Gathering logs and troubleshooting data from LiveUpdate Administrator 2.x

Products

• Mail Security for Microsoft Exchange
• Endpoint Protection
• Endpoint Security
• Carbon Black Cloud Endpoint Standard

Issue/Introduction

LiveUpdate Administrator (LUA) 2.x  contains a built-in function to collect troubleshooting information that can help Symantec Technical Support diagnose problems. Supplemental diagnostic logs will provide a complete picture. This article contains information on how to collect these.

Environment

• LiveUpdate Administrator 2.3.1 and newer.

Resolution

These sections below describe how to gather various logs for troubleshooting LUA issues.  At minimum the "Luadebuginfo.zip" and "LUA Event Logs, SymDiag, Recovery File" sections should be followed to gather enough logs to troubleshoot most LUA issues.  The other sections describe additional and more detailed logging that may be needed on a case by case basis.

Luadebuginfo.zip

To gather troubleshooting diagnostic information from LUA 2.3.1 and later:

1. Open Internet Explorer on your LiveUpdate Administrator 2.x server
2. Login to LUA 2.x using valid account credentials.
3. Click on the Troubleshoot link in the upper-right corner of the LUA interface, then follow the on-screen instructions.

This will produce a .zip file that can be provided to support.

LUA Event Logs, SymDiag, Recovery File

Three additional pieces of information are always helpful when troubleshooting LUA issues: LUA Event Logs, SymDiag, LUA configuration recovery file.

• LUA Event Logs:  export the LUA server's event log in .csv format: "EventAuditLog.csv".
• SymDiag: The output of a broader diagnostic tool like SymDiag diagnostic tool from the LUA server can provide helpful system-wide context.
• LUA configuration recovery file: export the LUA server's configuration recovery file and provide it to Technical Support. 

If the source of the update issue lies on the clients updating from LUA, gathering diagnostic data from one or more clients may be necessary (for example, SymDiag diagnostics or log.lue files from affected clients).  Depending on the issue encountered, Symantec Technical Support will also often request specific individual files (directory listings, configuration files, etc).

Additional Debug level options

If instructed by support, one or more of the following additional debug logging options may be requested.

Debug-Level Information

If instructed by Technical Support, to set the log DEBUG level, in LUA 2.x this can be configured following the below steps:

1. Log in to the LUA Web interface.
2. Click Configure>Preferences.
3. Locate the Logging section, select ON in the Debug Mode drop-down box and Informational in the Event threshold drop-down box.
4. Click Update to apply the settings.

Tomcat Debug logging

1. Navigate to "<LUA-Install-Directory>\tomcat\conf\" and take a backup of the file "logging.properties"
2. Edit this file in Notepad and change all the logging levels to ALL.
   Currently they would be either set to FINE or INFO. We need to change all of them to ALL.
3. Restart the "LUA Apache Tomcat" service.

Additional logging

You can run the command "tomcat9w.exe //ES//LUATomcat" from tomcat/bin directory and go to the logging tab and set the logging level to debug.
Restart the LUA Apache Tomcat service after making above changes.

Once the issue is reproduced, collect all the log files and then change the values to FINE/INFO and restart the tomcat service. Alternatively you can restore the original backed up file.

There is no option to change the rotation file size in the logging.properties file, though there is option to change the log rotation days which is by default set to 7 and server.xml has the setting for access log which is also 7 days.