Work with organization logs

Monitoring logs helps you identify errors, troubleshoot problems, and address issues with your organization. Use the ArcGIS Portal Administrator Directory to view, query, configure, and delete your organization's logs. The Portal Administrator Directory aggregates the log messages into a table you can read and manipulate.

Events logged to each component in your organization can be accessed from the Portal Administrator Directory. You may still need to use ArcGIS Server Manager to specify server log settings, delete server logs, and use all filter options.

The sections in this topic describe the logs and how to work with them to address issues.

• Capture, query, and view events
• Using event filters in a query to narrow down search results
• Delete the logs

Capture, query, and view events

When an event occurs in the organization, the event is captured and recorded in the logs. To view messages associated with the event, query the logs. To query and view the current messages, follow these steps:

1. Open the Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
2. Click Logs > Query.
3. Leave all of the default settings and click Query.

Some messages are returned along with additional information. For example, you'll see the following messages if a user enters the incorrect password too many times and is locked out of their account:

In the above scenario, the user john_cho was attempting to sign in but was entering the wrong password. After five attempts, the account lockout policy was enforced and the user was locked out of the account. This may also indicate a malicious user is attempting to access the organization.

All events record the above information, such as the log level type, the time at which the event occurred, the source component that logged it, the machine on which the event occurred, the user associated with the event, the log code, the process ID, and the request ID. All of this information can help you troubleshoot your organization more effectively. See Understand logs for a detailed explanation of this information.

When you suspect something is wrong

If you suspect there is an issue with the organization, or a user reports a problem, reproduce the event, capture the event with the logs, query the logs to obtain information about the event, then use the information in the log to help resolve the issue caused by the event.

If an issue is suspected or reported, use the following decision tree to help you capture the event with the logs:

• Try to reproduce the issue:
  • If the issue can be reproduced, query the logs and review the messages for information about the issue:
    1. If no information is present, increase the level of logging. Reproduce the issue again, query the logs, and review messages.
    2. If information is present in the log messages, review the information to help you resolve the problem.
  • If the issue cannot be reproduced, take note of the scenario leading to the issue in case it arises again.

Tip:

If you suspect the issue spans multiple components, it's recommended that you select your federated servers when querying logs. The server logs and ArcGIS Data Store logs may provide additional information to help you troubleshoot.

Below are examples of how to capture events, query, and identify them with the logs.

• User cannot add an attachment to a feature service
• User specifies an invalid username or password
• Item is moved from one folder to another
• Organization is set to read-only

User cannot add an attachment to a feature service

In this example, a user reports that they cannot add an attachment to a feature service. The user has tried many times and the file won't upload. To capture this type of event, the portal log level must first be set to INFO.

Once the portal is logging messages at the INFO level, complete the following steps:

1. Ask the user to reproduce the problem and to record the steps and time it took to reproduce the problem.
2. Open the Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
3. Click Logs > Query.
   1. Specify the time values obtained by the user. The format is in yyyy-mm-ddThh:mm:ss. For example, the start time is 2015-05-10T14:05:00 and the end time is 2015-05-10T14:03:00.
   2. Specify the query to return messages at the INFO log level.
   3. In the Users field, specify the member's username. For example, jcho for John Cho.
   4. Click Query.
4. Review the Message field for any messages related to the problem.

You reveal a message stating the following:

Failed to add attachment. File size limit of 20 MB exceeded for feature service '/gis/rest/services/Hosted/parks3k_19/FeatureServer/0/1/addAttachment'.

You now understand the user was attempting to upload a file that exceeded the file size limit. Instruct the user to reduce the file size to less than 20 MB.

User specifies an invalid username or password

To capture this type of event, the portal log level must first be set to WARNING or lower.

Once the portal is logging messages at the WARNING level, complete the following steps:

1. Open Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
2. Click Logs > Query.
3. Verify the log level is set to the WARNING log level. Ignore all other fields, as this returns warning-level messages for all users.
4. Review the Message field for any messages related to the problem.

You reveal a message stating the following:

Sign in error: Invalid username or password specified for 'asmith'.

This message states that user asmith (Ashley Smith) specified an invalid username or password when attempting to sign in to the organization. Monitor these events to prevent unauthorized access attempts.

Item is moved from one folder to another

To capture this type of event, the portal log level must first be set to INFO.

Once the portal is logging messages at the INFO level, complete the following steps:

1. Open Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
2. Click Logs > Query.
3. Verify the log level is set to INFO. Ignore all other fields, as this returns info-level messages for all users since the level was set.
4. Click Query.
5. Review the Message field for any messages related to the problem.

You reveal a message stating the following:

Item moved from folder 'jcho/(Home)' to folder 'jcho/(Home)/Utilities'. Item ID is 'b7557bd2691b4e74bc4ce3e373402cc6'.

This message states that user jcho (John Cho) moved an item (with the ID b7557bd2691b4e74bc4ce3e373402cc6) from his home folder (Home) to a subdirectory within that folder named Utilities.

Organization is set to read-only

To capture what happens across all components when you set your organization to read-only mode, the log level for components must first be set to INFO or lower. See Specify portal log settings and Specify server log settings for more information.

Once your components are logging messages at the INFO level or lower and your organization is set to read-only mode, complete the following steps:

1. Open Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
2. Click Logs > Query.
3. Verify the log level is set to INFO and click Query.
4. Locate the log message indicating the organization was set to read-only and note the request ID for that message.

   Successfully set the organization to read-only mode

5. Click Query to return to query log messages.
6. Enter the request ID noted in step 4 in the RequestIDs field.
7. Select All in the Federated Servers field.
8. Click Query and review logs across all components related to placing the organization in read-only mode.

Using event filters in a query to narrow search results

To help you narrow down events and display more relevant messages, you can query based on log level, source component, time, a specific log code or range of codes, a specific user or list of users, and request ID. You can combine any number of these filters as part of your query.

To query all of your organization's log messages, you can select your federated servers. Time and request ID can be used to filter log messages across components, while the rest will only filter portal logs. If you want more options for filtering server logs, you can use ArcGIS Server Manager.

To access these filters, sign in to the Portal Administrator Directory and click Home > Logs > Query.

Log level

Events vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the portal. Select the desired level from the Log level drop-down list. For a detailed summary of each level, see Log type.

Source

The sources of logged events are generated from the sharing, administrative, and portal components of the software. For example:

• Events related to publishing and users are categorized under Sharing.
• Events related to security and indexing are categorized under Portal Admin.
• Events related to installing the software are categorized under Portal.

By default, all sources are queried (the All option from the drop-down list). To filter portal events based on a specific source, select the desired source from the Source drop-down list.

Time

To filter events to a specific time frame, specify the desired time values using the Start Time and End Time fields (the format is yyyy-mm-ddThh:mm:ss). The start time is the most recent time and the end time is the oldest time. For example:

• To define a 15-minute time interval, the start time is 2015-05-01T13:15:00 and the end time is 2015-05-01T13:00:00.
• To define a one-hour time interval, the start time is 2015-05-01T14:00:00 and the end time is 2015-05-01T13:00:00.
• To define one day, the start time is 2015-05-02T12:00:00 and the end time is 2015-05-01T12:00:00.
• To query all logs, leave the time fields blank.

If the start time is specified and the end time is not specified, all of the oldest logs up to the start time specified are returned. Conversely, if the start time is not specified and the end time is specified, all of the latest logs down to the end time specified are returned.

If selected, events logged to federated servers will also be filtered.

Log codes

Each message is associated with a log code. The codes are organized into several categories. You can filter portal logs based on a specific code or a range of codes, for example:

• To filter for a single code, specify the code value (for example, 204028).
• To filter for specific codes, separate the codes with a comma (,) (for example, 204028, 212015, 219114).
• To filter based on a range of codes, such as all codes in the security category, specify the beginning and ending code separated by a dash (-) (for example, 204000–205999).
• To filter based on a range of codes and individual codes, specify the beginning and ending code (separated by a dash) and separate the individual codes with a comma (for example, 204000–205999, 212015, 219114).

Users

To filter portal events for a specific user, specify the desired username in the Users field, for example:

• To filter for one specific user, specify the username (for example, jcho for John Cho).
• To filter for many users, separate the usernames with a comma (,) (for example, jcho, asmith for John Cho and Ashley Smith).

Note:

The use of the wildcard character (*) is not supported.

Requests IDs

The unique ID string attached to every request made, which is carried throughout the request's life cycle in the system. Select one or all federated servers if you are filtering by request ID for an operation that spans multiple components.

Message count

The number of messages to display when performing a query. Messages display on a single web page. If necessary, scroll down the page to view all messages.

Federated servers

To troubleshoot problems or gain insight into operations that span multiple ArcGIS Enterprise components, include server logs in your query by selecting one or all federated servers. When querying the hosting server logs, ArcGIS Data Store logs will also be included.

Delete the logs

If you want to delete the logs, click Home > Logs > Clean > Clean Logs. This deletes all of the log messages from the portal machine. When debugging a specific scenario that causes issues with your portal, deleting the logs can help isolate the issue. In this manner, the log is cleared of any other events, which allows you to focus on debugging the issue.

To delete server logs, use ArcGIS Server Manager.