Skip To Content

Work with server logs

Monitoring server logs helps you identify errors, troubleshoot problems, and address issues with your site. You'll use ArcGIS Server Manager to view, query, configure, and delete portal logs. Manager aggregates the log messages into a table you can read and manipulate.

The sections in this help topic describe the server logs and how to work with them to address issues.

How to capture, query, and view events

When an event occurs in your site, the event is captured and recorded in the logs. To view messages associated with the event, you'll need to query the logs. To query and view the current messages in your site, follow these steps:

  1. Open Manager and log in as an administrator. If you need help with this step, see Logging in to Manager.
  2. Click Logs > View Logs to review the current logs. Some messages are returned along with additional information.

All events record information, such as the log level, the time at which the event occurred, the source component that logged it, the machine on which the event occurred, the log code, the user associated with the event, and so on. All of this information can help you troubleshoot your portal more effectively. See Understanding the logs for a detailed explanation of this information.

Installation and post-installation logging behavior

When you install or upgrade ArcGIS Server, the server's log level is set to Verbose. This means that very detailed messages are logged during the installation or upgrade process.

If you encounter a failure during this process and want to review the logs to help you troubleshoot, first determine if you can access ArcGIS Server Manager. If you can, query the logs and review the messages. If not, review the log messages on disk. To access the logs on disk, browse to the logs directory and open the most recent log file (for example, C:\arcgisserver\logs\<machine name>\server\server-20150101.095803-8596-0.0.log). If necessary, you can share this information with Esri Support.

After the installation or upgrade process completes, the server's log level is set to Warning by default. This means that only moderate to serious problems will be logged. If a user of the server reports a problem, you may need to change the log level to capture more fine-grained messages for that specific issue. To learn how to modify the logging level, see Specify server log settings in Manager.

When you suspect something is wrong

If you suspect there is an issue with the server, or a user reports a problem, you'll need to reproduce the event, capture the event with the logs, and query the logs to obtain information about the event. Then, you'll use the information in the log to help you resolve the issue caused by the event.

If an issue is suspected or reported, use the following to help you capture the event with the logs:

  • Try to reproduce the issue
    • If the issue can be reproduced, query the logs and review the messages for information about the issue
      • If no information is present, increase the logging level. Reproduce the issue again, query the logs, and review messages.
      • If information is present in the log messages, review the information to help you resolve the problem.
    • If the issue cannot be reproduced, take note of the scenario leading to the issue in case it arises again.
Tip:

If the issue is related to publishing hosted services, it's recommended that you also review the Portal for ArcGIS logs. The portal logs may provide additional information to help you troubleshoot the publishing issue.

Understand the logs

All events record specific information, such as the log level, the time at which the event occurred, and the machine on which the event occurred. All of this information can help you troubleshoot your server more effectively.

By default, only the Level, Time, Message, and Source properties display in the log message window. If you want to add or remove properties from the display, choose Columns.

Tip:

Reorder columns by dragging and dropping column headings in the event log display. Click each column heading to sort in ascending or descending order.

Level

Logged events can vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the server.

The following are the log level types:

Log levelDescriptionSample message

Severe

Serious problems that require immediate attention. This level only includes severe messages.

Unable to process request. Service Planning/counties/FeatureServer not found.

Warning

Moderate problems that require attention. This level also includes severe messages.

Failed to log in. Invalid username or password specified.

Info

Common administrative messages of the server, including messages about service creation and startup. This level also includes severe and warning messages.

Folder Planning was created successfully.

Fine

Common messages from use of the server, such as names of operation requests received. This level includes severe, warning, and info messages.

Checking for expired items in C:\arcgisserver\directories\arcgisjobs.

Verbose

Messages providing more detail about how the server fulfills an operation, such as noting that each layer in a map service was drawn successfully, how fast the layer was drawn, and how long it took the server to access the layer's source data. This level includes severe, warning, info, and fine messages.

Beginning of layer draw: counties.

Debug

Highly verbose messages designed for developers and support technicians who want to obtain a better understanding of the server's state when troubleshooting. It's recommended that you don't use this level in a production environment; it may cause a decrease in performance. If you're not troubleshooting an issue, use the Warning level instead.

Cleaning up server directories.

Off

Logging is turned off. Events are not logged with the server.

N/A

Time

This is the time at which the logged event occurred. Events are organized chronologically, with the most recent event displayed first. Click the Time column header to sort messages in ascending or descending order.

You can specify the desired time interval to display when querying the logs.

Source

The source of the logged event can be a service or the server. Events associated with services display the name and service type as the source property. Events associated with the server display the framework component name that logged the message as the source property.

The following are examples:

  • An event related to the SampleWorldCities map service appears as SampleWorldCities.MapServer.
  • After successfully creating a server cluster in your site, Admin displays as the component that logged the message.

Optionally, you can specify the desired source to display when querying the logs.

Machine

Each server machine participating in your site maintains a set of logs specific to that machine. If you've registered ArcGIS Data Store with your site, each Data Store machine also logs messages specific to that machine.

For example, a server may log an error that it failed to update the location of the configuration store. Only those messages that apply to statistics recorded for a specific machine include a machine property.

You can specify the desired machine to display when querying the logs.

Code

This is the log code associated with the message. The codes are organized into several ranges as described in Log codes overview.

Time Elapsed

This is the time it took (in milliseconds) for the logged event to complete. For example, the export web map image event has an elapsed time to indicate the amount of time it took to export the web map image.

User Name

This is the name of the user who submitted the request resulting in the log message. This property is useful to help you track individual user activity when security is enabled.

Process

This is the machine process ID that logged the event.

Thread

This is the server process thread that generated the message.

Request ID

This is the unique ID string attached to every request made to ArcGIS Server upon submission, which is carried throughout the request's lifecycle in the system.

Method Name

This is the method call on the service that resulted in the log message.

Use log filters to narrow search results

To help you narrow events and display relevant messages, you can query based on log level, log age (time), source component, and machine. You can combine any number of these filters as part of your query. You can access these filters on the View Logs page in Manager.

Log Filter

Events vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the server. Choose the desired level from the Log Filter drop-down list. For a detailed summary of each level, see the Level section above.

Age

Events logged with the server are organized chronologically, with the most recent event displayed first. To filter events to a specific time frame, specify the desired increment from the Age drop-down list:

Time incrementDescription

Last 15 Minutes

Displays events logged within the last 15 minutes

Last Hour

Displays events logged within the last hour

Last 6 Hours

Displays events logged within the last six hours

Last 24 Hours

Displays events logged within the last day

Last Week

Displays events logged within the last week or within the time frame you specified the site to retain logs on disk

Since Startup

Displays events logged since the last time the server restarted or within the time frame you specified the site to retain logs on disk

All

Displays all events logged since ArcGIS Server was installed or within the time frame you specified the site to retain logs on disk

Click the Time column header to sort messages in ascending or descending order.

Remember that the query only returns logs within the time frame you specified your ArcGIS Server site to retain logs on disk. The default is 90 days. For example, if you configured your site to keep logs for five days, selecting Last Week from the Age filter only returns logs from the last five days.

Tip:

Click Settings to specify how long the server keeps logs on disk. For more information, see Specify server log settings.

Source

The source of the logged event can be a service or the server. Events associated with services display the name and service type as the source property. Events associated with the server display the framework component name that logged the message as the source property.

By default, all sources are queried (the All option from the drop-down list). To query a specific service or server framework component, choose the name of the service or component from the Source filter. For a description of the sources that appear for logged events, see the table below.

Note:

The Admin, Server, Rest, and Soap sources described below are aggregated under the Server Framework level in the Source filter. To query these sources, choose Server Framework from the Source drop-down filter.

SourceDescription

Admin

Indicates the message has been logged by the administrative API. The administrative API is the server tier that allows you to administer your server, for example, create the site, add machines and services, configure clusters, and so on.

Server

Indicates the message has been logged by the portion of the server framework responsible for creating instances of services.

Rest

Indicates the message has been logged by the server's REST handler. The Rest component logs messages at all levels.

Soap

Indicates the message has been logged by the server's SOAP handler. The Soap component logs messages at all levels.

ArcGIS Data Store

Indicates the message has been logged by ArcGIS Data Store. Messages only appear if you've registered ArcGIS Data Store with ArcGIS Server.

<servicename>.FeatureServer

The source is a feature service.

<servicename>.GeocodeServer

The source is a geocode service.

<servicename>.GeoDataServer

The source is a geodata service.

<servicename>.GeometryServer

The source is a geometry service.

Geometry.GeometryServer

The source is the preconfigured geometry service installed with ArcGIS Server.

<servicename>.GPServer

The source is a geoprocessing service.

CachingTools.GPServer

The source consists of the preconfigured caching tools installed with ArcGIS Server.

PrintingTools.GPServer

The source is the preconfigured PrintingTools service installed with ArcGIS Server.

PublishingTools.GPServer

The source consists of the preconfigured publishing tools installed with ArcGIS Server.

<servicename>.ImageServer

The source is an image service.

<servicename>.KmlServer

The source is a KML service.

<servicename>.MapServer

The source is a map service.

<servicename>.NAServer

The source is a network analysis service.

<servicename>.WCSServer

The source is a web coverage service.

<servicename>.WFSServer

The source is a web feature service.

<servicename>.WMServer

The source is a workflow manager service.

<servicename>.WMSServer

The source is a web map service.

<servicename>.WMTSServer

The source is a web map tile service.

<servicename>.WPSServer

The source is a web processing service.

<servicename>.SceneServer

The source is a scene service.

<servicename>.SchematicsServer

The source is a schematics service.

<servicename>.SearchServer

The source is a search service.

SampleWorldCities.MapServer

The source is the preconfigured SampleWorldCities map service installed with ArcGIS Server.

Search.SearchServer

The source is the preconfigured search service installed with ArcGIS Server.

Search_indexer.GPServer

The source is the preconfigured search service's accompanying _indexer geoprocessing service.

<searchservicename>_indexer.GPServer

The source is the search service's accompanying _indexer geoprocessing service.

Machine

Each server machine participating in your site maintains a set of logs specific to that machine. If you've registered ArcGIS Data Store with your site, each Data Store machine also logs messages specific to that machine.

By default, all machines are queried (the All option from the drop-down list). To query events logged with a specific machine, choose the desired machine from the Machine filter.

Page through server logs

When you execute a query in the View Logs module, the log message window displays 1,000 of the most recent messages that match your query. The time frame of these messages appears at the bottom of the log message window.

If your query returns more than 1,000 messages, page to the next set of records by clicking the Older button at the bottom of the log message window. Similarly, page forward in time by clicking the Newer button.

When paging through records, the log message window does not automatically update to account for new messages that may have been logged after the query executed. Click Query on the View Logs module to obtain the most recent results for your query.

View the logs in a printer-friendly format

After executing a query, click the Printer Friendly View link to view logs in a printer-friendly format. This opens a new browser window (or tab) that displays the logs in HTML. You can use this view to print the logs, save the HTML to disk, or copy and paste the logs into a document or spreadsheet. In this manner, you can share your log messages with others in your organization and, if necessary, Esri Support.

The printer-friendly view only displays the last executed query, the current view of the log message window, and any logging properties you specified. However, if you sorted or reordered columns in the event log display, the HTML view returns the columns to their original state when the query first executed. You can copy and paste the logs into a spreadsheet and use the tools in the application to sort and reorder columns.

Delete logs

Click Delete Logs to delete all log messages from each server participating in your site. You'll be prompted to confirm your decision to delete all the logs after you click Delete Logs.

When debugging a specific scenario that causes issues with your server, deleting the logs can help isolate the issue. For example, if you're attempting to determine the drawing performance of a particular layer in a map service, it may be helpful to delete the log, send a request to the map, and update the log message window to display the request event. In this manner, the log is cleared of all other events, which allows you to focus on debugging the map service.