Work with system logs

ArcGIS Enterprise on Kubernetes records events that occur in your organization, and any errors associated with those events are recorded in the logs. The logs are available in ArcGIS Enterprise Manager.

You can use the logs to monitor and troubleshoot problems with your organization. Information in the logs can help you identify errors and provide context on how to address problems. Logs also compile a history of events and patterns over time.

Capture, query, and view events

When an event occurs in your site, the event is captured and recorded in the logs. To view messages associated with the event, query the logs. To query and view the current messages in your site, follow these steps:

1. Sign in to ArcGIS Enterprise Manager as an administrator.
2. Click the Logs button on the sidebar to review the current logs.

   Some messages are returned along with additional information.

All logs record several pieces of information regarding the event. You can view and switch columns that display the following:

• Time and date of the log event
• Log level of the event
• Log message
• Source of the log event
• Request ID of the log event
• Username associated with event
• Service type on which the event occurred
• Node on which the log event occurred
• Log code pertaining to the event
• Stack trace of the event

You can also filter logs based on time, log level, source, request ID, username, service type, and log code.

Note:

If your organization fails to retrieve logs, check the health status of your system managed data stores. Your organization will be unable to access logs when the spatiotemporal and index store is unhealthy. Use Lens or another Kubernetes IDE to view Kubernetes events, check the logs of your administrative pods, and restart pods if needed.

Troubleshoot using logs

If you suspect you have an issue with a service or node, or a user reports a problem, you can reproduce the event, capture the event with the logs, and query the logs to obtain information about the event. Then use the information in the log to resolve the issue caused by the event.

If an issue is suspected or reported, try to reproduce this issue. If you can reproduce it, query the relevant logs and review the messages for information that may help. For example, if a user reports a performance issue with a web service, reproduce their actions and monitor the logs to see what's occurring. You may find an error message that indicates the cause.

If no information is present, increase the logging level. This broadens the range of logs captured and may provide helpful information.

Log levels

Logged events can vary in detail from the Severe level, which indicates a problem that requires immediate attention, to the Verbose level, which is a detailed, informative message generated through regular use of the server.

The following table describes the log levels:

Log level	Description	Sample message
Severe	Serious problems have occurred that require immediate attention. This level only includes Severe messages.	Unable to process request. Service X not found.
Warning	Moderate problems have occurred that require attention. This level also includes Severe messages.	Failed to sign in. Invalid username or password specified.
Info	Common administrative messages include information about service creation and startup. This level also includes Severe and Warning messages.	Accessing organization account settings.
Fine	Common messages include information such as names of operation requests received. This level also includes Severe, Warning, and Info messages.	Checking for expired items.
Verbose	Messages provide detail about how the deployment fulfills an operation, such as noting that each layer in a map service was drawn successfully, how fast the layer was drawn, or how long it took to access the layer's source data. This level also includes Severe, Warning, Info, and Fine messages.	Beginning of layer draw: counties.
Debug	Messages are designed for developers and support technicians who want a better understanding of the problem when troubleshooting. It's recommended that you do not use this level in a production environment because it may cause a decrease in performance. If you're not troubleshooting an issue, use the Warning level instead.	Cleaning up directories.

Update logging level

When working with system logs in ArcGIS Enterprise Manager, you may need to increase the logging level to capture and review events.

You can expand the range of logs that are recorded. You can also examine logs related to service creation and startup. in which case you can change the log level from the default Warning to Info.

To update the log level in ArcGIS Enterprise Manager, do the following:

1. Click Settings on the Logs page.
2. On the Log settings page, set the desired default log level.
3. Click Save.

Update log retention duration

You can set a log retention policy for your system logs. By default, system logs will be retained for 60 days before they are deleted.

To update the length of the retention period, do the following:

1. Click Settings on the Logs page.
2. On the Log settings page, update the log retention duration.
3. Click Save.

Update the log index

To troubleshoot issues related to accessing logs—for example, if new logs are not generating or if existing logs have become unavailable—you can update the log index.

To update the log index in ArcGIS Enterprise Manager, do the following:

1. Click Settings on the Logs page.
2. On the Log settings page, click Update log index.

Delete log messages

To delete log messages, do the following:

1. On the Logs page, click the Delete button .
2. On the Delete log messages page, you have the following options:
   • Select log level(s)—Select one or multiple log levels that you want to delete.
   • Select time period—Select a time period from which you want to delete log messages.
   • Select custom time period—If checked, select a custom time period from which you want to delete log messages.
3. Click Delete.