About the information in the System reports and logs

Article:HOWTO27546  |  Created: 2010-01-09  |  Updated: 2010-01-20  |  Article URL http://www.symantec.com/docs/HOWTO27546
Article Type
How To

Product(s)

Environment


About the information in the System reports and logs

The System reports and logs contain information that is useful for troubleshooting client problems.

Table: System reports and log summary describes some typical uses for the kind of information that you can get from System quick reports and log.

Table: System reports and log summary

Report or log

Typical uses

Top Clients That Generate Errors report

Use this report to see which clients generate the largest number of errors and warnings. You may want to look at the location and type of users on these clients to see why they experience more problems than others. You can then go to the System log for details.

Top Servers That Generate Errors report

Use this report to see which servers generate the largest number of errors and warnings. You may want to look at these servers to see why they experience more problems than is typical for your network.

Top Enforcers That Generate Errors report

Use this report to see which Enforcers generate the largest number of errors and warnings. You may want to look at these Enforcers to see why they experience more problems than is typical for your network.

Database Replication Failures Over Time report

Use this report to see which servers or sites experience the most problems with database replication. It also tells you why the replications fail so that you can remediate the problems.

Site Status report

Use this report to see how your server handles its client load. Based on the information that is in this report, you may want to adjust the load.

This report displays the current status and throughput of all servers in your local site. It also shows information about client installation, client online status, and client log volume for your local site. The data this report draws from is updated every ten seconds, but you need to rerun the report to see updated data.

Note:
If you have multiple sites, this report shows the total installed and online clients for your local site, not all your sites.

If you have site or domain restrictions as an administrator, you only see the information that you are allowed to see.

The health status of a server is classified as follows:

  • Good: The server is up and works normally

  • Poor: The server is low on memory or disk space, or has a large number of client request failures.

  • Critical: The server is down

For each server, this report contains the status, health status and reason, CPU and memory usage, and free disk space. It also contains server throughput information, such as policies downloaded, and site throughput sampled from the last heartbeat.

It includes the following site throughput information:

  • Total clients installed and online

  • Policies downloaded per second

  • Intrusion Prevention signatures downloaded per second

  • Learned applications per second

  • Enforcer system logs, traffic logs, and packet logs per second

  • Client information updates per second

  • Client security logs, system logs, traffic logs, and packet logs received per second

  • Application and device control logs received per second

Online has the following meanings in this report:

  • For the clients that are in push mode, online means that the clients are currently connected to the server.

  • For the clients that are in pull mode, online means that the clients have contacted the server within the last two client heartbeats.

  • For the clients in remote sites, online means that the clients were online at the time of the last replication.

Administrative log

Use this log to look at administrative-related items like the following activities:

  • Logons and logoffs

  • Policy changes

  • Password changes

  • When certificates are matched

  • Replication events

  • Log-related events

This log may be useful for troubleshooting client problems such as missing certificates, policies, or imports. You can look separately at events as they relate to domains, groups, users, computers, imports, packages, replications, and other events.

Client-Server Activity log

Use this log to look at all the client activity that takes place for a specific server.

For example, you can use this log to look at the following items:

  • Successful and unsuccessful policy downloads

  • Client connections to the server

  • Server registrations

Server Activity log

Among other things, use this log for the following reasons:

  • To locate and troubleshoot replication problems

  • To locate and troubleshoot backup problems

  • To locate and troubleshoot Radius Server problems

  • To look at all server events of a particular severity level

Client Activity log

Among other things, you can use this log to monitor the following client-related activities:

  • Which clients have been blocked from accessing the network

  • Which clients need to be restarted

  • Which clients had successful or unsuccessful installations

  • Which clients had service initiation and termination problems

  • Which clients had rules import problems

  • Which clients had problems downloading policies

  • Which clients had failed connections to the server

  • The status of the client as a group update provider (GUP)

Enforcer Activity log

Use this log to monitor problems with the Enforcers. In this log, you can view management events, Enforcer events, enable events, and policy events. You can filter them by their severity level.

For example, you can use this log to troubleshoot the following types of problems:

  • Enforcer connectivity

  • The importation and application of policies and configurations

  • Enforcer starts, stops, and pauses


Note:
If you do not have Symantec Network Access Control installed, the Enforcer Activity log and the entries in other logs that apply to Enforcers are empty.

About the reports you can run


Legacy ID



349966


Article URL http://www.symantec.com/docs/HOWTO27546


Terms of use for this information are found in Legal Notices