---
title: Auth Log
slug: kronpam-how-to-guides/auth-log
docTags: 
createdAt: 2025-04-30T11:48:52.765Z
---

This log contains logs of any authentication attempt made by the user on Kron PAM. The packets are sent to the server in the following format:

| **dbId**                    | Database ID of the authentication log in the PAM Database                                                                                                                                      |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **id**                      | Specific ID of the log in the PAM Database                                                                                                                                                     |
| **time**                    | Time trying to authenticate                                                                                                                                                                    |
| **event**                   | The event that takes on the following values: <br />0: LOGIN\_SUCCESS<br />1: LOGIN\_FAILURE<br />2: LOGOUT<br />3: LOGIN\_TOKEN\_PROVIDED<br />4: AUTH\_CHALLENGE                             |
| **eventSource**             | Event source for the authentication log. It can take on the following values: ui, api, Tacacs, global-user-auth, kcore-rest-api,scproxy-ssh-key, scproxy                                       |
| **clientIp**                | The source IP that sends the auth request                                                                                                                                                      |
| **tenantId**                | Tenant, the auth request has started                                                                                                                                                           |
| **Params**                  | Whether the Authentication is a success or a failure, the related parameters are sometimes noted in this field. Ex:” Active Directory Error 52e: Invalid Credentials”, “Global Username: root” |
| **nasIp**                   |  The IP address of the target device                                                                                                                                                           |
| **nasHostname**             |  The IP hostname of the target device                                                                                                                                                          |
| **username**                | The username entered in the interface                                                                                                                                                          |
| **externalDirectorySource** | If the user is an LDAP/AD user, this field is filled; The LDAP source name in KRON PAM                                                                                                         |
| **instanceName**            | Kron PAM instance by which the auth request is started                                                                                                                                         |
| **deviceGroupNames**        | Group names of the target device                                                                                                                                                               |

**Example:**

Authentication log with **admin&#x20;**&#x75;ser:

:::BlockQuote
\{dbId=1877583, id='be4c9d57-8111-432e-b98c-f56a3be8e3b5', time=2025-04-24 12:33:51.489, event=0, eventSource='global-user-auth', clientIp='10.0.1.1', tenantId='krontech', params='Global Username: pamuser', nasIp='10.10.10.10', nasHostname='10.10.10.10', userName='admin', externalDirectorySource=null, instanceName='kronPAM', deviceGroupNames='Linux Device'}
:::