> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Logs and troubleshooting

> Access endpoint, server, and portal logs to investigate issues, analyze system behavior, and troubleshoot ESPM-related problems.

## Overview

Logs are one of the most valuable sources of information when troubleshooting issues within ESPM. They provide visibility into system operations, probe execution, risk factor evaluation, communication between components, and unexpected errors.

When investigating problems such as missing risk factors, unexpected health scores, policy assignment issues, synchronization problems, or event-based risks, logs can help identify the root cause and provide the technical details needed for remediation.

Depending on the nature of the issue, you may need to review logs from the endpoint, the ESPM Server Module, or the ESPM Portal.

## Types of Logs

### Endpoint Logs

Endpoint logs contain information collected from the endpoint agent, including:

* Probe execution details
* Risk factor evaluation results
* Detected events
* Policy synchronization activities
* Communication with the server
* Endpoint-side errors and warnings

The logging level for endpoint logs is configurable through [Endpoint Configuration](/docs/administration/clients/windows-client-configuration) .

For troubleshooting purposes, the **Debug** logging level provides the most detailed information, including:

* Probe behavior
* Risk factor processing
* Event detection details
* Communication diagnostics

Endpoint logs are downloaded together with the endpoint's standard client logs.

### Server Module Logs

Server Module logs contain information related to policy processing and health score calculations, endpoint synchronization, data processing operations, internal server events and errors, and more.

These logs are typically used when investigating issues that affect multiple endpoints or system-wide functionality.

### Portal Logs

Portal logs contain information related to user interface operations, portal services, errors and warnings, and more.

These logs are useful when troubleshooting issues related to the ESPM Portal itself.

## Downloading Server Module and Portal Logs

<Note>
  Downloading logs requires the [Tenant Management and System Configuration administrative permission](/docs/administration/users/administrative-permissions).
</Note>

1. In the **ESPM Portal**, navigate to **Configuration**.
2. In the **Logs** section, click **Download Logs**.
3. A ZIP archive containing the available logs is generated and downloaded using the standard browser download mechanism.

## Using Logs for Troubleshooting

Logs can help troubleshoot issues such as:

* Missing or unexpected risk factors
* Incorrect health score calculations
* Policy assignment problems
* Endpoint synchronization issues
* Missing telemetry
* Probe execution failures
* Event-based risk investigations
* Portal display issues
* Server processing errors

When investigating a problem:

1. Identify which ESPM component is involved.
2. Collect the relevant logs.
3. Review warnings, errors, and related events.
4. Correlate timestamps between endpoint, server, and portal logs.
5. Verify whether the issue originates from:
   * Endpoint data collection
   * Server-side processing
   * Portal presentation

## Key Considerations

* Debug logging should be enabled only when additional diagnostic information is required, as it may generate significantly larger log files.
* For event-based risk factors, endpoint logs often provide the most detailed information about the events that triggered the risk.
* When troubleshooting communication issues, reviewing both endpoint and server logs is recommended.
* When troubleshooting user interface problems, portal logs often contain the most relevant information.
* Collect logs as soon as possible after an issue occurs to ensure the required diagnostic information is available.