Collecting Data: Read First for Tivoli Endpoint Manager Products

Technote (troubleshooting)


Required Information to collect when contacting IBM Support regarding an IEM/TEM/Bigfix issue.

Resolving the problem

Before contacting Support, please reference Featured Documents for IBM Endpoint Manager for common problems/solutions.

And visit here for a current videos on using IBM Endpoint Manager.

Required Information when you contact IBM Support for Tivoli Endpoint Manager issues:

If you need to open a case with IBM Support regarding Tivoli Endpoint Manager, please gather the following information in addition to any other details that may help Tech Support more efficiently determine the cause of your problem:

  • Description of the problem and:
    • Steps taken leading up to the problem
    • Fixlet/Task names and IDs in question
    • Expected behaviors and actual behaviors
    • Error messages encountered: spelling is important!
    • Cut & paste any important screen shots and errors if possible
  • Versions of the TEM Components (Server, Relays, Clients, Console, IEM Tools, etc.) currently in your IEM deployment
  • Details about any changes that have occurred in the IEM deployment environment (including changes to any software, hardware, networking infrastructures, additions of any proxies and firewalls, and changes to settings)
  • Date/Time that the problem started and ended, is still occurring?
  • Scope of the issue (e.g. is it isolated to a small group of systems?)
  • Impact of the issue (e.g. does this issue prevent patching a particular group of systems?)
  • Describe what attempts have been taken to resolve the issue?
  • Screen shots from any Failures and any Warnings from the Deployment Health Checks Dashboard. For further information please see the following article:
  • Log files (see below for specific components)

For TEM Client issues:

Client Diagnostics :
Client diagnostics (which contain a lot of useful information) can be run as a tool manually on the endpoint or by taking action (as a master console operator) on the appropriate Fixlets in BES Support site from the console and targeting the endpoints to investigate:
    353 TROUBLESHOOTING: Run BES Client Diagnostics
    655 TROUBLESHOOTING: Run BES Client Diagnostics (Linux/UNIX/Mac)

These actions will use the Upload Manager facility to return the data to the server. The data is returned to the server in the client's UploadManagerData directory on the server to a folder represented by the endpoint's computer id. For example, for computer 13044499, client diagnostics would be found in:
    C:\Program Files (x86)\BigFix Enterprise\BES Server\UploadManagerData\BufferDir\sha1\99\13044499

Note: Client diagnostics can be used a general collections tool to collect clients logs and dump files. It will also collect client debug loggingand client usage profilerlogs if they have been enabled via t heir tasks in the BES Support site:

Running the tool manually: The tool can also be manually run on an endpoint machine and can be downloaded from the Wiki here.

Client Logs:
To collect only client logs from an endpoint, remote into an endpoint and zip up the client Logs directory found in the client's __BESData/__Global directory. Location of client logs:

    Windows: C:\Program Files\BigFix Enterprise\BES Client\__BESData\__Global\Logs
    Unix/Linux: /var/opt/BESClient/__BESData/__Global/Logs
    Mac: /Library/Application Support/Bigfix/BES Agent/__BESData/__Global/Logs
Note: Client logs can be collected using the Client Diagnostics tool.

Client Dump Files:
If the client process on a Window's endpoint is stopping or crashing; dump files may be getting generated and can prove useful in determining the cause of the agent's stop or crash. Dump files for the client's output to the client's BES Client directory:
    \Program Files (x86)\BigFix Enterprise\BES Client\BESClient.dmp
Note: Dump files can be collected using the Client Diagnostics tool.

Client Debug Logging:
Client debug logging is not activated by default on a client endpoint. It is a very verbose tracing which can be enabled to log every process activity an agent does in operating and evaluating content.

To enable/disable client debug logging, take action on the following tasks in the BES Support site and target the endpoints you would like to have debug logging enabled on:

    157 BES Client Setting: Enable Debug Logging
    196 BES Client Setting: Disable Debug Logging

For steps on how to manually configure Client Debug Logging visit this article.

Note: Client debug logging can be collected using the Client Diagnostics tool.

Client Usage Profiler Logging:
In addition, enabling the usage profiler on the IEM Client can sometimes identify objects that are taking too long to evaluate. The following tasks in the IEM Support site can be used to enable or disable the usage profiler:

    361 TROUBLESHOOTING: Enable BES Client Usage Profiler
    418 TROUBLESHOOTING: Disable BES Client Usage Profiler

Note: We need 24 hours of client usage profiler data in order to get enough data to establish a pattern of what performance issues may be occurring.

After you have collected 24 hours of this information, please run the IEM Client Diagnostics tool. Download the tool from:

For IEM Relay or Gather issues:
Include IEM Relay/Gather logs and any dump files. The BESRelay.log file on the IEM Server and the logfile.txt file on an IEM Relay can often help identify issues. They are located in the following locations by default:

  • C:\Program Files\BigFixEnterprise\BES Server\BESRelay.log
  • C:\Program Files\BigFixEnterprise\BES Relay\logfile.txt

In addition, include any dump files which the IEM Relay, Gather Service, and BES Root Server service has generated. To determine where the dump files are kept, please refer to the following article:

For IEM Console issues:
Enable debugging on the IEM Console log and include this along with any dump files.
See the following for how to enable logging:

For Trend CPM issues:
For installation issues include Trend client installation logs, the Core Protection Module (CPM) Endpoint installation logs can be found in C:\WINDOWS and include CPMInstall.log, OFCNT.log, ClnExtor.log, and CPMInstallResult.log.

For system-wide pattern issues include the server's Trend mirror script logs, the Core Protection Module (CPM) Endpoint Mirror Script logs can be found in C:\Program Files\BigFix Enterprise\TrendMirrorScript\logs

For CPM action failures include the BES Client logs, see the following article describing where the client logs are located:

For local malware/spyware issues, enable/get the logs by taking action on the following Task:
Task #28: Core Protection Module - Upload Logs (see in the description of the Task for the directory location of where the logs are uploaded to)

For undetected malware/spyware issues see the following article for information to include:

To contact IBM Support regarding a Tivoli Endpoint Manager (TEM) issue :
Please refer to the following:
For additional information on how Support works at IBM please refer to the following Support Handbook:

Historical Number


Rate this page:

(0 users)Average rating

Document information

More support for:

Tivoli Endpoint Manager

Software version:

BES 7.2

Operating system(s):

Platform Independent

Reference #:


Modified date:


Translate my page

Machine Translation

Content navigation