Okta Certified Administrator · Part I

Monitoring and Troubleshooting

9% of the exam — the smallest of the first four domains.

Module 1: Logging and Reporting

3 sub-topics · this deck covers sub-topic 1 of 3

↑ Module 1 Overview

The Exam Bullet

"Demonstrate understanding of Okta logging"

Every action in Okta leaves a trace. This sub-topic is about where that trace lives and what it actually captures.

The Mechanism

The System Log records "details of all logged events for your org" — time, actor, target, and event type. Sensitive values like clientSecret are hashed before being logged.

Location: Admin Console > Reports > System Log.

The Three Views

Graphs — bar charts of event counts over time, by category, target, actor, event type
Events Table — detailed, sortable event listings
Filters & Search — parameter-based filtering (time, event info, actor, targets)

By default, filters show all events for the last 7 days.

The Extra Capabilities

Beyond basic viewing: drag across the graph to expand a time range, click a row's arrow for full event detail, download as CSV, toggle between the table and a geolocation map view, jump to the Rate Limit Dashboard straight from a violation event, and track MFA abandonment metrics.

The Exam Angle

Watch for scenario questions built around this trap:

→ "An admin needs to export System Log data for an external audit." = CSV download, directly from the System Log view.

One Line To Remember

System Log (Reports > System Log) captures time/actor/target/event type for every org event, with clientSecret hashed. Three views: Graphs, Events Table, Filters. Default window: last 7 days. Extras: CSV export, geolocation map, Rate Limit Dashboard link, MFA abandonment tracking.

Sources: help.okta.com — Reports_SysLog.htm

Next: Sub 2 →