Agent Error Logging

Errors and important events that occur on the agent are logged in the agent as special Error Log Reports.

It’s possible to view these reports on the agent using the web and telnet interfaces, but it’s also possible to let the agent send the reports to the PerformanceGuard server, that stores them in the database.

Error reports sent to the server may be viewed centrally using the web interface.

Error Types and Severities

Events are classified according to the situation in which they occurred:

Internal Name	Numerical Value	Description
DEFAULT	1000	The event occurred in an unspecified state
CONFIG	1001	The event occurred
TYPE_RUNTIME	1002	The event occurred during the agents normal operation
TYPE_WINPCAP	1003	The event occurred when the agent interacted with the WinPCap driver
TYPE_BTM	1004	The event occurred when the agent interacted with an BTMv2 component or inside an BTMv2 component
TYPE_CITRIXAGENT	1006	The event occurred when the agent interacted the CitrixHelper.exe or inside CitrixHelper.exe

Events generated by the agent have one of the following severities:

Internal Name	Numerical Value	Description
SEVERITY_INFO	0	An event that’s part of the agent’s normal operation has occurred
SEVERITY_USER	11	Some user-supplied data, for example part of the configuration caused a problem
SEVERITY_MINOR	128	A minor problem was encountered, but the overall operation of the agent is unaffected
SEVERITY_SEVERE	129	A problem occurred that means that some part of the agent’s normal operation is affected
SEVERITY_BLOCKING	130	A problem occurred that causes a major or all parts of the agent to malfunction

Configuration

The agent will always collect all error reports locally. By default, all error reports that have a severity of User (11) or higher are also sent to the PerformanceGuard backend and stored in the database.
In the Error Handling section of the agent configuration, the minimum severity can be configured to a different value.
It’s also possible to configure whether error details should be sent from agents to the PerformanceGuard server or not. By default, error details are not sent.
If you configure agents to send all error reports, you’ll put a stress on the system, with respect to bandwidth and database, as the agent generates a significant amount of informational error logs, for example during configuration.

View Errors

View Locally on the Agent

Errors may be viewed using the agent Telnet interface and the web interface.
By default, the agent will keep generated error log reports for three reconfigurations. This means that when the agent is reconfigured for the third time, the error log reports that were generated for the agent’s initial configuration will be deleted. The number of reconfigurations that error reports should be kept from is controlled by the agent registry configuration value : “ErrorConfigKeepPeriods”.
The Telnet interface allows you to simply list all error log entries sorted by time stamp, the web interface offers a more advanced view where it’s possible to filter on the Location, the Name and the severity of events.

View Centrally in the PerformanceGuard Web Interface

You can view agent error log reports in the PerformanceGuard web interface: Select ADMINISTRATION > Status > Errors.

Event Processor Debug Messages

If the “LogErrorsToFile” registry value is specified for the agent, special event processor log entries will be created in the log file.
An example of these messages and their meaning:
Consider an agent with the following login configuration:

LoginStartCondition=<SESSION; logon>
LoginEndCondition=<PROCESS; GUARDagent; started> and <PROCESS; explorer; started> and <CPU; explorer; below; 10>

Two event processors will be instantiated:

LoginStartEvaluator

Value : Expr1
Expr1 : <SESSION; logon>

and LoginEndEvaluator

Value : And( Expr2, And( Expr3, Expr4 ) )
Expr2 : <PROCESS; GUARDagent; started>
Expr3 : <PROCESS; explorer; started>
Expr4 : <CPU; explorer; below; 10>

For each expression the event processors will calculate a list of <value; time> pairs that record the value of the expression for specific points in time.

Error Log File Entries

In the error log file you can follow how the value of the expressions evolve over time.
The LoginStartEvaluator logs its state like this:

Mon Jun 21 15:22:20 2010|Config|Info|E2EDynamicMachine|LoginStartEvaluator|State='<SESSION;logon> Values: 0ms:unknown, 12921600507781ms:true'|

The state of an evaluator is expressed as a number of lines, one for each sub-expression, each ending with a list of <value; time> pairs, indicating the value of the sub-expression at different points in time.

The expression is read like: the value of Expr1, that is at t=0 the value is unknown, at t = 12921600507781 ms the value changes to true.

This means that the Login Start Condition is true from the time 12921600507781 ms

In this example, the LoginEndEvaluator is slightly more complicated, and the state logged is:

This is easiest read from the bottom and up. The value of Expr4 is unknown, which results in the last AND being unknown (from 1292160050896 ms), which in turns renders the entire result unknown.

Five seconds later in the log file, the following entry is found:

Here, Expr4 turns true at 12921600531046ms, as Expr2 and Expr3 have turned true earlier, the result of the entire expression is that the login end condition is true at 12921600531046ms.

From the examples, the login time can be calculated as : 12921600531046ms - 12921600507781 ms = 23265 ms = 23.265 s

Agent Log Errors To File

The agent can create a detailed log file. This is not enabled by default.

Edit the agent registry, add at path to log folder.

By default the PerformanceGuard agent uses registry values under the key:
HKEY_LOCAL_MACHINE\SOFTWARE\PremiTech\E2EAgent


Name:	LogErrorsToFile/DontLogErrorsToFile
Type:	Name of folder
Default value:
Description:	If the LogErrorsToFile key is set in the registry, the agent will try to create a log file and log errors in the file. This can be useful for examining the behavior of the agent e.g. during boot and shutdown of the instrumented computer. If a value is specified for the key it will be considered as the name of a folder, the agent will try to create the log files in the named folder first, then it will try the C:\Users\AppData\LocalLow\ folder, and finally the folder where the agent executable is located. Log files are named GuardAgent—.log Some special debugging type messages are only visible in the log file, that is they will never be visible in neither the error display on the agent web service nor transmitted to the PerformanceGuard frontend server. Among these are debugging messages for event processing. Consult CapaSystems technical staff before you use/change this setting.