Skip to content

Trace one operation end to end

Put every record one request produced in your tenant on a single timeline, oldest first, using the request's correlation identifier, so you can follow what happened across the platform's services.

Who can do it

A tenant administrator or a tenant auditor, and a platform super administrator or platform auditor working in your tenant. Tracing needs the permission to trace a request by its correlation identifier; the built-in key manager role does not hold it.

Before you start

  • You need a correlation identifier, a UUID. Every event's details on your Audit Log show the correlation identifier of the request that produced it.
  • The timeline is built from the cryptographic and administrative trails. A sign-in is followed from your Audit Log instead.

Steps

  1. Reach the trace in one of two ways:
    • On a row in the activity of a key, an application or a user, select Trace request.
    • Or open the trace screen at its address and paste the identifier into the search box.
  2. Select Trace. The identifier becomes part of the page address, so the result is a link you can send to someone who may read the same trails.
  3. Read Trace Summary, then the Event Timeline.
  4. Select Copy correlation ID to put the identifier on your clipboard for a ticket.

What you see when it worked

Trace Summary states the total events, the cryptographic operations, the administrative actions, the total duration from the first record to the last, and a status: FAILURE when any record failed, "Performed — result withheld" when none failed but an operation's result was withheld, and SUCCESS otherwise. Each record on the timeline shows the gap in milliseconds from the one before it.

Everything shown belongs to your tenant. When the request also touched another tenant, only your side of it is returned, so a gap in the timing is not evidence that nothing happened in between.

If it fails

What you see Cause What to do
"No events found for this correlation ID" No record carrying that identifier exists on the trails you may read in your tenant "Verify the correlation ID is correct and try again"; then check whether the records you expect are sign-ins, which are not on this timeline
"Failed to load correlation trace" The read failed Try again

Without the console

The console has no control for reading the final state of one operation by its event identifier; use the API for that.

Surface How
API, the whole timeline GET /api/v3/audit/correlation/{correlationId} (operation getAllEventsByCorrelation)
API, one trail GET /api/v3/audit/correlation/{correlationId}/crypto (getCryptoEventsByCorrelation) and GET /api/v3/audit/correlation/{correlationId}/admin (getAdminEventsByCorrelation)
API, one operation's final state (no console control) GET /api/v3/audit/tenants/{tenantId}/operations/{eventId} (getTenantOperationResult), by the original event identifier of a cryptographic or access event: whether its result was answered or withheld

There is no CLI command and no admin SDK method for tracing.