Auth0 Log Stream Delivers Queued Events After Resuming from Paused State
When a Log Stream is paused and then re-enabled, it may be observed that log events generated during the paused period are delivered after resumption. This can be unexpected, especially when the log stream was intentionally paused during bulk operations (such as bulk user deletions) to prevent those events from being sent to the downstream destination.
This article explains why this happens and provides a recommended workaround.
- Log Streams
- Auth0
When a Log Stream is paused, Auth0 does not discard the log events generated during the paused period. Instead, those events are retained in a queue and will be delivered once the log stream is resumed. The logs are held based on the tenant's log retention period, which varies by subscription plan. See the Log Data Retention documentation for more details on log retention per plan.
This means that if a log stream is paused for any duration within the retention window, all events generated during that time will be exported upon resumption.
If the goal is to prevent certain log events from being delivered to the downstream destination (for example, during mass deletion operations), pausing the log stream will not achieve this.
Instead, the recommended workaround is to:
- Delete the log stream before performing the bulk operation.
- Perform the bulk operation (for example, mass user deletions).
- Create a new log stream and set the starting date to after the bulk operation has completed.
This ensures that the events generated during the bulk operation are never delivered to the destination.
