These include:

• Configuration issues
• Archive or backup problem
• Troubleshoot report generation
• Fault in Alerting
• HA cluster issues
• WEB UI related errors

Search for issues in local logs

SSB generates various log messages during its operation and stores them in the local logspace.

When you encounter an issue, you can check local logspace for specific logs or errors, which can help you to find the root cause.

Navigate to Search --> Logspaces --> Select local logspace --> add a search expression

Search expressions can be combined with OR, AND, NOT operators. eg. 'program:ssb/traptoemail OR program:ssb/traptosnmp' 

Troubleshooting on the fly

SSB provides an interface to view the system logs on the fly.

Similarly to the search interface you can filter the logs with a search pattern. Note that 'program:' prefix is not needed, as shown in the screenshot.

Navigate to Basic Settings --> Troubleshooting --> View log files --> optionally add a search pattern

A new window will open with continuously updated new logs.

This way, in the main window you can reproduce your issue while checking the system logs.

Debug logging

Warning!

Turning on debug logging produces a few times more system logs than standard logging.

This may affect performance and lead to message loss.

If your system's CPU and/or memory usage is above 90% do not debug logging.

Debug logs provide the most detailed information about what the appliance is doing.

If standard logs have not provided enough information turning on debug logging may be considered.

Note: Be aware that syslog-ng will not produce debug logs by default. (See next section.)

Navigate to Basic Settings --> Management --> Debug logging --> Enable debug logs

Increasing log verbosity of Syslog-ng

Warning!

Increasing log verbosity produces many times more system logs than standard logging.

This may affect performance and lead to message loss.

If your system's CPU and/or memory usage is above 70% do not increase log verbosity of syslog-ng.

Increasing log verbosity may help identify the root cause of message processing related issues.

Please refer to 'verbose' and 'debug' logging section from the following knowledge base article.

https://support.oneidentity.com/syslog-ng-premium-edition/kb/261897/troubleshooting-syslog-ng