The IdentityMesh Event Log

Operator runbook for the Windows event log that collects every IdentityMesh warning and error in one place. Use it when something looks wrong and you want to know where to click first.

Where to look

Open Event Viewer on the host that runs the component (for Web UI entries, the Admin API host), then go to Applications and Services Logs → IdentityMesh. It sits at the same level as Windows PowerShell and Key Management Service.

The Source column tells you which component wrote the entry. There is one Source per component:

The main installer creates the log and all six Sources on the server host. The relay installer creates the Relay Agent Source on relay hosts. Connect’s installer creates nothing; see Connect on workstations below. Uninstalling leaves the log and its history in place.

What gets logged

Apart from the single “installed” event the installer writes, only Warning and Error entries go to the event log. Information stays in the daily log files under C:\ProgramData\IdentityMesh, so the event log holds the “needs attention” subset and stays readable.

• Connector run errors. An error a connector raises during an import or export used to be visible only in the connector’s run log in the portal. It now also appears under the Sync Engine source, with the connector id, run id and category.
• Browser errors. The Admin Portal reports unhandled script errors, failed API calls and error toasts to the API, which writes them under the Web UI source. Each entry carries the signed-in user, the page, and for a failed API call the HTTP method, path, status and the API’s requestId. Sign-in redirects (401) are not reported.

To trace a browser error to its cause, copy the requestId from the Web UI entry and search the Admin API source for the same value.

Reading a Web UI event

A Web UI entry looks like this:

Web UI Error: POST /api/connectors/probe failed with 500
User: CONTOSO\alice
Page: /identity/connectors
HTTP: POST /api/connectors/probe -> 500   requestId: 0HN… traceId: 00-…
Title: An error occurred while processing your request.
Detail: …
Client time: 2026-10-17T05:09:11.123Z   Received: 2026-10-17T05:09:12.004Z
User agent: Mozilla/5.0 …
Remote address: 10.0.0.25
Repeated: 3x
Stack:
…

The first line says what failed. User and Page say who hit it and where. The HTTP line is only present for failed API calls. Repeated appears when the same failure happened several times in one batch and was collapsed into one entry. Stack is present for script errors.

Filtering

To see one component, choose Filter Current Log in the Actions pane and pick it under Event sources. For example, tick IdentityMesh Sync Engine to hide everything else. You can also filter on Level (Warning, Error) in the same dialog.

Size and retention

The log is created at 20 MB and overwrites the oldest events when full. To raise the limit, run this in an elevated PowerShell:

Limit-EventLog -LogName IdentityMesh -MaximumSize 64MB

Connect on workstations

Connect is installed per user, so its installer cannot register an event source. Connect always writes a daily file: %LOCALAPPDATA%\IdentityMesh\Connect\connect-yyyyMMdd.log (the last 14 files are kept). If the source is registered, it also writes to the event log.

To also see Connect in Event Viewer on a workstation, an administrator registers the source once, from an elevated PowerShell:

New-EventLog -LogName IdentityMesh -Source 'IdentityMesh Connect'

After that, standard users write to the log without further rights.

If events still land in Application

If you see IdentityMesh entries in the Application log, or the IdentityMesh log is empty, one of two things happened:

• The service started before the MSI registered the Sources. Restart the service and the entries move to the IdentityMesh log.
• The component runs on a development machine, or was started without an elevated session, so nothing registered the Sources.

To fix it, re-run the installer, or create the Source yourself from an elevated PowerShell and then restart the service:

Remove-EventLog -Source 'IdentityMesh Admin API'
New-EventLog -LogName IdentityMesh -Source 'IdentityMesh Admin API'

The Remove-EventLog line comes first because a Source that is already registered in Application cannot be registered again in another log.

Use the matching Source name from the table above for each component. Old entries that were already written to Application stay there.

Related

• siem-integration.md for forwarding the log to a SIEM.
• installer.md for the step that registers the log.
• relay-agent.md for the relay agent’s own logging.