why is the Okta System Log missing events for last week
Explains gaps in the Okta System Log by checking retention windows first, then collector downtime, then query filters. Use when events for a past window are missing. Not for real-time polling delays.
TL;DR
Check retention first: the System Log keeps 90 days on most plans and less on some, so last week's events may simply have aged out. Then check whether the poller or SIEM agent was down during the gap, then verify the query filters.
why is the Okta System Log missing events for last weekUse this when
- Events for a specific past window are missing.
- The gap has clean edges rather than random holes.
- Other windows are complete.
Not for this skill when
- Recent events are delayed by minutes. That is polling lag.
- No events exist at all. Check auth and the query itself.
- The events exist under a different filter. Broaden the query first.
Steps
- Confirm the missing events are inside the retention window for the org's plan. Verify: retention is not the answer.
- Check the poller or SIEM agent uptime for the missing window. Verify: the collector was actually running.
- Re-run the query with no filters. Verify: the gap persists without filtering.
- Check the Okta trust site for an incident during that window. Verify: no platform gap.
- If events are truly missing, open a support case; otherwise fix the collector gap. Verify: the resolution matches the evidence.
Variant phrasings
System Log gaps
The short phrasing.
missing events Okta
The symptom-first search.
log retention
The cause-first phrasing.
Compatibility: Okta System Log, Classic and Okta Identity Engine. Retention varies by plan.
Why it happens
Gaps come from retention expiry, collector downtime, or overly narrow queries, in that order of likelihood. Each has a clean edge pattern that distinguishes it.
Edge cases / pitfalls
- Events existing under a different event type filter; the gap is a filter artifact.
- Org migrations or tenant changes resetting the log.
- The collector running but its clock wrong, writing events with skewed timestamps.
- Partial gaps from a collector that was flapping rather than fully down.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstgnLu40vCRuhvAC5hmKvYQ