Logging for Event Notifications

IBM Cloud services, such as Event Notifications, generate platform logs that you can use to investigate abnormal activity and critical actions in your account, and troubleshoot problems.

You can use IBM Cloud Logs Routing, a platform service, to route platform logs in your account to a destination of your choice by configuring a tenant that defines where platform logs are sent. For more information, see About Logs Routing.

You can use IBM Cloud Logs to visualize and alert on platform logs that are generated in your account and routed by IBM Cloud Logs Routing to an IBM Cloud Logs instance.

As of 28 March 2024, the IBM Log Analysis service is deprecated and will no longer be supported as of 30 March 2025. Customers will need to migrate to IBM Cloud Logs before 30 March 2025. During the migration period, customers can use IBM Log Analysis along with IBM Cloud Logs. Logging is the same for both services. For information about migrating from IBM Log Analysis to IBM Cloud Logs and running the services in parallel, see migration planning.

Locations where platform logs are generated

Field	Type
Dallas (`us-south`)	Yes
Sydney (`au-syd`)	Yes
Frankfurt (`eu-de`)	Yes
Madrid (`eu-es`)	Yes
London (`eu-gb`)	Yes

Locations where logs are sent to IBM Log Analysis

Event Notifications sends platform logs to IBM Log Analysis in the regions indicated in the following table.

Regions where platform logs are sent in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
Yes	No	No	No

Regions where platform logs are sent in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
No	Yes	No	No

Regions where platform logs are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)	Madrid (`eu-es`)
Yes	Yes	Yes

Locations where logs are sent by IBM Cloud Logs Routing

Event Notifications sends logs by IBM Cloud Logs Routing in the regions that are indicated in the following table.

Regions where platform logs are sent in Americas locations
Dallas (`us-south`)	Washington (`us-east`)	Toronto (`ca-tor`)	Sao Paulo (`br-sao`)
Yes	No	No	No

Regions where platform logs are sent in Asia Pacific locations
Tokyo (`jp-tok`)	Sydney (`au-syd`)	Osaka (`jp-osa`)	Chennai (`in-che`)
No	Yes	No	No

Regions where platform logs are sent in Europe locations
Frankfurt (`eu-de`)	London (`eu-gb`)	Madrid (`eu-es`)
Yes	Yes	Yes

Enabling logging

Platform logs are logs that are exposed by logging-enabled services and the platform in IBM Cloud.

Platform logs are regional.

You can monitor logs from enabled services on the IBM Cloud in the region where the service is available.
You can configure one instance only of the Log Analysis service per region to collect platform logs in that location.

You can have multiple Log Analysis instances in a location. However, only one instance in a location (region) can be configured to receive logs from enabled services in that IBM Cloud location.
To configure a Log Analysis instance, you must set on the platform logs configuration setting. Also, you must have the platform role editor or higher for the Log Analysis service in your account.

To enable platform logs, see:
- Configuring platform logs through the Observability dashboard
- Configuring platform logs from the command line

For more information about platform logs, see Configuring IBM Cloud platform logs.

Viewing logs

If a Log Analysis instance in a region is already enabled to collect platform logs, logs from the Event Notifications service in that region are collected automatically and available for analysis through this instance.

To view and analyze platform logs for an Event Notifications instance, check that the Log Analysis instance is provisioned in the same region where the Event Notifications instance that you want to monitor is available.

To start the Log Analysis web UI to view logs, see Navigating to the web UI.

Launching IBM Cloud Logs from the Observability page

For more information about launching the IBM Cloud Logs UI, see Launching the UI in the IBM Cloud Logs documentation.

Fields per log type

Table 4 outlines the fields that are included in each log record:

Table 4. Log record fields
Field	Type	Description
`logSourceCRN`	Required	Defines the account where the log is published.
`saveServiceCopy`	Required	Defines whether IBM saves a copy of the record for operational purposes.
`resourceGroupId`	Required	Defines the resource group that is associated with the Event Notifications instance.
`message`	Required	Description of the log that is generated.
`msg_timestamp`	Required	UTC timestamp of the message.
`messageID`	Required	ID of the log that is generated.
`resolution`	Optional	Guidance on how to proceed if you receive this log record.
`documentsURL`	Optional	More information on how to proceed if you receive this log record.
`sourceID`	Required	CRN of the IBM Cloud service that sends the notification through the Event Notifications service.
`notificationID`	Optional	ID of the notification that is sent to a destination.
`destinationID`	Optional	ID of the destination for which the status is being reported.
`level`	Required	Type of log. Valid values are `INFO`, `WARN`, `ERROR`

Log messages

The following table lists the message IDs that are generated by the Event Notifications service:

Additional information about message IDs
Message ID	Log type	Description
`event-notifications.00001I`	`INFO`	`A notification event from source <sourceID> has been received.` CRN is used for IBM Cloud services. SourceID can be an IBM Cloud service or a human, for example
`event-notifications.00002I`	`INFO`	`The notification ID <NOTIFICATION-ID> has been assigned to the event that is originated from source <sourceID>.`
`event-notifications.00003I`	`INFO`	`A notification event with ID <NOTIFICATION-ID> is published through the following topic IDs: [<LIST-OF-TOPIC-IDS>]`
`event-notifications.00004I`	`INFO`	`A notification request with ID <NOTIFICATION-ID> is processed by the following subscribers: [<LIST-OF-SUBSCRIPTIONS>]`
`event-notifications.00006I`	`INFO`	`No devices found for platform: push_chrome` Valid platforms are [push_chrome, push_firefox, push_android, push_ios, push_safari]
`event-notifications.00007I`	`INFO`	`An SMS is dispatched to the following numbers: [<LIST-OF-TELEPHONE-NUMBERS].`
`event-notifications.00008I`	`INFO`	`An email is sent to each of the following destinataries: [<LIST-OF-EMAIL-ADDRESSES>]`
`event-notifications.00009I`	`INFO`	`The Webhook is successfully served. Response from the Webhook API: OK with the status code: 200`
`event-notifications.00010I`	`INFO`	`A notification event with ID <NOTIFICATION_ID is sent to the following subscriptions.<LIST-OF_SUBSCRIPTIONS>`
`event-notifications.00011I`	`INFO`	`A notification event with ID <NOTIFICATION_ID is sent to the following destinations.<LIST-OF_DESTINATIONS>`
`event-notifications.00012I`	`INFO`	`Notification processed successfully for total: 1 devices and platform push_chrome`
`event-notifications.00013I`	`INFO`	`Notification dispatched successfully to total devices <COUNT> and platform push_android`.
`event-notifications.00014I`	`INFO`	`The Slack destination is successfully served. Response from the Slack API: OK with the status code: 200`.
`event-notifications.00015I`	`INFO`	`The notification is delievered to the deviceID:<DEVICE_ID> on the platform: <PLATFORM_NAME> and the destination ID:<DESTINATION_ID>`.
`event-notifications.00015I`	`INFO`	`The user has opened the notification on the deviceID:<DEVICE_ID> and the platform: <PLATFORM_NAME> and the destination ID:<DESTINATION_ID>.`
`event-notifications.00016I`	`INFO`	`The Microsoft Teams destination is successfully served. Response from the Microsoft Teams API: OK with the status code: 200`
`event-notifications.00017I`	`INFO`	`The IBM Cloud functions destination is successfully served. Response from the IBM Cloud functions API: OK with the status code: 200`
`event-notifications.00018I`	`INFO`	`The Pager Duty destination is successfully served. Response from the Pager Duty API: OK with the status code: 200`
`event-notifications.00019I`	`INFO`	`The Code Engine destination is successfully served. Response from the Code Engine API: OK with the status code: 200`
`event-notifications.00020I`	`INFO`	`The Service Now destination is successfully served. Response from the Service Now API: OK with the status code: 200`
`event-notifications.00021I`	`INFO`	`The Cloud Object Storage is successfully served. Response from the Cloud Object Storage API: OK with the status code: 200`
`event-notifications.00022I`	`INFO`	`An email of size 1048 bytes is sent to the following recepients: <masked-email-id>, from the sender: <masked-sender-email-id>`
`event-notifications.00023I`	`INFO`	`An email of size 1048 bytes is deferred to each of the following : <masked-email-id>, from the sender: <masked-sender-email-id>`
`event-notifications.00001W`	`WARN`	`A notification event from source<Source_ID> is rejected because no topic is configured for the source. . The topic to filter the event is missing.`
`event-notifications.00002W`	`WARN`	`A notification event from the source <Source_ID> is invalid as it is not filtered by any topic.`
`event-notifications.00003W`	`WARN`	`A notification request with ID <NOTIFICATION-ID>, that is processed by the following subscribers: [<LIST-OF-SUBSCRIPTIONS>], is forbidden for the destination type: smtp_ibm/sms`
`event-notifications.00004W`	`WARN`	`A notification with ID <NOTIFICATION_ID> is not dispatched as it has no subscribers.`
`event-notifications.00005W`	`WARN`	`Webhook returned with an error response: Not Found with the status code: 404`
`event-notifications.00006W`	`WARN`	`Slack returned with an error response: <error_message> with the status code: 404`
`event-notifications.00007W`	`WARN`	`Microsoft teams API returned with an error response: Not Found with the status code: 401`
`event-notifications.00008W`	`WARN`	`The SMS is not delivered because it is unsubscribed by: [<SMS_NUMBERS>]`
`event-notifications.00009W`	`WARN`	`IBM Cloud functions API returned with an error response: Not Found with the status code: 401`
`event-notifications.00010W`	`WARN`	`Pager Duty API returned with an error response: Not Found with the status code: 401`
`event-notifications.00011W`	`WARN`	`Code Engine functions API returned with an error response: Not Found with the status code: 401`
`event-notifications.00012W`	`WARN`	`Service Now API returned with an error response: Not Found with the status code: 401`
`event-notifications.00013W`	`WARN`	`An email of size 1xxx bytes is bounced, Please check the authentacity of the emails: [gagn13@in.ibm.com], from the sender: ts<oel*@xyz.com>host xyz.pphosted.com[] said: 550 5.1.1 User Unknown (in reply to DATA command`
`event-notifications.00001E`	`ERROR`	`Notifications failed to dispatch to the following invalid devices [<DEVICE_IDS>] and platform push_android.`
`event-notifications.00002E`	`ERROR`	`Webhook returned with an error response:<Error response> Unauthorised with the status code:404`
`event-notifications.00003E`	`ERROR`	`Notification dispatch failed due to the authentication error for device id <device_id> and platform <platform_name>`.
`event-notifications.00004E`	`ERROR`	`Slack returned with an error response: <error_message> with the status code: 401`
`event-notifications.00005E`	`ERROR`	`Notification dispatch failed due to the <'BadDeviceToken'> error for device id <device_id> and platform <platform_name>.`
`event-notifications.00006E`	`ERROR`	`Microsoft teams API returned with an error response: Unauthorised with the status code: 401`
`event-notifications.00007E`	`ERROR`	`IBM Cloud functions API returned with an error response: Unauthorised with the status code: 401`
`event-notifications.00008E`	`ERROR`	`Pager Duty API returned with an error response: Unauthorised with the status code: 401`
`event-notifications.00009E`	`ERROR`	`Code Engine API returned with an error response: Unauthorised with the status code: 401`
`event-notifications.00010E`	`ERROR`	`Service Now API returned with an error response: Unauthorised with the status code: 401`

-->

List logs generated by a service

If you want to view all the logs that are being generated for a particular source, get the sourceID from the Event Notifications service dashboard and use the following query in Log Analysis:

sourceID:<source_crn>

List logs for a notification request

If you know the notification ID that is generated for a request from a service or source to the Event Notifications service, use the following query in Log Analysis to list all logs for that particular notification ID:

notificationID:<notification Id>