How log files work

ArcGIS Server writes events that occur in the server, and any errors associated with those events, to log files. Events such as when services are started, when services go into use (server context creation), and when machines are added to the server are all written to the logs. Low-level messages, such as layer draw times in a map service, can also be written to the logs.

The ArcGIS Server SOC Monitor (ArcSOCMon.exe) is the centralized log reader/writer for ArcGIS Server. One of the functions of ArcSOCMon is to log all events that occur in the server object manager (SOM), the server object containers (SOCs), and the services they contain.

The logs are actually a collection of files: matching XML and .dat files that reside on each machine in the ArcGIS Server system. The XML files contain the <log> tags, and the .dat files contain the messages that are constantly being appended. The XML file can be opened in any XML-aware tool to view the messages in the .dat file.

Since log files are now distributed among all the ArcGIS Server machines, manually reading and correlating the log files can be challenging. Log files are best read by the Manager applications but can also be accessed using the Server API (ArcObjects). Both of these methods organize log messages chronologically regardless of which machines contributed the files.

By default, the log files are written to <installation_location>\server\user\log on every machine on Windows and <ArcGIS Server installation directory>/user/log on Linux/Solaris. Each time ArcGIS Server restarts, new log files are created, and the server will continue to write messages to those log files until they reach the maximum log size.

Once the log file exceeds the maximum size, it is retired and a new log file is created. By default, the maximum log size is 10 MB. You can change this value, and you can also specify the overall number of log files allowed in the log directory. These settings are available on the General tab of the Server Properties dialog box in Manager or ArcCatalog.

Log messages can vary in their level of severity from Error, which indicates a problem that requires immediate attention, to Info:Detailed, which is a common message generated through regular use of the server. The log level determines the number and types of messages that are written to the file. Following are the ArcGIS Server log levels:

None—No logging.

Error—Serious problems that require immediate attention.

Normal—Warnings about problems that require attention and errors.

Info:Simple—Common administrative messages of the server, including messages about service creation. This level also includes warnings and errors.

Info:Standard—Common messages from use of the server that are logged at most once per request. This level also includes all Info:Simple messages, warnings, and errors.

Info:Detailed—Frequent messages from the server that could be logged multiple times per request, such as noting that each layer in a map service drew successfully. This level includes all Info:Standard and Info:Simple messages, as well as warnings and errors.

Verbose—ArcGIS Server developers can use this level to place debugging messages when testing server objects or server object extensions that they've developed. Includes all Info-level messages, warnings, and errors.

By default, the log level of the server is set to Info:Simple, meaning messages whose severity is Error, Normal, or Info:Simple will be logged. All messages whose level is Info:Standard or Info:Detailed are not logged.

You can change the log location(s), maximum log size, and logging level at any time using Manager, ArcCatalog, or the Server API. Any changes that you make are reflected immediately in the server.

If you're configuring a distributed installation of ArcGIS Server (where components of the server run on more than one machine), you can choose to share the log directory and reference it using a UNC path (for example, \\myServer\log), or you can use a local path to the same log directory on every machine. You'll also need to make sure the SOC account has Read and Write permissions to the log directory.

Dive-in:

To manually delete a log file, you must stop the ArcSOCMon.exe process on the machine that's writing the log file. This applies even when you are writing log files to a shared location. The log file name contains the name of the SOC machine that wrote the file (preceded by the SOM machine name).

Using the log files as an administrative tool

Log files are an important tool for monitoring and troubleshooting problems with your GIS server. GIS server administrators will monitor the server's statistics and use the statistics to help determine when they need to consult the log files. The GIS server's statistics give general information about the state of the GIS server and whether errors have been occurring. The statistics are available to server administrators through ArcCatalog.

Through both the GIS server's statistics and reports from users of the system, administrators will be confronted with errors and other problems occurring in the system. The log files provide the information to identify what the errors are and, through the information in the log, suggest what to investigate to solve the problem.

For example, an administrator might view the server statistics and note that there were a number of errors associated with creating new services in the server. By further examining the statistics, the problem area can be narrowed down to a particular server object container machine. The information in the log file can then be used to determine what errors have been logged and to discover, for example, that the server object container machine on which the errors were occurring did not have access to the output directory. Using this information, the administrator can rectify the directory access problem, then use statistics and the log files to determine if the error occurs again.

The log files comprise a history of the statistics and events that occur over time in the server. The server's statistics are in memory and are accumulated summaries of time slices since the GIS server started. The granularity of these time slices is more coarse the farther back in time you go. Statistics are also cleared when the server is stopped. The GIS server's logs maintain a record of all events in the server and are not deleted when the server is stopped.

Log files in security workflows

If you've enabled security on your GIS server, you'll see an additional tag in your log messages reporting which user is making the request. This can help you track individual user activity on your GIS server.