The agent has two logging mechanisms: the default logfiles and the emsg log. The logfiles are for general logging purposes, and are enabled by default. The emsg log is for debug messages, and is disabled by default. The logfiles are created in a platform-dependent directory (/var/opt/BESClient/BESData/Global/Logs on Linux) and end with .log and .bkg. The location and name of the emsg log must be specified explicitly by creating a setting named _BESClient_EMsg_File.

 

.log files

• Logfiles ending in .log are created for individual days. The first time a log messge is written on a given day, a new logfile is created for that day. Further log messages written on that day are appended to the file. These files have names such as 20091211.log that indicate the day on which the logfile was created. For instance, the file 20091211.log was created on December 11, 2009. The setting _BESClient_Log_Days indicates the length of log history to preserve. Specifically, logfiles not created within the last _BESClient_Log_Days days are periodically deleted to conserve disk space. The minimum allowed value is 0 (which disables logging) and the maximum allowed value is 366. The default value is 10.

 

.bkg files

• At the time the client attempts to create a log message, it checks to see if a logfile already exists for the current day. If so, the client checks the size of the file. If the file size is at least _BESClient_Log_MaxSize bytes, then the logfile is full.
• If the logfile is full, the client does the following:
  • Suppose the name of the logfile is 20091211.log. The client will check for the presence of a backup logfile 20091211.bkg. If not present, the client renames 20091211.log to 20091211.bkg and creates an empty file named 20091211.log. Otherwise, the client deletes the current logfile 20091211.log and creates an empty file of the same name. The client then writes the log message to the file 20091211.log. The motivation for this behavior is that if a problem occurs, valuable troubleshooting information is more likely to appear early in the log, and is often followed by repetitive messages of little additional value.
• If the logfile is not full, then the message is appended to the logfile.

 

Log error messages

• winsock errors -- See http://support.bigfix.com/cgi-bin/kbdirect.pl?id=273

 

Disk limits and configuration

• See above description of .log and .bkg files.

 

EMsg log

• The EMsg or Debug Log can output a lot more detail about what the client is doing, but can quickly output a large amount of data to the disk, so its suggested to not leave it on by default
  • The setting '''_BESClient_EMsg_Detail''' sets the detail level. This can be from 0 to a very large number. The messages are keyed to different numbers and will only emit if their number is below the setting
  • The setting '''_BESClient_EMsg_File''' points to the fully qualified platform specific path and name of the file to output the EMSG log into eg:"c:\besaction.log"
  • The setting '''_BESClient_EMsg_MaxSize''' limits the size of the emsg log. Specifically, if the size in bytes of the emsg log is at least this value then the client will not write further messages to the log.

Detail

• The setting _BESClient_EMsg_Detail specifies the verbosity level of messages written to the emsg log. Larger values imply greater verbosity. For instance:
  • A value of 0 disables emsg logging.
  • A value >= 1 enables critical error messages.
  • A value >= 5 enables messages about sidelined and unsidelined files.
  • A value >= 10 enables action debug messages.
  • A value >= 20 enables messages related to evaluation suspending/resuming.
  • A value >= 100 enables logging of network connection events.
  • A value >= 1000 enables verbose messages.
• The minimum detail value is 0 and the maximum detail value is the largest unsigned 32-bit integer. The default value is 0 (logging disabled).
• On Windows, the setting _BESClient_EMsg_NTEventLog determines whether emsg log messages are also written to the Windows event log. A nonzero value causes events to be written to the Windows event log. The default value is 0.
• The boolean setting _BESClient_EMsg_EvalLog determines whether an emsg log message is written each time the client begins evaluation of a fixlet or action. The default value is false.