How log files work

ArcGIS Server logs events that occur in the server, and any errors associated with those events, to log files. Events such as when services are started, when services go into use (server context creation), and when machines are added to the server are all written to the logs.

The server object manager (SOM) is the centralized logging mechanism for ArcGIS server. The SOM logs all events that occur in the SOM, the server object containers (SOCs), and the services they contain.

The logs are actually a pair of files: an XML file and a .dat file. The XML file contains the <log> tags, and the .dat file contains the messages that are constantly being appended. You can open the XML file in any XML-aware tool to view the messages in the .dat file.

By default, the log files are written to <install_location>\server\user\log on the SOM machine. Each time the SOM service starts, a new log file is created, and the server will continue to write messages to that log until it reaches the maximum log size. Once the log file exceeds the maximum size, it is retired and a new log file is created. By default, the maximum log size is 10 MB.

Log messages can vary in their level of severity from Error, which indicates a problem that requires immediate attention, to Info:Detailed, which is a common message generated through regular use of the server. The log level determines the number and types of messages that get written to the file. Following are the ArcGIS Server log levels:

None - No logging.

Error - Serious problems that require immediate attention.

Normal - Warnings about problems that require attention and errors.

Info:Simple - Common administrative messages of the server, including messages about service creation. This level also includes warnings and errors.

Info:Standard - Common messages from use of the server that are logged at most once per request. This level also includes all Info:Simple messages, warnings, and errors.

Info:Detailed - Frequent messages from the server that could be logged multiple times per request, such as noting that each layer in a map service drew successfully. This level includes all Info:Standard and Info:Simple messages, as well as warnings and errors.

Verbose - ArcGIS Server developers can use this level to place debugging messages when testing server objects or server object extensions that they've developed. Includes all Info-level messages, warnings, and errors.

By default, the log level of the server is set to Info:Simple, meaning messages whose severity is Error, Normal, or Info:Simple will be logged. All messages whose level is Info:Standard or Info:Detailed are not logged.

You can change the log location, maximum log size, and logging level at any time using Manager, ArcCatalog, or the server API. Any changes that you make are reflected immediately in the server. You can also manually edit the log properties in the Server.dat configuration file. In that case, the changes are not reflected until the SOM is stopped and restarted.

If you're configuring a distributed installation of ArcGIS Server (where components of the server run on more than one machine), you will need to share the log directory and reference it using a UNC path (for example, \\myServer\log) You'll also need to make sure the SOM and SOC accounts have Read and Write permissions to the log directory.

Using the log files as an administrative tool

Log files are an important tool for monitoring and troubleshooting problems with your GIS server. GIS server administrators will monitor the server's statistics and use the statistics to help determine when they need to consult the log files. The GIS server's statistics give general information about the state of the GIS server and whether errors have been occurring. The statistics are available to server administrators through ArcCatalog.

Through both the GIS server's statistics and reports from users of the system, administrators will be confronted with errors and other problems occurring in the system. The log files provide the information to identify what the errors are and, through the information in the log, infer what to investigate to solve the problem.

For example, an administrator might view the server statistics and note that there were a number of errors associated with creating new services in the server. By further examining the statistics, the problem area can be narrowed down to a particular server object container machine. The information in the log file can then be used to determine what errors have been logged and to discover, for example, that the server object container machine on which the errors were occurring did not have access to the output directory. Using this information, the administrator can rectify the directory access problem, then use statistics and the log files to determine if the error occurs again.

The log files comprise a history of the statistics and events that occur over time in the server. The server's statistics are in memory and are accumulated summaries of time slices since the GIS server started. The granularity of these time slices is more coarse the farther back in time you go. Statistics are also cleared when the server is stopped. The GIS server's logs maintain a record of all events in the server and are not deleted when the server is stopped.