IBM Support

Data Collection: BigFix Client

Question/Answer


Question

Where can I collect logs and related data from the IBM BigFix client for troubleshooting purposes?

Answer

 

 

Client Logs

The BigFix Client writes its current activity in to a log file with the current date as the file name, in the following format: "[year][month][day].log". If the size of an active log exceeds 512K on a particular day, it is backed up (in a .bkg file) and a new log is created. Every time the log hits the size limit, the backup action overwrites the existing backup. Both active and backup logs are deleted after ten days.

Section 1. Default locations

The default locations of the BigFix Client logs are as follows:

  • Windows: C:\Program Files (x86)\BigFix Enterprise\BES Client\__BESData\__Global\Logs
  • Unix/Linux: /var/opt/BESClient/__BESData/__Global/Logs
  • Mac: /Library/Application Support/Bigfix/BES Agent/__BESData/__Global/Logs

Section 2. Updating log settings

To modify the number of days that you can retain the client logs or the log size limit, use the following client settings:

_BESClient_Log_Days

The maximum of number of days you can retain the client log files.

Type: Numeric
Version: 5.1
Platform: All
MinNumeric: 1
MaxNumeric: 366
Default: 10
Requires Client Restart: NO

_BESClient_Log_MaxSize The maximum size of a log file in bytes. When the size exceeds this limit, the log is renamed as 'current_date'.bkg (unless this file already exists) and then another log is created for the rest of the day.
Type: Numeric
Version: 7.0
Platform: All
MinNumeric: 0
MaxNumeric: maxuint32
Default: 512000
Requires Client Restart: NO

 

Note: It's recommended that you leave the values of the settings at their defaults unless there is a compelling reason to modify them.

Section 3. Collecting the logs

Use one of the following methods to collect the client logs:

Method 1: Connect to the endpoint machine remotely, compress and copy the logs directory, and transfer or FTP it to a network file share.

Method 2. Gather client diagnostics data. For details, see Client Diagnostics.


Client Debug Logging

 

You can activate client debug logging (also called extended message (EMsg) logging) on a client to verbosely trace every operation that a client performs. Make sure you always set it to the maximum detail level, which is 10000.

Section 1. Enabling/disabling client debug logging

Use one of the following methods to enable/disable client debug logging:

Method 1: Take action on the following tasks in the BES Support site:

Task # 157: BES Client Setting: Enable Debug Logging (specify 10000 as the debug detail level)
Task # 196: BES Client Setting: Disable Debug Logging

Method 2: Create or remove the following custom client settings through the BigFix Console. To create a setting, select the computer(s) > right-click > click "Edit Computer Settings".

_BESClient_EMsg_Detail Enables the BigFix Client debug log level that provides extended information about the BigFix Client activity. Set the value to 10000.
_BESClient_EMsg_File

The full path to the file (including the file name) to which you want to write the extended messages. For example:

  • Windows: C:\Program Files (x86)\BigFix Enterprise\BES Client\besclientdebug.log
  • Unix/Linux: /var/opt/BESClient/besclientdebug.log
  • Mac: /Library/Application Support/Bigfix/BES Agent/besclientdebug.log

Note: For this to work, you must set _BESClient_EMsg_Detail to a value greater than 0.

_BESClient_EMsg_EvalLog

Enables the EMsg (debug) logging of content identifiers prior to relevance evaluation. Set it to 1 to enable the setting. This setting is useful, for example, in identifying problematic relevance expressions.

 

Method 3: Connect to the endpoint machine remotely, and create or remove debug logging settings as follows:

Windows

Add or remove the following registry keys and values, as applicable:

  • [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BigFix\EnterpriseClient\Settings\Client\_BESClient_EMsg_Detail]
  • "value"="10000"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BigFix\EnterpriseClient\Settings\Client\_BESClient_EMsg_File]
  • "value"="C:\Program Files (x86)\BigFix Enterprise\BES Client\besclientdebug.log"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BigFix\EnterpriseClient\Settings\Client\_BESClient_EMsg_EvalLog]
  • "value"="1"
Unix/Linux

Stop the client service, and add the following lines to the config file located at /var/opt/BESClient/besclient.config or remove them, as applicable:

  • [Software\BigFix\EnterpriseClient\Settings\Client\_BESClient_EMsg_File]
  • value = /var/opt/BESClient/besclientdebug.log
  • [Software\BigFix\EnterpriseClient\Settings\Client\_BESClient_EMsg_Detail]
  • value = 10000
  • [Software\BigFix\EnterpriseClient\Settings\Client\_BESClient_EMsg_EvalLog]
  • value = 1

Note: For the changes to the settings to take effect, restart the client service.

Section 2. Collecting the logs

To collect the client debug logs, use one of the following methods:

Method 1. Connect to the endpoint machine remotely, compress and copy the besclientdebug.log file, and transfer or FTP it to a network file share.

Method 2. Gather client diagnostics data. For details, see Client Diagnostics.


Client Usage Profiler

 

The client usage profiler logs the time spent on evaluating content. It highlights the pieces of content that consume most of a client's time during its evaluation cycle. After the usage profiler is enabled, the Client tracks the top 100 activities that take the longest time and stores them in files (in the client directory) with the following naming convention "usageprofiler.txt.xxxx"
 

Section 1. Enabling/disabling the client usage profiler

Method 1: Take action on the following tasks in the BES Support site:

Task # 361: TROUBLESHOOTING: Enable BES Client Usage Profiler

Task # 418: TROUBLESHOOTING: Disable BES Client Usage Profiler


Method 2: Create the following custom client settings through the BigFix Console or remove them, as applicable. To create a setting, select the computer(s) > right-click > click  "Edit Computer Settings".

_BESClient_Resource_TrackingMaxFiles Set to 24 (24 hours of tracking).
_BESClient_Resource_TrackingCount Set to 100.
_BESClient_Resource_TrackingCycleSeconds Set to 3600.
_BESClient_Resource_TrackingFile

Windows: Set to C:\Program Files (x86)\BigFix Enterprise\BES Client\usageprofiler.txt

Unix/Linux: Set to /var/opt/BESClient/usageprofiler.txt

Mac: Set to /Library/Application Support/BigFix/BES Agent/usageprofiler.txt

 


Method 3: Connect to the endpoint machine remotely, and create or remove client usage profiler settings as follows:

Windows

Add or remove the following registry keys and values, as applicable:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix\EnterpriseClient\Settings\Client\_BESClient_Resource_TrackingMaxFiles]
"value"="24"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix\EnterpriseClient\Settings\Client\_BESClient_Resource_TrackingCount]
"value"="100"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix\EnterpriseClient\Settings\Client\_BESClient_Resource_TrackingCycleSeconds]
"value"="3600"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\BigFix\EnterpriseClient\Settings\Client\_BESClient_Resource_TrackingFile]
"value"="C:\Program Files (x86)\BigFix Enterprise\BES Client\usageprofiler.txt"

Unix/Linux Stop the client service, and add the following lines to the config file located at /var/opt/BESClient/besclient.config or remove them, as applicable:

 

[Software\BigFix\EnterpriseClient\Settings\Client\_BESClient_Resource_TrackingMaxFiles]

value = 24

[Software\BigFix\EnterpriseClient\Settings\Client\_BESClient_Resource_TrackingCount]

value = 100

[Software\BigFix\EnterpriseClient\Settings\Client\_BESClient_Resource_TrackingCycleSeconds]

value = 3600

[Software\BigFix\EnterpriseClient\Settings\Client\_BESClient_Resource_TrackingFile]

value = "/var/opt/BESClient/usageprofiler.txt"

Note: For the changes to the settings to take effect, restart the client service.

Section 2. Collecting the logs

As a best practice, collect the client usage data over a 24-hour period. This is the minimum duration that the usage profiler needs to generate enough and meaningful data samples that you can use in troubleshooting problems.

The following is an example of a usage file that contains unusually long evaluation times. An efficient piece of content would typically take less than a second for evaluation. You must investigate items taking longer than a second.

=====

Start:Thu, 30 Feb 2013 15:21:40 -0800
Elapsed Time:02:48:48
Tracking: Top 100
Samples:99
Elapsed Evaluation Time:18:18:32

Time in Seconds:Site.Item ID:Activity
1) 16478.126: actionsite.2147453787:Analysis Relevance
2) 16478.124: actionsite.2146599782:Analysis Relevance
3) 16478.119: actionsite.2142786964:Analysis Relevance
4) 16478.118: BES Support.521:Verify Fixlet Relevance

=======

See this tech note for an analysis that you can import into the console and activate. The analysis contains properties that return evaluation statistics and top ten lengthiest evaluations, which you can use either in addition to or in lieu of the client usage profiler.

To collect the client usage profiler files, use one of the following methods:

Method 1. Connect to the endpoint machine remotely, compress and copy the logs directory, and transfer or FTP it to a network file share.

Method 2. Gather client diagnostics data. For details, see Client Diagnostics.


Client Dump Files

 

When a client process stops or crashes on a Windows endpoint, dump files are generated. You can use these files in determining why the agent stopped or crashed.

Dump files are output to the client's BES Client directory on the endpoint. For example, C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.dmp.

To collect the client dump files, use one of the following methods:

Method 1: Connect to the endpoint machine remotely, compress and copy the dump files, and transfer or FTP it to a network file share.

Method 2. Gather client diagnostics data. For details, see Client Diagnostics.


 

Client Performance Counters

 

Performance counter properties - These are deployed to measure client evaluation performance and track the top ten longest evaluating pieces of content on a client.


 

Client Diagnostics

 

See Client Diagnostics for information about how to generate and collect client diagnostics.

 

Historical Number

302

Document information

More support for: IBM BigFix Platform

Component: Client

Software version: All Versions

Operating system(s): Platform Independent

Reference #: 1505873

Modified date: 29 September 2018


Translate this page: