Log Stream Webhook is Triggered Only After 5 minutes

This article explains why Auth0 log stream webhooks are only sending events every 5 minutes when previously it would send whenever there was an event triggered in Auth0.

• Log Stream Webhooks

The delivery attempts to the configured log stream endpoint are timing out. The streaming service has a hard request timeout of 5 seconds, and the configured log stream endpoint fails to respond to delivery attempts within that 5 seconds.
The delivery service also throttles erroring streams by attempting deliveries every 5 minutes until the errors stop.

This issue is typically caused by one of the following:

• Delivery batches too big: By default, the delivery service will attempt a maximum of 100 logs per HTTP request (for webhook streams). Sometimes, the log stream endpoint is not properly equipped to handle that many logs within a 5-second window. This can be confirmed by checking if the service is receiving the requests and, if so, looking at the response time of the service. If it’s more than 5 seconds, then that's the issue.
  • Unfortunately, it is not possible to adjust batch sizes through Auth0 Management API, but it can be done from the backend if necessary, depending on the use case.
• Firewall: a firewall change could also be an issue. If there has been a firewall change, please check if the Auth0 IP addresses are allowed (IP Allowlist).

If the issue is with the batch size, it can be lowered depending on the use case.