ULS logs question?

Hi ,
I have multi-tier SP farm. Right now i have to go to each server to see the uls log for an error. I have uls log viewer but i researched online and none said that i can see the uls logs of SharePoint farm from one central location. Is there a way that i
can see the whole farm uls logs centrally?
Right now each server is configured to write logs in separate drive rather than 15 hive. Can i have a file share setup in different server where all the logs can be written outside of SP farm? If yes what permissions do that file share require? Write
permission from timer/farm account?
Please suggest.
Adit

You can also use the Usage Logging database:
http://technet.microsoft.com/en-us/library/hh769360(v=office.14).aspx
http://technet.microsoft.com/en-us/library/ee663480.aspx
Trevor Seward, MCC
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Similar Messages

How Can I get Alert for specific error occurs in ULS logs ?

I am looking for either OOB functionality or Tool which could send me the email notification/Alert when specific error occurs in ULS Logs ? Please advice!

I dont think you can get this from OOB features...But you can use the 3rd party tool, we are using the SCOM for monitoring for our SharePoint, we get the alerts for error which we configured.
http://www.microsoft.com/en-us/download/details.aspx?id=4419
Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

ULS Logs full of Micro Trace Tags

Hi,
We recently upgraded to SP 2013 and everything went alright.
The server ULS logs are mostly not helpful because its filled with these two messages:
1. Micro Trace Tags: (none)
2. Forced due to logging gap
I have set Diagnostics logging for critical and unexpected events only but the above gets written for medium and verbose. When I look for a corelation id all I get are the above errors. We are on Aug CU, is this a bug?
"The opinions expressed here represent my own and not those of anybody else"

I think its easy to ignore, check the following post for more explanation why Forced Logging gap error
message written:
Link
I’ve found what it’s doing
but not how to modify the behavior. In the Microsoft.SharePoint.Diagnostics.ULS class there is a private method called “HandleLoggingGaps”. This method is called before trace data is sent to the log in several of the core logging methods.
When called, it checks both the LastSkippedTraceTime value and the last traced time in the current correlation context plus a variable called MaxLoggingGap against the current date/time.
The MaxLoggingGap value
is set by default to 50 milliseconds but there is an environment variable “_ULS_MAX_LOGGING_GAP_IN_MILLISECONDS_” that it will use instead if that variable contains a value. This would seem to indicate that the gap time is configurable but I have yet
to find the setting that will do so. I did some reflecting of the powershell cmdlets but so far not found any direct correlation (although EventLogFloodProtectionQuietPeriod and EventLogFloodProtectionNotifyInterval in the set-spdiagnosticconfig
cmdlet look promising).
Please remember to mark your question as answered &Vote helpful,if this solves/helps your problem. ****************************************************************************************** Thanks -WS MCITP(SharePoint 2010, 2013) Blog: http://wscheema.com/blog

Office Web Apps - "Could not find trace string in ULS logs" unhealthy?

I have reviewed everything I could find on unhealthy WAC clusters as my problem seems unrelated to certificate or missing components. I've already digested
http://www.wictorwilen.se/office-web-apps-server-2013---machines-are-always-reported-as-unhealthy (Thanks Wictor).
The particular configuration is an Office Web Apps 2013 ([X-OfficeVersion, 15.0.4551.1005]), running on top of Windows Server 2012, configured for http access (SSL offloaded NLB cluster) and finally linked to Exchange 2013, Lync 2013 and SharePoint
2013. Everything works as expected from client side after setting IIS ARR to handle all reverse proxy bits.
FarmOU                            :
InternalURL                       : https://officeapps.fqdn/
ExternalURL                       : https://officeapps.fqdn/
AllowHTTP                         : True
SSLOffloaded                      : True
CertificateName                   :
EditingEnabled                    : True
LogLocation                       : C:\ProgramData\Microsoft\OfficeWebApps\Data\Logs\ULS
LogRetentionInDays                : 7
LogVerbosity                      : Unexpected
Proxy                             :
CacheLocation                     : C:\ProgramData\Microsoft\OfficeWebApps\Working\d
MaxMemoryCacheSizeInMB            : 75
DocumentInfoCacheSize             : 5000
CacheSizeInGB                     : 15
ClipartEnabled                    : False
TranslationEnabled                : False
MaxTranslationCharacterCount      : 125000
TranslationServiceAppId           :
TranslationServiceAddress         :
RenderingLocalCacheLocation       : C:\ProgramData\Microsoft\OfficeWebApps\Working\waccache
RecycleActiveProcessCount         : 5
AllowCEIP                         : False
ExcelRequestDurationMax           : 300
ExcelSessionTimeout               : 450
ExcelWorkbookSizeMax              : 50
ExcelPrivateBytesMax              : -1
ExcelConnectionLifetime           : 1800
ExcelExternalDataCacheLifetime    : 300
ExcelAllowExternalData            : True
ExcelWarnOnDataRefresh            : True
OpenFromUrlEnabled                : False
OpenFromUncEnabled                : True
OpenFromUrlThrottlingEnabled      : True
PicturePasteDisabled              : True
RemovePersonalInformationFromLogs : False
AllowHttpSecureStoreConnections   : False
Machines                          : {WAC15PD-02, WAC15PD-01}
The problem however is an incessant logging on the WAC cluster nodes of event 1204,2204 followed almost immediately by 1004,2004. This repeats every 4min or so...
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider
Name="Office Web Apps Monitoring" />
<EventID
Qualifiers="0">1204</EventID>
<Level>2</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated
SystemTime="2014-02-04T20:49:37.000000000Z" />
<EventRecordID>3043246</EventRecordID>
<Channel>Microsoft Office Web Apps</Channel>
<Computer>wac15pd-01.fqdn</Computer>
<Security
/>
</System>
- <EventData>
<Data><?xml version="1.0" encoding="utf-16"?> <HealthReport xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <HealthMessage>UlsControllerWatchdog reported status for UlsController in category 'Verify Trace Logging'. Reported status: Could not find trace string in ULS logs in C:\ProgramData\Microsoft\OfficeWebApps\Data\Logs\ULS.</HealthMessage>
<ComponentOwner>ServicesInfrastructure</ComponentOwner>
</HealthReport></Data>
</EventData>
</Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider
Name="Office Web Apps Monitoring" />
<EventID
Qualifiers="0">2204</EventID>
<Level>2</Level>
<Task>1</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated
SystemTime="2014-02-04T20:49:37.000000000Z" />
<EventRecordID>3043247</EventRecordID>
<Channel>Microsoft Office Web Apps</Channel>
<Computer>wac15pd-01.fqdn</Computer>
<Security
/>
</System>
- <EventData>
<Data><?xml version="1.0" encoding="utf-16"?> <HealthReport xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <HealthMessage>UlsControllerWatchdog reported status for UlsController in category 'Verify Trace Logging'. Reported status: Could not find trace string in ULS logs in
C:\ProgramData\Microsoft\OfficeWebApps\Data\Logs\ULS.</HealthMessage> <ComponentOwner>ServicesInfrastructure</ComponentOwner>
</HealthReport></Data>
</EventData>
</Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider
Name="Office Web Apps Monitoring" />
<EventID
Qualifiers="0">1004</EventID>
<Level>2</Level>
<Task>10002</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated
SystemTime="2014-02-04T20:49:39.000000000Z" />
<EventRecordID>3043266</EventRecordID>
<Channel>Microsoft Office Web Apps</Channel>
<Computer>wac15pd-01.fqdn</Computer>
<Security
/>
</System>
- <EventData>
<Data><?xml version="1.0" encoding="utf-16"?> <HealthReport xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <HealthMessage>AgentManagerWatchdog reported status for
AgentManagerWatchdog in category 'Recent Watchdog Reports'. Reported status: Machine health is Unhealthy</HealthMessage> </HealthReport></Data>
</EventData>
</Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider
Name="Office Web Apps Monitoring" />
<EventID
Qualifiers="0">2004</EventID>
<Level>2</Level>
<Task>10002</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated
SystemTime="2014-02-04T20:49:39.000000000Z" />
<EventRecordID>3043267</EventRecordID>
<Channel>Microsoft Office Web Apps</Channel>
<Computer>wac15pd-01.fqdn</Computer>
<Security
/>
</System>
- <EventData>
<Data><?xml version="1.0" encoding="utf-16"?> <HealthReport xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> <HealthMessage>AgentManagerWatchdog reported status for
AgentManagerWatchdog in category 'Recent Watchdog Reports'. Reported status: Machine health is Unhealthy</HealthMessage> </HealthReport></Data>
</EventData>
</Event>
Further exploration of ULS log files (C:\ProgramData\Microsoft\OfficeWebApps\Data\Logs\ULS) did not yield particularly much, except the following;
02/04/2014 20:48:04.48 UlsControllerWatchdog.exe (0x1244)      0x0F60 Services Infrastructure       Uls Controller Watchdog       ajbam Assert
We're about to trace a string for category MsoSpUlsControllerWatchdog at level Info and we expect to find in the log later, but it appears that the category has been throttled. We will never be able to find the string and this watchdog will always fail.
StackTrace:   at Microsoft.Office.Web.UlsControllerWatchdog.Program.CheckServiceInstance(ServiceInstance serviceInstance)     at Microsoft.Office.Web.Common.WatchdogHelperThreadManager.GetHealthResults(WatchdogExecutionContext
context, ServiceInstance si)     at Microsoft.Office.Web.Common.WatchdogHelperThreadManager.WatchingThreadMethod(Object o)     at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback
callback, Object state, Boolean preserveSyncCtx)     at System.Threading.ExecutionContext.Ru... 345fbec5-e958-4f1f-bf56-d65c1c0d472a
02/04/2014 20:48:04.48* UlsControllerWatchdog.exe (0x1244)      0x0F60 Services Infrastructure       Uls Controller Watchdog       ajbam Assert
...n(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)     at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch() 345fbec5-e958-4f1f-bf56-d65c1c0d472a
02/04/2014 20:48:05.52 UlsControllerWatchdog.exe (0x1244)      0x0F60 Services Infrastructure       Services Infrastructure Health adhog Unexpected Health report
by UlsControllerWatchdog: Agent: UlsController, eventId: 1204, eventType: Error, categoryId: 1, eventMessage: <?xml version="1.0" encoding="utf-16"?> <HealthReport xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">    <HealthMessage>UlsControllerWatchdog reported status for UlsController in category 'Verify Trace Logging'. Reported
status: Could not find trace string in ULS logs in C:\ProgramData\Microsoft\OfficeWebApps\Data\Logs\ULS.</HealthMessage>    <ComponentOwner>ServicesInfrastructure</ComponentOwner> </HealthReport> 345fbec5-e958-4f1f-bf56-d65c1c0d472a
02/04/2014 20:48:05.52 UlsControllerWatchdog.exe (0x1244)      0x0F60 Services Infrastructure       Services Infrastructure Health adhoh Unexpected Health report
by UlsControllerWatchdog (persistent): Agent: UlsController, eventId: 2204, eventType: Error, categoryId: 1 345fbec5-e958-4f1f-bf56-d65c1c0d472a
I suspect these might be related, but can't seem to find any logical explanation why this should cause the Get-OfficeWebAppsMachine to report HealthStatus of Unhealthy. If related, is there a way to disable this check or remove throttling in a safe
way? Alternatively if this is some coding issue (I've not found any other blog/QA dealing with this particularly) it would be nice to get confirmation of this and potentially a fix/solution.
Any help would be greatly appreciated. Thank you!

Hi ChristiaanB,
You get this ULS error because you change the log verbosity of the OWA farm. I wrote an article for this on my blog : OWA unhealthy uls issue
Regards,
Wes

888k Error in ULS Logs for File System Cache

Hello,
We have a SharePoint 2010 farm in a three-tier architecture with multiple WFEs and APP servers.
Roughly once a week we will have a number of WFEs seize up and jump to 100% CPU usage. Usually they come in pairs; two servers will jump to 100% at the same time while all the other servers are fine in the 20% - 50% range.
Corresponding to the 100% CPU spike, the following appear in the ULS logs:
"File system cache monitor encoutered error, flushing in memory cache: System.IO.InternalBufferOverflowException: Too many changes at once in directory:C:\ProgramData\Microsoft\SharePoint\Config\<GUID>\."
When these appear, the ULS logs will show hundreds back-to-back flooding the logs.
I have yet to figure out how to stop these and bring the CPU usage down while the incident is happening, and how to prevent them in the future.
While the incident is happening, I have tried clearing the configuration cache, shutting the timer jobs down on each server, deleting all the files but config.ini in the folder listed above, changing config.ini to 1, and restarting the timer. The CPU will
drop momentarily during this process, but as soon as all the timer jobs are restarted the CPUs jump back to 100% on the same servers.
This week as part of my weekly maintenance I thought I'd be proactive and clear the cache even though the behavior wasn't happening, and all CPUs were normal. As soon as I finished, the CPU on two servers that were previously fine jumped to 100% and wouldn't
come down. Needless to say, users complain of latency when servers are at 100% CPU.
So I am frustrated. The only thing I have found that works when the CPUs jump to 100% with these errors are a reboot. Nothing else, including IISReset and stopping/starting the admin and timer job services work. Being Production systems, reboots during the
middle of the day are bad.
Any ideas? I have scoured the Internet resources on this error and have come up relatively empty-handed. All the articles reference clearing the configuration cache, which, in my instance, does not get rid of these issues, and can even trigger them.
Thanks,
Joseph Irvine

Take a look at http://support.microsoft.com/kb/952167 for the list of recommended exclusions per Microsoft.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Basic log question

Just trying out backintime. I put it in crontabs and append to a log file. So far so good, but I don't get time or date of the last entry. Here the crontab entry:
*/45 * * * * backintime -b >>/tmp2/backintime/messages.log
Question: Do I have to fiddle around with the code of backintime to get more info or can I do something in the crontab entry?

> Hm, comparing stuff takes a long time
<gasp> With rsync if you don't change the contents much it shouldn't take more than a minute ... If you have a million tiny files it may take more but I guess you would like your backups to run perfectly, so you'd better check what's wrong.
BTW: Although Dillon's cron supports 'every n minutes' you may want to check '45 * * * *'. Are you using the "stock" Arch cron or some other one?
Last edited by karol (2009-12-18 15:37:02)

Error found in ULS log, now how to fix?

Hello,
I am using SharePoint Foundation 2010, and I don't know what happened, but SP will no longer save any of my site columns and won't even let me access my site columns from Site Settings-->Gallery-->Site Columns. I've only been using SharePoint Designer
2010 and SharePoint Foundation 2010 itself. I went into the ULS log and it gave me this:
System.ArgumentNullException: Key cannot be null. Parameter name: key    at System.Collections.Hashtable.Insert(Object key, Object nvalue, Boolean add)     at Microsoft.SharePoint.SPFieldCollection.get_InternalNameDict()
at Microsoft.SharePoint.SPFieldCollection.GetIndexForInternalName(String internalName)     at Microsoft.SharePoint.SPField..ctor(SPFieldCollection fields, String fieldName)     at Microsoft.SharePoint.SPFieldLookup..ctor(SPFieldCollection
fields, String fieldName)     at Microsoft.SharePoint.Applications.GroupBoard.SPFieldCallTo..ctor(SPFieldCollection fields, String fieldName)
This happens every time I try to access my site columns. Can anyone tell me how to fix this? Or what's wrong? Any help would be incredibly appreciated.

Hello jchai81,
For my understanding. Have you tried customizing one of the Group Work Lists feature (Group Board feature), the Phone call memo list?
http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.applications.groupboard.spfieldcallto(v=office.14).aspx
Btw, is this on a production environment?
- Dennis | Netherlands | Blog |
Twitter

Wss3 ULs log file blank or with 1kb

our wss3 ULs log files are blank, with one or two files throught out a day with 1kb, with the following log
11/11/2014 11:01:34.55 wsstracing.exe (0x09D0) 0x7C30 ULS Logging Unified Logging Service uls1 Monitorable Tracing Service lost trace events. Current value 45.
I have double checked in the Central Admin >> Diagnostic Logging : Trace Log is pointing to the 12 hive locally Tried stop and start the Windows Sharepoint Services Tracing then stop and started the Window Sharepoint Services Timer No effect on the ULs
log files, still blank. The wss3 version is 12.0.0.6421 any ideas? suggestions? Regards Xun

Hello,
You may try to run " stsadm -o listlogginglevels" command and set it to default.
https://social.technet.microsoft.com/Forums/office/en-US/d8fa7b2f-f9b4-4c49-8c2b-5b1c73a4d717/empty-trace-log-files-inside-12logs-folder-moss2007?forum=sharepointadminlegacy
Also check tracing service
http://techdhaan.wordpress.com/2009/04/20/moss-2007-uls-logs-folder-in-12-hive-is-empty/
Let us know your result
Hemendra:Yesterday is just a memory,Tomorrow we may never see<br/> Please remember to mark the replies as answers if they help and unmark them if they provide no help

Accessing Server Logs Question

I'm working on converting an old ASP application to a Java one, and have some questions.
The customer wants a semi-sophisticated auditing system built in to the application, but I'm not sure OAS can provide the same level of detailed logs that IIS did (at least, not without a JNI DLL somewhere).
One of the reports requested, "Client Errors", wants to output the following fields:
- Requested File
- Error Code
- Total Requests
- Client Description
- Error Description
- Win32 Description
There are about 2 dozen other reports, as well.
The questions:
1. Can OAS log this sort of information in an extended w3c log format (Win32 Description might not be possible without JNI)?
2. How is the best way for the application to get to these logs? (I currently envision a regular job running to read the log into a database table)
Sorry if these are dumb questions. Any help would be appreciated.

Each Report Server has a log in which it record each time a report is run.

Application Logging questions, SLG0

Hello all,
I have a couple of generic questions I would like to ask the users of this forum.
1. The people that are using application logging, in what types of situations do you use this functionality, interface programming, updating custom tables, etc.?
2. People that are aware of this functionality and are not using it, why are you not using it?
SAP help documentation has pretty good information about the different function modules that are part of this product.
Thanks
Bruce

Hi Bruce;
As part of the SAP's AII (Auto-ID) production, we use SLG1 extensively because that is where all of the application errors are stored by the system when it processes inbound or outbound messages.
The biggest pro is that it consolidates all of the logging information; the biggest con is that it is hard to search through all that information for a particular message, unless the document number is part of the message. It can be a challenge to find a particular log entry when there can be upwards of 2,500 in one day.
Cheers,
John

"rescue and recovery" and "swshare" log question

I am currently analzying logs from "rescue and recovery" and "swshare" program and notice SMA.log and capture.sma in particular. I want to verifiy what do each of those 2 logs mean. does one mean the data that was successfully backed up and the other one means what was restored to the machine? the restore.log contains a specific date, was that the date the data was restored to the machine?
Thanks in advance!!!

The logs gets created automatically and have the information of the particular task which is completed or processed.
Best Regards,
Tanuj
Did someone help you today? Press the star on the left to thank them with a Kudo!
If you find a post helpful and it answers your question, please mark it as an "Accepted Solution".! This will help the rest of the Community with similar issues identify the verified solution and benefit from it.
Follow @LenovoForums on Twitter!

Java.util.logging question

'Lo all -
I'm new to Java, so bear with me on this question - I'm sure it has a simple answer.
I am using the following code to create a new Logger object:
public class TAGLogging {
    private Logger oLog;
    private FileHandler oLogFile;
    private String sLoggingFolder = "AppLogs";
    private String sFormattedDateTime = String.format("%1$tY%1$tm%1$td_%1$tH%1$tM%1$tS",Calendar.getInstance());
    private String sCallingClass = new Throwable().fillInStackTrace().getStackTrace()[1].getClassName();
    private String sCallingMethod = new Throwable().fillInStackTrace().getStackTrace()[1].getMethodName();
    /** Constructors */
    public TAGLogging(String sLogFileName) throws IOException {
        this.initialSetup(sLogFileName);
    public TAGLogging() throws IOException {
        String sLogFileName = sLoggingFolder + File.separator + sFormattedDateTime + ".xml";
        this.initialSetup(sLogFileName);
    /** Methods */
    private void initialSetup(String logFileName) throws IOException {
        oLogFile = new FileHandler(logFileName);
        oLog = Logger.getLogger(sCallingClass);
        oLog.addHandler(oLogFile);
        oLog.setLevel(Level.ALL);
    }Everything is being logged correctly to the /AppLogs/yyyymmdd_HHMMSS.xml file. The problem is that there is another file that is being created in my home directory, which incidentally, is not where the program is located. The name, java01.log, matches the default logging.properties file set up, but I have removed all that and changed the file to the following (minus all the comments):
handlers= java.util.logging.FileHandler
.level= INFO
java.util.logging.FileHandler.level = ALL
java.util.logging.FileHandler.limit = 50000
java.util.logging.FileHandler.count = 1
java.util.logging.FileHandler.formatter = java.util.logging.XMLFormatter
java.util.logging.ConsoleHandler.level = INFO
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
The java01.log file contains the exact same contents as the file I am purposely logging to, the AppLogs/yyyymmd_HHMMSS.xml one.
Does anyone have any clue what is causing this file to get created, and if so, how do I stop it?
Message was edited by:
malakh

Man, I REALLY hate to do this, but it looks like I may be forced to work around it instead of fixing the issue. I'll have to add some code to manually remove the java01.log file when it's done writing to it.
Navy - Turns out that Log4j is pretty much the same thing as java.util.logging, except on steroids. It is almost identical syntactically, just has more options and more flexibility than JUL.

Aironet 1140 connection and log questions

Hi Cisco gurus,
Recently we decided to change the name of one of our Aironet 1140 AP's. Everything was great for a few days then, for some reason, nobody was able to connect to it. They would all recieve timeout messages when they would connect. A quick reset solved the problem, but I'm curious if there was an actual reason to why it didn't allow users to connect in case it happens again.
Which brings me to my next question, how do you set the AP clock so that the event logs display the proper date and time? I'm sure I overlooked something, but I can't find out how to set the proper date and time.
Thank you in advance.

conf t
serv time d d s l
serv time l d s l
sntp service
! Set the timezone
clock timezone WORD
clock summer-time WORD recurring

Basic Capturing/logging question

For capturing footage, I usually hit the Capture "Now" option, and then label the clip after it's captured.
However when I do this, the actual file just gets labeled as "Untitled" in the folders on the computer.
How do I label a clip while it's actually being captured in FCP? Do I capture with the Capture "Clip" option?
Like I said, very basic question, but would help me out immensely. Thanks.

shocker11 wrote:
The Capture Now thing I'm getting now. However, I'm still getting confused for this logging and then batch capturing deal. I hit "set marker" for each of my in and out points on where I want to capture, however, it doesn't seem to log it into the "log window" correctly.
You log clips not by placing markers in an extended clip, but by setting In and Out points for smaller clips. Once you've determined where you'd like your clip to begin, press I. When you know where you'd like the clip to end, press O. Then press F2 to Log Clip.
Not to be snarky - because I really hate it when folks get told to read the manual - but this really is one of those times where skimming through the relevant sections of the manual will answer all of your questions. So you might want to give that a shot, since that's the best step-by-step that I've seen.

Tacacs+ accounting log question

I have a tacacs server running for accounting purpose only (so I use local authentiation). So I can collect all accounting logs only.
This is a snapshot for accounting part.
Tacacs accounting logs
<102> 2014-02-23 10:20:22 [10.254.1.2:22823] 02/23/2014 10:20:22 NAS_IP=10.254.1.x Port=443 rem_addr=10.254.50.129 User= brian Flags=Stop task_id=57 cmd=perfmon interval 10 service=shell elapsed_time=0
<102> 2014-02-23 10:23:51 [10.254.1.2:58167] 02/23/2014 10:23:51 NAS_IP=10.254.1.x Port=0 rem_addr=10.254.50.129 User=brian Flags=Stop task_id=58 cmd=configure term service=shell elapsed_time=0
<102> 2014-02-24 07:06:31 [10.254.1.2:19784] 02/24/2014 07:06:31 NAS_IP=10.254.1.x Port=443 rem_addr=10.254.51.166 User=mike Flags=Stop task_id=59 cmd=perfmon interval 10 service=shell elapsed_time=0
<102> 2014-02-24 07:07:53 [10.254.1.2:19254] 02/24/2014 07:07:53 NAS_IP=10.254.1.x Port=0 rem_addr=10.254.51.166 User=mike Flags=Stop task_id=5a cmd=configure term service=shell elapsed_time=0
As you can see, I can't see any command lines, such as show int ip b. I can see all routers and switches logs, but ASA logs shows only like above. No mather what commands I used, it only shows above logs. Do i miss something? I like to capture all commands lines when users use ASDM because we use always ASDM.
I used Free tacacs+ server, not ACS.
Thanks for your time.

Hi Patrick,
In the ACS View Reports (Monitoring & Reports > Reports > Catalog > AAA Protocol) you can select the
radio button and by selecting 'Run' on the bottom run a specific query. Without that by default you will see only a report from one day.
For the 2nd question, yes the ACS View is designed to store that information, however if needed you can send the logs to an external syslog server or perfrom regular backups of the ACS View database.
Kind regards,
Pawel

ULS logs question?

Similar Messages

Maybe you are looking for