API: OK with the status code: 200
event-notifications.00010I INFO A notification event with ID <NOTIFICATION_ID is sent to the following subscriptions.<LIST-OF_SUBSCRIPTIONS>
event-notifications.00011I INFO A notification event with ID <NOTIFICATION_ID is sent to the following destinations.<LIST-OF_DESTINATIONS>
event-notifications.00012I INFO Notification processed successfully for total: 1 devices and platform push_chrome
event-notifications.00013I INFO Notification dispatched successfully to total devices <COUNT> and platform push_android.
event-notifications.00014I INFO The Slack destination is successfully served. Response from the Slack API: OK with the status code: 200.
event-notifications.00015I INFO The notification is delievered to the deviceID:<DEVICE_ID> on the platform: <PLATFORM_NAME> and the destination ID:<DESTINATION_ID>.
event-notifications.00015I INFO The user has opened the notification on the deviceID:<DEVICE_ID> and the platform: <PLATFORM_NAME> and the destination ID:<DESTINATION_ID>.
event-notifications.00016I INFO The Microsoft Teams destination is successfully served. Response from the Microsoft Teams API: OK with the status code: 200
event-notifications.00017I INFO The IBM Cloud functions destination is successfully served. Response from the IBM Cloud functions API: OK with the status code: 200
event-notifications.00018I INFO The Pager Duty destination is successfully served. Response from the Pager Duty API: OK with the status code: 200
event-notifications.00019I INFO The Code Engine destination is successfully served. Response from the Code Engine API: OK with the status code: 200
event-notifications.00020I INFO The Service Now destination is successfully served. Response from the Service Now API: OK with the status code: 200
event-notifications.00021I INFO The Cloud Object Storage is successfully served. Response from the Cloud Object Storage API: OK with the status code: 200
event-notifications.00022I INFO An email of size 1048 bytes is sent to the following recepients: <masked-email-id>, from the sender: <masked-sender-email-id>
event-notifications.00023I INFO An email of size 1048 bytes is deferred to each of the following : <masked-email-id>, from the sender: <masked-sender-email-id>
event-notifications.00001W WARN A notification event from source<Source_ID> is rejected because no topic is configured for the source. . The topic to filter the event is missing.
event-notifications.00002W WARN A notification event from the source <Source_ID> is invalid as it is not filtered by any topic.
event-notifications.00003W WARN A notification request with ID <NOTIFICATION-ID>, that is processed by the following subscribers: [<LIST-OF-SUBSCRIPTIONS>], is forbidden for the destination type: smtp_ibm/sms
event-notifications.00004W WARN A notification with ID <NOTIFICATION_ID> is not dispatched as it has no subscribers.
event-notifications.00005W WARN Webhook returned with an error response: Not Found with the status code: 404
event-notifications.00006W WARN Slack returned with an error response: <error_message> with the status code: 404
event-notifications.00007W WARN Microsoft teams API returned with an error response: Not Found with the status code: 401
event-notifications.00008W WARN The SMS is not delivered because it is unsubscribed by: [<SMS_NUMBERS>]
event-notifications.00009W WARN IBM Cloud functions API returned with an error response: Not Found with the status code: 401
event-notifications.00010W WARN Pager Duty API returned with an error response: Not Found with the status code: 401
event-notifications.00011W WARN Code Engine functions API returned with an error response: Not Found with the status code: 401
event-notifications.00012W WARN Service Now API returned with an error response: Not Found with the status code: 401
event-notifications.00013W WARN An email of size 1xxx bytes is bounced, Please check the authentacity of the emails: [g*a*g*n*1*3@in.ibm.com], from the sender: t*s*<*o*e*l*@xyz.com>host xyz.pphosted.com[] said: 550 5.1.1 User Unknown (in reply to DATA command
event-notifications.00001E ERROR Notifications failed to dispatch to the following invalid devices [<DEVICE_IDS>] and platform push_android.
event-notifications.00002E ERROR Webhook returned with an error response:<Error response> Unauthorised with the status code:404
event-notifications.00003E ERROR Notification dispatch failed due to the authentication error for device id <device_id> and platform <platform_name>.
event-notifications.00004E ERROR Slack returned with an error response: <error_message> with the status code: 401
event-notifications.00005E ERROR Notification dispatch failed due to the <'BadDeviceToken'> error for device id <device_id> and platform <platform_name>.
event-notifications.00006E ERROR Microsoft teams API returned with an error response: Unauthorised with the status code: 401
event-notifications.00007E ERROR IBM Cloud functions API returned with an error response: Unauthorised with the status code: 401
event-notifications.00008E ERROR Pager Duty API returned with an error response: Unauthorised with the status code: 401
event-notifications.00009E ERROR Code Engine API returned with an error response: Unauthorised with the status code: 401
event-notifications.00010E ERROR Service Now API returned with an error response: Unauthorised with the status code: 401

Analyzing logs

List logs generated by a service

If you want to view all the logs that are being generated for a particular source, get the sourceID from the Event Notifications service dashboard and use the following query in Log Analysis:

sourceID:<source_crn>

List logs for a notification request

If you know the notification ID that is generated for a request from a service or source to the Event Notifications service, use the following query in Log Analysis to list all logs for that particular notification ID:

notificationID:<notification Id>