Portal for ArcGIS records events that occur, and any errors associated with those events, to logs. Logs are an important tool for monitoring and troubleshooting problems with your portal. Information in the logs will help you identify errors and provide context on how to address problems. The logs also comprise a history of the events that occur over time.
For example, the following events are recorded in the logs:
- Installation and upgrade events, such as authorizing the software and creating the portal
- Publishing of services and items, such as hosted services, web maps, and data items
- Content management events, such as sharing items, changing item ownership, and adding, updating, moving, and deleting items
- Security events, such as users signing in to the portal; creating, deleting, and disabling users; creating and changing user roles; updating HTTP and HTTPS settings; importing and exporting security certificates; and updating the portal's identity store
- Organization management events, such as adding and configuring groups; adding or removing users from a group; configuring the gallery, basemaps, utility services, and federated servers; and configuring log settings and deleting logs
- General events, such as updating the portal's search index and restarting the portal
The following events are not recorded in the logs:
- Users logging out of the portal
- Federating and unfederating an ArcGIS Server site with your portal
- REST requests to edit and query portal items
For a detailed list of which portal events are logged, see Work with portal logs.
If you're familiar with ArcGIS Server, working with logs in portal is similar to the experience of working with logs in the ArcGIS Server Administrator Directory. Currently, there is no logging experience equivalent to ArcGIS Server Manager in the portal. If your ArcGIS Server site is federated with your portal, you cannot use ArcGIS Server Manager to access and work with portal logs; you must use the ArcGIS Portal Directory.
Access portal logs
Use the Portal Administrator Directory to query, view, configure, and delete portal logs. The Portal Administrator Directory aggregates the log messages into a table you can read and manipulate.
To access the portal logs, follow these steps:
- Open the Portal Administrator Directory and log in as an Administrator.
The URL is typically available at https://webadaptorhost.domain.com/webadaptorname/portaladmin.
- Click Logs > Query.
- On the Query Logs page, click Query to review the current logs.
For example, you'll see the following messages if a user provides the incorrect password too many times and is locked out of their account:
In the above scenario, the user john_cho was attempting to sign in but was providing the wrong password. After 10 attempts, the account lockout policy was enforced and he was locked out of his account. This may also indicate a malicious user is attempting to access the portal.
You can also use the log filters on the Query Logs page to help you narrow down events and display more relevant messages. Work with portal logs contains details on how to capture events, query the logs, review messages, and filter events based on certain criteria.
- To manage log settings, such as the default level of logging, how long logs are kept on disk, and where the portal writes its logs, click Home > Logs > Settings. See Specify portal log settings for details.
- To delete the logs, click Home > Logs > Clean.
This deletes all of the log files from the portal machine.