Monitoring logs helps you identify errors, troubleshoot problems, and address issues with your organization. Use the ArcGIS Portal Administrator Directory to view, query, configure, and delete your organization's logs. The Portal Administrator Directory aggregates the log messages into a table you can read and manipulate.
Events logged to each component in your organization can be accessed from the Portal Administrator Directory. You may still need to use ArcGIS Server Manager to specify server log settings, delete logs, and use all filter options.
The sections in this help topic describe the logs and how to work with them to address issues.
- Capture, query, and view events
- Using event filters in a query to narrow down search results
- Delete the logs
Capture, query, and view events
When an event occurs in the organization, the event is captured and recorded in the logs. To view messages associated with the event, query the logs. To query and view the current messages, follow these steps:
- Open the Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
- Click Logs > Query.
- Leave all of the default settings and click Query.
Some messages are returned along with additional information. For example, you'll see the following messages if a user enters the incorrect password too many times and is locked out of their account:
In the above scenario, the user john_cho was attempting to sign in but was entering the wrong password. After five attempts, the account lockout policy was enforced and the user was locked out of the account. This may also indicate a malicious user is attempting to access the organization.
All events record the above information, such as the log level type, the time at which the event occurred, the source component that logged it, the machine on which the event occurred, the user associated with the event, the log code, the process ID, and the request ID. All of this information can help you troubleshoot your organization more effectively. See Understand logs for a detailed explanation of this information.
When you suspect something is wrong
If you suspect there is an issue with the organization, or a user reports a problem, reproduce the event, capture the event with the logs, query the logs to obtain information about the event, then use the information in the log to help resolve the issue caused by the event.
If an issue is suspected or reported, use the following decision tree to help you capture the event with the logs:
- Try to reproduce the issue:
- If the issue can be reproduced, query the logs and review the messages for information about the issue:
- If no information is present, increase the level of logging. Reproduce the issue again, query the logs, and review messages.
- If information is present in the log messages, review the information to help you resolve the problem.
- If the issue cannot be reproduced, take note of the scenario leading to the issue in case it arises again.
- If the issue can be reproduced, query the logs and review the messages for information about the issue:
Tip:
If you suspect the issue spans multiple components, it's recommended that you select your federated servers when querying logs. The server logs, and the logs of their registered data stores, may provide additional information to help you troubleshoot.
Below are examples of how to capture events, query, and identify them with the logs.
- User cannot add an attachment to a feature service
- User specifies an invalid username or password
- Item is moved from one folder to another
User cannot add an attachment to a feature service
For example, a user reports that they cannot add an attachment to a feature service. The user has tried many times and the file won't upload.
- Open the Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
- Click Logs > Settings > Edit.
- Set the log level to INFO and click Update. The portal is now logging messages at the Info level.
- Ask the user to reproduce the problem. Ask them to record the steps and time period it took to reproduce the problem.
- In the Portal Administrator Directory, click Logs > Query.
- Specify the time values obtained by the user. The format is in yyyy-mm-ddThh:mm:ss. For example, the start time is 2015-05-10T14:05:00 and the end time is 2015-05-10T14:03:00.
- Specify the query to return messages at the INFO log level.
- In the Users field, specify the member's username. For example, jcho for John Cho.
- Click Query.
- Review the Message field for any messages related to the problem.
You reveal a message stating the following:
Failed to add attachment. File size limit of 20 MB exceeded for feature service '/gis/rest/services/Hosted/parks3k_19/FeatureServer/0/1/addAttachment'.
You now understand the user was attempting to upload a file that exceeded the file size limit. Instruct the user to reduce the file size to less than 20 MB.
User specifies an invalid username or password
This type of event is logged at the default WARNING level. To capture this type of event, the log level needs to be set to warning or lower, for example:
- Open Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
- Click Logs > Settings > Edit.
- Verify the level is set to WARNING or lower. If not, set the log level to WARNING (or lower) and click Update.
- When desired, open the Portal Administrator Directory and click Logs > Query.
- Specify the query to return messages at the WARNING log level. Ignore all other fields, as this returns warning-level messages for all users.
- Review the Message field for any messages related to the problem.
You reveal a message stating the following:
Sign in error: Invalid username or password specified for 'asmith'.
This message states that user asmith (Ashley Smith) specified an invalid username or password when attempting to sign in to the organization. Monitor these events to prevent unauthorized access attempts.
Item is moved from one folder to another
To capture this type of event, increase the log level to INFO, for example:
- Open Portal Administrator Directory and sign in as an administrator. The URL is typically available at https://webadaptorhost.example.com/webadaptorname/portaladmin.
- Click Logs > Settings > Edit.
- Set the log level to INFO and click Update. The portal is now logging messages at the Info level and records events related to items moved from one folder to another.
- When desired, open the Portal Administrator Directory and click Logs > Query.
- Specify the query to return messages at the INFO log level. Ignore all other fields, as this returns info-level messages for all users since the level was set.
- Review the Message field for any messages related to the problem.
You reveal a message stating the following:
Item moved from folder 'jcho/(Home)' to folder 'jcho/(Home)/Utilities'. Item ID is 'b7557bd2691b4e74bc4ce3e373402cc6'.
This message states that user jcho (John Cho) moved an item (with the ID b7557bd2691b4e74bc4ce3e373402cc6) from his home folder (Home) to a subdirectory within that folder named Utilities.
Using event filters in a query to narrow search results
To help you narrow down events and display more relevant messages, you can query based on log level, source component, time, a specific log code or range of codes, a specific user or list of users, and request id. You can combine any number of these filters as part of your query.
To query all of your organization's log messages, you can select your federated servers. Time and request id can be used to filter log messages across components, while the rest will only filter portal logs. If you want more options for filtering server logs, you can use ArcGIS Server Manager.
To access these filters, sign in to the Portal Administrator Directory and click Home > Logs > Query.
Log level
Events vary in their level of detail from Severe, which indicates a problem that requires immediate attention, to Verbose, which is a detailed, informative message generated through regular use of the portal. Select the desired level from the Log level drop-down list. For a detailed summary of each level, see Log type.
Source
The sources of logged events are generated from the sharing, administrative, and portal components of the software. For example:
- Events related to publishing and users are categorized under Sharing.
- Events related to security and indexing are categorized under Portal Admin.
- Events related to installing the software are categorized under Portal.
By default, all sources are queried (All option from the drop-down list). To filter portal events based on a specific source, select the desired source from the Source drop-down list.
Time
To filter events to a specific time frame, specify the desired time values using the Start Time and End Time fields (the format is yyyy-mm-ddThh:mm:ss). The start time is the most recent time and the end time is the oldest time. For example:
- To define a 15-minute time interval, the start time is 2015-05-01T13:15:00 and the end time is 2015-05-01T13:00:00.
- To define a one-hour time interval, the start time is 2015-05-01T14:00:00 and the end time is 2015-05-01T13:00:00.
- To define one day, the start time is 2015-05-02T12:00:00 and the end time is 2015-05-01T12:00:00.
- To query all logs, leave the time fields blank.
If the start time is specified and the end time is not specified, all of the oldest logs up to the start time specified are returned. Conversely, if the start time is not specified and the end time is specified, all of the latest logs down to the end time specified are returned.
If selected, events logged to federated servers and their registered data stores will also be filtered.
Log codes
Each message is associated with a log code. The codes are organized into several categories. You can filter portal logs based on a specific code or a range of codes, for example:
- To filter for a single code, specify the code value (for example, 204028).
- To filter for specific codes, separate the codes with a comma (,) (for example, 204028, 212015, 219114).
- To filter based on a range of codes, such as all codes in the security category, specify the beginning and ending code separated by a dash (-) (for example, 204000–205999).
- To filter based on a range of codes and individual codes, specify the beginning and ending code (separated by a dash) and separate the individual codes with a comma (for example, 204000–205999, 212015, 219114).
Users
To filter portal events for a specific user, specify the desired username in the Users field, for example:
- To filter for one specific user, specify the username (for example, jcho for John Cho).
- To filter for many users, separate the usernames with a comma (,) (for example, jcho, asmith for John Cho and Ashley Smith).
Note:
The use of the wildcard character (*) is not supported.
Requests IDs
The unique ID string attached to every request made, which is carried throughout the request's life cycle in the system. Select one or all federated servers if you are filtering by request ID for an operation that spans multiple components.
Message count
The number of messages to display when performing a query. Messages display on a single web page. If necessary, scroll down the page to view all messages.
Federated servers
To troubleshoot problems that span multiple ArcGIS Enterprise components, include server logs in your query by selecting one or all federated servers. When querying server logs, ArcGIS Data Store logs will also be included.
Delete the logs
If you want to delete the logs, click Home > Logs > Clean > Clean Logs. This deletes all of the log messages from the portal machine. When debugging a specific scenario that causes issues with your portal, deleting the logs can help isolate the issue. In this manner, the log is cleared of any other events, which allows you to focus on debugging the issue.
To delete server logs, use ArcGIS Server Manager.