> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/troubleshooting/logs-and-diagnostics/audit-log-export-errors.md). # Audit log export errors Error codes and log messages from the audit log export connectors, with the cause and the action for each. The error codes and log messages the **audit log export** feature produces, each mapped to its cause and the action to take. Export is configured in [Audit and export](/administration-guide/operations/audit-and-export.md); this page is for when it is configured and not working. How to use it: * Everything here is emitted by `audit-log-manager`, not the webconsole. Look in that service's log. * Log strings are quoted as they appear in the code (`[...]` denotes a connector/identifier the service fills in), so you can grep for them. * API error codes are the `ResponseCode` values returned to callers and surfaced in the webconsole. {% hint style="info" %} **Looking for a different service's errors?** There is no single index of every message OpenIAM emits. [Which log answers which question](/administration-guide/operations/which-log-to-read.md) maps a symptom to the service that records it, and names the log lines worth grepping for. {% endhint %} ## How export fails Export runs asynchronously; failures are retried up to **2** times and then recorded as failed dispatches (which can be listed and manually retried from the connector's failed-dispatch view). ### API error codes (returned on save / surfaced in the webconsole)

Response code	Cause / action
`CANNOT_INSTANTIATE_GROOVY_CLASS`	The connector's transformer Groovy script does not implement `IdmAuditLogExportTransformer` (webconsole shows "Groovy class must extend export transformer"). Fix the script's class.
`CHECK_GROOVY_EXCEPTION`	The transformer Groovy script failed to compile/instantiate on save. Check the script for errors.
`INVALID_ARGUMENTS`	An unsupported operation was requested (e.g. an unknown API name, or a purge with an empty list).

### Log messages

Log message (quoted from code)	Cause / action
`Dispatch failed for connector [...] auditLogId [...]: <error>`	A delivery attempt failed; `<error>` is the underlying cause. Retried, then recorded as a failed dispatch.
`HTTP connector [...]: POST to <url> returned non-2xx status <code>`	The webhook endpoint rejected the request. Verify the endpoint URL, the Authentication Token / Auth Header Name, and the endpoint's own logs.
`HTTP connector [...]: failed to serialize payload`	The transformed payload could not be serialized to JSON. Check the transformer's output.
`HTTP connector [...]: transformer failed, using empty map`	The transformer threw at runtime; an empty payload was sent. Fix or remove the transformer.
`HTTP connector [...]: transformer headers() failed, skipping custom headers`	The transformer's custom-header logic threw; the request was sent without the custom headers.
`Syslog connector [...]: cannot resolve hostname '<host>'`	DNS/host resolution failed — the event is dropped for that connector. Verify the Hostname.
`Syslog connector [...]: error opening socket` / `... error sending message`	UDP send problem. Check network/firewall reachability to the syslog Port.
`Syslog connector [...]: transformer failed, using empty map`	The transformer threw at runtime; an empty message was sent. Fix or remove the transformer.
`Groovy script <id> does not implement IdmAuditLogExportTransformer, falling back to default`	A configured transformer isn't a valid transformer; the connector used the default (full-event) payload instead.
`Failed to instantiate transformer for groovyScriptId=<id>, falling back to default`	The transformer could not be loaded at cache-refresh time; the default payload was used.
`Failed to refresh AuditExportConnectorCache`	The service could not reload connectors from the database; recent connector changes may not be applied. Check DB connectivity for `audit-log-manager`.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/troubleshooting/logs-and-diagnostics/audit-log-export-errors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.