Collect High Debug Server Logs
search cancel

Collect High Debug Server Logs

book

Article ID: 286504

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to collect high debug App Control Server logs.

Environment

  • App Control Server: All Supported Versions

Resolution

  1. Gather Relevant Background Information:
    • What is the OS version and build of the application server where the App Control Server is installed?
    • What is the total system memory of the application server?
    • What is the total free disk space on the drive App Control Server is installed on?
    • What version of the App Control Server is currently installed?
    • Is the SQL database located on the same server as the App Control Server?
    • What version of SQL Server is hosting the App Control database? Is it patched to the latest Cumulative Update?
    • What error message or events are you receiving regarding this issue?
    • When did the error messages/events/issue start?
    • Were there any new changes on the server(s) or the network recently?
  2. Gather Event Viewer and IIS Logs:
  3. Gather High Debug App Control Server Logs
    1. Log in to the App Control Console
    2. Navigate to https://ServerAddress/support.php > Diagnostics
    3. Click the Snapshot Server Logs button to write existing logs and start a fresh log file.
    4. Set Server Logging as follows:
      • Logging Duration: 30 Minutes
      • All Debug Levels: High
      • Enable SQL Trace
    5. Click Start logging & reproduce the issue.
    6. Return to https://ServerAddress/support.php > Diagnostics
    7. Click "Stop Logging Now"
    8. Click on ÔÇťAvailable log files" from the right menu > Related Views > Save files:
      API-TIMESTAMP.log
      AppControlAD-TIMESTAMP.log
      ReporterLog-TIMESTAMP.log
      ServerLog-TIMESTAMP.bt9
      SQLTrace-date-time.csv

Additional Information

  • App Control Server 8.8.6 and earlier: Restart the App Control Reporter service after collecting logs due to a known issue causing it to stop sending events after debugging finishes.