Monitoring server logs helps you identify errors, troubleshoot problems, and address issues with your site. You'll use ArcGIS Server Manager to view, query, configure, and delete portal logs. Manager aggregates the log messages into a table you can read and manipulate.
The sections in this help topic describe the server logs and how to work with them to address issues.
- Capture, query, and view events
- Understand the logs
- Use log filters to narrow search results
- Page through server logs
- View the logs in a printer-friendly format
- Delete logs
Capture, query, and view events
When an event occurs in your site, the event is captured and recorded in the logs. To view messages associated with the event, you'll need to query the logs. To query and view the current messages in your site, follow these steps:
- Open Manager and sign in as an administrator. If you need help with this step, see Log in to Manager.
- Click Logs > View Logs to review the current logs. Some messages are returned along with additional information.
All events record information, such as the log level, the time at which the event occurred, the source component that logged it, the machine on which the event occurred, the log code, the user associated with the event, and so on. All of this information can help you troubleshoot your portal more effectively. See Understanding the logs for a detailed explanation of this information.
Installation and postinstallation logging behavior
When you install or upgrade ArcGIS Server, the server's log level is set to Verbose. This means that very detailed messages are logged during the installation or upgrade process.
If you encounter a failure during this process and want to review the logs to help you troubleshoot, first determine whether you can access ArcGIS Server Manager. If you can, query the logs and review the messages. If not, review the log messages on disk. To access the logs on disk, browse to the logs directory and open the most recent log file (for example, <ArcGIS Server installation directory>/arcgisserver/logs/<machine name>/server/server-20150101.095803-8596-0.0.log). If necessary, you can share this information with Esri Support.
After the installation or upgrade process completes, the server's log level is set to Warning by default. This means that only moderate to serious problems will be logged. If a user of the server reports a problem, you may need to change the log level to capture more fine-grained messages for that specific issue. To learn how to modify the logging level, see Specify server log settings in Manager.
Troubleshoot issues
If you suspect there is an issue with the server, or a user reports a problem, you'll need to reproduce the event, capture the event with the logs, and query the logs to obtain information about the event. Then, you'll use the information in the log to help you resolve the issue caused by the event.
If an issue is suspected or reported, do the following to capture the event with the logs:
- Try to reproduce the issue.
- If the issue can be reproduced, query the logs and review the messages for information about the issue.
- If no information is present, increase the logging level. Reproduce the issue again, query the logs, and review messages.
- If information is present in the log messages, review the information to help you resolve the problem.
- If the issue cannot be reproduced, take note of the scenario leading to the issue in case it arises again.
- If the issue can be reproduced, query the logs and review the messages for information about the issue.
Tip:
If the issue is related to publishing hosted services, it's recommended that you also review the Portal for ArcGIS logs. The portal logs may provide additional information to help you troubleshoot the publishing issue.
Understand the logs
All events record specific information, such as the log level, the time at which the event occurred, and the machine on which the event occurred. All of this information can help you troubleshoot your server more effectively.
By default, only the Level, Time, Message, and Source properties display in the log message window. If you want to add or remove properties from the display, choose Columns.
Tip:
Reorder columns by dragging and dropping column headings in the event log display. Click each column heading to sort in ascending or descending order.
Level
Logged events can vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the server.
Note:
ArcGIS Server can only retain 1,000 logs at a time. Only the most recent 1,000 logs are retained, regardless of the other settings you've chosen for log retention.
The frequency of log messages increases as you increase the level of detail; for example, more messages are logged at the FINE level than at the SEVERE level.
It's recommended that you keep the log level at SEVERE, WARNING, or INFO, except when you need to increase the log level for troubleshooting purposes.
The following are the log level types:
| Log level | Description | Sample message |
|---|---|---|
| Severe | Serious problems that require immediate attention. This level only includes severe messages. | Unable to process request. Service Planning/counties/FeatureServer not found. |
| Warning | Moderate problems that require attention. This level also includes severe messages. | Failed to log in. Invalid username or password specified. |
| Info | Common administrative messages of the server, including messages about service creation and startup. This level also includes severe and warning messages. | Folder Planning was created successfully. |
| Fine | Common messages from use of the server, such as names of operation requests received. This level includes severe, warning, and info messages. |
Checking for expired items in /admin/arcgisserver/directories/arcgisjobs. |
| Verbose | Messages providing more detail about how the server fulfills an operation, such as noting that each layer in a map service was drawn successfully, how fast the layer was drawn, and how long it took the server to access the layer's source data. This level includes severe, warning, info, and fine messages. | Beginning of layer draw: counties. |
| Debug | Highly verbose messages designed for developers and support technicians who want to obtain a better understanding of the server's state when troubleshooting. It's recommended that you don't use this level in a production environment; it may cause a decrease in performance. If you're not troubleshooting an issue, use the Warning level instead. | Cleaning up server directories. |
| Off | Logging is turned off. Events are not logged with the server. | N/A |
Time
This is the time at which the logged event occurred. Events are organized chronologically, with the most recent event displayed first. Click the Time column header to sort messages in ascending or descending order.
You can specify the desired time interval to display when querying the logs.
Source
The source of the logged event can be a service or the server. Events associated with services display the name and service type as the source property. Events associated with the server display the framework component name that logged the message as the source property.
The following are examples:
- An event related to the SampleWorldCities map service appears as SampleWorldCities.MapServer.
- After successfully creating a server cluster in your site, Admin displays as the component that logged the message.
Optionally, you can specify the desired source to display when querying the logs.
Machine
Each server machine participating in your site maintains a set of logs specific to that machine. If you've registered ArcGIS Data Store with your site, each Data Store machine also logs messages specific to that machine.
For example, a server may log an error that it failed to update the location of the configuration store. Only those messages that apply to statistics recorded for a specific machine include a machine property.
You can specify the desired machine to display when querying the logs.
Code
This is the log code associated with the message. The codes are organized into several ranges as described in Log codes overview.
Time Elapsed
This is the time it took (in milliseconds) for the logged event to complete. For example, the export web map image event has an elapsed time to indicate the amount of time it took to export the web map image.
User Name
This is the name of the user who submitted the request resulting in the log message. This property is useful to help you track individual user activity when security is enabled.
Process
This is the machine process ID that logged the event.
Thread
This is the server process thread that generated the message.
Request ID
This is the unique ID string attached to every request made to ArcGIS Server upon submission, which is carried throughout the request's life cycle in the system.
Method Name
This is the method called on the service that resulted in the log message.
Use log filters to narrow search results
To help you narrow events and display relevant messages, you can query based on log level, log age (time), source component, and machine. You can combine any number of these filters as part of your query. You can access these filters on the View Logs page in Manager.
Log Filter
Events vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the server. Choose the desired level from the Log Filter drop-down list. For a detailed summary of each level, see the Level section above.
Age
Events logged with the server are organized chronologically, with the most recent event displayed first. To filter events to a specific time frame, specify the desired increment from the Age drop-down list:
| Time increment | Description |
|---|---|
| Last 15 Minutes | Displays events logged within the last 15 minutes |
| Last Hour | Displays events logged within the last hour |
| Last 6 Hours | Displays events logged within the last six hours |
| Last 24 Hours | Displays events logged within the last day |
| Last Week | Displays events logged within the last week or within the time frame you specified the site to retain logs on disk |
| Since Startup | Displays events logged since the last time the server restarted or within the time frame you specified the site to retain logs on disk |
| All | Displays all events logged since ArcGIS Server was installed or within the time frame you specified the site to retain logs on disk |
Click the Time column header to sort messages in ascending or descending order.
Remember that the query only returns logs within the time frame you specified your ArcGIS Server site to retain logs on disk. The default is 90 days. For example, if you configured your site to keep logs for five days, selecting Last Week from the Age filter only returns logs from the last five days.
Tip:
Click Settings to specify how long the server keeps logs on disk. For more information, see Specify server log settings.
Source
The source of the logged event can be a service or the server. Events associated with services display the name and service type as the source property. Events associated with the server display the framework component name that logged the message as the source property.
By default, all sources are queried (the All option from the drop-down list). To query a specific service or server framework component, choose the name of the service or component from the Source filter. For a description of the sources that appear for logged events, see the table below.
Note:
The Admin, Server, Rest, and Soap sources described below are aggregated under the Server Framework level in the Source filter. To query these sources, choose Server Framework from the Source drop-down filter.
| Source | Description |
|---|---|
| Admin | Indicates the message has been logged by the administrative API. The administrative API is the server tier that allows you to administer your server, for example, create the site, add machines and services, and configure clusters. |
| Server | Indicates the message has been logged by the portion of the server framework responsible for creating instances of services. |
| Rest | Indicates the message has been logged by the server's REST handler. The Rest component logs messages at all levels. |
| Soap | Indicates the message has been logged by the server's SOAP handler. The Soap component logs messages at all levels. |
| ArcGIS Data Store | Indicates the message has been logged by ArcGIS Data Store. Messages only appear if you've registered ArcGIS Data Store with ArcGIS Server. |
| <servicename>.FeatureServer | The source is a feature service. |
| <servicename>.GeocodeServer | The source is a geocode service. |
| <servicename>.GeoDataServer | The source is a geodata service. |
| <servicename>.GeometryServer | The source is a geometry service. |
| Geometry.GeometryServer | The source is the preconfigured geometry service installed with ArcGIS Server. |
| <servicename>.GPServer | The source is a geoprocessing service. |
| CachingTools.GPServer | The source consists of the preconfigured caching tools installed with ArcGIS Server. |
| PrintingTools.GPServer | The source is the preconfigured PrintingTools service installed with ArcGIS Server. |
| PublishingTools.GPServer | The source consists of the preconfigured publishing tools installed with ArcGIS Server. |
| <servicename>.ImageServer | The source is an image service. |
| <servicename>.KmlServer | The source is a KML service. |
| <servicename>.MapServer | The source is a map service. |
| <servicename>.NAServer | The source is a network analysis service. |
| <servicename>.WCSServer | The source is a web coverage service. |
| <servicename>.WFSServer | The source is a web feature service. |
| <servicename>.WMServer | The source is a workflow manager service. |
| <servicename>.WMSServer | The source is a web map service. |
| <servicename>.WMTSServer | The source is a web map tile service. |
| <servicename>.WPSServer | The source is a web processing service. |
| <servicename>.SceneServer | The source is a scene service. |
| <servicename>.SchematicsServer | The source is a schematics service. |
| <servicename>.SearchServer | The source is a search service. |
| SampleWorldCities.MapServer | The source is the preconfigured SampleWorldCities map service installed with ArcGIS Server. |
| Search.SearchServer | The source is the preconfigured search service installed with ArcGIS Server. |
| Search_indexer.GPServer | The source is the preconfigured search service's accompanying _indexer geoprocessing service. |
| <searchservicename>_indexer.GPServer | The source is the search service's accompanying _indexer geoprocessing service. |
Machine
Each server machine participating in your site maintains a set of logs specific to that machine. If you've registered ArcGIS Data Store with your site, each Data Store machine also logs messages specific to that machine.
By default, all machines are queried (the All option from the drop-down list). To query events logged with a specific machine, choose the desired machine from the Machine filter.
Page through server logs
When you execute a query in the View Logs module, the log message window displays 1,000 of the most recent messages that match your query. The time frame of these messages appears at the bottom of the log message window.
If your query returns more than 1,000 messages, page to the next set of records by clicking the Older button at the bottom of the log message window. Similarly, page forward in time by clicking the Newer button.
When paging through records, the log message window does not automatically update to account for new messages that may have been logged after the query executed. Click Query on the View Logs module to obtain the most recent results for your query.
View the logs in a printer-friendly format
After executing a query, click the Printer Friendly View link to view logs in a printer-friendly format. This opens a new browser window (or tab) that displays the logs in HTML. You can use this view to print the logs, save the HTML to disk, or copy and paste the logs into a document or spreadsheet. In this way, you can share your log messages with others in your organization and, if necessary, Esri Support.
The printer-friendly view only displays the last executed query, the current view of the log message window, and any logging properties you specified. However, if you sorted or reordered columns in the event log display, the HTML view returns the columns to their original state when the query first executed. You can copy and paste the logs into a spreadsheet and use the tools in the application to sort and reorder columns.
Delete logs
Click Delete Logs to delete all log messages from each server participating in your site. You'll be prompted to confirm your decision to delete all the logs after you click Delete Logs.
When debugging a specific scenario that causes issues with your server, deleting the logs can help isolate the issue. For example, if you're attempting to determine the drawing performance of a particular layer in a map service, it may be helpful to delete the log, send a request to the map, and update the log message window to display the request event. In this manner, the log is cleared of all other events, which allows you to focus on debugging the map service.