Paths and file names below assume a default installation location (/opt/shibboleth-idp) and unchanged logging/logback configuration. Though you might prefer to adjust your logging config and or make /opt/shibboleth-idp/logs a symbolic link to another file system/volume. You might also want to remove the "idp-" prefix from all the {process,warn,audit,consent-audit} log files since they'll likely end up in one IDP-specific logging directory anyway (and having all files start with the same letter isn't overly useful). But again, the examples below can't match local deployment decisions and so have been written to match a default IDP installation's behaviour. So adjust as needed.

Who and how am I?

$ /opt/shibboleth-idp/bin/


Applying updates

See IDP 3 Updates for detailed instructions.

What's happening right now?

multitail -f /opt/shibboleth-idp/logs/idp-process.log /var/log/tomcat8/access.log

egrep 'WARN|ERROR' /opt/shibboleth-idp/logs/idp-process.log

journalctl -u tomcat8.service -e -f

multitail -f /opt/shibboleth-idp/logs/idp-process.log /var/log/tomcat8/access.log -l 'journalctl -u tomcat8.service -f'

Who logged in and where, with what attributes sent?

multitail -f /opt/shibboleth-idp/logs/idp-audit.log

fgrep '|someuser99|' /opt/shibboleth-idp/logs/idp-audit.log

/opt/shibboleth-idp/bin/ --saml2 -n someuser99 -r

zgrep ' failed$' /opt/shibboleth-idp/logs/idp-process.log.201901*

fgrep succeeded /opt/shibboleth-idp/logs/idp-process.log

fgrep /opt/shibboleth-idp/logs/idp-audit.log /var/log/tomcat8/access.log


ACOnet has contributed a log analysis tool for parsing the Shibboleth IDP's audit logs. For the current day use  /opt/shibboleth-idp/logs/idp-audit.log. -culn /opt/shibboleth-idp/logs/idp-audit.log.20190123.gz
2 unique relying parties
10 unique userids
25 logins
logins   | relyingPartyId
14       |
11       | -cul /opt/shibboleth-idp/logs/idp-audit.log.201812*
21 unique relying parties
15 unique userids
406 logins


$EDITOR /opt/shibboleth-idp/conf/logback.xml  # Set <logger name="PROTOCOL_MESSAGE" level="DEBUG"/> and save
/opt/shibboleth-idp/bin/ -id shibboleth.LoggingService

Make sure to undo this after you're done to avoid filling up file systems/volumes/disks with unnecessary DEBUG messages.

Locally managed Metadaten (

Cf. IDP 3 Metadata configuration.