18Monitoring and logs

SYNERGY Management Gateway records what it does in several places, each meant for a different reader and a different question. This chapter covers the tools for watching the platform itself: the live application log, the log files on the server, forwarding the log to an external system or to Sentry, exporting traces and metrics to an OpenTelemetry collector, and the health endpoints that monitoring tools and load balancers can poll.

These tools describe the platform. They are not the record of who changed what in Active Directory. That record is the operations log, described in Chapter 9, Operations log, approvals and waiting operations.

Overview

The table below summarises the monitoring tools, who can use them and what they are for.

The Monitoring group in the navigation menu (shown as Observability when the menu is expanded) also contains Operations and My Waiting Operations; those are covered in Chapter 9.

Important: Live Logs and Log Stream are available only while your active role is the System Admin role. No grantable permission unlocks them. The application log can contain server internals such as LDAP filters, exception text and stack traces, so it is treated as system-level information. If you hold System Admin among several roles, switch to it first (see Chapter 3, Signing in and your account).

Application log basics

Every component of the platform writes to one application log. Each entry has:

• Time – when the entry was written.
• Level – how serious it is (see the table below).
• Source – the source context, which is the name of the component that wrote the entry, for example Synergy.ManagementGateway.ActiveDirectory for directory operations or Synergy.ManagementGateway.Infrastructure.Notifications for email notifications.
• Message – the text of the entry.
• Exception – for errors, the technical details of the failure, including a stack trace.

The levels, from least to most serious, are:

By default the server records Information and above. Verbose and Debug entries are not produced unless the server's minimum level is lowered in its configuration file (the Serilog:MinimumLevel section of the API's appsettings.Production.json). This affects every log tool in this chapter: you cannot see or forward entries the server never writes.