Configuring logging on the Notification Server and an Altiris Agent computer

Products

• IT Management Suite

Issue/Introduction

How do I configure logging on the Notification Server and on Altiris Agent computers?

How do I enable Verbose Logging?

Environment

ITMS 8.x

Resolution

The explanation of the entries are contained below. Here I will put the recommended values when troubleshooting issues:
RECOMMENDATIONS:

• Severity = ff (hex value), or 255 (decimal value)
• MaxFiles
  • Agent: 100 (decimal value)
  • Server: 200 (decimal value)
• MaxSize
  • Agent: 1000 (decimal value)
  • Server: 2000 (decimal value)

The above values are typically what we use in Symantec Support in order to troubleshoot issues. the only item for consideration is the increased logging will take more space on the disk. Make sure you have enough space for the values selected.

In Altiris 8, the Altiris Agent logging is controlled registry values in the registry key:

• HKLM\Software\Altiris\Altiris Agent\Event Logging\LogFile

In Altiris 7, the Notification Server  is controlled registry values in the registry key:

• HKLM \Software\Altiris\eXpress\Event Logging\LogFile

The same registry values apply  to both Altiris Agent and NS logging.

FileName: The naming convention for these logs (String value)

• Agent default: agent.log
• NS default: a.log

FilePath: Folder path where the log files will be stored; (String Value)

• Agent default: 
  • C:\ProgramData\Symantec\Symantec Agent\Logs
• NS default:
  • C:\ProgramData\Symantec\SMP\Logs\
  • Altiris Log Viewer - Options > Log Options

MaxFiles: Maximum number of log files to create; (DWORD Value)

• Agent default: 10 (files)

MaxSize: Maximum size of each log file (in KB); (DWORD Value)

• Agent default: 100 (KB)

Severity: The level of logging to be recorded; (DWORD Value)

• Agent default: value not set, will Error, Warning & Informational messages
• NS default: same as Agent

Additional information:

• These values can be modified on the client as well as on the server. 
• The NS logging severity level can be set in the Altiris Console: Settings > All Settings; Notification Server > Notification Server Settings; Logging (tab); In Altiris 6: the Error Logging Advanced setting in the Configuration tab. The Console will only set the registry value if trace logging level is enabled.
• When the logs are generated, a.log is always the current log and when the max size is reached, it becomes a1.log. The next one would be a2.log and so on until the max files is reached. At that point you may begin to lose data unless archiving or purging kicks in.
• Very large log files sizes on the Notification Server can result in poor performance when viewing from the Web console, so you may be better off increasing the MaxFiles rather than the MaxSize. 
• The Agent will not create more than one day of logs regardless of the MaxFiles and PurgeDays settings if the FilePath value is not also specified. This will only be an issue for a 6.0 Agent which was upgraded from NS Client 5.x. NS Client created only the FileName value where the Agent install creates both FileName and FilePath.

There are four main levels of severity logging, and they are:

• Errors
• Warnings
• Information
• Trace

The registry Severity key can be manually adjusted to the desired logging level (these are Decimal values):

1 = Errors
2 = Warnings
3 = Errors and Warnings
4 = Information
5 = Errors & Information
6 = Warnings & Information
7 = Errors, Warning & Information
8 = Trace
9 = Errors and Trace
10 = Warnings and Trace
11 = Errors, Warnings, and Trace
12 = Information and Trace
13 = Errors, Information, and Trace
14 = Warnings, Information, and Trace
15 = Errors, Warnings, Information, and Trace
255 = Verbose logging

ULMAgent

 

Edit this file /opt/altiris/notification/nsagent/etc/client.conf
Set debug_level=DEVNOTE
Set debug_file_size=10240
Set debug_backup_copies=20
Save changes and restart ULM Agent /opt/altiris/notification/nsagent/bin/rcscript restart

Additional Information

Notification server (SMP) and agent log directory