Monitoring portal logs helps you identify errors, troubleshoot problems, and address issues with your portal. Use the ArcGIS Portal Directory to view, query, configure, and delete portal logs. The ArcGIS Portal Directory aggregates the log messages into a table you can read and manipulate.
The sections in this help topic describe the portal logs and how to work with them to address issues.
- Capture, query, and view events
- Understanding the logs
- Using event filters in a query to narrow down search results
- Delete the logs
Capture, query, and view events
When an event occurs in the portal, the event is captured and recorded in the logs. To view messages associated with the event, query the logs. To query and view the current messages in your portal, follow these steps:
- Open ArcGIS Portal Directory and log in as an Administrator. The URL is typically available at https://webadaptor.domain.com/arcgis/portaladmin.
- Click Logs > Query.
- Leave all of the default settings and click Query.
Some messages are returned along with additional information. For example, you'll see the following messages if a user enters the incorrect password too many times and is locked out of their account:
In the above scenario, the user john_cho was attempting to log in but was entering the wrong password. After ten attempts, the account lockout policy was enforced and the user was locked out of the account. This may also indicate a malicious user is attempting to access the portal.
All events record the above information, such as the log level type, the time at which the event occurred, the source component that logged it, the machine on which the event occurred, the user associated with the event, the log code, and process ID. All of this information can help you troubleshoot your portal more effectively. See Understanding the logs for a detailed explanation of this information.
Installation and post-installation logging behavior
When you install or upgrade the portal, the portal's log level is set to Verbose. This means that very detailed messages are logged during the installation or upgrade process.
If you encounter a failure during this process and want to review the logs to help you troubleshoot, determine if you can access the ArcGIS Portal Directory. If you can, query the logs and review the messages. If not, review the log messages on disk. To access the logs on disk, browse to the logs directory and open the most recent log file (for example, C:\arcgisportal\logs\<machine name>\portal\portal-20150101.095803-8596-0.0.log). If necessary, you can share this information with Esri Support.
After the installation or upgrade process completes, the portal's log level is set to Warning by default. This means that only moderate to serious problems are logged. If a user of the portal reports a problem, you may need to change the log level to capture more fine-grained messages for that specific issue. To learn how to modify the level of logging, see Specify portal log settings.
When you suspect something is wrong
If you suspect there is an issue with the portal, or a user reports a problem, reproduce the event, capture the event with the logs, query the logs to obtain information about the event, then use the information in the log to help resolve the issue caused by the event.
If an issue is suspected or reported, use the following decision tree to help you capture the event with the logs:
- Try to reproduce the issue:
- If the issue can be reproduced, query the logs and review the messages for information about the issue:
- If no information is present, increase the level of logging. Reproduce the issue again, query the logs, and review messages.
- If information is present in the log messages, review the information to help you resolve the problem.
- If the issue cannot be reproduced, take note of the scenario leading to the issue in case it arises again.
- If the issue can be reproduced, query the logs and review the messages for information about the issue:
Tip:
If the issue is related to publishing, it's recommended that you also review the ArcGIS Server logs. The server logs may provide additional information to help you troubleshoot the publishing issue.
Below are examples of how to capture events, query, and identify them with the logs.
- User cannot add an attachment to a feature service
- User specifies an invalid username or password
- Item is moved from one folder to another
User cannot add an attachment to a feature service
For example, a user reports that they cannot add an attachment to a feature service. The user has tried many times and the file won't upload.
- Open ArcGIS Portal Directory and log in as an Administrator. The URL is typically available at https://webadaptor.domain.com/arcgis/portaladmin.
- Click Logs > Settings > Edit.
- Set the log level to INFO and click Update. The portal is now logging messages at the Info level.
- Ask the user to reproduce the problem. Ask them to record the steps and time period it took to reproduce the problem.
- In the ArcGIS Portal Directory, click Logs > Query.
- Specify the time values obtained by the user. The format is in yyyy-mm-ddThh:mm:ss. For example, the start time is 2015-05-10T14:05:00 and the end time is 2015-05-10T14:03:00.
- Specify the query to return messages at the INFO log level.
- In the Users field, specify the member's user name. For example, jcho for John Cho.
- Click Query.
- Review the Message field for any messages related to the problem.
You reveal a message stating:
Failed to add attachment. File size limit of 20 MB exceeded for feature service '/gis/rest/services/Hosted/parks3k_19/FeatureServer/0/1/addAttachment'.
You now understand the user was attempting to upload a file that exceeded the file size limit. Instruct the user to reduce the file size to less than 20 MB.
User specifies an invalid user name or password
This type of event is logged at the default WARNING level. To capture this type of event, the log level needs to be set to warning or lower, for example:
- Open ArcGIS Portal Directory and log in as an Administrator. The URL is typically available at https://webadaptor.domain.com/arcgis/portaladmin.
- Click Logs > Settings > Edit.
- Verify the level is set to WARNING or lower. If not, set the log level to WARNING (or lower) and click Update.
- When desired, open the ArcGIS Portal Directory and click Logs > Query.
- Specify the query to return messages at the WARNING log level. Ignore all other fields as this returns warning-level messages for all users.
- Review the Message field for any messages related to the problem.
You reveal a message stating:
Sign in error: Invalid username or password specified for 'asmith'.
This message states that user asmith (Ashley Smith) specified an invalid user name or password when attempting to log in to the portal. Monitor these events to prevent unauthorized access attempts.
Item is moved from one folder to another
To capture this type of event, increase the log level to INFO, for example:
- Open ArcGIS Portal Directory and log in as an Administrator. The URL is typically available at https://webadaptor.domain.com/arcgis/portaladmin.
- Click Logs > Settings > Edit.
- Set the log level to INFO and click Update. The portal is now logging messages at the Info level and records events related to items moved from one folder to another.
- When desired, open the ArcGIS Portal Directory and click Logs > Query.
- Specify the query to return messages at the INFO log level. Ignore all other fields as this returns info-level messages for all users since the level was set.
- Review the Message field for any messages related to the problem.
You reveal a message stating:
Item moved from folder 'jcho/(Home)' to folder 'jcho/(Home)/Utilities'. Item ID is 'b7557bd2691b4e74bc4ce3e373402cc6'.
This message states that user jcho (John Cho) moved an item (with the ID b7557bd2691b4e74bc4ce3e373402cc6) from his home folder (Home) to a subdirectory within that folder called Utilities.
Understanding the logs
All events record specific information, such as the log level type, the time at which the event occurred, the source component that logged it, the machine on which the event occurred, the user associated with the event, the log code, and process ID. All of this information can help you troubleshoot your portal more effectively. The following sections explain this information in detail.
Log type
Logged events can vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the portal.
The following are the log level types:
| Level | Description | Sample message |
|---|---|---|
Severe | Serious problems that require immediate attention. This level only includes severe messages. | The 'System/GPServer/PublishingTools' service is stopped or ArcGIS Server is not started. Verify these components are started and try again. |
Warning | Moderate problems that require attention. This level also includes severe messages. | Organization updated: HTTP access disabled. The portal can only be accessed through HTTPS. |
Info | Common administrative messages of the portal, including messages about organization settings being updated. This level also includes severe and warning messages. | User 'asmith' signed in to the portal. |
Fine | Common messages from use of the portal, like names of operations and requests received. This level includes severe, warning, and info messages. | Account settings updated. |
Verbose | Messages providing more detail about how the portal fulfills operations and requests. This level includes severe, warning, info, and fine messages. | Setting log level to VERBOSE before creating new site. |
Debug | Highly verbose messages designed for developers and support technicians who want to obtain a better understanding of the portal's state when troubleshooting. Don't use this level in a production environment; it may cause a decrease in performance. If you're not troubleshooting an issue, use the Warning level instead. | Failed to update index for item '44b37137e1f64de2bec832ab82043b86'. |
Off | Logging is turned off. Events are not logged with the portal. | N/A |
Message
This is the message associated with the logged event. Messages vary in their level of detail based on the log level type.
Time
The time at which the logged event occurred. Events are organized chronologically, with the most recent event displayed first. The time format is in yyyy-mm-ddThh:mm:ss. You can specify the desired time frame to display when querying the logs.
Source
The source of the logged events are generated from the sharing, administrative, and portal components of the software. Events related to publishing and users are categorized under Sharing. Events related to security and indexing are categorized under Portal Admin. Events related to installing the software are categorized under Portal. If desired, you can specify the desired source to display when querying the logs.
Machine
The portal machine on which the event occurred.
User
The name of the user that submitted the request resulting in the log message. This property is useful to help you track individual user activity when security is enabled.
Code
The log code associated with the message. The codes are organized into several categories with specific ranges and content. You can specify a specific code or code range to display when querying the logs.
| Category | Range | Message content |
|---|---|---|
Publishing | 200000–201999 | Publishing and deleting hosted services. |
Content management | 202000–203999 | Adding, removing, updating, and moving items. Changing item ownership. Sharing items with everyone, the organization, and groups. |
Security | 204000–205999 | Built-in or enterprise user log in. Portal token generation and configuration. Disabling and enabling account sign up. Disabling and enabling the ArcGIS Portal Directory. Importing or exporting a security certificate. Creating, deleting, and disabling users. Changing user role privileges. Creating and deleting custom roles. Disabling and enabling HTTPS and anonymous access. Updating the identity store. |
Organization management | 206000–207999 | Customizing the organization home page. Configuration of the gallery, basemaps, display units, utility services, and federated servers. Creating and deleting groups. Adding users to a group and removing users from a group. Invite users to a group or accepting an invitation to a group. Configuration of ArcGIS Pro licenses. ArcGIS Web Adaptor configuration. Modifying the location of the portal content directory. Configuring forward and reverse proxy servers. Exceeding the number of named users authorized for the portal. Editing log setting and deleting logs. |
Installation and upgrade | 208000–209999 | Installing and upgrading the software, creating the portal website, and authorizing the software. |
Search index | 210000–211999 | Generating the portal's item search index. |
General | 212000–219999 | Restarting the portal. Configuring a highly available portal. Other general messages generated through regular use of the portal. |
Process
The machine process ID that logged the event.
Using event filters in a query to narrow down search results
To help you narrow down events and display more relevant messages, you can query based on time, log level, a specific log code or range of codes, a specific user or list of users, and the portal's source component. You can combine any number of these filters as part of your query.
To access these filters, log in to the ArcGIS Portal Directory and click Home > Logs > Query.
Log level
Events vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the portal. Select the desired level from the Log level drop-down list. For a detailed summary of each level, see the Log type section above.
Source
The source of logged events are generated from the sharing, administrative, and portal components of the software. For example:
- Events related to publishing and users are categorized under Sharing.
- Events related to security and indexing are categorized under Portal Admin.
- Events related to installing the software are categorized under Portal.
By default, all sources are queried (All option from the drop-down list). To filter events based on a specific source, select the desired source from the Source drop-down list.
Time
To filter events to a specific time frame, specify the desired time values using the Start Time and End Time fields (format is in yyyy-mm-ddThh:mm:ss). The start time is the most recent time and the end time is the oldest time. For example:
- To define a fifteen minute time interval, the start time is 2015-05-01T13:15:00 and the end time is 2015-05-01T13:00:00.
- To define a one hour time interval, the start time is 2015-05-01T14:00:00 and the end time is 2015-05-01T13:00:00.
- To define one day, the start time is 2015-05-02T12:00:00 and the end time is 2015-05-01T12:00:00.
- To query all logs, leave the time fields blank.
If the start time is specified and the end time is not specified, all of the oldest logs up to the start time specified are returned. Conversely, if the start time is not specified and the end time is specified, all of the latest logs down to the end time specified are returned.
Log codes
Each message is associated with a log code. The codes are organized into several categories, as described above. You can filter based on a specific code or a range of codes, for example:
- To filter for a single code, specify the code value (for example, 204028).
- To filter for specific codes, separate the codes with a comma (,) (for example, 204028, 212015, 219114).
- To filter based on a range of codes, such as all codes in the security category, specify the beginning and ending code separated by a dash (-) (for example, 204000–205999).
- To filter based on a range of codes and individual codes, specify the beginning and ending code (separated by a dash) and separate the individual codes with a comma (for example, 204000–205999, 212015, 219114).
Users
To filter events for a specific user, specify the desired user name in the Users field, for example:
- To filter for one specific user, specify the user name (for example, jcho for John Cho).
- To filter for many users, separate the user names with a comma (,) (for example, jcho, asmith for John Cho and Ashley Smith).
Note:
The use of the wildcard character (*) is not supported.
Message count
The number of messages to display when performing a query. Messages display on a single web page. If necessary, scroll down the page to view all messages.
Delete the logs
If you want to delete the logs, click Home > Logs > Clean > Clean Logs. This deletes all of the log messages from the portal machine. When debugging a specific scenario that causes issues with your portal, deleting the logs can help isolate the issue. In this manner, the log is cleared of any other events, which allows you to focus on debugging the issue.