Obtaining various logs for your Enterprise GIS


Whenever a user runs into some sort of problem with the GIS system, one of the first things to look at would be the relevant logs. These give a more detailed insight into what is happening and where potential problems were encountered. This post will explain exactly how to obtain every type of log in the ArcGIS Enterprise stack.

IIS logs

ArcGIS Server logs

ArcGIS Server crash dump files

ArcGIS Pro SDE Intercept logs

ArcGIS Portal logs

ArcGIS Datastore logs

Capture HAR files & console logs from desktop browsers

Using Fiddler to capture web request logs

Capturing diagnostics on mobile devices

Capturing Tomcat logs in AGS and Portal

Survey123 Connect

PostgreSQL Internal database logs for ArcGIS Enterprise

Using SAML tracer to capture SAML based network traffic

Extract log from android device

Extract iOS device logs using Mac and Windows


IIS logs

If your ArcGIS Web Adaptor is installed on a Windows machine, it is most likely running as an application inside Microsoft’s Internet Information Services (IIS).

IIS services incoming web requests, where the Web Adaptor will take these requests and forward them on to the relevant ArcGIS url. This allows you to deploy your Web Adaptor in an accessible location without exposing the internals of your Enterprise deployment to potential security risks.

By default logging in IIS is not enabled. To enable it:

  1. Open IIS (click start -> type IIS).
  2. Select the Web Adaptor you would like to enable logging for on the left hand panel.
  3. Double-click on the Logging item in the middle panel.
  4. Click on Enable on the right hand panel. You can also directly open the log files directory from this panel.

The Default log location of the IIS is at %SystemDrive%\inetpub\logs\LogFiles. You can browse to this location by opening Windows Explorer and pasting the above path into the address bar.

If the logs are not stored in the default location, follow these directions below to look up where they are currently being stored.

  1. Open IIS.
  2. Click on the site and double – click on “Logging” feature.
  • The log directory can be found under the “Logging” feature.

ArcGIS Server logs

ArcGIS Server is the Enterprise component which does most of the “heavy-lifting”. When ArcGIS Server encounters errors these are logged. It is also possible to set the log level to a more detailed level for more in-depth inspection.

The default ArcGIS server log location is at “C:\arcgisserver\logs\server”

If the logs are not stored in the default location, follow the below steps to access the ArcGIS server log files.

  1. Open ArcGIS Server Manager
  2. Navigate to Logs > Settings.
  3. The log file location can be found as per the below screenshot.
  4. If more detailed logs are required, set the Log level to the required option. Note: Once increasing the log level to a more detailed option, the action which caused the error will need to be performed again as to write logs at the new level.

ArcGIS Server crash dump files

When a serious crash of an internal process of ArcGIS Server occurs, a crash dump file is created to aid in troubleshooting the cause.

ArcGIS server crash dump files are stored inside the Error reports folder of the ArcGIS server logs folder location. The Error Reports folder is created automatically upon application crash, it may not be present after installation of the latest version of ArcGIS. ” windbg” tool can be used to read the crash dump files to diagnose the issue. By default only the 10 latest crash dumps are retained.


ArcGIS Portal logs

The default portal log location is at “C:\arcgisportal\logs\<server_name>\portal”

If the logs are not stored in the default location, follow the below steps to access the portal log files.

  1. Open the ArcGIS Portal Directory and log in as an Administrator. The URL is typically available at https://webadaptorhost.domain.com/webadaptorname/portaladmin.
  2. Navigate to Logs > Settings.
  3. The log files can be found as per the below screenshot.


ArcGIS Pro SDE Intercept logs

Enabling SDE Intercept logs instructs ArcGIS Pro to write a log file recording all interactions with the Enterprise Geodatabase. These logs are useful for gaining insight into what communications are happening between Pro and the Geodatabase.

Below is the workflow for setting up SDE Intercept log file in ArcGIS Pro

Run Command Prompt as Administrator on the machine where Pro is installed and enter the following commands:

  1. set SDEVERBOSE=TRUE
  2. set SDEINTERCEPTLOC=c:\Temp
  3. set SDEINTERCEPT=cwrTf
  4. start /d “C:\Program Files\ArcGIS\Pro\bin\” ArcGISPro.exe
  5. Perform the workflow of interest in Pro
  6. Open Windows Explorer and navigate to c:\Temp or alternate directory specified in step 2.
  7. The sde logs will have a file name such as se_intercept_clnt.001

ArcGIS Datastore logs

ArcGIS Datastore is an open-source database (PostgreSQL) included with Enterprise and configured to work with an ArcGIS Server. This allows users to store all kinds of data without the need for an additional RDBMS to be installed. The default ArcGIS datastore log location is at “C:\arcgisdatastore\logs\<server_name>.

If the logs are not stored in the default location, its usually located at the path where the ArcGIS datastore is created using ArcGIS Datastore configuration wizard.

The location of the log files can be confirmed by running the Describe Datastore tool:


Capture HAR files & console logs from desktop browsers.

HAR is the short form for HTTP Archive format, which tracks all the logging of web browser’s interaction with a site. Most modern browsers have the ability to log and export these files, as well as any messages written to the console. Sharing this allows an analyst to view the exact details around the requests that the browser is sending to the server(s) and what the responses are.

The browser console lists any execution errors or warnings that are encountered along with technical details around the error/warning.

To generate the HAR file for Chrome:

To generate the HAR file for Firefox:

  1. Open Firefox and go to the page where you are experiencing trouble.
  2. Select the Firefox menu (three horizontal parallel lines) at the top-right of your browser window, then select Web Developer > Network.
  3. The Developer Network Tools opens as a docked panel at the side or bottom of Firefox. Click the Network tab.
  4. The recording auto starts when you start performing actions in the browser.
  5. Once you have reproduced the issue and you see that all the actions have been generated in the Developer Network Panel (should just take a few seconds), right-click anywhere under the File column and click on Save all as Har.
  6. Save the HAR file somewhere convenient.
  7. Switch to the Console tab and save this in the same manner.


To generate the HAR file for Internet Explorer/ Edge:

  1. Open Internet Explorer and go to the page where the issue is occurring.
  2. Press F12 on your keyboard (or click the gear icon > F12 Developer Tools)
  3. Click the Network tab.
  4. Reproduce the issue that you were experiencing before, while the network requests are being recorded.
  5. Once done click the Save button.
  6. Give the trace a filename and click the Save button which will save it as a .har file or .xml file.
  7. Switch to the Console tab and save this in the same manner.

Using Fiddler to capture web request logs

Telerik Fiddler is a utility that captures outgoing web requests. It is similar to what is available in most modern browsers. The difference is that Fiddler can also capture these requests when made outside of a browser (i.e., from Pro, a custom app, a script etc.)

Fiddler (Classic) can be downloaded from HERE.

  1. After you install Fiddler, Go to Start Menu -> Search for Fiddler.
  2. Launch Fiddler and it will start capturing HTTP traffic. However, most of the communications in ArcGIS are done over the more secure HTTPS protocol. To view these, you need to enable decryption of secure HTTPS requests first. This will also require you to add the Fiddler root certificate to your computer to tell it to trust Fiddler with this kind of operation.
    1. Go to Tools -> Telerik Fiddler Options -> HTTPS -> Check Decrypt Https Traffic Option
    1. You will be prompted to install the ROOT certificate. Allow this to enable Fiddler to capture HTTPS calls. Click OK to close the Options window.

When you run Fiddler, it behaves as default proxy server on your system. This means that requests will be passed to Fiddler before being forwarded onwards to the destination. If Fiddler is currently actively capturing requests, you should see entries being added to the main panel on the left.

  • First, disable Capture Traffic and clear the captured calls:
  • Now prepare the application for which you would like to capture the traffic to the stage just before it fails or gives an error.
  • Enable Capture Traffic in Fiddler.
  • Recreate the issue in the application.
  • Return to Fiddler and disable Capture Traffic to avoid unwanted requests being logged.
  • You should now see several entries in the left-hand panel in Fiddler.

For the purpose of capturing the logs, we will not be going into details on how to analyze the information. The entire session’s information can be saved and shared with an analyst who can review the details.

  • Click on File -> Save -> All Sessions.
  • Save the .saz file and share it with the analyst.

Capturing diagnostics on mobile devices

Similar to the above scenario of using Fiddler to capture web traffic on a PC, it can also be used on mobile devices. The process on a mobile device is a bit more elaborate.

  1. If necessary, install Fiddler to your Windows machine from https://www.telerik.com/fiddler.
  2. Determine the IP address of the machine with Fiddler installed.  Open the command prompt on the machine.  Type in the command:  ipconfig. Press Enter on the keyboard. Make a note of the IP address returned (may be written as the IPv4 Address).
  3. In Fiddler, go to Tools > Options….
  4. In the HTTPS tab, check the boxes next to “Capture HTTPS CONNECTs” and “Decrypt HTTPS traffic.”
  5. In the Connections tab, check the box next to “Allow remote computers to connect”.
  6. In the same Connections tab, check to see on which port Fiddler listens. Make a note of this port number.  If needed, work with your IT team to add inbound/outbound firewall rules so web traffic can come through this port.
  7. Close and reopen Fiddler.
  8. Connect the mobile device to an internal Wi-Fi network which can resolve the machine.
  9.  On the mobile device, go to the Wi-Fi settings and open the details for the Wi-Fi network you are connected to.  Go to proxy settings and change it to Manual.  Change the proxy hostname to the IP address of the machine with Fiddler installed (this was found in step 2) and change the proxy port to the port on which Fiddler listens (this was found in step 6).
  10. On the mobile device, open a web browser. To test to make sure the device can resolve the IP address, type in the IP address of the machine followed by a colon “:” then the port on which Fiddler listens as the URL. This should look like <IP address>:<Fiddler port number. Make sure this leads to a web page called Fiddler Echo Service.
  11. Leave the Fiddler Echo Service page open. Next, we will need to allow HTTPS traffic to be decrypted by installing the Fiddler Root certificate to the device and telling the device to trust it.  If you are working with an Android device, follow the steps under “Decrypt HTTPS” at this link:  http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForAndroid . If you are working with an iOS device, follow the steps under “Decrypt HTTPS Traffic from iOS Devices” at this link:  http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/ConfigureForiOS
  12. In Fiddler, start capturing the web traffic.

Capturing Tomcat logs in AGS and Portal

Apache Tomcat is an open-source, Java-based web server that is part of the ArcGIS Enterprise stack. Tomcat provides the environment within which many ArcGIS processes are executed. For certain types of troubleshooting it is useful to enable the logs within Tomcat to gather information on a web server level.

By default, the Tomcat logs are not enabled. To enable the logs:

  1. Go to [install path] \server\framework\runtime\tomcat\conf or [install path] \Portal\framework\runtime\tomcat\conf
  2. Copy the file called logging.properties.disabled and paste it into the same folder. Name it logging.properties.
  3. This file is a template for the logging settings, and when named logging.properties Tomcat will read and implement it.
  4. Edit the logging.properties file you just created
  5. Replace all instances of ${catalina.log.level} with the word FINE
  6. This sets all the logging to a FINE log level.
  7. Restart the ArcGIS Server or Portal for ArcGIS service, depending on which one you enabled logging on.

Accessing the logs:

  1. For the internal Tomcat deployment in ArcGIS Server, the logs are located at [install path] \server\framework\runtime\tomcat\logs
  2. For the internal Tomcat deployment in ArcGIS Portal, the logs are located at [install path] \Portal\framework\runtime\tomcat\logs

Survey123 Connect

To enable logging in Survey123 Connect, open Settings through the main menu in the upper right, and click the Diagnostics tab.


PostgreSQL Internal database logs for ArcGIS Enterprise

PostgreSQL is an advanced, enterprise-class, and open-source relational database system. ArcGIS Portal internally uses the PostgreSQL database to store portal user information, portal groups, and content information. ArcGIS Datastore is an open-source database (PostgreSQL) included with Enterprise and configured to work with an ArcGIS Server. It users to store all kinds of data without the need for an additional RDBMS to be installed

  1. For portal internal postgres database, the logs are located at [Portal site content location]\arcgisportal\logs\database\pg_log
  2. [ArcGIS datastore content location]\arcgisdatastore\logs\<server name>\database

Using SAML tracer to capture SAML based network traffic.

SAML stands for Security Assertion Markup Language. It is an XML-based open-standard for transferring identity data between two parties: an identity provider (IdP) and a service provider (SP).

Identity Provider — Performs authentication and passes the user’s identity and authorization level to the service provider.

Service Provider — Trusts the identity provider and authorizes the given user to access the requested resource.

In troubleshooting SAML (or “Enterprise Login”) related issues, it is usually necessary to look at the SAML response coming from the identity provider.

  1. To install SAML Tracer extension to Google Chrome browser, log in to chrome web store and search for SAML –tracer.
  • Click on Add to Chrome – Add Extension
  • SAML-tracer extension is added to the right-hand top side of the google chrome web browser.
  • The SAML request and response are captured in the SAML-tracer windows. This information can be exported as json file through the export button at the top of the window and shared with an analyst who can review the details.

Extract logs from android device

Android devices offer their own logging functionality which aids in the troubleshooting of application crashes etc. The logs are easy to create, but extracting them to a computer requires some additional work and installations on the computer.

  1. On the Android device, navigate to Settings > About device, and tap the Build Number option seven times to enable developer mode.
  2. Navigate back to the Settings menu, open Developer options > enable the USB debugging option.
  3. For Android devices running on versions 5.0 or later, increase the Log buffer sizes to 4 MB per log buffer
  4. Open the mobile application (in this instance, Collector for ArcGIS), and reproduce the error. This generates the log file.
  5. Connect the Android device to a computer with a USB cable.
  6. Download Android SDK Platform Tools, and extract the contents to the computer.
  7. Open the extracted platform-tools folder and ensure adb.exe exists.
  8. Ctrl + Shift + right-click the empty workspace area and select Open command window here.
  9. In the command prompt, perform the following:
  10. Change the directory by typing CD, followed by the extraction destination directory. For example, CD C:\AndroidLog
  11. Enter the following command: adb logcat -v threadtime -d > C:\AndroidLog\logcat.txt
  12. The log file (logcat.txt) is now extracted to the destination folder using verbose logging.

Extract iOS device logs using Mac and Windows

  1. Using Mac device
    1. First, install Apple Configurator 2 from App Store and launch the application.
    1. Connect your iOS device to the mac through USB. On the device screen, you will be asked if you trust the computer. Tap Trust.
    1. By default, all the connected devices will appear on the home screen. Double click on the device you wish to get the logs from.
    1. Click on Console from the menu on the top left corner of the new window. You can see the log activities on the screen.
    1. Click on Clear to clear the screen and perform the necessary actions (for example, an app crash) you wish to.
    1. Click on Save button to save the logs.
  • Using Windows device
    • Install iTools on your Windows machine.
    • Launch iTools.
    • Connect your iOS device to the Windows machine through USB.
    • Click on Toolbox.
    • When you are ready to reproduce the issue, click on Real-time log under Advanced Features. You can see the logging happening in real time.
    • Click on Save to save the log activities.

Created by Naveen K and Eduard B.

Got something to say?

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s