Agent files

The two files that can help you troubleshoot issues during the agent installation, asset enrollment, and the operational phase of a managed asset are <instance>.lgm and mtoken*.log. The <instance>.lgm is available on the asset as soon as you start the installation. mtoken*.log files are created only after a successful installation. To optimize log collection on the assets using the Logcollect utility, you can also add two additional files to the asset - loglevel.conf and logcollect.conf.

<instance>.lgm

This file lists the details of the Xshield instance from which the agent was installed on the asset. Note that <instance> is the actual name of the instance. For example, for an instance named customer-demo, the file is customer-demo.lgm.

The following details are listed for agent version 8.6.6.1 and older:

• Notaries – the FQDN of the instance from which the agent was downloaded (Server name or Address on the UI).

• TenantName – the name of the instance from which the agent was downloaded (Tenant name on the UI).

• authKey – the installer key of the instance from which the agent was downloaded (Installer Key on the UI).

The following additional detail is listed for agent version 8.7.0.81:

• productKey – the product key of the instance from which the agent was downloaded (Product Key on the UI).

The <instance>.lgm file is stored at the following locations.

mtoken*.log

These files log all the operational activities of the agent from the time the agent is installed on the asset. Multiple mtoken.log files are created, one for every 10 MB of log messages; the ‘*’ corresponds to the naming convention used to name the files. The files are named in the mtoken <_><YYYY-MM-DD>_<HH-MM-SS>.log format. For example, mtoken_2021-04-23_11-45-49.log.

The mtoken*.log files are stored at the following locations on the assets.

mtoken*.log files before enrollment

The first mtoken*.log file is created only after the agent is successfully installed on the asset. If you want to identify the reasons for a failed installation from the mtoken*.log file, you must do the following:

On Windows assets

1. Use the native tools on the asset to clean files and folders from the failed installation. For example, the Windows Installer CleanUp Utility.

2. Initiate the installation with the following command: “msiexec /i " <FQDN of the instance>\colortokens-lgm_<agent version>_user_win64.msi" /L*V c:\windows\temp\ msilog.log”. For example, This creates a temporary log file msilog.log, and this file contains the events that block the installation.

On Linux and macOS assets

Check the Syslog log files to see logs for information about failed installations on Linux and macOS assets.

loglevel.conf

Without the loglevel.conf file, the loglevel is set to INFO. To change the loglevel, add the loglevel.conf file and add the loglevel definition. For example, set loglevel=DEBUG for troubleshooting purposes. You can set the loglevel to one of the following levels - INFO, ERROR, WARN, or DEBUG.

logcollect.conf

Add the logcollect.conf file to enable the Logcollect utility to collect native system logs and event logs. After adding the logcollect.conf file, add COLLECT_SYSLOG=Yes to the file.

You can add the loglevel.conf and logcollect.conf files in the assets in the following locations.