Check troubleshooting logs

You can see individual troubleshooting logs and log files or get a consolidated report.

Log output types

You can get the logs from the Advanced shell.

You can also get the log files from the web admin console as follows:

For module-specific logs, download the individual log files under Troubleshooting logs.
For all the log files and a system snapshot, generate the Consolidated troubleshooting report (CTR).

You can get debug-level logs with Troubleshooting logs, the CTR, and the CLI. Debug mode is turned off for all subsystems by default.

Note

Logs and reports aren't synchronized between the primary and auxiliary devices in a high-availability cluster. Each device contains logs and reports for the traffic it processes.

Turn on debug mode

You can turn on debug mode for individual subsystems to get debug-level logs as follows:

For the system controller logs, enter the following command:
```
system diagnostics CSC debug
```

For each service subsystem log you want, enter the following command:

system diagnostics subsystems <subsystem> debug on

Example

system diagnostics subsystems Pktcapd debug on

Note

Currently, you can only turn on debug mode for some service subsystems. See Debug-level logs.

Warning

To save disk space, we recommend that you turn off debug mode after troubleshooting.

Download log files

Individual log filesConsolidated troubleshooting reportLogs from CLI

(Optional) To purge all logs of a subsystem, enter the following command:
```
system diagnostics <subsystem> purge-log
```
Reproduce the issue you want to report.
On the web admin console, go to Diagnostics > Tools.
Under Troubleshooting logs, select the log files.
Click Download.

The files are downloaded as a compressed file.
To share the file with Sophos Support, upload it to the support case you created. See Submit files.

(Optional) To purge all logs of a subsystem, enter the following command:
```
system diagnostics <subsystem> purge-log
```
Reproduce the issue you want to report.
On the web admin console, go to Diagnostics > Tools.
Under Consolidated troubleshooting report, select the following options:
1. System snapshot: This doesn't require debug mode.
2. All log files
Note

Some log files in the CTR only show the number of log lines specified on the CLI.
Enter the reason for generating the CTR.
Click Generate.
Click Download.

The report is downloaded in encrypted format.
To share the file with Sophos Support, upload it to the support case you created. See Submit files.

(Optional) To purge all logs of a subsystem, enter the following command:
```
system diagnostics <subsystem> purge-log
```
Reproduce the issue you want to report.
Sign in to the CLI and enter 5 for Device Management and 3 for Advanced Shell.
To open the log directory, enter the following command: cd /log
To list the log lines of a file, enter the following command: tail -f /log/<logfilename>.log
Copy the lines to a text file.
To share the file with Sophos Support, upload it to the support case you created. See Submit files.

Turn off debug mode

The log files increase in size when debug mode is on. To free up disk space, you must turn off debug mode after you download the log files.

To turn off debug mode, do as follows:

Sign in to the CLI and enter 4 for Device console.
For the system controller logs, enter the following command:
```
system diagnostics CSC debug
```

For each service subsystem log you want, enter the following command:

system diagnostics subsystems <subsystem> debug off

Example

system diagnostics subsystems Pktcapd debug off

More resources

Diagnostics