logs of errors when integration cannot create incident

[AnthonyMull]

Hi community,

is there any easy way to search for logs if an integration that creates incidents can no longer create incidents?

Thank you

[Its_Azar]

Hi there @AnthonyMull 

You can just simply log your script using a gs.info or gs.log, i mean if you are calling you integration via Business rule or scrip include or scripted rest, you just log the req body and response body, 

or you can just log the status code incase of successful creation the status code will return 200.

[pavani_paluri]

Hi @AnthonyMull ,

Start with System Logs: Go to System Logs → All and filter by the integration user or keywords you know the integration uses. This shows errors like authentication failures or script issues.
Check Transaction Logs: Go to System Logs → Transactions. Filter for the `incident` table and the integration user. This tells you if the system is receiving calls but failing to insert records.
Audit Logs: Look at System Logs → Audit to see if incident records were attempted but blocked by business rules or ACLs.
Identify the integration path: Confirm how incidents are normally created (REST API, email, import set, MID Server, etc.). Then check the logs tied to that mechanism.
Verify credentials and roles: Make sure the integration account still has the right roles and hasn’t expired.
Recent changes: Check if any new business rules, ACLs, or transform maps were added that could block incident creation.

Mark it helpful if this helps you to understand. Accept solution if this give you the answer you're looking for

Kind Regards,

Pavani P

Mark it helpful if this helps you to understand. Accept solution if this give you the answer you're looking for

Kind Regards,

Pavani P

[GlideFather]

Ahoy @AnthonyMull,

depends on the configurations. You can have error logs added in the transform script or other options.

If you have an integration service account, you can create a dashboard/report with incidents created in last 1 hour/day/week to see if there is any record created, if it is empty then something's wrong..

[Tanushree Maiti]

Hi @AnthonyMull 

Generally we check following log 

• System Logs (syslog): Go to System Logs > System Log > All and apply a filter with Source = INTG_AUDIT to review outputs generated by integration scripts.
• System Import Sets > Import Set Logs: Ideal for finding issues if the integration uses transform maps to create incidents.
• IntegrationHub History: If using IntegrationHub/Flow, look at the flow execution records
• Transaction Logs (syslog_transaction): Review failed API transaction records, such as sys_ws_operation or sys_transform_map, to detect attempts that were blocked while creating incidents.
• ECC Queue: Inspect the ecc_queue table for entries marked with an “error” status, or verify whether input records from monitoring platforms like Splunk or Netenrich were received but not processed.
• Inbound Email Logs: For email-based integrations, review System Mail > Inbound Actions or System Logs - Emails to identify errors and confirm the email was not skipped or handled by another rule.