Logging and monitoring
Where the management agent records what it did, and what to watch in production.
There are three places to look when something goes wrong, and you'll usually need more than one of them:
MIM run history for the run result, object counts, and per-object errors
The management agent log for what the connector was doing at the time
The Windows Application event log for warnings and errors worth alerting on
Start with the run history error, then match its time against the management agent log.
Management agent log
The path, level, and retention are set on the Connectivity page. The file rolls daily, and Number of days to retain logs controls how many daily files are kept.
Levels are Trace, Debug, Info, Warn, Error, and Fatal. Run at the Info level for day-to-day use, and drop to Debug or Trace only while reproducing a problem.
Timestamps are the MIM server's local time. The MIM Synchronization Service account must be able to create and append to the file.
Reading import diagnostics
At Info level an import records, for each object type, how many objects Okta returned, how long the enumeration took, the processing concurrency, and how long any factor or membership requests took.
This split is what lets you diagnose a slow import. A long enumeration time with fast processing points to Okta or rate limiting, while fast enumeration with long processing points to the per-object work, which in practice means the factor or membership attributes.
When those attributes are selected, the log also records the number of extra requests made, the values returned, any failures, and the elapsed time. Read those figures before you touch page sizes or concurrency in Advanced settings.
One number regularly causes confusion: MIM reports a single imported-object count that covers every selected object type, so an import of 52 users and 52 groups reports 104. The management agent log records the two counts separately.
Windows event log
Warnings and errors are written to the Application log with the source:
What to monitor
Failed run profiles
An import that returns zero objects when it should not
Import and export error counts
Run durations drifting upwards
Okta rate-limit errors
Log file growth, and failures to write the log
API token validity, or changes to the OAuth app
Certificate expiry, if you use X.509 authentication
That the scheduled full import is actually completing
Last updated