AIC Sentinel -A Modern Web-Based Log Viewer for PingOne Advanced Identity Cloud
Real-time log streaming, intelligent filtering, transaction tracing, and historical search for PingOne AIC
By Mark Nienaber — February 2026
Introduction
PingOne Advanced Identity Cloud (AIC) has fantastic logging capabilities through its monitoring API, giving you access to both audit and debug logs across AM and IDM. And there are genuinely excellent tools for working with them. fidc-debug-tools by Volker Scheuber has been my go-to for CLI-based log tailing, and Frodo CLI provides powerful command-line access to your AIC environments including log management. I’ve relied on both heavily and still do.
But I kept wanting something more visual. Something where I could see AM and IDM logs together in one stream, toggle noise categories on and off with a click, hover over a transaction ID and instantly trace every related log entry across both systems. That led me to create AIC Sentinel, a browser-based log viewer for PingOne Advanced Identity Cloud that brings real-time streaming, intelligent noise filtering, one-click transaction tracing, historical search, and export capabilities right into your browser.
It’s built on the same AIC monitoring API that fidc-debug-tools and Frodo use, but wraps it in an interactive UI that makes debugging sessions genuinely enjoyable rather than something you endure.
How Logging Works in PingOne AIC
Before getting into the tool, let’s cover the official methods for accessing logs in AIC. Understanding these is important because AIC Sentinel builds on top of the same underlying API.
PingOne AIC retains logs for 30 days and provides three methods to access them:
Method 1: REST API (Pull)
The primary programmatic method. You authenticate with an API key and secret, then query the /monitoring/logs endpoints directly.
Setup: Navigate to Tenant Settings > Global Settings > Log API Keys in the admin console, create a new key, and note the api_key_id and api_key_secret.
Tail logs (most recent entries):
curl — get \
— header ‘x-api-key: <api-key>’ \
— header ‘x-api-secret: <api-secret>’ \
— data ‘source=am-authentication’ \
‘https://<tenant-fqdn>/monitoring/logs/tail’
Query logs (with time range and filters):
curl — get \
— header ‘x-api-key: <api-key>’ \
— header ‘x-api-secret: <api-secret>’ \
— data ‘source=am-authentication’ \
— data-urlencode ‘_queryFilter=/payload/principal eq “user@example.com”’ \
‘https://<tenant-fqdn>/monitoring/logs’
This gives you full access to everything, and tools like fidc-debug-tools and Frodo CLI make working with these endpoints much more convenient from the command line. That said, when you’re tailing am-everything, the sheer volume of data can be overwhelming in a terminal, which is exactly where a visual interface shines.
For full details, see the official documentation: Retrieve log entries using the API.
Method 2: Admin Console Monitoring (Beta)
AIC provides a built-in log monitoring interface in the admin console, available only in development and sandbox environments (not production). Navigate to Monitoring to access live tail, search, and filtering capabilities.
This is great for quick checks in your lower environments and provides a convenient built-in option without any additional tooling.
For more details: Monitor log entries in the admin console.
Method 3: Log Streaming to External SIEM (Push)
For production monitoring, AIC supports streaming logs to external platforms like Splunk, Grafana Cloud, Datadog, and New Relic via the telemetry API endpoints.
This is the recommended approach for production monitoring, alerting, and long-term log retention with your existing observability stack.
For more details: Manage log streaming using the API.
Why a Web-Based Log Viewer?
Between the REST API, the admin console, SIEM streaming, fidc-debug-tools, and Frodo CLI, there’s no shortage of ways to access your AIC logs. They’re all great options, and each has real strengths depending on what you’re trying to do.
But here’s the thing. During those intense debugging sessions where you’re tailing logs, triggering actions, and trying to figure out what on earth just happened, it can be really hard to piece things together when AM and IDM logs are in separate streams, or when the volume of routine log entries buries the signal in noise. I found myself constantly wishing I could just see everything in one place, click to filter, hover to trace.
AIC Sentinel was inspired by the excellent work in fidc-debug-tools and adds a visual, interactive layer on top of the same AIC monitoring API. The key difference is the UI. None of the existing tools provide a browser-based interface for log viewing, and that’s the gap this tool fills.
Unified AM + IDM View
This is probably my favourite feature. Instead of running separate tails for AM and IDM and trying to mentally correlate timestamps, AIC Sentinel streams both into a single, unified view. Entries are colour-coded by source (amber for AM, cyan for IDM) so you can instantly see which system generated each log entry, without losing the chronological interleaving that’s critical for understanding cross-system flows.
When you’re debugging an authentication journey that involves IDM callbacks, or tracing an OAuth flow that touches both AM and IDM, having everything in one timeline is a game-changer.
14 Noise Filter Categories
This is where things get really fun. If you’ve ever tailed am-everything, you know that the vast majority of log entries are internal housekeeping. CTS operations, session lookups, health checks, LDAP connection pool management. Important for the system, but noise when you’re trying to debug.
Rather than writing custom include/exclude filters for every session, AIC Sentinel groups noisy loggers into 14 categories that you can toggle on or off with a single click:
In a typical debugging session, the default settings alone eliminate the vast majority of noise, leaving you with the entries that actually matter. And if you need to see what a specific category is doing, just toggle it back on. It’s one click.
You can also mute individual loggers on the fly. Just hover over any logger name in the log viewer and click the mute icon. No need to open settings.
Transaction Tracing
This is honestly one of the most powerful features, and I’m really excited about how it turned out. Every request that flows through AIC gets a transaction ID that links all the related log entries together, across AM, IDM, authentication nodes, OAuth endpoints, everything.
In AIC Sentinel, when you hover over any transaction ID, it transforms into an orange Trace badge. Click it, and instantly every log in the viewer filters down to just that transaction. The filter input glows orange so you know tracing is active, and there’s a clear x button to get back to the full view.
This is incredibly useful for: — Authentication debugging — trace a single login attempt from the initial request through every journey node, callback, and session creation — OAuth flows — follow a token exchange from the authorize endpoint through consent, token generation, and introspection — IDM operations — trace a sync event or managed object operation across all the services involved
It takes what used to be a manual process of copying transaction IDs and crafting query filters, and turns it into a single click.
Smart Log Messages
AIC log entries contain rich detail in their JSON payloads, but let’s be honest, parsing through nested JSON to find the event name or the principal isn’t exactly fun. AIC Sentinel extracts contextual information and presents it as a readable summary for each entry. You’ll see the event name, principal, journey/tree name, node outcome, HTTP method and path. The stuff you actually care about at a glance.
This means you can scan through hundreds of log entries quickly, spot the one that looks relevant, and only then expand it to see the full JSON payload with syntax highlighting. It’s a huge time saver.
Real-Time WebSocket Streaming
Instead of polling from the browser (which would eat through your rate limit in no time), the tool uses a Node.js backend that polls the AIC tail endpoint and streams results to your browser over WebSockets. This gives you a smooth, real-time experience with configurable poll frequency (2–30 seconds) and automatic rate limit management.
The status bar at the bottom shows your connection state, rate limit usage, log count, and whether you’re in live tailing or historical mode. You always know what’s going on.
Historical Search with Easy Mode Switching
Open the historical search panel to query logs by time range with quick presets (last 15 minutes, 1 hour, 6 hours, 24 hours) or custom start/end times. Filter by Transaction ID to trace a specific request across both AM and IDM. The tool automatically splits longer time ranges into 24-hour chunks to work within API pagination limits.
When you’re viewing historical results, a prominent banner makes it crystal clear that live tailing is paused, and the status bar shows an amber Historical indicator. One click on Resume Live Tailing gets you back to real-time mode. No more confusion about whether you’re looking at live data or search results.
Saved Connections & Session Persistence
If you work with multiple tenants (and who doesn’t?), you can save and manage multiple connections with masked credentials. Switch between your development, staging, and sandbox environments without re-entering credentials every time.
Get Mark Nienaber’s stories in your inbox
Join Medium for free to get updates from this writer.
Your entire session state, connection details, filters, noise settings, persists across page refreshes via session storage. Accidentally close the tab? Just reopen it and you’re right back where you were.
Export
Export your logs in three formats:
- JSON — Pretty-printed, suitable for further processing
- Text — Human-readable with timestamps, levels, and loggers
- CSV — With columns for timestamp, source, level, logger, transactionId, and message
Export all logs or just the currently filtered view. GThank you.reat for sharing with colleagues or attaching to support tickets.
Architecture
The tool is intentionally lightweight, just three production dependencies:
├── server.js # Express + WebSocket entry point
├── src/
│ ├── api/
│ │ ├── logClient.js # HTTP client for AIC tail + query endpoints
│ │ └── rateLimiter.js # Rate limit tracking (60 req/min)
│ ├── ws/
│ │ └── tailManager.js # Per-client WebSocket polling manager
│ ├── routes/
│ │ ├── connection.js # POST /api/connect
│ │ └── logs.js # Search, config, sources endpoints
│ └── data/
│ ├── categories.json # 14 noise filter category definitions
│ └── sources.json # Log source metadata
├── tests/
│ └── e2e.test.js # End-to-end test suite (48 tests)
└── public/
├── index.html # Single-page application
├── css/app.css # Tailwind CSS
└── js/
├── app.js # Alpine.js store + WebSocket client
└── utils/ # Formatting and time utilities
The backend polls the AIC /monitoring/logs/tail endpoint, respects the 60 requests/minute rate limit via X-RateLimit header tracking, and streams results to connected browsers over WebSockets. The frontend is a single-page application built with Alpine.js and Tailwind CSS (loaded via CDN, no build step required).
The whole thing is deliberately simple. No webpack, no React build pipeline, no complex state management. Just a Node.js server and a well-structured HTML page. It installs in seconds and just works.
Getting Started
Prerequisites
· Node.js (v18 or later)
· AIC Log API credentials — Create these under Tenant Settings > Global Settings > Log API Keys in your AIC admin console
Installation
Lets clone the public repository, then we will move into the directory and install the prerequsites.
git clone https://github.com/mark-nienaber/aic-sentinel.git
cd aic-sentinel
npm install
Configuration
You can either configure via environment variables (Optional) or enter credentials directly in the browser UI, whichever you prefer.
Or to use environment variables, copy the example file and edit:
cp .env.example .env
PORT=3000
TENANT_URL=https://your-tenant.forgeblocks.com
API_KEY_ID=your-api-key-id
API_KEY_SECRET=your-api-key-secret
POLL_FREQUENCY=10
MAX_LOG_BUFFER=5000
Run
npm start
Open your browser to http://localhost:3000. If you configured the .env file, your credentials will be pre-filled. Otherwise, enter them in the connection panel and click Connect. You can also save the connection for next time.
Typical Debugging Workflow
Here’s how I actually use the tool during a debugging session, and it’s become second nature:
- Connect to the AIC tenant (or pick a saved connection)
- Check the noise filters. The defaults are usually perfect, but if I’m debugging something specific like you can chose appropriately
- Trigger the action in the AIC tenant (attempt a login, run a sync, trigger an OAuth flow, etc.)
- Scan the smart messages. The contextual summaries make it easy to spot the entries that matter
- Trace a transaction. Hover over a transaction ID and click the trace badge to follow a single request across AM and IDM
- Click to expand any entry to see the full JSON payload with syntax highlighting
- Mute a noisy logger. If one particular logger is cluttering things up, just hover and click mute
- Search history if I need to look back at earlier events
- Export the filtered logs to share with a colleague or attach to a support ticket
Now, Fix your problems and try again :)
Complementing Existing Tools
AIC Sentinel isn’t trying to replace the existing tools. It complements them. Here’s how I think about the options:
Frodo CLI — A powerhouse CLI for managing AIC environments, including log access. If you’re already using Frodo for environment management, its log capabilities are right there.
AIC Admin Console Monitoring — Built-in, no setup required, ideal for quick checks in development and sandbox environments.
fidc-debug-tools — Still available for quick CLI-based log tailing. This project was the original inspiration for AIC Sentinel, and I’m grateful for Volker’s excellent work.
AIC Sentinel — Adds the visual, browser-based layer with unified AM/IDM views, one-click noise filtering, transaction tracing, and interactive historical search.
All of these tools use the same underlying AIC monitoring API. It’s a matter of choosing the right interface for your workflow. And honestly, I find myself switching between them depending on what I’m doing.
Security Considerations
A few things to keep in mind:
- This tool is designed for development and debugging use. For production log monitoring, use AIC’s log streaming to an external SIEM.
- Credentials are stored in your browser’s local storage when using saved connections, with API secrets masked in the UI. This is convenient for development but keep it in mind for shared machines.
- The tool runs locally. Your API credentials are sent from the Node.js backend directly to your AIC tenant. They are not transmitted to any third party.
- Rotate your Log API keys periodically, as you would with any credential.
Conclusion
PingOne Advanced Identity Cloud has excellent logging capabilities, and the ecosystem of tools for working with them keeps getting better. AIC Sentinel adds something that was missing from the mix, a browser-based, visual interface inspired by the excellent fidc-debug-tools and complementing tools like Frodo CLI.
Whether you’re tracing an authentication journey through every node, following an OAuth token exchange across AM and IDM, debugging a custom script, or just trying to figure out why that one sync job keeps failing at 3am, having a visual interface with unified views, intelligent noise filtering, and one-click transaction tracing makes the whole experience so much better.
I’ve been using it daily and it’s genuinely transformed how I debug AIC environments. Give it a try and let me know what you think.
Disclaimer
This tool is provided “as is”, without warranty of any kind. Review your organisation’s security policies before using any third-party tool with production credentials. AIC Sentinel is licensed under PolyForm Noncommercial 1.0.0 — free for personal, educational, and non-commercial use. For commercial licensing, contact the author.
