> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Syteca Logs

> Download and configure Application Server, Management Tool, and Client log files for troubleshooting or for the Syteca Support team.

When contacting the Syteca Support team about an issue, attach the relevant log files to your email if possible. This page covers how to collect logs for the Application Server, the Management Tool, and Clients, and how to change each component's log level.

<Tip>
  Log Collector tools can generate the required files automatically, without navigating the Management Tool or the file system directly:

  * **Application Server:** `https://syteca.com/log-collectors/SytecaServer_LogsCollector.exe`
  * **Clients:** `https://syteca.com/log-collectors/SytecaClient_LogsCollector.exe`

  Running a tool generates the log files on the desktop of the corresponding endpoint computer.
</Tip>

## Application Server logs

<Warning>
  **NOT AVAILABLE IN SAAS.**
</Warning>

<Steps>
  <Step title="Open System Health">
    Open the [System Health](/docs/administration/dashboards/system-health-dashboards) page and select the **System State** tab.
  </Step>

  <Step title="Download the logs">
    Choose **Download Log Files (MT and Server)** from the drop-down list.
  </Step>
</Steps>

<Frame caption="Downloading Application Server and Management Tool log files from the System Health page.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/resources/troubleshooting/logs-download-server-logs.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=b4e46e28d2398032a73162b4118e7f41" alt="System Health System State tab with Download Log Files option" width="1894" height="550" data-path="images/resources/troubleshooting/logs-download-server-logs.png" />
</Frame>

Alternatively, find the log files directly on the Application Server computer at `C:\Program Files\Ekran System\Ekran System\ServerLogs`.

### Application Server log levels

| Level              | Value | Records                                                  |
| ------------------ | ----- | -------------------------------------------------------- |
| **Error**          | 1     | Critical (fatal) and non-critical error events only.     |
| **Warning**        | 2     | Warning events plus critical error events.               |
| **Info** (default) | 3     | All events: warnings, critical, and non-critical errors. |
| **Debug**          | 4     | All Application Server transactions.                     |

<Tabs>
  <Tab title="Change level in the Management Tool">
    <Steps>
      <Step title="Open Configuration">
        Click **Configuration** at the top of the Management Tool, then select the **System Settings** tab.
      </Step>

      <Step title="Set the Server Log Level">
        Scroll to the **Server Log Settings** section at the bottom, select the required level, and click **Save**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Change level locally">
    <Steps>
      <Step title="Open the settings file">
        On the Application Server computer, open `EkranServer.Settings.config` (located in `C:\Program Files\Ekran System\Ekran System\Server`) as an administrator.
      </Step>

      <Step title="Set the log level key">
        ```xml theme={"system"}
        <add key="TraceLogLevel" value="3" />
        ```
      </Step>

      <Step title="Restart the service">
        Restart the **EkranServer** service.
      </Step>
    </Steps>
  </Tab>
</Tabs>

<Tip>
  After investigating an issue, change the level back to **Info** — leaving Debug enabled generates significantly more log data than needed for normal operation.
</Tip>

## Management Tool logs

<Warning>
  **NOT AVAILABLE IN SAAS.**
</Warning>

Download Management Tool logs the same way as Application Server logs: open [System Health](/docs/administration/dashboards/system-health-dashboards) → **System State** tab → **Download Log Files (MT and Server)**.

If the Management Tool isn't accessible, find the log files directly on the computer where the Management Tool is installed, at `C:\Users\SYTECAManagementTool\AppData\Local`.

## Client logs

<Steps>
  <Step title="Open the Clients page">
    Select the checkboxes next to the Clients whose logs you need.
  </Step>

  <Step title="Download the logs">
    Click **Bulk Action**, then select **Download Logs**.
  </Step>
</Steps>

<Note>
  Logs can only be downloaded through the Management Tool for Clients that are currently online. For offline Clients, collect logs locally on the Client computer using the steps below.
</Note>

### Collect logs locally, by OS

<Tabs>
  <Tab title="Windows">
    Windows Client logs consist of two parts:

    * **Client logs**, stored at `C:\Program Files\Ekran System\Ekran System\ClientLogs`.
    * **Syteca Connection Manager logs** (when Connection Manager is used), stored at `C:\Users\<user>\AppData\Local\Syteca`.
  </Tab>

  <Tab title="Linux">
    <Steps>
      <Step title="Open the Client folder">
        ```bash theme={"system"}
        cd /opt/.Ekran
        ```
      </Step>

      <Step title="Run the log collection tool">
        ```bash theme={"system"}
        sudo ./getenv.sh
        ```

        This creates an archive containing the logs in the same folder.
      </Step>
    </Steps>

    Two additional log files exist outside this archive, at `/var/.ekran/logs/`:

    | File                | Contains                                                                                                                                                                                                                    |
    | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | `LoginsLogouts.log` | Every remote SSH login/logout to or from the Client machine, whether the session was recorded, and the session type (ssh/sftp/scp). Only populated when additional data-collection software (e.g. a SIEM system) is in use. |
    | `rescue.log`        | Timestamps, hostname, username, recorder PID, and reason for each time the Client entered or exited [Rescue mode](/docs/administration/clients/linux#yellow-status-icon-rescue-mode).                                            |

    <Note>
      `LoginsLogouts.log` never records session content or user passwords — only login/logout metadata. `scp` and `sftp` sessions aren't recorded by the Client and are logged as "will not be recorded."
    </Note>
  </Tab>

  <Tab title="macOS">
    <Steps>
      <Step title="Open the Client folder">
        ```bash theme={"system"}
        open /Library/Application\ Support/Ekran
        ```
      </Step>

      <Step title="Run the log collection tool">
        Run `pack_agent_data.sh` to create an archive containing the logs on the desktop.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Client log levels

| Level              | Value | Records                                                  |
| ------------------ | ----- | -------------------------------------------------------- |
| **Error**          | 1     | Critical (fatal) and non-critical error events only.     |
| **Warning**        | 2     | Warning events plus critical error events.               |
| **Info** (default) | 3     | All events: warnings, critical, and non-critical errors. |
| **Debug**          | 4     | All Client transactions.                                 |

<Tabs>
  <Tab title="Change level in the Management Tool">
    On the **Clients** page, click the Client's name, select the **Properties** tab on the **Editing Client** page, and scroll to the **Diagnostics** section at the bottom.
  </Tab>

  <Tab title="Change level locally — Windows">
    <Steps>
      <Step title="Set the registry value">
        In Registry Editor, go to `HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem\Client` and add a **DWORD (32-bit)** value named `TraceLogLevel` with data `3`.
      </Step>

      <Step title="Restart the Client">
        Restart the **EkranClient** service.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Change level locally — Linux">
    <Steps>
      <Step title="Open the settings file">
        ```bash theme={"system"}
        cd /etc/.ekran
        ```

        Open `settings.xml` as `root` in a text editor (for example `nano`).
      </Step>

      <Step title="Set the log level">
        Change the `AgentLogLevel` value, then save.
      </Step>

      <Step title="Restart the Client computer">
        Restart the Linux Client machine to apply the change.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Change level locally — macOS">
    <Steps>
      <Step title="Edit the settings file">
        ```bash theme={"system"}
        sudo nano /opt/.Ekran/settings.xml
        ```

        Change the `AgentLogLevel` value, then save.
      </Step>

      <Step title="Restart the Client process">
        Restart the `sytecad` process.
      </Step>
    </Steps>

    <Note>
      If there's no connection to the Application Server, a locally changed log level takes effect immediately. Once connectivity is restored, the level reverts to whatever is configured in the Management Tool.
    </Note>
  </Tab>
</Tabs>

### Syteca Connection Manager logs

Found at `C:\Users\<user>\AppData\Local\Syteca`.

## Monitoring logs (Windows and macOS Clients)

Monitoring logs are text files written on the Client computer, separate from the [Client diagnostic logs](#client-logs) covered above.

<Steps>
  <Step title="Open the Monitoring tab">
    On the **Editing Client** / **Editing Client Group** page, select the **Monitoring \[Windows/macOS]** tab.
  </Step>

  <Step title="Enable monitoring logs">
    In the **Log Files** section, select **Enable creating log files of monitored events**.
  </Step>

  <Step title="Set a custom location (optional)">
    Enter a path in the log location field. Environment variables like `%appdata%` and `%temp%` are supported.
  </Step>
</Steps>

Two files are created:

| File                  | Contains                                                                                                  |
| --------------------- | --------------------------------------------------------------------------------------------------------- |
| `Client_<yyyy_mm_dd>` | Monitored activity: timestamp, session ID, Client host name, user name, activity title, application name. |
| `Login_<yyyy_mm_dd>`  | Every login to the Client computer: timestamp, host name, user name.                                      |

<Note>
  If the configured location isn't accessible or is write-protected, logs save instead to `<systemdisk>\ProgramData\Ekran System\MonLogs`. Changing the location later doesn't move existing log files — they stay where they were, and new files start in the new location.
</Note>

### Example configurations

| Intent              | `.ini` parameters                                   | Management Tool equivalent                                    |
| ------------------- | --------------------------------------------------- | ------------------------------------------------------------- |
| No monitoring logs  | `MonLogging=0`<br />`LogPath=`                      | Deselect **Enable creating log files of monitored events**.   |
| Default location    | `MonLogging=1`<br />`LogPath=`                      | Select the checkbox, leave the location field empty.          |
| Custom folder       | `MonLogging=1`<br />`LogPath=C:\1\Logs`             | Select the checkbox, set location to `C:\1\Logs`.             |
| User profile folder | `MonLogging=1`<br />`LogPath=%AppData%\EKRAN\_Logs` | Select the checkbox, set location to `%AppData%\EKRAN\_Logs`. |

## Related

<CardGroup cols={2}>
  <Card title="System Health dashboards" icon="activity" href="/docs/administration/dashboards/system-health-dashboards">
    Where log downloads and system state live in the Management Tool.
  </Card>

  <Card title="Disconnected Clients" icon="wifi-off" href="/docs/administration/clients/parameters/disconnected-client-detection">
    Diagnosing Clients that have gone offline.
  </Card>

  <Card title="Windows Clients" icon="windows" href="/docs/administration/clients/windows">
    Windows Client installation and configuration.
  </Card>

  <Card title="Linux Clients" icon="terminal" href="/docs/administration/clients/linux">
    Linux Client installation and configuration.
  </Card>
</CardGroup>