Monitoring server logs helps you identify errors, troubleshoot problems, and address issues with your site. You'll use ArcGIS Server Manager to view, query, configure, and delete portal logs. Manager aggregates the log messages into a table you can read and manipulate.
The sections in this help topic describe the server logs and how to work with them to address issues.
- How to capture, query, and view events
- Understanding the logs
- Using log filters to narrow down search results
- Paging through server logs
- Viewing the logs in a printer-friendly format
- Deleting logs
How to capture, query, and view events
When an event occurs in your site, the event is captured and recorded in the logs. To view messages associated with the event, you'll need to query the logs. To query and view the current messages in your site, follow these steps:
- Open Manager and log in as an administrator. If you need help with this step, see Logging in to Manager.
- Click Logs > View Logs to review the current logs. Some messages are returned along with additional information.
All events record information, such as the log level, the time at which the event occurred, the source component that logged it, the machine on which the event occurred, the log code, the user associated with the event, and so on. All of this information can help you troubleshoot your portal more effectively. See Understanding the logs for a detailed explanation of this information.
Installation and post-installation logging behavior
When you install or upgrade ArcGIS Server, the server's log level is set to Verbose. This means that very detailed messages are logged during the installation or upgrade process.
If you encounter a failure during this process and want to review the logs to help you troubleshoot, first determine if you can access ArcGIS Server Manager. If you can, query the logs and review the messages. If not, review the log messages on disk. To access the logs on disk, browse to the logs directory and open the most recent log file (for example, C:\arcgisserver\logs\<machine name>\server\server-20150101.095803-8596-0.0.log). If necessary, you can share this information with Esri Support.
After the installation or upgrade process completes, the server's log level is set to Warning by default. This means that only moderate to serious problems will be logged. If a user of the server reports a problem, you may need to change the log level in order to capture more fine-grained messages for that specific issue. To learn how to modify the level of logging, see Specify server log settings in Manager.
When you suspect something is wrong
If you suspect there is an issue with the server, or a user reports a problem, you'll need to reproduce the event, capture the event with the logs, and then query the logs to obtain information about event. Then, you'll use the information in the log to help you resolve the issue caused by the event.
If an issue is suspected or reported, use the following decision tree to help you capture the event with the logs:
- Try to reproduce the issue:
- If the issue can be reproduced, query the logs and review the messages for information about the issue:
- If no information is present, increase the level of logging. Reproduce the issue again, query the logs, and review messages.
- If information is present in the log messages, review the information to help you resolve the problem.
- If the issue cannot be reproduced, take note of the scenario leading to the issue in case it arises again.
- If the issue can be reproduced, query the logs and review the messages for information about the issue:
Tip:
If the issue is related to publishing hosted services, it's recommended that you also review the Portal for ArcGIS logs. The portal logs may provide additional information to help you troubleshoot the publishing issue.
Understanding the logs
All events record specific information, such as the log level, the time at which the event occurred, and the machine on which the event occurred. All of this information can help you troubleshoot your server more effectively.
By default, only the Level, Time, Message, and Source properties display in the log message window. If you want to add or remove properties from the display, choose Columns.
Tip:
Reorder columns by dragging and dropping column headings in the event log display. Click each column heading to sort ascending or descending.
The following sections explain this information in detail.
Level
Logged events can vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the server.
The following are the log level types:
| Log level | Description | Sample message |
|---|---|---|
| Severe | Serious problems that require immediate attention. This level only includes severe messages. | Unable to process request. Service Planning/counties/FeatureServer not found. |
| Warning | Moderate problems that require attention. This level also includes severe messages. | Failed to log in. Invalid username or password specified. |
| Info | Common administrative messages of the server, including messages about service creation and startup. This level also includes severe and warning messages. | Folder Planning was created successfully. |
| Fine | Common messages from use of the server, like names of operation requests received. This level includes severe, warning, and info messages. | Checking for expired items in C:\arcgisserver\directories\arcgisjobs. |
| Verbose | Messages providing more detail about how the server fulfills an operation, such as noting that each layer in a map service was drawn successfully, how fast the layer was drawn, and how long it took the server to access the layer's source data. This level includes severe, warning, info, and fine messages. | Beginning of layer draw: counties. |
| Debug | Highly verbose messages designed for developers and support technicians who want to obtain a better understanding of the server's state when troubleshooting. It's recommended that you don't use this level in a production environment; it may cause a decrease in performance. If you're not troubleshooting an issue, use the Warning level instead. | Cleaning up server directories. |
| Off | Logging is turned off. Events are not logged with the server. | N/A |
Time
The time at which the logged event occurred. Events are organized chronologically, with the most recent event displayed first. Click the Time column header to sort messages ascending or descending.
You can specify the desired time interval to display when querying the logs.
Source
The source of the logged event can be a service or the server itself. Events associated with services display the name and service type as the source property. Events associated with the server display the framework component name that logged the message as the source property.
For example:
- An event related to the SampleWorldCities map service appears as SampleWorldCities.MapServer.
- After successfully creating a server cluster in your site, Admin displays as the component that logged the message.
If desired, you can specify the desired source to display when querying the logs.
Machine
Each GIS server machine participating in your site maintains its own set of logs specific to that machine. Also, if you've registered ArcGIS Data Store with your site, each Data Store machine logs messages specific to that machine.
For example, a GIS server may log an error that it failed to update the location of the configuration store. Only those messages that apply to statistics recorded for a specific machine include a machine property.
You can specify the desired machine to display when querying the logs.
Code
The log code associated with the message. The codes are organized into several ranges as described in Log codes overview.
Time Elapsed
The time it took (in milliseconds) for the logged event to complete. For example, the export web map image event has an elapsed time to indicate the amount of time it took to export the web map image.
User Name
The name of the user that submitted the request resulting in the log message. This property is useful to help you track individual user activity when security is enabled.
Process
The machine process ID that logged the event.
Thread
The server process thread that generated the message.
Method Name
The method call on the service that resulted in the log message.
Using log filters to narrow down search results
To help you narrow down events and display more relevant messages, you can query based on log level, log age (time), source component, and machine. You can combine any number of these filters as part of your query. You can access these filters on the View Logs page in Manager.
Log Filter
Events vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the server. Select the desired level from the Log Filter drop-down list. For a detailed summary of each level, see the Level section above.
Age
Events logged with the server are organized chronologically, with the most recent event displayed first. To filter events to a specific time frame, specify the desired increment from the Age drop-down list:
| Time increment | Description |
|---|---|
| Last 15 Minutes | Displays events logged within the last 15 minutes. |
| Last Hour | Displays events logged within the last hour. |
| Last 6 Hours | Displays events logged within the last six hours. |
| Last 24 Hours | Displays events logged within the last day. |
| Last Week | Displays events logged within the last week, or within the time frame you specified the site to retain logs on disk. |
| Since Startup | Displays events logged since the last time the server restarted, or within the time frame you specified the site to retain logs on disk. |
| All | Displays all events logged since ArcGIS Server was installed, or within the time frame you specified the site to retain logs on disk. |
You can click the Time column header to sort messages ascending or descending.
Remember that the query only returns logs within the time frame you specified your ArcGIS Server site to retain logs on disk. The default is 90 days. For example, if you configured your site to keep logs for five days, selecting Last Week from the Age filter only returns logs from within the last five days.
Tip:
Click Settings to specify how long the server keeps logs on disk. For more information, see Specify server log settings in Manager.
Source
The source of the logged event can be a service or the server itself. Events associated with services display the name and service type as the source property. Events associated with the server display the framework component name that logged the message as the source property.
By default, all sources are queried (All option from the drop-down list). To query a specific service or server framework component, choose the name of the service or component from the Source filter. For a description of the sources that appear for logged events, see the table below.
Note:
The Admin, Server, Rest, and Soap sources described below are aggregated under the Server Framework level in the Source filter. To query these sources, select Server Framework from the Source drop-down filter.
| Source | Description |
|---|---|
| Admin | Indicates the message has been logged by the administrative API. The administrative API is the server tier that allows you to administer your server, for example, create the site, add machines and services, configure clusters, and so on. |
| Server | Indicates the message has been logged by the portion of the server framework responsible for creating instances of services. |
| Rest | Indicates the message has been logged by the server's REST handler. The Rest component logs messages at all levels. |
| Soap | Indicates the message has been logged by the server's SOAP handler. The Soap component logs messages at all levels. |
| ArcGIS Data Store | Indicates the message has been logged by ArcGIS Data Store. Messages only appear if you've registered ArcGIS Data Store with ArcGIS Server. |
| <servicename>.FeatureServer | The source is a feature service. |
| <servicename>.GeocodeServer | The source is a geocode service. |
| <servicename>.GeoDataServer | The source is a geodata service. |
| <servicename>.GeometryServer | The source is a geometry service. |
| Geometry.GeometryServer | The source is the preconfigured geometry service installed with ArcGIS Server. |
| <servicename>.GlobeServer | The source is a globe service. |
| <servicename>.GPServer | The source is a geoprocessing service. |
| CachingTools.GPServer | The source consists of the preconfigured caching tools installed with ArcGIS Server. |
| PrintingTools.GPServer | The source is the preconfigured PrintingTools service installed with ArcGIS Server. |
| PublishingTools.GPServer | The source consists of the preconfigured publishing tools installed with ArcGIS Server. |
| <servicename>.ImageServer | The source is an image service. |
| <servicename>.JPIPServer | The source is a JPIP service. |
| <servicename>.KmlServer | The source is a KML service. |
| <servicename>.MapServer | The source is a map service. |
| <servicename>.MobileServer | The source is a mobile data service. |
| <servicename>.NAServer | The source is a network analysis service. |
| <servicename>.WCSServer | The source is a web coverage service. |
| <servicename>.WFSServer | The source is a web feature service. |
| <servicename>.WMServer | The source is a workflow manager service. |
| <servicename>.WMSServer | The source is a web map service. |
| <servicename>.WMTSServer | The source is a web map tile service. |
| <servicename>.WPSServer | The source is a web processing service. |
| <servicename>.SceneServer | The source is a scene service. |
| <servicename>.SchematicsServer | The source is a schematics service. |
| <servicename>.SearchServer | The source is a search service. |
| SampleWorldCities.MapServer | The source is the preconfigured SampleWorldCities map service installed with ArcGIS Server. |
| Search.SearchServer | The source is the preconfigured search service installed with ArcGIS Server. |
| Search_indexer.GPServer | The source is the preconfigured search service's accompanying _indexer geoprocessing service. |
| <searchservicename>_indexer.GPServer | The source is the search service's accompanying _indexer geoprocessing service. |
Machine
Each GIS server machine participating in your site maintains its own set of logs specific to that machine. Also, if you've registered ArcGIS Data Store with your site, each Data Store machine logs messages specific to that machine.
By default, all machines are queried (All option from the drop-down list). To query events logged with a specific machine, choose the desired machine from the Machine filter.
Paging through server logs
When you execute a query in the View Logs module, the log message window displays 1,000 of the most recent messages that match your query. The time frame of these messages appears at the bottom of the log message window.
If your query returns more than 1,000 messages, page to the next set of records by clicking the Older button at the bottom of the log message window. Similarly, page forward in time by clicking the Newer button.
When paging through records, the log message window does not automatically update to account for new messages that may have been logged after the query executed. Click Query on the View Logs module to obtain the most recent results for your query.
Viewing the logs in a printer-friendly format
After executing a query, click the Printer Friendly View link to view logs in a printer-friendly format. This opens a new browser window (or tab) that displays the logs in HTML. You can use this view to print the logs, save the HTML to disk, or copy and paste the logs into a document or spreadsheet. In this manner, you can share your log messages with others in your organization and if necessary, Esri technical support.
The printer-friendly view only displays the last executed query, the current view of the log message window, and any logging properties you specified. However, if you sorted or reordered columns in the event log display, the HTML view returns the columns to their original state when the query first executed. If desired, copy and paste the logs into a spreadsheet and use the tools in the application to sort and reorder columns.
Deleting logs
Click Delete Logs to delete all log messages from each GIS server participating in your site. You'll be prompted to confirm your decision to delete all the logs after you click Delete Logs.
When debugging a specific scenario that causes issues with your server, deleting the logs can help isolate the issue. For example, if you are attempting to determine the drawing performance of a particular layer in a map service, it may be helpful to delete the log, send a request to the map, then update the log message window to display the request event. In this manner, the log is cleared of any other events, which allows you to focus on debugging the map service.