How to enable debug level logs on the SMA 1000 series appliance?

07/14/2021 28 People found this article helpful 44,165 Views

Description

This article explains how to raise the log level to debug and which is the corresponding log file to be checked/sent to Sonicwall support.

Resolution

Login to AMC console. Navigate to Logging | Configure Logging tab. The log level by default will be at the “Info” level.
In order to increase the log level go to the “Logging” page of Appliance Management Console (AMC) and select the “Configure Logging” tab. In the address bar, append the string “?troubleshoot=1” as shown in the below and apply the pending changes.
Result of this will show the increased log levels. The log level of each services can be set according to the requirement.
The Highest logging level you can set for each service is as shown below:

NOTE: Enabling Debug level logging (even High or Protocol level) for services like Policyserver, Network Tunnel and Workplace wouldn't affect the user session with the appliance. However it might impact the backend resource connection established by the user (ex. File share transfer, telnet sessions, etc). Hence we recommend the debug level logging change in a change window without affecting existing users connected to the appliance.
Plaintext logging: This can be enabled to gather logs for translation issues and SSO issues. Corresponding log in the appliance is Extraweb_plaintext.log
Flush log: Enabling this will empty the real-time logs. This option can be used to collect fresh logs.

To disable the extra logging click on the "Restore Defaults" button and save it and apply pending changes. The logs can be retrieved from the appliance using SSH tools like WinSCP. Logs are present under the path /var/log/aventail and logs also downloaded from AMC-Troubleshooting-Snapshot.

NOTE: Increasing the log level to higher levels will generate more detailed logs which will occupy Hard Disk space. This could affect the performance of the appliance after over a period of time and also depends on the amount of activity and number of users logging in. It is recommended to perform this only when required to troubleshoot the reported issue.