Collect High Debug Server Logs

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to collect high debug App Control Server logs.

Environment

• App Control Server: All Supported Versions

Resolution

1. Gather Relevant Background Information:
   • What is the OS version and build of the application server where the App Control Server is installed?
   • What is the total system memory of the application server?
   • What is the total free disk space on the drive App Control Server is installed on?
   • What version of the App Control Server is currently installed?
   • Is the SQL database located on the same server as the App Control Server?
   • What version of SQL Server is hosting the App Control database? Is it patched to the latest Cumulative Update?
   • What error message or events are you receiving regarding this issue?
   • When did the error messages/events/issue start?
   • Were there any new changes on the server(s) or the network recently?
2. Gather Event Viewer and IIS Logs:
   • Collecting IIS Logs
   • Collecting Event Viewer logs
3. Gather High Debug App Control Server Logs
   
   1. Log in to the App Control Console
   2. Navigate to https://ServerAddress/support.php > Diagnostics
   3. Click the Snapshot Server Logs button to write existing logs and start a fresh log file.
   4. Set Server Logging as follows:
      • Logging Duration: 30 Minutes
      • All Debug Levels: High
      • Enable SQL Trace
   5. Click Start logging & reproduce the issue.
   6. Return to https://ServerAddress/support.php > Diagnostics
   7. Click "Stop Logging Now"
   8. Click on “Available log files" from the right menu > Related Views > Save files:

      API-TIMESTAMP.log
      AppControlAD-TIMESTAMP.log
      ReporterLog-TIMESTAMP.log
      ServerLog-TIMESTAMP.bt9
      SQLTrace-date-time.csv

Additional Information

• App Control Server 8.8.6 and earlier: Restart the App Control Reporter service after collecting logs due to a known issue causing it to stop sending events after debugging finishes.