IN THIS CHAPTER
Since the early days of Systems Management Server (SMS), the application has used numerous log files for tracking and troubleshooting purposes. This appendix discusses how to enable logging as well as listing the log files used by specific Configuration Manager (ConfigMgr) 2007 components.
Microsoft-related articles on log files are available in a number of places, including the following:
• General information is available at http://technet.microsoft.com/en-us/library/bb892800.aspx.
• Additional detail on client log files is found at http://technet.microsoft.com/en-us/library/bb693897.aspx.
• For information on mobile devices, http://technet.microsoft.com/en-us/library/bb680409.aspx discusses the log files on managed mobile devices and those computers used to deploy the mobile device client.
• Information on Operating System Deployment–related log files is located separately at http://technet.microsoft.com/en-us/library/bb932135.aspx.
• Information regarding the smsts.log file is located at http://blogs.technet.com/carlossantiago/archive/2009/01/19/how-can-i-increase-the-size-of-the-smsts-log-file.aspx.
Some logs are initially enabled, whereas others are not.
• To conserve server resources, server-based log files are not enabled by default. To enable site server component logging, use the ConfigMgr Service Manager, discussed in the “Using ConfigMgr Service Manager” section of this appendix. The site server components are located on the machine with the SMS_Executive service installed, in the Registry under HKEY_LOCAL_MACHINESoftwareMicrosoftSMSTracing where you can view the configuration by each component. However, Microsoft prefers you use ConfigMgr Service Manager rather than making modifications directly to the Registry.
• Client-based files are enabled by default, and can be disabled through the Registry on the client under HKEY_LOCAL_MACHINESoftwareMicrosoftCCMLogging.
Those logs enabled by default may include only high-level information, to try to reduce overhead. Enabling more detailed logging produces low-level information that might be useful for troubleshooting problems, although Microsoft recommends you avoid this in production sites because it can lead to excessive logging, which may make it difficult to find relevant information in the log files. If you need to log for troubleshooting purposes, turn off detailed logging once you are through!
The level of logging enabled determines whether all the files listed on the client and management point actually exist. To enable debug or verbose logging after installing Configuration Manager 2007 for the client or management point, run the Registry editor (Start -> Run, and type regedit.exe) and then make the following Registry changes:
• For debug logging, stop the SMS Agent Host service; then create the HKEY_LOCAL_MACHINESoftwareMicrosoftCCMLoggingdebuglogging key.
Restart the SMS Agent Host service (this is also described in Microsoft TechNet knowledgebase article 833417 at http://support.microsoft.com/kb/833417).
• For verbose logging, change the value of Loglevel to 0 at HKEY_LOCAL_MACHINESoftwareMicrosoftCCMLogging.
A reboot is not required.
To toggle logging off or on for individual server components, perform the following steps:
- In the ConfigMgr console, select Tools -> ConfigMgr Service Manager. Right-click and select Start ConfigMgr Service Manager.
- Open ConfigMgr Service Manager.
- Navigate to those components for which you want to change the logging settings.
- In the right pane, select one or more components.
- Right-click and select Logging.
- In the ConfigMgr Component Logging dialog box, check or uncheck the Logging enabled option, as appropriate.
- Click OK.
To expand log file size, run ConfigMgr Service Manager and in step 6 select the log size in MB.
To enable logging for the SQL component, edit the Registry and go to HKEY_LOCAL_MACHINESoftwareMicrosoftSMSTracing. Change SQLEnabled to 1 and restart the SMS_EXECUTIVE service. SQL Logging will dump every SQL call for any component that interacts with the database on the server side to its associated log file. This logging tends to be rather verbose.
NAL logging shows network connection processing as the server runs. When enabled, it adds entries to any server-side log that has to negotiate a network connection, such as the Distribution Manager. The logging produces a sizeable amount of error messages in the logs that may be misleading; the system is trying to work through all the different connectivity options and determine the best one—so the “errors” are not necessarily all errors.
To turn on NAL logging with all verbosity levels for the client, make the following Registry changes. You may need to add the Logging subkey.
• HKEY_LOCAL_MACHINESoftwareMicrosoftNALLoggingVerbosity(DWORD)value=00000007
• HKEY_LOCAL_MACHINESoftwareMicrosoftNALLoggingLog To(DWORD)value=00000003
To configure logging for the reporting point server, modify the HKEY_LOCAL_MACHINESoftwareMicrosoftSMSTracingSMS_Reporting Point Registry key.
This key contains information regarding the log file name, maximum file size allowed, and whether it is enabled (default) or disabled. Microsoft recommends you do not disable reporting point logging.
To change the maximum file size, change the MaxFileSize DWORD value as needed. The default value is 280000 (Hex) or 2621440 (Decimal).
To modify the location of this log file, change the TraceFileName value as needed.
The SmsReporting.log file captures a great deal of information about the reporting components, site database connections, and reporting query requests, and it monitors the dashboard use and a host of other items and components. This log file can be very verbose or “chatty” and thus can grow exponentially. If you decide to temporarily disable it for one reason or another to stop the influx of information, simply change the Reporting Point Logging Enabled DWORD value from 1 (On) to 0 (Off). Change it back when you have completed your tasks.
Reporting point installation information is recorded at %ProgramFiles%Microsoft Configuration ManagerLogsSMSReportingInstall. (%ProgramFiles%Microsoft Configuration Manager is also referred to within this appendix as <ConfigMgrInstallPath>.)
This section lists setup-specific log files for the ConfigMgr installation. Setup logs for individual components are included in the section documenting log files for that component.
Almost all site installation information appears in the logs on the root of the system drive, making the log files a primary source of help when you’re troubleshooting installation issues. Install the ConfigMgr toolkit prior to site installation and use Trace32.exe from the toolkit to associate .log files with Trace32. Trace32 makes ConfigMgr log files easier to read. Setup logs include the following:
• %SystemRoot%ConfigMgrPrereq.log—Shows the results of the prerequisite checker, created in the root of the system drive.
• %SystemRoot%ConfigMgrSetup.log—Installation log, updated with results from running ConfigMgr setup program and upgrades.
• %SystemRoot%SMS_BOOTSTRAP.log—Installation log for secondary site servers when the installation is initiated from the parent site.
• %SystemRoot%ExtAdSch.log—Created from the ExtADsch utility to extend the Active Directory Schema.
• %SystemRoot%ComponentSetup.log—Shows the results of installing site components.
• <ConfigMgrInstallPath> LogsSLPSetup.log—Installation log for server locator point. The server locator point is used during client installations to locate an appropriate management point. Only one server locator point is required, and it should be located on the central site.
Client log files are used to track various problems occurring on the ConfigMgr client. The location of these files varies when the client is also a management point.
• If the client is a management point and the management point is created prior to the client being installed, the client log files are located in the %SystemDrive%SMS_CCMLogs folder.
• If the client is not a management point or the client was installed prior to the management point being added, the client log files are located at %windir%System32CCMLogs. (For 64-bit systems, these files are located at %windir%SysWOW64CCMLogs.)
Client log files are a great place to begin troubleshooting efforts. Files include the following:
• CAS.log— Content Access service for the local machine’s package cache.
• CcmExec.log— Tracks the client’s activities and SMS Agent Host service information.
• CertificateMaintenance.log— Records Active Directory (AD) certificates for the directory service and management points.
• ClientIDManagerStartup.log— Used for maintenance of the resource’s Globally Unique Identifier (GUID).
• ClientLocation.log— Tracks site assignments.
• ContentTransferManager.log— Records scheduling information for the Background Intelligent Transfer Service (BITS) or the Server Message Block (SMB) to download or to access ConfigMgr packages.
• DataTransferService.log— Records all BITS communication for policy or package access.
• Execmgr.log— Records advertisement information as it is run.
• FileBITS.log— Used to record SMB package access tasks.
• Fsinvprovider.log— WMI provider for software inventory and file collection tasks.
• InventoryAgent.log— Creates data discovery records (DDRs) as well as hardware and software inventory records.
• LocationServices.log— Locates management points and distribution points.
• Mifprovider.log— Management Information Format (MIF) file WMI provider.
• Mtrmgr.log— Tracks software-metering processes.
• PolicyAgent.log— Requests policies by using the Data Transfer service.
• PolicyAgentProvider.log— Records any policy changes.
• PolicyEvaluator.log— Records any new policy settings.
• Remctrl.log— Logs when the remote control component starts.
• Scheduler.log— Records schedule tasks for all client operations.
• Smscliui.log— Records usage of the Systems Management tool in Control Panel on the client.
• StatusAgent.log— Logs status messages created by the client components.
• SWMTRReportGen.log— Generates a usage data report that is collected by the metering agent. (This data is logged in Mtrmgr.log.)
All server log files are located in the %ProgramFiles%Microsoft Configuration ManagerLogs folder on the server where the role is installed. Log files for particular components are listed in those respective sections. The server log files are as follows:
• Adsgdis.log— Active Directory Security Group Discovery log.
• Adusrdis.log— Active Directory User Discovery log file showing when the discovery method runs as well as its results.
• Adsysdis.log— Active Directory System Discovery log. Active Directory System Discovery is the key discovery method used to create DDRs for computers.
• Adsysgrp.log— Information on Active Directory System Group Discovery.
• Aikbmgr.log— Maintains a record of asset intelligence data in the site database.
• Ccm.log— Logs information regarding client Configuration Manager tasks.
• Cidm.log— Records changes to the client settings by the Client Install Data Manager (CIDM).
• Colleval.log— Logs when collections are created, changed, and replicated to child sites as well as deleted by the Collection Evaluator.
• Compmon.log— Maintains Registry setting for discovery components.
• Compsumm.log— Records Component Status Summarizer tasks.
• Cscnfsvc.log— This log records Courier Sender confirmation service tasks.
• Dataldr.log— Processes MIF files for hardware inventory in the Configuration Manager 2007 database.
• Ddm.log— Saves data discovery record (DDR) information to the Configuration Manager 2007 database by the Discovery Data Manager and processes PDR (Windows Port Driver) information.
• Despool.log— Records incoming site-to-site communication transfers.
• Distmgr.log— Records package creation, compression, delta replication, and information updates.
• Hman.log— Records site configuration changes as well as publishes site information in Active Directory Domain Services.
• Inboxast.log— Records files moved from the management point to the corresponding <ConfigMgrInstallPath>INBOXES folder.
• Inboxmgr.log— Records file maintenance. This log confirms inboxes were successfully created on the site server and the management point.
• Inboxmon.log— Monitors the file count in various inboxes.
• Invproc.log— Records processing of delta MIF files for the Dataloader component from client inventory files.
• Mpcontrol.log— Records the registration of the management point with Windows Internet Naming Services (WINS) and records the availability of the management point every 10 minutes.
• Mpfdm.log— Management point component that moves client files to the corresponding <ConfigMgrInstallPath>INBOXES folder.
• MPMSI.log— Management point .msi installation log.
• MPSetup.log— Records the management point installation wrapper process and provides information about management point installation. Resides on the site server.
• Netdisc.log— Shows activity regarding network discovery.
• Ntsvrdis.log— ConfigMgr 2007 server discovery information. Server discovery is a “hidden” discovery method that has no user-configurable properties. It runs by default on the site server every 24 hours and its only role is to “discover” any system configured as a site system and create a DDR for it.
• Offermgr.log— Records advertisement updates.
• Offersum.log— Records summarization of advertisement status messages.
• Policypv.log— Records updates to the client policies to reflect changes to client settings or advertisements.
• Replmgr.log— Records replication of files between the site server components and the Scheduler component.
• Rsetup.log— Reporting point setup log.
• Sched.log— Records site-to-site job and package replication.
• Sender.log— Records files that are sent to other child and parent sites.
• Sinvproc.log— Records client software inventory data processing to the site database in Microsoft SQL Server.
• Sitecomp.log— Records maintenance of installed site components. This log verifies successful installation of the ConfigMgr components (or reinstallation in the case of a site reset).
• Sitectrl.log— Records site setting changes to the Sitectrl.ct0 file.
• Sitestat.log— Records the monitoring process of all site systems.
• Smsdbmon.log— Records responses to database changes related to software updates.
• Smsexec.log— Records the processing of all site server component threads.
• Smsprov.log— Records WMI provider access to the site database.
• SMSReportingInstall.log— Records the reporting point installation. This component starts the installation tasks as well as processes configuration changes.
• Srvacct.log— Records the maintenance of accounts when the site uses standard security.
• Statesys.log— Processes and summarizes state messages.
• Statmgr.log— Writes all status messages to the database.
• Swmproc— Processes metering files and maintains settings.
The following files are related to backup activity:
• Smssqlbkup.log— Records the backup process for the site database.
• Smsbkup.log— Used with the site backup task, located in the site backup folder.
• Smswriter.log— Manages volume snapshots for backups.
You will find the management point log files at %ProgramFiles%SMS_CCMLogs on the management point if the management point was created prior to the client being installed. Otherwise, they are at %windir%System32CCMLogs (on 64-bit systems, at %windir%SysWOW64CCMLogs). These files include the following:
• MP_ClientID.log— Used to generate the client ID.
• MP_ClientREG.log— Used at client registration during the initial installation to verify it is an approved system.
• MP_Ddr.log— Records the conversion of XML.ddr records from clients as well as copies them to the site server.
• MP_DriverManager.log— Provides information about the management point when it responds to a request from the Auto Apply Driver task sequence action. The log is generated on the management point.
• MP_GetAuth.log— Records the status of the site management points.
• MP_GetPolicy.log— Records policy information.
• MP_Hinv.log— Converts eXtensible Markup Language (XML) hardware inventory records from clients and copies the files to the site server.
• MP_Location.log— Records location manager tasks. Useful for troubleshooting problems accessing Internet Information Services (IIS) and Windows Management Instrumentation (WMI). For OSD, provides information about the management point when it responds to request state store or release state store requests from the state migration point. The log is generated on the management point.
• MP_Policy.log— Records policy communication.
• MP_Relay.log— Copies files that are collected from the client.
• MP_Retry.log— Records the hardware inventory retry processes.
• MP_RegistrationManager.log— Records the client registration process.
• MP_Sinv.log— Converts XML hardware inventory records from clients and copies them to the site server.
• MP_Status.log— Converts XML.svf status message files from clients and copies them to the site server.
The following log files for the Admin User Interface (UI) are located in the %ProgramFiles%Microsoft Configuration ManagerAdminUIAdminUILog folder:
• AdminUI.log— Console log file
• RepairWizard.log— Records errors, warnings, and information about the process of running the Repair Wizard
• ResourceExplorer.log— Records errors, warnings, and information about running the Resource Explorer
• SMSAdminUI.log— Records the local Configuration Manager 2007 console tasks when you connect to Configuration Manager 2007 sites
Log files for mobile devices include those on the mobile device management point and client logs.
If you have enabled mobile device management in your site hierarchy, the following mobile device management log files are typically stored in the <ConfigMgrInstallPath> Logs folder of the mobile device management point computer:
• DmClientHealth.log— Records the GUIDs of all mobile device clients communicating with the device management point
• DmClientRegistration.log— Records registration requests from and responses to the mobile device client in native mode
• DmpDatastore.log— Records all the site database connections and queries made by the device management point
• DmpDiscovery.log— Records all the discovery data from the mobile device clients on the device management point
• DmpFileCollection.log— Records mobile device file collection data from mobile device clients on the device management point
• DmpHardware.log— Records hardware inventory data from mobile device clients on the device management point
• DmpIsapi.log— Records mobile device communication data from device clients on the device management point
• DmpMSI.log— Records MSI data for device management point setup
• DmpSetup.log— Records the mobile device management setup process
• DmpSoftware.log— Records mobile device software distribution data from mobile device clients on the device management point
• DmpStatus.log— Records mobile device status messages data from mobile device clients on the device management point
• FspIsapi.log— Records fallback status point communication data from mobile device clients and client computers on the fallback status point
See http://technet.microsoft.com/en-us/library/bb680409.aspx for the locations of log files on managed mobile devices and those computers used to deploy the mobile device client; these settings are configurable. The default setting on the client is %temp%DMClientLogs. On Window Mobile Smartphone 2003, this location is redirected to Storage empDMClientLogs.
• DmCertEnroll.log— Records certificate enrollment data on mobile device clients.
• DMCertResp.htm (in emp)— This log file records the HTML response from the certificate server when the mobile device Enroller program requests a client authentication certificate on mobile device clients.
• DmClientSetup.log— Records client setup data on mobile device clients.
• DmClientXfer.log— Records client transfer data for Windows Mobile Device Center and ActiveSync deployments.
• DmCommonInstaller.log— Records the client transfer file installation for setting up mobile device client transfer files on client computers.
• DmInstaller.log— Records whether DMInstaller correctly calls DmClientSetup, and whether DmClientSetup exits with success or failure on mobile device clients.
• DmInvExtension.log— Records the Inventory Extension file installation for setting up Inventory Extension files on client computers.
• DmSvc.log— Records mobile device management service data on mobile device clients.
The following OSD log files are located at <ConfigMgrInstallPath>SMS_CCMLogs unless otherwise noted:
• CCMSetup.log— Provides information about client-based operating system actions. Located at %windir%system32ccmsetup.
• Client.msi.log— Setup log file for the client. Located at %windir%system32ccmsetup.
• CreateTSMedia.log— Information about task sequence media when it is created. The log is generated on the computer running the Configuration Manager 2007 administrator console. Located at <ConfigMgrInstallPath>\%temp%.
• DriverCatalog.log— Provides information about device drivers that have been imported into the driver catalog. This file is found at <ConfigMgrInstallPath>Logs.
• MP_ClientIDManager.log— This log file provides information about the Configuration Manager 2007 management point when it responds to Configuration Manager 2007 client ID requests from boot media or the Preboot Execution Environment (PXE). This log is generated on the Configuration Manager 2007 management point.
• MP_DriverMGR.log— Provides information about the ConfigMgr 2007 management point when it responds to a request from the Auto Apply Driver task sequence action. The log is generated on the Configuration Manager management point.
• MP_Location.log— Provides information about the Configuration Manager management point when it responds to request state store or release state store requests from the state migration point. This log is generated on the ConfigMgr 2007 management point.
• Pxecontrol.log— Provides information about the PXE Control Manager and is located at <ConfigMgrInstallPath>smsLogs.
• PXEMsi.log— PXEMsi.log provides information about the PXE service point. It is generated when the PXE service point site server has been created. The log file is found at <ConfigMgrInstallPath>smsLogs.
• PXESetup.log— Provides information about the PXE service point and is generated when the PXE service point site server has been created. It can be found at <ConfigMgrInstallPath>smsLogs.
• Setupact.log— This log file provides information about Windows Sysprep and setup logs. It is located at %windir%.
• Setupapi.log— Provides information about Windows Sysprep and setup logs. It is located in %windir%.
• Setuperr.log— Provides information about Windows Sysprep and setup logs. It is located in %windir%.
• SmpIsapi.log— Provides information about the state migration point Configuration Manager 2007 client request responses.
• Smpmgr.log— Provides information about the results of state migration point health checks and configuration changes. The log file is found at <ConfigMgrInstallPath>smsLogs.
• SmpMSI.log— Provides information about the state migration point and is generated when the state migration point site server has been created. The log file is found at <ConfigMgrInstallPath>smsLogs.
• Smsprov.log— Provides information about the SMS provider. The log file is located at <ConfigMgrInstallPath>Logs.
• Smspxe.log— Provides information about the Configuration Manager 2007 PXE service point.
• SMSSMPSetup.log— Provides information about the state migration point and is generated when the state migration point site server has been created. The log file is found at <ConfigMgrInstallPath>smsLogs.
• Smsts.log— The smsts.log is used for operating system deployment and task sequence log events. smsts.log describes all task sequencer transactions and is used to help troubleshoot OSD issues. Depending on the deployment scenario, it may exist in one of the following locations:
• %temp%SMSTSLOG—Used if the task sequence completes when running in the full operating system without an agent installed in the computer.
• <CCM Install Dir>Logs—Used if the task sequence completes in the full operating system with a ConfigMgr client installed on the computer.
<CCM Install Dir> is typically %windir%System32CCMLogs, although it is <Configuration Manager 2007 installation drive>SMS_CCM for the site server and %windir%SysWOW64CCMLogs for 64-bit operating systems.
• <largest fixed partition>SMSTSLOG—Used if the task sequence completes when running in Windows PE.
Unlike all other ConfigMgr components, you cannot configure its size in the Registry. To increase the size of smsts.log, create a file named smsts.ini in the Windows folder (%windir%), with the following contents:
If you are booting up from media or using PXE, edit your boot image for the smsts.ini file to be in the Windows folder.
• TaskSequenceProvider.log— Provides information about task sequences when they are imported, exported, or edited. The log file is found at <ConfigMgrInstallPath>Logs.
• USMT Log loadstate.log— USMT Log loadstate.log provides information about the User State Migration Tool (USMT) regarding the restore of user state data. It is located at %windir%system32CCMLogs.
• USMT Log scanstate.log— Provides information about the USMT regarding the capture of user state data. It is located at %windir%system32CCMLogs.
Multicasting with OSD applies only to Configuration Manager 2007 R2. Unless otherwise noted, the following log files may be found at <ConfigMgrInstallPath>SMS_CCMLogs:
• McsMgr.log— Provides information about multicast availability and changes to multicast configuration. Located at <ConfigMgrInstallPath>Logs.
• McsSetup.log— Provides information about the multicast service point role setup. The log file is generated when the multicast service point site server has been created. It confirms the environment has been successfully set up and runs the .msi file. Located at <ConfigMgrInstallPath>Logs.
• McsMSI.log— Provides information about the .msi setup for the multicast service point. It is generated when the multicast service point site server has been created. Located at <ConfigMgrInstallPath>Logs.
• McsExec.log— McsExec.log provides information about multicast packages, namespace management, session creation, and health checking for multicast.
• McsISAPI.log— Provides information about the multicast service point Configuration Manager 2007 client request responses.
• McsPrv.log— This file provides information about the interaction between multicast components and the Windows Deployment Service (WDS) components, such as the creation, reading, and distribution of namespaces.
• McsPerf.log— MCSPerf.log provides information about the multicast performance counter updates.
The default location for client log files related to Network Access Protection (NAP) is %windir%CCMLogs. For those client computers that are also management points, the log files are found in %ProgramFiles%SMS_CCMLogs. The log files include the following:
• Ccmcca.log— Logs the processing of compliance evaluation based on Configuration Manager NAP policy processing, and contains the processing of remediation for each software update required for compliance.
• Ciagent.log— Tracks the process of remediation and compliance. (The software updates the log file Updateshandler.log, which provides more informative details on installing the software updates required for compliance.)
• Locationservices.log— Used by other Configuration Manager features (such as information about the client’s assigned site), but also contains information specific to NAP when the client is in remediation. This log records the names of the required remediation servers (management point, software update point, and distribution points that host content required for compliance), which are also sent in the client statement of health.
• Sdmagent.log— Shared with the Configuration Manager feature Desired Configuration Management (DCM), and contains the tracking process of remediation and compliance. (The software updates the log file Updateshandler.log, which provides more informative details about installing the software updates required for compliance.)
• SMSSha.log— The main log file for the ConfigMgr NAP client, this contains a merged statement of health information from the location services (LS) and configuration compliance agent (CCA) ConfigMgr components.
SMSSha.log also contains information about the interactions between the ConfigMgr System Health Agent and the operating system NAP agent, and also between the ConfigMgr System Health Agent and both the configuration compliance agent and the location services. It provides information about whether the NAP agent successfully initialized, the statement of health data, and the statement of health response.
System Health Validator (SHV) point log files are located in %systemdrive%SMSSHVSMS_SHVLogs. The SHV log files include the following:
• Ccmperf.log— Contains information about initializing the System Health Validator point performance counters.
• SmsSHV.log— The main log file for the System Health Validator point; logs basic operations of the System Health Validator service, including the initialization progress.
• SmsSHVADCacheClient.log— Contains information about retrieving ConfigMgr health state references from AD.
• SmsSHVCacheStore.log— Information about the cache store used to hold the ConfigMgr NAP health state references retrieved from AD, such as reading from the store and purging entries from the local cache store file. The cache store is not configurable.
• SmsSHVRegistrySettings.log— Records any dynamic changes to the SHV component configuration while the service is running.
• SmsSHVQuarValidator.log— Records client statement of health information and processing operations. To obtain full information, change the Registry key LogLevel from 1 to 0 at HKEY_LOCAL_MACHINESoftwareMicrosoftSMSSHVLogging@Global
• SMSSHVSetup.log— Records the success or failure (with failure reason) of installing the System Health Validator point. This log is located at <ConfigMgrInstallPath>Logs.
The following files are located with the ConfigMgr 2007 client computer log files (%windir%System32CCMLogs or %windir%SysWOW64CCMLogs). For those client computers that are also management points, the client log files are located in the %SystemDrive%SMS_CCMLogs folder.
• Ciagent.log— Provides information about downloading, storing, and accessing assigned configuration baselines.
• Dcmagent.log— Provides high-level information about the evaluation of assigned configuration baselines and desired configuration management processes.
• Discovery.log— Provides detailed information about the Service Modeling Language (SML) processes.
• EventLogForwarder.log— Used for writing events to the event log when DCM flags a configuration item (CI) as out of compliance. These events are potentially available for Operations Manager (OpsMgr) to generate an alert to flag a problem condition.
• MP_GetSdmPackage.log— Lists details about a management point’s retrieval of DCM-specific package information.
• Sdmagent.log— Provides information about downloading, storing, and accessing configuration item content.
• Sdmdiscagent.log— Provides high-level information about the evaluation process for the objects and settings configured in the referenced configuration items.
• SmsClrHost.log— Client log file that includes details about ConfigMgr’s use of the .NET Framework (required for DCM).
The site server log files related to Wake On LAN (WOL) are located in the folder <ConfigMgrInstallPath>Logs on the site server. There are no client-side log files for Wake On LAN.
• Wolmgr.log— Information about wake-up procedures, such as when to wake up advertisements or deployments that are configured for WOL
• WolCmgr.log— Contains information about which clients need to be sent wake-up packets, the number of wake-up packets sent, and the number of wake-up packets retried
Log files for software updates are maintained on both the site server and client. The next two sections discuss these files.
By default, these files are found in <InstallPath>Logs:
• Ciamgr.log— Provides information about the addition, deletion, and modification of software update configuration items.
• Distmgr.log— Replication of software update deployment packages.
• Objreplmgr.log— Provides information about the replication of software updates notification files from a parent site to its child sites.
• PatchDownloader.log— Provides information about the process for downloading software updates from the update source specified in the software updates metadata to the download destination on the site server. The location will vary:
• On 64-bit operating systems and 32-bit operating systems without the Configuration Manager 2007 client installed, PatchDownloader.log is created in the server logs folder.
• On 32-bit operating systems with the ConfigMgr 2007 client installed, PatchDownloader.log is created in the client logs folder.
• Replmgr.log— Provides information about the process for replicating files between sites.
• Smsdbmon.log— Provides information about when software update configuration items are inserted, updated, or deleted from the site server database, and creates notification files for software updates components.
• SUPSetup— Provides information about the software update point installation. When the software update point installation completes, “Installation was successful” is written to this log file.
• WCM.log— Information about the software update point configuration and connecting to the Windows Server Update Services (WSUS) server for subscribed update categories, classifications, and languages.
• WSUSCtrl.log— Provides information about the configuration, database connectivity, and health of the WSUS server for the site.
• Wsyncmgr.log— Information about the software updates synchronization process.
The following files are located with the ConfigMgr 2007 client computer log files (%windir%System32CCMLogs or %windir%SysWOW64CCMLogs). For those client computers that are also management points, the client log files are located in the %SystemDrive%SMS_CCMLogs folder.
• CAS.log— Provides information about the process of downloading software updates to the local cache and cache management.
• Ciagent.log— Provides information about processing configuration items, including software updates.
• LocationServices.log— Provides information about the location of the WSUS server when a scan is initiated on the client.
• PatchDownloader.log— Provides information about the process for downloading software updates from the update source to the download destination on the site server.
This log is only on the client computer configured as the synchronization host for the Inventory Tool for Microsoft Updates.
• PolicyAgent.log— Provides information about the process for downloading, compiling, and deleting policies on client computers.
• PolicyEvaluator— Provides information about the process for evaluating policies on client computers, including policies from software updates.
• RebootCoordinator.log— Information about the process for coordinating system restarts on client computers after software update installations.
• ScanAgent.log— Provides information about the scan requests for software updates, what tool is requested for the scan, the WSUS location, and so on.
• ScanWrapper.log— Provides information about the prerequisite checks and the scan process initialization for the Inventory Tool for Microsoft Updates on SMS 2003 clients.
• SdmAgent.log— Provides information about the process for verifying and decompressing packages containing configuration item information for software updates.
• ServiceWindowManager.log— Provides information about the process for evaluating configured maintenance windows.
• SmscliUI.log— Information about the Configuration Manager Control Panel user interactions. This includes initiating a Software Updates Scan Cycle from the Configuration Manager Properties dialog box, opening the Program Download Monitor, and so on.
• SmsWusHandler— Provides information about the scan process for the Inventory Tool for Microsoft Updates on SMS 2003 client computers.
• StateMessage.log— Provides information about when Software Updates state messages are created and sent to the management point.
• UpdatesDeployment.log— Provides information about the deployment on the client. Deployment information includes software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface.
• UpdatesHandler.log— Provides information about software update compliance scanning and about the download and installation of software updates on the client.
• UpdatesStore.log— Provides information regarding the compliance status for the software updates that were assessed during the compliance scan cycle.
• WUAHandler.log— Information about when the Windows Update Agent on the client searches for software updates.
• WUSSyncXML.log— Provides information about the Inventory Tool for the Microsoft Updates synchronization process.
This log is only on the client computer configured as the synchronization host for the Inventory Tool for Microsoft Updates.
You will find the following WSUS log files running on the software update point site system role in %ProgramFiles%Update ServicesLogFiles:
• Change.log— Captures data about the WSUS server database information that has changed
• SoftwareDistribution.log— Provides information about the software updates that are synchronized from the configured update source to the WSUS server database
The Windows Update Agent log file is found on the ConfigMgr client computer in %windir%. This file, WindowsUpdate.log, provides information about when the Windows Update Agent connects to the WSUS server and retrieves the software updates for compliance assessment, and whether there are updates to the agent components.
Out of Band (OOB) Management applies only to systems running ConfigMgr 2007 Service Pack (SP) 1 and above. The log files are found in the following locations:
• On the OOB service point site system server
• On any computer running the OOB Management console from the Configuration Manager console
• On client computers running the Configuration Manager 2007 SP 1 client that are managed out of band
The following logs are located at <ConfigMgrInstallPath>Logs on the site system server selected to host the OOB service point role:
• AMTSPSetup.log— Shows the success or failure (with failure reason) of installing the OOB service point.
• Amtopmgr.log— Shows the activities of the OOB service point relating to the discovery of management controllers, provisioning, and power control commands.
• Amtproxymgr.log— Shows the activities of the site server relating to provisioning, which include the following:
• Publishing provisioned computers to Active Directory Domain Services
• Registering the service principal name of provisioned computers in Active Directory Domain Services
• Requesting the web server certificate from the issuing Certificate Authority (CA)
It also shows the activities of sending instruction files to the OOB service point, which include the following:
• Discovery of management controllers
• Provisioning
• Power control commands
Finally, it shows the activities related to OOB Management site replication.
Oobconsole.log shows the activities related to running the OOB Management console. It is located at <ConfigMgrInstallPath>AdminUIAdminUILog on any computer running the OOB Management console from the ConfigMgr console.
Oobmgmt.log shows OOB Management activities performed on workstation computers, including the provisioning state of the management controller. It is found at %windir%System32CCMLogs on workstation computers running the ConfigMgr 2007 SP 1 client that are managed out of band.