question on logs file in UEM

[Skmr]

Hi all,

I am seeing 3 log files in one of the user profile like logs, logs1 and logs2

Among 3 log files, I can't able to open logs file and when I am trying open it I am seeing below message.

I asked user to log-off he did but still I am not able to open "logs" file but I can open other two file like logs1/logs2

Why I am seeing 3 log files for some users?

and also why I can not able to open "logs" file even user logged off from machine?

Thank you.

[Sravan_k]

Hi pkmr,

I am not sure why it is creating different logs files.. I am requesting some experts to help you on it UEMdev​ and ijdemes​

I have one more question, how many backup your are taking for your user profiles? [you can find this setting in GPO for UEM]

Thank you.

[Skmr]

I am taking 4 back-up's of user profiles.

is it related to my issue?

currently I am facing two issues randomly

1. profiles are not loading properly like, files/folder of documents, desktop and short-cut's on taskbar

2. I can not open log files as shown above.

regards.

[sjesse]

How long are you waiting till after they log off. They could be disconnected but UEM could be exporting there profile still. I usually copy the file when its locked like this to a different location to get around the lock to see whats going on.

[sjesse]

UEM will create a new log when one is locked, it actually says this in the new log towards the top, I've seen this when I've done some testing.

[alsmk2]

Are you trying to open the log file immediately after a user has logged off? I see this quite often and it usually because although the user thinks they have logged off, UEM is still exporting/ processing the logoff in the background, so keeps a file lock.

In my experience, the other log files are created when that user then tries to log on again before the previous export has fully completed..

If the locks are lasting for a good while, I'd be looking at the particular users profile to see if any parts of it are large - I'd usually look into any zip file above 20mb as a potential issue (that may seem small, but I've seen 20mb zip files with tens of thousands of files in them which brings both logons and logoffs down to a crawl). As a good measure, unzip the file yourself - however long it takes to unzip seems to translate roughly into how much extra logon / logoff time that particular file will add (after all, UEM has to unzip / rezip the same way).

[Skmr]

thanks for response, I am waiting for at least 4 to 5 min.

[Skmr]

Hi Alsmk,

your comment make sense, will do manual test [unzip/rezip] on long profiles

thanks for your response!

Pkmr. 

[DEMdev]

Hi Skmr,

If the configured log file cannot be written to, FlexEngine (the UEM agent) will try appending -1, -2, -3, ..., until it finds an "available" file name.

If you get the "... it is being used by another process" error message when trying to open the log file, it does indeed mean that some process (maybe the UEM agent, maybe something else?) has a lock on the file.

Could it be the case that some users are logged on to multiple systems at the same time? That wouldn't necessarily result in having multiple log files like this, but let's try to figure out what's going on.

BTW, the fact that your log files are called logs, logs1, etc, indicates a minor configuration issue: the Path and name of log file setting of the Flexengine logging policy setting should be just that – the path and the file name of the log file. I assume you have it configured as something like \\server\share\%username%\logs, where it should be something like \\server\share\%username%\logs\FlexEngine.log.

Note that this is unrelated to the symptoms you're seeing; just wanted to point it out.

[Skmr]

Thanks for your response!

Could it be the case that some users are logged on to multiple systems at the same time? That wouldn't necessarily result in having multiple log files like this, but let's try to figure out what's going on.

Yes, this user has two pools

BTW, the fact that your log files are called logs, logs1, etc, indicates a minor configuration issue: the Path and name of log file setting of the Flexengine logging policy setting should be just that – the path and the file name of the log file. I assume you have it configured as something like \\server\share\%username%\logs, where it should be something like \\server\share\%username%\logs\FlexEngine.log.

Note that this is unrelated to the symptoms you're seeing; just wanted to point it out.

I think you are right, we may configured like this "\\server\share\%username%\logs"

[DEMdev]

The fact that the user has two pools provides a bit of explanation why the log file might be in use, but that should never really be the case for long.

Can you share some log files (the "normal" one, and also the 1 and 2 (and 3...) versions) so we can try to figure out what's going on?

[Skmr]

as of now since I say this issue from last time, I was not seen this issue will update you on it if I see it next time!

thanks for responding!

[alsmk2]

Just bear in mind that if the user logs on to two desktops at the same time with the same UEM profile that their may be inconsistencies in the profile they see. Eg,

- User logs onto both machines at the same time.

- On machine 1 user opens IE and adds a favourite for google.com

- On machine 2 user opens IE and adds a favourite for yahoo.com

- User logs off machine 2, the yahoo favourite is sync'd to their profile.

- User logs off machine 1, google.com fav is sync'd, but this will effectively overwrite the previous config file so the user loses yahoo.com favourite.

The next time the user logs on to either desktop, they will only see the google favourite as that was the only one present in their profile on last export.

It's a minor point that you probably won't hear users complain about, but I have seen this happen in similar setups.