The ArcGIS Server logs events that occur in the server, and any errors associated with those events, to log files. Events such as when services are started, when services go into use (also called server context creation), and when machines are added to the server are some of the examples of events logged by the server.
The server object manager (SOM) is the centralized logging mechanism for ArcGIS server. Through the SOM, all events that occur within the SOM, events that occur in server object containers (SOCs), and their contained services are logged by the SOM.
The logs are actually a pair of files: an XML file and a .dat file. The XML file contains the <log> tags, and the .dat file contains the messages that are constantly being appended. You can open the XML file in any XML aware tool to view the messages in the .dat file.
By default, these log files are written to <install_location>\server\user\log on the SOM machine. Each time the SOM service starts, a new log file is created, and the server will continue to write messages to that log until it reaches the maximum log size. Once the log file exceeds the maximum size, it is retired and a new log file is created. By default, the maximum log size is 10 megabytes.
Log messages can vary in their level of severity from "error", which indicates a problem that requires immediate attention, to "detailed", which is a common message generated through regular use of the server. The messages that are logged are defined by the log level that is set in the server. The following are the ArcGIS Server's logging levels:
0 (None): No logging
1 (Error): Serious problems that require immediate attention are logged.
2 (Warning): Problems that require attention and errors are logged.
3 (Normal): Common administrative messages of the server, warnings, and errors are logged.
4 (Detailed): Common messages from user use of the server, including server services, normal messages, warnings, and errors are logged.
5 (Debug): Verbose messages to aid in troubleshooting; detailed messages, normal messages, warnings, and errors are logged.
By default, the log level of the server is set to level 3 (Normal), meaning messages whose severity is Error, Warning, or Normal will be logged. All messages whose level is Detailed or Debug are not logged.
The log location, maximum log size, and logging level can be changed at any time using either ArcCatalog or the server API. Changes made will be reflected immediately in the server. The log properties can also be modified by editing the Server.dat configuration file. In that case, the changes will not be reflected until the SOM is stopped and restarted.
If you're configuring a distributed installation of ArcGIS Server (where components of the server run on more than one machine), you will need to share the log directory and reference it using a UNC path (for example, \\myServer\log) You'll also need to make sure the SOM and SOC Accounts have Read and Write permissions to the log directory.
Log files are an important tool for monitoring and troubleshooting problems with your GIS server. GIS server administrators will monitor the server's statistics and use the statistics to help determine when they need to consult the log files. The GIS server's statistics give general information about the state of the GIS server and whether errors have been occurring. The statistics are available to server administrators through ArcCatalog.
Through both the GIS server's statistics and reports from users of the system, administrators will be confronted with errors and other problems occurring in the system. The log files provide the information to identify what the errors are and, through the information in the log, infer what to investigate to solve the problem.
For example, an administrator may view the server statistics and note that there were a number of errors associated with creating new services in the server. By further examining the statistics, the problem area can be narrowed down to a particular server object container machine. The information in the log file can then be used to determine what errors have been logged and to discover, for example, that the server object container machine on which the errors were occurring did not have access to the output directory. Using this information, the administrator can rectify the directory access problem, then use statistics and the log files to determine if the error occurs again.
The log files comprise a history of the statistics and events that occur over time in the server. The server's statistics are in memory and are accumulated summaries of time slices since the GIS server started. The granularity of these time slices is more coarse the further back in time you go. Statistics are also cleared when the server is stopped. The GIS server's logs maintain a record of all events in the server and are not deleted when the server is stopped.