How to see logs

You can see individual logs and log files or get a consolidated report.

Log output types

You can get the log files from the CLI.

You can get the logs and log files from the web admin console as follows:

For brief logs of all the important events, see Log viewer.
For module-specific logs, download the individual log files.
For all the log files and a system snapshot, generate the Consolidated troubleshooting report (CTR).

You can get debug-level logs with Troubleshooting logs, the CTR, and the CLI. Debug mode is turned off for all subsystems by default.

Note

You can only get the log files separately from the primary and auxiliary high-availability devices.

You can turn on debug mode for individual subsystems to get debug-level logs as follows:

For the system controller logs, enter the following command:
```
system diagnostics CSC debug
```

For each service subsystem log you want, enter the following command:

system diagnostics subsystems <subsystem> debug on

Example

system diagnostics subsystems Pktcapd debug on

Note

Currently, you can only turn on debug mode for some service subsystems. See Debug-level logs.

Warning

To save disk space, we recommend that you turn off debug mode after troubleshooting.

Individual log filesConsolidated troubleshooting reportLogs from CLI

(Optional) To purge all logs of a subsystem, enter the following command:
```
system diagnostics <subsystem> purge-log
```
Reproduce the issue you want to report.
On the web admin console, go to Diagnostics > Tools.
Under Troubleshooting logs, select the log files.
Click Download.

The files are downloaded as a compressed file.
Email the file or share it through FTP with Sophos Support. See Connect to Sophos FTP server using an FTP client.

(Optional) To purge all logs of a subsystem, enter the following command:
```
system diagnostics <subsystem> purge-log
```
Reproduce the issue you want to report.
On the web admin console, go to Diagnostics > Tools.
Under Consolidated troubleshooting report, select the following options:
1. System snapshot: This doesn't require debug mode.
2. Log files
Enter the reason for generating the CTR.
Click Generate.
Click Download.

The report is downloaded in encrypted format.
Email the file or share it through FTP with Sophos Support. See Connect to Sophos FTP server using an FTP client.

(Optional) To purge all logs of a subsystem, enter the following command:
```
system diagnostics <subsystem> purge-log
```
Reproduce the issue you want to report.
Sign in to the CLI and enter 5 for Device Management and 3 for Advanced Shell.
To open the log directory, enter the following command: cd /log
To list the log files, enter the following command: tail -f /log/<logfilename>.log
Copy them to a text file.
Email the file or share it through FTP with Sophos Support. See Connect to Sophos FTP server using an FTP client.

The log files increase in size when debug mode is on. To free up disk space, you must turn off debug mode after you download the log files.

To turn off debug mode, do as follows:

Sign in to the CLI and enter 4 for Device console.
For the system controller logs, enter the following command:
```
system diagnostics CSC debug
```

For each service subsystem log you want, enter the following command:

system diagnostics subsystems <subsystem> debug off

Example

system diagnostics subsystems Pktcapd debug off

More resources