Following logs with keenauth logs tail

keenauth logs tail follows the environment logs (sign-ins, sessions, tokens, MFA, attack protection) while you work, like tail -f. It prints the most recent records first, oldest first, then checks for new records at a fixed interval and prints them as they appear. Press Ctrl-C to stop; the command then exits with code 0.

The command reads the same records as keenauth logs list and needs the same permission (logs:read). It works with an API key and with a keenauth login session.

Usage

keenauth logs tail --type authentication. --user usr_01j9z3k4m5n6p7q8r9s0t1v2w3

An invalid filter or interval stops the command with code 2 before any request is sent.

Output

• table: one line per record with the time (UTC), type, outcome, user, organization and log ID; a missing value is shown as -.
• json: one JSON object per line (newline-delimited JSON), the same object as keenauth logs get returns. This is the default when stdout is not a terminal, so you can pipe it, for example to jq.
• yaml: one YAML document per record, each starting with ---.

keenauth logs tail --type authentication.failed -o json | jq -r '.ip_country'

The IP address, user agent and identifier hint appear only if your credential has the permissions described in the logs API.

How it follows

The logs API returns the newest records first and has no wait parameter, so the command polls. After the first page, each check asks for the records at or after the newest time it has printed and skips the records it has already printed, so no record is shown twice. A check follows the result pages until it has every new record, up to 2,000 records per check. Records older than the retention window of your plan are not returned.

Exit codes