ArcGIS Enterprise records events that occur, and any errors associated with those events, to logs. Logs are an important tool for monitoring and troubleshooting problems with your organization. Information in the logs will help you identify errors and provide context on how to address problems. The logs also comprise a history of the events that occur over time.
For example, the following events are recorded in the logs:
- Installation and upgrade events, such as authorizing the software and creating the portal
- Publishing of services and items, such as hosted services, web maps, and data items
- Content management events, such as sharing items, changing item ownership, and adding, updating, moving, and deleting items
- Security events, such as users signing in to the organization; creating, deleting, and disabling users; creating and changing user roles; updating HTTP and HTTPS settings; importing and exporting security certificates; and updating the portal's identity store
- Organization management events, such as adding and configuring groups; adding or removing users from a group; configuring the gallery, basemaps, utility services, and federated servers; and configuring log settings and deleting logs
- General events, such as updating the portal's search index and restarting the portal
The following events are not recorded in the logs:
- Users logging out of the organization
- Federating and unfederating an ArcGIS Server site with your portal
- REST requests to edit and query items
While you can query logs across ArcGIS Enterprise components from the Portal Administrator Directory, all event filters are not available to sever logs. For more filtering options, query server logs from ArcGIS Server Manager.
Install and upgrade logging behavior
When you install or upgrade ArcGIS Enterprise, each component's log level is set to Verbose. This means that very detailed messages are logged during the installation or upgrade process.
If you encounter a failure when installing or upgrading Portal for ArcGIS and want to review the logs to help you troubleshoot, determine whether you can access the Portal Administrator Directory. If you can, query the logs and review the messages. If not, review the log messages on disk. To access the logs on disk, browse to the logs directory and open the most recent log file (for example, <Portal for ArcGIS installation directory>/arcgisportal/logs/<machine name>/portal/portal-20150101.095803-8596-0.0.log). If necessary, you can share this information with Esri Support.
After the installation or upgrade process completes, the log level for each component is set to Warning by default. This means that only moderate to serious problems are logged. If a user reports a problem, you may need to change the log level to capture more fine-grained messages for that specific issue. To learn how to modify the level of logging, see Specify portal log settings and Specify server log settings.
Understand logs
All events record specific information, such as the log level type, the time at which the event occurred, the source component that logged it, the machine on which the event occurred, the user associated with the event, the log code, and process ID. All of this information can help you troubleshoot more effectively. The following sections explain this information in detail.
Log type
Logged events can vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the organization.
The following are the log level types:
| Level | Description | Sample message |
|---|---|---|
Severe | Serious problems that require immediate attention. This level only includes severe messages. | The 'System/GPServer/PublishingTools' service is stopped or ArcGIS Server is not started. Verify these components are started and try again. |
Warning | Moderate problems that require attention. This level also includes severe messages. | Organization updated: HTTP access disabled. The portal can only be accessed through HTTPS. |
Info | Common administrative messages, including messages about organization settings being updated. This level also includes severe and warning messages. | User 'asmith' signed in to the portal. |
Fine | Common messages from use of the organization, such as names of operations and requests received. This level includes severe, warning, and info messages. | Account settings updated. |
Verbose | Messages providing more detail about how the organization fulfills operations and requests. This level includes severe, warning, info, and fine messages. | Setting log level to VERBOSE before creating new site. |
Debug | Highly verbose messages designed for developers and support technicians who want to obtain a better understanding of the organization's state when troubleshooting. Don't use this level in a production environment; it may cause a decrease in performance. If you're not troubleshooting an issue, use the Warning level instead. | Failed to update index for item '44b37137e1f64de2bec832ab82043b86'. |
Off | Logging is turned off. Events are not logged with the organization. | N/A |
Message
This is the message associated with the logged event. Messages vary in their level of detail based on the log level type.
Time
The time at which the logged event occurred. Events are organized chronologically, with the most recent event displayed first. The time format is yyyy-mm-ddThh:mm:ss.
Source
The events logged in the portal are of one of the following sources:
- Sharing—Events related to publishing and users.
- Portal Admin—Events related to security and indexing.
- Portal—Events related to installing the software.
The source of events logged in a server can be a service or the server. Events associated with services display the name and service type as the source property. Events associated with the server display the framework component name that logged the message as the source property.
The following are examples:
- An event related to the SampleWorldCities map service appears as SampleWorldCities.MapServer.
- After successfully creating a server cluster in your site, Admin displays as the component that logged the message.
Machine
The machine on which the event occurred.
User
The name of the user who submitted the request resulting in the log message. This property is useful to help you track individual user activity when security is enabled.
Code
The log code associated with the message. The codes are organized into several categories with specific ranges and content.
The following table contains portal log codes. To review server log codes, see Log codes.
| Category | Range | Message content |
|---|---|---|
Publishing | 200000–201999 | Publishing and deleting hosted services. |
Content management | 202000–203999 | Adding, removing, updating, and moving items. Changing item ownership. Sharing items with everyone, the organization, and groups. |
Security | 204000–205999 | Built-in or organization-specific user log in. Portal token generation and configuration. Disabling and enabling account sign up. Disabling and enabling the ArcGIS Portal Directory. Importing or exporting a security certificate. Creating, deleting, and disabling users. Changing user role privileges. Creating and deleting custom roles. Disabling and enabling HTTPS and anonymous access. Updating the identity store. |
Organization management | 206000–207999 | Customizing the organization home page. Configuration of the gallery, basemaps, display units, utility services, and federated servers. Creating and deleting groups. Adding users to a group and removing users from a group. Invite users to a group or accepting an invitation to a group. Configuration of ArcGIS Pro licenses. ArcGIS Web Adaptor configuration. Modifying the location of the portal content directory. Configuring forward and reverse proxy servers. Exceeding the number of named users authorized for the portal. Editing log setting and deleting logs. |
Installation and upgrade | 208000–209999 | Installing and upgrading the software, creating the portal website, and authorizing the software. |
Search index | 210000–211999 | Generating the portal's item search index. |
General | 212000–219999 | Restarting the portal. Configuring a highly available portal. Other general messages generated through regular use of the portal. |
Process
The machine process ID that logged the event.
Request ID
The unique ID string attached to every request upon submission, which is carried throughout the request's life cycle in the system.