Collecting Data: Read First for Tivoli Endpoint Manager Products

Technote (troubleshooting)


Required Information to collect when contacting IBM Support regarding an IEM/TEM/Bigfix issue.

Resolving the problem

Before contacting Support, please reference Featured Documents for IBM Endpoint Manager for common problems/solutions.

And visit here for a current videos on using IBM Endpoint Manager.

Required Information when you contact IBM Support for Tivoli Endpoint Manager issues:

If you need to open a case with IBM Support regarding Tivoli Endpoint Manager, please gather the following information in addition to any other details that may help Tech Support more efficiently determine the cause of your problem:

Download the PMR Problem Description Worksheet.doc file to use as template in collecting this information. Once filled out please submit/upload it it to the PMR:

PMR #: Provide the PMR number this problem has been entered under.
Description: Provide a thorough description of the problem (all the symptoms you are experiencing).
Component Versions: Server/Console/WR:
Content: Object Type (Fixlet,Task,Baseline,Analysis, Property,etc.)
Site's Version:
Action: Name:
Issue Date:
Operator Name (MO/NMO):
Expected / Actual Behaviors: Describe what behavior is expected if the product was working for you and then Describe the actual behavior of how the product is working instead.
Steps / Error Messages / Screenshots: Provide the steps you are taking leading up to the problem occurring, the error messages experienced, and screenshots of each of the steps and error messages
Changes leading up to problem: Details about any changes that have occurred in the IEM deployment environment (including changes to any software, hardware, networking infrastructures, additions of any proxies and firewalls, and changes to settings)
Start Date/Time: Date/Time that the problem started and ended, is it still occurring?
Scope of Issue: Scope of the issue (e.g. is it isolated to a small group of systems? Part of the network? A relay or specific sets of relays? etc.)
Impact of Issue: Impact of the issue. What part of the product have you lost functionality in and how is it impacting your IT/business activities (e.g. does this issue prevent patching a particular group of systems?)
Resolve Attempts: Describe what attempts have been taken to resolve the issue?
Health Check /Deployment Data: Screen shots from any failures and any warnings from the Deployment Health Checks Dashboard. For further information please see the following article:

* Log files and other machine data: see below for specific logs and machine data that can be gathered to assist in problem determination.

For TEM Client issues:

Client Diagnostics :
Client diagnostics (which contain a lot of useful information) can be run as a tool manually on the endpoint or by taking action (as a master console operator) on the appropriate Fixlets in BES Support site from the console and targeting the endpoints to investigate:
    353 TROUBLESHOOTING: Run BES Client Diagnostics
    655 TROUBLESHOOTING: Run BES Client Diagnostics (Linux/UNIX/Mac)

These actions will use the Upload Manager facility to return the data to the server. The data is returned to the server in the client's UploadManagerData directory on the server to a folder represented by the endpoint's computer id. For example, for computer 13044499, client diagnostics would be found in:
    C:\Program Files (x86)\BigFix Enterprise\BES Server\UploadManagerData\BufferDir\sha1\99\13044499

Note: Client diagnostics can be used a general collections tool to collect clients logs and dump files. It will also collect client debug logging and client usage profiler logs if they have been enabled via t heir tasks in the BES Support site:

Running the tool manually: The tool can also be manually run on an endpoint machine and can be downloaded from the Wiki here.

Client Logs:
To collect only client logs from an endpoint, remote into an endpoint and zip up the client Logs directory found in the client's __BESData/__Global directory. Location of client logs:

    Windows: C:\Program Files\BigFix Enterprise\BES Client\__BESData\__Global\Logs
    Unix/Linux: /var/opt/BESClient/__BESData/__Global/Logs
    Mac: /Library/Application Support/Bigfix/BES Agent/__BESData/__Global/Logs
Note: The preferred method for collecting the Client logs is to use the Client Diagnostics tool.

Client Dump Files:
If the client process on a Window's endpoint is stopping or crashing; dump files may be getting generated and can prove useful in determining the cause of the agent's stop or crash. Dump files for the client's output to the client's BES Client directory:
    \Program Files (x86)\BigFix Enterprise\BES Client\BESClient.dmp
Note: Dump files can be collected using the Client Diagnostics tool.

Client Debug Logging:
Client debug logging is not activated by default on a client endpoint. It is a very verbose tracing which can be enabled to log every process activity an agent does in operating and evaluating content.

To enable/disable client debug logging, take action on the following tasks in the BES Support site and target the endpoints you would like to have debug logging enabled on:

    157 BES Client Setting: Enable Debug Logging
    196 BES Client Setting: Disable Debug Logging

For steps on how to manually configure Client Debug Logging visit this article.

Note: Client debug logging can be collected using the Client Diagnostics tool.

Client Usage Profiler Logging:
In addition, enabling the usage profiler on the IEM Client can sometimes identify objects that are taking too long to evaluate. The following tasks in the IEM Support site can be used to enable or disable the usage profiler:

    361 TROUBLESHOOTING: Enable BES Client Usage Profiler
    418 TROUBLESHOOTING: Disable BES Client Usage Profiler

Note: We need 24 hours of client usage profiler data in order to get enough data to establish a pattern of what performance issues may be occurring.

After you have collected 24 hours of this information, please run the IEM Client Diagnostics tool. Download the tool from:

For IEM Relay or Gather issues:
Include IEM Relay/Gather logs and any dump files. The BESRelay.log file on the IEM Server and the logfile.txt file on an IEM Relay can often help identify issues. They are located in the following locations by default:


  • C:\Program Files\BigFixEnterprise\BES Server\BESRelay.log
  • C:\Program Files\BigFixEnterprise\BES Relay\logfile.txt
  • /var/log/BESRelay.log

In addition, include any dump files which the IEM Relay, Gather Service, and BES Root Server service has generated. To determine where the dump files are kept, please refer to the following article:

For IEM Console issues:
Enable debugging on the IEM Console log and include this along with any dump files.
See the following for how to enable logging:

For Trend CPM issues:
For installation issues include Trend client installation logs, the Core Protection Module (CPM) Endpoint installation logs can be found in C:\WINDOWS and include CPMInstall.log, OFCNT.log, ClnExtor.log, and CPMInstallResult.log.

For system-wide pattern issues include the server's Trend mirror script logs, the Core Protection Module (CPM) Endpoint Mirror Script logs can be found in C:\Program Files\BigFix Enterprise\TrendMirrorScript\logs

For CPM action failures include the BES Client logs, see the following article describing where the client logs are located:

For local malware/spyware issues, enable/get the logs by taking action on the following Task:
Task #28: Core Protection Module - Upload Logs (see in the description of the Task for the directory location of where the logs are uploaded to)

For undetected malware/spyware issues see the following article for information to include:

To contact IBM Support regarding a IBM Endpoint Manager (IEM) issue :
Please refer to the following:
For additional information on how Support works at IBM please refer to the following Support Handbook:

Historical Number


Document information

More support for:

Tivoli Endpoint Manager

Software version:

BES 7.2

Operating system(s):

Platform Independent

Reference #:


Modified date:


Translate my page

Content navigation