Environment
- App Control Console: All Supported Versions
- App Control Windows Agent: All Supported Versions
- Microsoft Windows: All Supported Versions
Objective
To setup high debug logging, that persists reboots, for issues that cannot be recreated on demand.
Resolution
- Login to the Console and navigate to Assets > Computers > relevant Computer
- Make a note of the Host ID from the URL (Example: host-details.php?host_id=592)
- From the Computer Details page > right hand side > Advanced > Set Debug Level:
- Debug Level: High
- Include Kernel
- Debug Duration: Permanent
- Click "Go"
- Navigate to https://ServerAddress/agent_config.php > Add Agent Config
- Name: Automatic Log Capture (or something relevant)
- Host ID: Value from Step 2 (Example: 592)
- Value: capture_log_on_matching_event=subtype=SubtypeEventID,filename=PathToFileOrPathBeingBlocked
- Policy: Relevant Policy
- Status: Enabled
- Once the Agent generates an Event matching the scenario, an Event in the Console will appear with Subtype "Agent Diagnostics Available"
- Verify the Agent Logs are available, and download them, from Tools > Requested Files > Diagnostic Files.
- Navigate back to Assets > Computers > relevant Computer > right hand side > Advanced > Set Debug Level > None (default).
- Once the Agent Logs are available, from the Computer Details page > right hand side > Advanced > Other Actions > Delete diagnostic files on computer.
- Navigate to https://ServerAddress/agent_config.php > Show Filters > Value > contains > capture_log_on_matching_event
- Either Delete or Disable this Agent Config.
- Upload the Agent Logs to the Vault.
Additional Notes
- capture_log_on_matching_event is a Kernel Configuration Property that will trigger the capture of Agent Diagnostic Logs based on the Event Subtype and optional additional criteria.
- There is a built in delay of 5 seconds after the Event to capture possible following activity.
- There is a built in dwell time of 15 minutes. The auto log capture will not trigger until 15 minutes after the last auto log capture.
- There is a limit of 10 auto log captures. No auto captures will occur until there are less than 10 captures in the logs directory.
- The 15 minute dwell time and 10 capture maximum are to stop poorly defined event criteria from generating large numbers of logs.
- Setting the property to an empty string disables auto-logging.
- A list of available Event Subtype IDs can be found on VMware Docs > Server Documentation > Events Guide.
Related Content
