Submit debug-level ArcGIS Enterprise log files to Esri Support Services for troubleshooting and review

Summary

Capturing Debug Level Logs for ArcGIS Enterprise

The following instructions are for capturing detailed, debug-level logs for your Portal for ArcGIS and ArcGIS Server products. In each case, it is important to capture the events that occur during the problematic steps or issue, to limit the unnecessary sharing of secure information, reduce file size, and to filter out unrelated information.

Note:
If your ArcGIS Server site includes a registered ArcGIS Data Store, its logs will also appear within the ArcGIS Server logs.

Why Reproducing the Issue Is Necessary

If the logging level was not previously set to Debug when the behaviour was first observed, the system will not have captured the detailed diagnostic information needed for troubleshooting. By setting the log level to Debug and then reproducing the issue, you ensure that the logs contain the necessary depth of information for Esri Support Services to investigate effectively.

Security Considerations when Sharing Debug-Level Log Files

While troubleshooting issues related to the ArcGIS Enterprise organization, and the ArcGIS Server site via screenshare and over the telephone is preferred, Esri Support Services recognizes that in some complex or urgent cases, analysts will need to ask users to provide more detailed, debug-level log files for troubleshooting.

Although log files can be crucial to quickly resolving issues, it is important to note that these files may also contain sensitive information, including but not limited to:

• Sensitive information such as usernames and machine names
• ArcGIS authorization tokens
• Sensitive internal system paths
• Sensitive service URLs or URL Query Parameters

Esri values the security and privacy of their customers’ data, and as such, acknowledges the potential security and privacy issues associated with sharing log files. To limit these risks, Esri recommends 'sanitizing' these files (instructions below) prior to sharing log files with Esri support.

Esri cannot be held liable if this notice is ignored, and Esri cannot sanitize log files on a customer’s behalf. While by policy Esri Support Services uses a secure environment to test customer data and review log files, this environment, by necessity, cannot be completely isolated and can access:

• ArcGIS Online
• Esri managed file transfer services (read-only FTP to download customer-provided datasets)
• Esri Support case attachments (read-only FTP to download customer-provided datasets)

Access to all other hosts is denied.

All files sent to Support services will be deleted in 90 days.

If there are doubts regarding the content of log files, Esri recommends that customers choose to NOT share log files with Esri support services and work with the support analyst to address the problem via other methods.

Procedure

Warning
The debug log level should only be used temporarily while debugging or troubleshooting, as it may cause a significant decrease in performance. Debug logs are highly detailed, which can significantly increase disk usage on the drive where logs are stored. Ensure you revert to the original log level once the necessary data has been captured to avoid potential performance or storage issues.

Portal for ArcGIS

Specify debug logging level

1. In a web browser, access the Portal Administrator Directory:

https://webadaptorhost.domain.com/webadaptorname/portaladmin

2. Select Logs > Settings.

Important: 
Make a note of the original log level so you can restore it when you’re finished collecting logs.

3. From the Settings page, click Edit.
4. In the dropdown menu for the Log level field, select Debug.
5. Click Update.

Reproduce the issue

Perform the actions that lead to the abnormal behaviour. Take note of the time the issue occurs to help isolate relevant log entries.

Collect the logs

ArcGIS Portal logs can be gathered from the Portal Administrator Directory, or directly from disk on the machine where Portal for ArcGIS is installed.

• Using the Portal Administrator Directory

1. In a web browser, return to the Portal Administrator Directory:

https://webadaptorhost.domain.com/webadaptorname/portaladmin

1. Select Logs > Query.
2. Set the Log Level to DEBUG, and specify the Start Time and End Time to cover the event period.
3. Select your Federated Server from the dropdown menu.
4. Click Query.
5. When the logs are displayed:
   1. Press Ctrl + A to select all.
   2. Press Ctrl + C to copy.
   3. Paste the content into a document and save.

• Logs from Disk

1. Navigate to the directory where your logs are stored. 

Note:
The default directory for Portal for ArcGIS logs is C:\arcgisportal\logs

2. Open the log file that corresponds to the time period when the issue occurred or was reproduced.
3. Copy the lines that correspond to this time period, paste them into a document, and save.

Reset the log level

Finally, return to the Portal Administrator Directory, and navigate to Logs > Settings > Edit to revert the log level to its original setting. For detailed instructions, refer to the steps under the subheading Specify debug logging level, above.

ArcGIS Server

Note:
If the ArcGIS Server site includes a registered ArcGIS Data Store, its logs will also appear within the ArcGIS Server logs. These entries will match the log level set in ArcGIS Server Manager and can be reviewed alongside other server activity.

Specify debug logging level

1. In a web browser, access the ArcGIS Server Manager:

https://webadaptorhost.domain.com/webadaptorname/manager

2. Click Logs from the navigation bar.
3. In the top-right corner and beneath the navigation bar, click the Settings button.
4. In the Log settings window that appears, select Debug in the dropdown menu for the Log level field.

Important:
Make a note of the original log level so you can restore it when you’re finished collecting logs.

5. Click Save.

Reproduce the issue

Perform the actions that lead to the abnormal behaviour. Take note of the time the issue occurs to help isolate relevant log entries.

Collect the logs

ArcGIS Server logs can be collected from the ArcGIS Server Manager, or directly from disk on the machine where ArcGIS Server is installed.

• From the ArcGIS Server Manager

1. In a web browser, return to the ArcGIS Server Manager:

https://webadaptorhost.domain.com/webadaptorname/manager

2. Navigate to Logs > Query.
3. Under the heading View Log Messages, set the Log Filter to Debug, and specify the Age to cover the event period.
4. Click Query.
5. When the logs are displayed:
   1. Highlight and copy the rows that correspond to the time period when the issue occurred or was reproduced.
   2. Paste the content into a document, and save.

• From Disk

1. Navigate to the directory where your logs are stored.

Note:
  The default directory where the ArcGIS Server logs are written is C:\arcgisserver\logs

2. Open the log file that corresponds to the time period when the issue occurred or was reproduced.
3. Copy the lines that correspond to this time period, paste them into a document, and save.

Reset the log level

Finally, return to the ArcGIS Server Manager, and navigate to Logs > Settings to revert the log level to its original setting. For detailed instructions, refer to the steps under the subheading Specify debug logging level, above.

Sanitize ArcGIS Enterprise log files

Once the log file is generated, you will need to inspect it with a text editor such as Notepad, Notepad ++, or Sublime Text and remove all sensitive information using the steps below.

1. Open the log file in a text editor, right-click the file, select Open With, then select the text editor application.
2. Use the text editor's Find and Replace tools to identify and replace all sensitive information captured in the log file. This includes:
   • Usernames, machine names, sensitive internal system paths
   • Authorization Tokens - these are long strings of letters, numbers, and symbols, similar to API keys, but used in any web-based Esri application to authenticate the user. Tokens will look like this:

VBQlHZ__ONCdOUPteoQPfEEPYTyrfy3XugMasrGO90rUmGiMa_tzvjfksFsZ57MtTE1gywBYtVhrldIKuPPu7MFt4u6ukauvDtH4r2kZePZtgbCFomXc0ThIuwF9cPK6LNTFOJ3Q850ilLO2zP6kzmaY0cfnsJBMcoPmFH9BOLamDQFig3628HwU53xis4gIiEJNkWhnI3ynb

• API keys - these are long strings of letters, numbers, and symbols used to access custom applications, and look like this:

AAPK5f9f39a988764653b27dd7d01fa14d35kfSLvKsiJoeoXX2oFBXE_021u_apQt1eAssZEfnmcri1hUhBmHEyxoOXJhaW9xgie

• Any other pieces of sensitive information. If you have any questions about whether your data is sensitive, please reach out to the data scheme owner in your organization and review the data classification with them. Esri cannot provide guidance on what each customer organization considers sensitive.

3. Save a copy of the edited log file with the sensitive information removed.
4. Provide the redacted copy of the log file to Esri Support Services with written notice that you have:
• reviewed these instructions
• and have sanitized the debug-level logs prior to providing them to Esri Support Services.

If you have any questions about this, please feel free to discuss them with your Support Service analyst.