> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/operations.md). # Monitor and maintain OpenIAM Route to the evidence you need — a failed operation, an audit trail, a stale index, a SIEM feed or an outbound integration. ## What this is, and when you need it Operating OpenIAM is mostly one skill: knowing where the evidence for a given claim lives. This section is for the administrator holding a symptom rather than a task — an operation that failed, a question about who changed what, a screen that disagrees with the data behind it. An OpenIAM operation crosses a browser, an Access Gateway, a front-end web server, a UI service, the ESB, a message broker, a connector and an external system, and each layer keeps its own record. A green message in the Webconsole is evidence about the first two layers only. ## Start here 1. [Which log answers which question](/administration-guide/operations/which-log-to-read.md) — the routing page, and the one to open first when all you have is a symptom. It says what the audit log can and cannot tell you, which service log explains which class of failure, and the things no log records at all. 2. [Diagnose a failed operation](/administration-guide/operations/diagnose-a-failed-operation.md) — one failed operation walked down through the layers, from the user object to the object in the managed system. Everything on it is read-only. 3. [Find audit evidence](/administration-guide/operations/find-audit-evidence.md) — the audit trail as a record: where events live, the parent and child tree, what the search screen can filter on, and what retention does to it. The two maintenance operations in this section that change state — [Rebuild a search index](/administration-guide/operations/rebuild-a-search-index.md) and [Rebuild the authorization graph](/administration-guide/operations/rebuild-the-authorization-graph.md) — each name their own required access, their risk and the evidence that they worked. Both also name a gap: the authorization graph has no rebuild control on any screen. Ending somebody's sessions is the third operation of this kind, and it lives with the rest of the sign-in material — [Terminate a user's sessions](/administration-guide/security/session-management.md), which is also the page to read for the gap that no screen lists or ends another person's sessions. Read [Change configuration safely](/administration-guide/start/change-safely.md) before any of them: all three are on its wide-blast-radius list, and pruned audit history is one of the few genuinely irreversible things in the product. ## Choose your outcome | I want to… | Go to | | ------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Work out which log holds the answer to the symptom in front of me | [Which log answers which question](/administration-guide/operations/which-log-to-read.md) | | Name the service log to ask for when I have no shell access | [Which log answers which question](/administration-guide/operations/which-log-to-read.md#the-service-logs-and-what-each-one-is-responsible-for) | | Raise a logger category so a specific diagnostic line appears | [Which log answers which question](/administration-guide/operations/which-log-to-read.md#raising-the-detail-level) | | Work out why a provisioning, synchronization or sign-in operation failed | [Diagnose a failed operation](/administration-guide/operations/diagnose-a-failed-operation.md) | | Find who changed something, and when | [Find audit evidence](/administration-guide/operations/find-audit-evidence.md) | | Search cannot find an object that is present and correct | [Rebuild a search index](/administration-guide/operations/rebuild-a-search-index.md) | | Membership is right and the user's effective access disagrees | [Rebuild the authorization graph](/administration-guide/operations/rebuild-the-authorization-graph.md) | | See who is signed in, or stop one person's live sessions | [Terminate a user's sessions](/administration-guide/security/session-management.md) | | Offboard a leaver, and find out which parts of it OpenIAM does not automate | [Offboard a leaver end to end](/administration-guide/lifecycle/offboard-a-leaver.md) | | A user cannot sign in and I need to work out why | [A user cannot sign in](/administration-guide/security/cannot-sign-in.md) | | Audit and log timestamps are out by a whole number of hours | [Timestamps off by a fixed offset](/administration-guide/operations/timestamps-off-by-a-fixed-offset.md) | | Limit how long audit events are kept, or find out why nothing is ever deleted | [Audit actions and retention](/administration-guide/reference/audit-actions-and-retention.md) | | Feed audit events to Splunk, Sentinel, QRadar or any syslog collector | [Audit export to a SIEM](/administration-guide/operations/audit-and-export.md) | | Choose between provisioning, a manual task, an outbound ticket and audit export | [Integration patterns for external systems](/administration-guide/operations/enterprise-integrations.md) | | Raise a ServiceNow incident when a request is approved | [Raise a ServiceNow incident from an approval](/administration-guide/requests/approval-flows/raise-a-servicenow-incident.md) — it is configured as part of the approval flow | | Hand work in a connector-less system to a person | [Manual fulfilment](/administration-guide/requests/fulfilment.md) | | Understand what OpenIAM can and cannot do with Teams or Slack | [Integration patterns for external systems](/administration-guide/operations/enterprise-integrations.md#collaboration-channels-and-their-real-boundary) | | Plan a backup, or test a restore | [What a backup and restore must cover](/administration-guide/platform/backup-and-restore-scope.md) | | Move configuration between environments | [Promote configuration between environments](/administration-guide/platform/import-export-and-promotion.md) | | Look up an audit action name, an index name or a batch task's schedule | [Reference](/administration-guide/reference.md) | ## Three shipped defaults that shape operations {% hint style="warning" %} **Audit history is kept indefinitely.** Every `org.openiam.audit.log.prune.days*` property ships `-1` (never prune) and the `PRUNE_AUDIT_LOGS` batch task ships disabled, so nothing deletes audit events. The trail is complete; the `auditlog` index grows without bound. Capping it is a deliberate change. **The audit log is not in the database.** It is an OpenSearch index. The `auditlog` *database* schema holds only audit-export configuration, so a database backup does not preserve your audit trail. **A health check reporting `UP` excludes RabbitMQ and Redis.** `management.health.rabbit.enabled` and `management.health.redis.enabled` both ship `false`, so neither contributes to the result. {% endhint %} *Applies to OpenIAM 2026.8.1. Last reviewed 7 August 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/operations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.