Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

WinCollect Log File

 

The WinCollect log file provides information about your deployment. Logs provide valuable information for troubleshooting issues.

WinCollect Log Overview

WinCollect generates log event extended format (LEEF) messages during installation and configuration and writes them to a single log file. The server in the Status Server field receives the LEEF messages through the syslog. These messages report on the status of the WinCollect service, authorization token, configuration, and more.

Example:

The following example displays a LEEF message that alerts administrators that the WinCollect agent is generating more events than the log source is tuned for.

You search for syslog messages by using the IP address of the WinCollect agent. JSA tracks information from the audit log to determine when log sources are created, when searches are run, and so on.

WinCollect Log Types

WinCollect Log Types

The default log directory is C:\Program Files\IBM\WinCollect\logs\. The log file is named WinCollect.log.

Each log entry is tagged with an identifier that indicates the entry type:

  • System

  • Code

  • Device

The following table describes the types of log entries in the WinCollect log file.

Table 1: WinCollect Log Types

Subfolder

Description

System

Indicates system information, such as the operating system that the agent is installed on, RAM and CPU information from the operating system, service start-up information, and WinCollect version information.

Code

Indicates information about for spillover and cache messages, file reader messages, authorization token messages, IP address or host name information for the local host, issues with destinations, log source auto-creation, stand-alone mode messages, and thread or process start-up and shutdown messages. Use these entries to investigate the WinCollect configuration. This log does not provide information about event collection.

Device

Created when WinCollect collects events, the protocols that run event log collection. The following issues are logged as device entries::

Loading Plug-in

Connection issues

Permission or Authentication

Windows error codes (hex value codes provided by the operating system, such as 0x000005 access denied)

File path or location

Event log is overdue to be polled

Event log transactions

RPC is unavailable (unable to find the location that you specified)

Reopening due to falling too far behind (tuning messages)

Disk Space Management for Log Files

WinCollect manages disk space for logs by generating a ".1" version when the log size exceeds 20 MB. After a ".5" version is created, WinCollect deletes the oldest version of the log.

WinCollect also manages disk space by archiving checkpoint folders. When JSA updates WinCollect with new code, the checkpoint folders store a backup of the replaced code. WinCollect archives the oldest patch checkpoint folder after 10 are created. WinCollect creates an archive folder that contains a list of files in the patch checkpoint folder, and a compressed file of the AgentConfig.xml file. WinCollect then deletes the patch checkpoint folder that it archived.

InfoX Debug Logs

InfoX debug logs make debugging WinCollect easier, without interfering with performance.

By default, InfoX is enabled and logs events for the first five minutes that the agent runs, for a maximum of 5,000 log entries. After that, InfoX logs events for one minute every 15 minutes, for a maximum of 200 log entries. InfoX generates debug logs even if your log level is set to info.

You can edit the InfoX configuration by adding any of these parameters to the install_config.txt file.

Table 2: InfoX Configuration Options

Parameter

Description

InfoX.enabled

Used to enable or disable InfoX.

Example: InfoX.enabled=true

InfoX.startLen

The number of seconds to run the agent at startup. To disable this feature, set this value to 0.

Example: InfoX.startLen=300

InfoX.startMax

The maximum number of events that can be logged at startup.

Example: InfoX.startMax=5000

InfoX.nextWait

The number of seconds to wait for the next logging period.

Example: InfoX.nextWait=900

InfoX.nextLen

The number of seconds to run the agent at each interval. To disable this feature, set this value to 0.

Example: InfoX.nextLen=60

InfoX.nextMax

The maximum number of events that can be logged at each interval.

Example: InfoX.nextMax=200