PingAccess

New
  • Published on Sep 16, 2026
  • 5 minute(s) read
Prev Next

PingAccess is an application access management product from Ping Identity that secures web applications, APIs, and resources through centralized access control and policy enforcement. It supports modern authentication and authorization standards, helping organizations protect applications across on-premises, cloud, and hybrid environments.

For more information, refer to the official PingAccess product page.

Integration Method:  Data Collector (Flat file)

Tables: API Activity (6003), HTTP Activity (4002)

This integration supports the following events.

Event

 Description

API Audit Logs

List of API related audit logs in the server.

Audit Logs

List of agent and engine related audit logs in the server.

This integration supports the following versions.

PingAccess

PingAccess >= 9.0

Prerequisites

  • The user should have administrator access to the device where the PingAccess 9.0 or higher is installed.

  • The user should have a compatible version of the system in which we can configure the data collector.

  • The user should have access to the DataBee console.

Configuration Overview

  1. Update the Log4j.xml file of PingAccess to support JSON logs.

  2. Data Collector Configuration and Installation.

  3. Create PingAccess Data Feed in the DataBee console.

Update the Log4j file to support JSON logs

PingAccess generates different audit logs that need to be configured for JSON output:

  • Engine Audit Logs - Contains transaction records of configured resources.

  • Agent Audit Logs - Contains transaction records between PingAccess agents and the PingAccess engine

  • API Audit Logs - Contains PingAccess administrative application programming interface (API) transaction records

Step 1: Backup the Existing Configuration

PingAccess uses log4j as a logging service. Before making any changes, create a backup of the Log4j configuration file. Make sure the backup is taken.

Location: <pa_home>/conf/log4j2.xml

Replace the pa_home with the actual PingAccess install location.
Ex: C:\Program Files\Ping Identity\pingaccess-9.0.3\conf\log4j2.xml

Step 2: Enable JSON Audit Logging

2.1 Configure the JSON Audit Appender

  • Open the log4j2.xml file in a text editor

  • Locate the following JSON audit appenders and verify that they are configured as shown below.

    • API Audit Log

      <RollingFile name="ApiAuditLog-JSON"
fileName="${sys:pa.home}/log/pingaccess_json_api_audit.log"
filePattern="${sys:pa.home}/log/pingaccess_json_api_audit.%d{yyyy-MM-dd}.log" ignoreExceptions="false">
<JsonTemplateLayout eventTemplateUri="${sys:pa.log4j.json.templates.uri}/api-audit-log.json"/>
<Policies>
<TimeBasedTriggeringPolicy/>
</Policies>
</RollingFile>

    • Engine Audit Log

      <RollingFile name="EngineAuditLog-JSON"
fileName="${sys:pa.home}/log/pingaccess_json_engine_audit.log"
filePattern="${sys:pa.home}/log/pingaccess_json_engine_audit.%d{yyyy-MM-dd}.log" ignoreExceptions="false">
<JsonTemplateLayout eventTemplateUri="${sys:pa.log4j.json.templates.uri}/engine-audit-log.json"/>
<Policies>
<TimeBasedTriggeringPolicy/>
</Policies>
</RollingFile>

    • Agent Audit Log

      <RollingFile name="AgentAuditLog-JSON"
fileName="${sys:pa.home}/log/pingaccess_json_agent_audit.log"
filePattern="${sys:pa.home}/log/pingaccess_json_agent_audit.%d{yyyy-MM-dd}.log" ignoreExceptions="false">
<JsonTemplateLayout eventTemplateUri="${sys:pa.log4j.json.templates.uri}/agent-audit-log.json"/>
<Policies>
<TimeBasedTriggeringPolicy/>
</Policies>
</RollingFile>

    Key Configuration Details:

    • fileName – Path to the JSON audit log file.

    • filePattern – Daily rotation pattern for log files.

    • JsonTemplateLayout – Enables JSON output format using PingAccess JSON templates.

    • TimeBasedTriggeringPolicy – Rotates log files daily.

    Default JSON Template Location:

    • The ${sys:pa.log4j.json.templates.uri} property points to <pa_home>/conf/log4j/json-templates

    The corresponding template files with json templated are:

    • <pa_home>/conf/log4j/json-templates/api-audit-log.json

      {
  "timestamp": {
    "$resolver": "timestamp",
    "pattern": {
      "format": "yyyy-MM-dd'T'HH:mm:ss.SSSXX"
    }
  },
  "exchangeId": {
    "$resolver": "mdc",
    "key": "exchangeId",
    "stringified": true
  },
  "trackingId": {
    "$resolver": "mdc",
    "key": "AUDIT.trackingId",
    "stringified": true
  },
  "roundTripMS": {
    "$resolver": "pattern",
    "pattern":"%X{AUDIT.roundTripMS} ms"
  },
  "subject": {
    "$resolver": "mdc",
    "key": "AUDIT.subject",
    "stringified": true
  },
  "authMech": {
    "$resolver": "mdc",
    "key": "AUDIT.authMech",
    "stringified": true
  },
  "client": {
    "$resolver": "mdc",
    "key": "AUDIT.client",
    "stringified": true
  },
  "method": {
    "$resolver": "mdc",
    "key": "AUDIT.method",
    "stringified": true
  },
  "requestUri": {
    "$resolver": "mdc",
    "key": "AUDIT.requestUri",
    "stringified": true
  },
  "responseCode": {
    "$resolver": "mdc",
    "key": "AUDIT.responseCode",
    "stringified": true
  }
}

    • <pa_home>/conf/log4j/json-templates/engine-audit-log.json

      {
  "timestamp": {
    "$resolver": "timestamp",
    "pattern": {
      "format": "yyyy-MM-dd'T'HH:mm:ss.SSSXX"
    }
  },
  "exchangeId": {
    "$resolver": "mdc",
    "key": "exchangeId",
    "stringified": true
  },
  "trackingId": {
    "$resolver": "mdc",
    "key": "AUDIT.trackingId",
    "stringified": true
  },
  "roundTripMS": {
    "$resolver": "pattern",
    "pattern":"%X{AUDIT.roundTripMS} ms"
  },
  "resource": {
    "$resolver": "mdc",
    "key": "AUDIT.resource",
    "stringified": true
  },
  "client": {
    "$resolver": "mdc",
    "key": "AUDIT.client",
    "stringified": true
  },
  "method": {
    "$resolver": "mdc",
    "key": "AUDIT.method",
    "stringified": true
  },
  "requestUri": {
    "$resolver": "mdc",
    "key": "AUDIT.requestUri",
    "stringified": true
  },
  "responseCode": {
    "$resolver": "mdc",
    "key": "AUDIT.responseCode",
    "stringified": true
  },
  "applicationName": {
    "$resolver": "mdc",
    "key": "AUDIT.applicationName",
    "stringified": true
  },
  "resourceName": {
    "$resolver": "mdc",
    "key": "AUDIT.resourceName",
    "stringified": true
  },
  "pathPrefix": {
    "$resolver": "mdc",
    "key": "AUDIT.pathPrefix",
    "stringified": true
  }
}

    • <pa_home>/conf/log4j/json-templates/agent-audit-log.json

      {
  "timestamp": {
    "$resolver": "timestamp",
    "pattern": {
      "format": "yyyy-MM-dd'T'HH:mm:ss.SSSXX"
    }
  },
  "exchangeId": {
    "$resolver": "mdc",
    "key": "exchangeId",
    "stringified": true
  },
  "trackingId": {
    "$resolver": "mdc",
    "key": "AUDIT.trackingId",
    "stringified": true
  },
  "roundTripMS": {
    "$resolver": "pattern",
    "pattern":"%X{AUDIT.roundTripMS} ms"
  },
  "proxyRoundTripMS": {
    "$resolver": "pattern",
    "pattern":"%X{AUDIT.proxyRoundTripMS} ms"
  },
  "resource": {
    "$resolver": "mdc",
    "key": "AUDIT.resource",
    "stringified": true
  },
  "subject": {
    "$resolver": "mdc",
    "key": "AUDIT.subject",
    "stringified": true
  },
  "authMech": {
    "$resolver": "mdc",
    "key": "AUDIT.authMech",
    "stringified": true
  },
  "client": {
    "$resolver": "mdc",
    "key": "AUDIT.client",
    "stringified": true
  },
  "method": {
    "$resolver": "mdc",
    "key": "AUDIT.method",
    "stringified": true
  },
  "requestUri": {
    "$resolver": "mdc",
    "key": "AUDIT.requestUri",
    "stringified": true
  },
  "responseCode": {
    "$resolver": "mdc",
    "key": "AUDIT.responseCode",
    "stringified": true
  },
  "failedRuleType": {
    "$resolver": "mdc",
    "key": "AUDIT.failedRuleType",
    "stringified": true
  },
  "failedRuleName": {
    "$resolver": "mdc",
    "key": "AUDIT.failedRuleName",
    "stringified": true
  },
  "applicationName": {
    "$resolver": "mdc",
    "key": "AUDIT.applicationName",
    "stringified": true
  },
  "resourceName": {
    "$resolver": "mdc",
    "key": "AUDIT.resourceName",
    "stringified": true
  },
  "pathPrefix": {
    "$resolver": "mdc",
    "key": "AUDIT.pathPrefix",
    "stringified": true
  }
}

Note:

Leave the default JSON templates and eventTemplateUri values unchanged. Modifying them may impact log ingestion and parsing the feed.

2.2 Enable Audit Logger References

Locate the following logger configurations and add or uncomment the JSON appender references.

  • Logger 1: API Audit Logger

    <Logger name="apiaudit" level="${sys:pa.log.level.apiaudit:-INFO}" additivity="false">
<AppenderRef ref="APIAuditLog-File"/>
<AppenderRef ref="ApiAuditLog-JSON"/>
</Logger>

  • Logger 2: Engine Audit Logger

    <Logger name="engineaudit" level="${sys:pa.log.level.engineaudit:-INFO}" additivity="false">
<AppenderRef ref="EngineAuditLog-File"/>
<AppenderRef ref="EngineAuditLog-JSON"/>
</Logger>

  • Logger 3: Agent Audit Logger

    <Logger name="agentaudit" level="${sys:pa.log.level.agentaudit:-INFO}" additivity="false">
<AppenderRef ref="AgentAuditLog-File"/>
<AppenderRef ref="AgentAuditLog-JSON"/>
</Logger>

What This Enables:

  • Administrative API operations and configuration changes

  • Access policy evaluation events

  • Agent-to-engine transaction auditing

  • Authentication and authorization events

  • Security and compliance audit records

Step 3: Save and Restart PingAccess

  • Save the changes to log4j2.xml

  • Restart the PingAccess service for the changes to take effect.

  • Wait for startup to complete (typically 30-60 seconds)

  • After startup verify the log files available at the <pa_home>/log/ location. Look for files with the below name formats,

    • API Audit Logs

      • pingaccess_json_api_audit.log

      • pingaccess_json_api_audit.yyyy-MM-dd.log

    • Engine Audit Logs

      • pingaccess_json_engine_audit.log

      • pingaccess_json_engine_audit.yyyy-MM-dd.log

    • Agent Audit Logs

      • pingaccess_json_agent_audit.log

      • pingaccess_json_agent_audit.yyyy-MM-dd.log

Data Collector Configuration and Installation

To receive logs from PingAccess, a Data Collector must be installed and configured in the device where the PingAccess logs will be available. The data collector is used to fetch logs from files on-prem environment and send data to DataBee securely.

Follow the steps provided in DataBee's official documentation to complete the configuration. Additionally, refer to this guide for detailed instructions on installing the Data Collector on your machine.

DataBee Configuration

  1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
     

  2. Search for PingAccess and click on it as shown below.

     

  3. Click on the Data Collector option for collection.
     

  4. Click on the Flat File option as the polling mechanism.
     

  5. Enter the feed contact information, select the collector that you have created from the drop down, and then scroll down.

  6. In the configuration page, confirm the following, then scroll down.

    • Format: json

    • Refresh Interval (minutes): Set as per your requirement

    • Source Files: Add below patterns for audit and server log files,

      1. <pa_home>\log\pingaccess_json_api_audit.*

      2. <pa_home>\log\pingaccess_json_engine_audit.*

      3. <pa_home>\log\pingaccess_json_agent_audit.*

  7. click on Submit.

Troubleshooting Tips

  • Issue: JSON Log Files Not Created

    • Possible Causes:

      • PingAccess not restarted after configuration changes

      • Syntax errors in log4j2.xml

    • Solution: Make sure log4j2.xml is correctly updated, if needed, compare it with backup file. Make sure to restart PingAccess after changes.

  • If you encounter any issues regarding log forwarding, refer to the DataBee troubleshooting document for detailed guidance.

Copyright © 2026 DataBee®, A Comcast Company.
DataBee® is a registered trademark of Comcast.