---
title: Working with logs
slug: epmm/system-manager-guide/working-with-logs
createdAt: 2026-10-06T07:58:36.669Z
---

Use the **Troubleshooting > Logs** options to:

- Setting the log level for Stunnel and HTTPD logs
- Exported logs
- Enable debugging for Ivanti modules
- Disable debugging for Ivanti modules
- Clear logs
- View logs
- Exporting logs

## Setting the log level for Stunnel and HTTPD logs

### Setting the Stunnel log level

In Troubleshooting > Logs, in the section Stunnel/HTTPD Log Management, you can set the log level for Stunnel. Stunnel is a library that Ivanti uses for TLS encryption. These logs are captured in the /var/log/mi\_messages file. The default log level is Emergency. Typically, you do not need to change the Stunnel log level. Ivanti recommends that you contact Technical Support before changing the log level.

### Setting the httpd log level

In Troubleshooting > Logs, in the section Stunnel/HTTPD Log Management, you can set the log level for events related to incoming HTTP/HTTPS requests. These logs are captured in the files in /var/log/httpd/https\_error\_log and /var/log/httpd/portal\_error\_log. The default log level is Warning. Typically, you do not need to change the httpd log level. Ivanti recommends that you contact Technical Support before changing the log level.

:::hint{type="info"}
Changing the log level to Debug or Trace causes many events to be logged. Ivanti EPMM maintains up to 5 100MB files for each of the log files in `/var/log/httpd`. When the maximum is exceeded, Ivanti EPMM deletes the oldest file.
:::

## Exported logs

The /var/log/httpd logs and /var/log/elasticsearch/elasticsearch.log are now exported to the splunk and syslog settings.

## Enabling debugging for Ivanti EPMM modules

You can specify which Ivanti EPMM modules you want to place in debug mode. Placing a module in debug mode causes more detailed messages to be recorded in the corresponding log.

**Procedure **

1. Under <font color="#323232">**Troubleshooting** &gt; **Logs**</font>, select the check boxes for the modules you want to place in debug mode:

| MICS | MobileIron Configuration Service (the service that supports System Manager) |
| ---- | --------------------------------------------------------------------------- |
| MIFS | MobileIron File Service (the service that supports the rest of Ivanti EPMM) |

2. For MIFS (MobileIron File Service), which represents the rest of Ivanti EPMM, select:
3. In the <font color="#323232">MIFS Debugging</font> section, use the <font color="#323232">Package</font> drop-down to select an area to include in the log.
4. Use the <font color="#323232">Log level</font> drop-down to select the level of detail you want to include.
5. Click the <font color="#323232">+</font> icon to add additional packages and log levels.
6. Click <font color="#323232">Apply</font>.

## Disabling debugging

You can disable all debugging or you can select the modules for which you want to disable debugging.

### Disabling all debugging

To disable all debugging, which stops Ivanti EPMM from writing detailed information to all logs, click <font color="#323232">Stop All Debugging </font>under <font color="#323232">Troubleshooting &gt; Logs</font>. For MIFS packages, clicking this button sets the log level to <font color="#323232">Info</font> for all selected packages.

### Disabling debugging for MICS or the employee portal

**Procedure&#xA0;**

1. Log in to System Manager.
2. Go to **Troubleshooting > Logs**.
3. Go to the **Log Management** group.
4. Clear the checkbox next to each module you want to remove from debug mode.
5. Click <font color="#323232">Apply</font>**&#x20;> OK**.

### Disabling debugging for MIFS packages

Use the following procedure to disable debugging for MIFS packages under <font color="#323232">Troubleshooting &gt; Logs</font>.

**Procedure&#xA0;**

1. Remove the package from the list (sets lowest level of logging)
2. Set the log level to OFF (turns off all logging for the selected package)

## Clearing logs

Clearing logs enables you to discard information for previous events, making it easier to isolate the information you need.

**Procedure&#xA0;**

1. Log in to System Manager.
2. Go to **Troubleshooting > Logs**.
3. Go to the **Log Management** group.
4. Click <font color="#323232">**Clear All Log**</font>**s**.

## Log Names

The <font color="#323232">Troubleshooting</font> screen enables you to view the contents of debug logs directly from the console. Debugging must be enabled. The following table lists the available logs:

Table: Viewing Logs

| Log Name           | Description                                                                                        |
| ------------------ | -------------------------------------------------------------------------------------------------- |
| MICS               | Ivanti Configuration Service-related log files (the service that supports System Manager).         |
| MIFS               | Ivanti File Service-related log files.                                                             |
| System             | Ivanti EPMM status logs-related log files.                                                         |
| Device             | Searchable device log files (search by mobile number or user).                                     |
| MI                 | Ivanti back-end system-related log files.                                                          |
| Catalina           | Ivanti application loading status-related log files.                                               |
| Catalina2          | Ivanti application loading status-related log files.                                               |
| SystemBackup       | Ivanti System Backup process-related log files. See [System backup](docId\:dx1Hte-M9APQVJtKB3Htc). |
| High Availability  | HA service-related log files, if configured.                                                       |
| LDAP               | Lightweight Directory Access Protocol (LDAP) integration-related log files.                        |
| CertActivity       | Certificate activity-related log files.                                                            |
| CertCheckJobStatus | Certificate status-related log files.                                                              |
| DEP                | Apple Automated Device Enrollment-related log files.                                               |
| VPP                | Apple volume purchase plan-related log files.                                                      |
| SSP                | Self-service user portal-related log files.                                                        |

## Viewing logs

**Procedure&#xA0;**

1. Log in to System Manager.
2. Go to **Troubleshooting > Logs**.
3. Go to <font color="#323232">**View Module Logs**</font> section
4. Click the link for the log you want to view.

::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/Dags7g57uZ32eWfseCcpV_viewtslog.png" position="flex-start" size="86" width="603" height="252" initialPath="../Resources/Images/ViewTSLog.png" githubPath="System Manager Guide/Resources/Images/ViewTSLog.png" darkWidth="603" darkHeight="252" showCaption="false" indent="1"}

:::Paragraph{indent="1"}
The window scrolls dynamically as Ivanti EPMM adds entries to the log. The most recent log entries are at the bottom.
:::

5. Click <font color="#323232">**x**</font> to close the log view.
   If you close the log view window and then re-open it, the displayed window shows only log entries made since you closed the window.

### Viewing only new log entries

**Procedure&#xA0;**

To remove existing log entries from the log view window and view only new log entries:

1. Log in to System Manager.
2. Go to **Troubleshooting > Logs**.
3. Go to the <font color="#323232">**View Module Logs**</font> section.
4. Click <font color="#323232">**Clear Window**</font> .

### Viewing logs by device or user

**Procedure&#xA0;**

1. Log in to System Manager.
2. Go to **Troubleshooting > Logs**.
3. Go to the <font color="#323232">**View Module Logs**</font> section
4. Click the <font color="#323232">**Device**</font> link.
5. Select <font color="#323232">**User**</font>**&#x20;or&#x20;**<font color="#323232">**Phone**</font> to specify whether you want to view logs by user or device.
6. Enter the user name or phone number.
7. Click <font color="#323232">**View Log**</font>.

## Exporting logs

You can upload logs directly to the default support site or a designated alternate site. The default support site is configured in <font color="#323232">Settings &gt; Log Upload</font>.

Typically, you will use the default HTTPS Server Configuration, which automatically includes the user name you entered in <font color="#323232">Maintenance &gt; Software Updates</font>. Confirm with Technical Support that the entries on this display are correct.

**Procedure&#xA0;**

1. Select <font color="#323232">**Troubleshooting** &gt; **Logs**</font>.
2. Scroll down to the <font color="#323232">**Export Logs**</font> section.
3. Select the log to download.
4. Select a database option.
   Show tech logs can include database information that some companies consider too sensitive to send to Customer Support. Therefore, you can use the <font color="#323232">Database Options</font> to specify whether to include data and whether to remove potentially sensitive information from the output.
   The following options are available:
   - <font color="#323232">**Sanitize**</font>: Remove sensitive information. This is the default selection. If you select the **Sanitize** option, the following data is removed:
     - email addresses
     - device tokens
     - unlock tokens
     - phone numbers
     - last locations
     - unsent alerts
     - events
   - <font color="#323232">**Standard**</font>: Sensitive information included.
   - <font color="#323232">**No Database**</font>: All database information omitted.
5. Select <font color="#323232">**SFTP Upload**, **HTTPS Upload**</font>**&#x20;or&#x20;**<font color="#323232">**Download**</font> from the <font color="#323232">**Type**</font> drop-down list, depending on the method you want to use.

:::hint{type="info" indent="1"}
For Self-service user portal (SSP) log files, **Download&#x20;**&#x69;s the only supported Export option.
:::

6. If you received an Ivanti support ticket number associated with this export, enter it in the <font color="#323232">**Support Ticket Number**</font> field.
7. If you selected <font color="#323232">SFTP Upload</font> or <font color="#323232">HTTPS Upload</font>, select the <font color="#323232">**Alternate Location**</font> check box and configure a backup location or user authentication in case transmission to the primary server or user fails.
8. If you receive technical support from an Ivanti partner instead of directly from Ivanti, then you will need to obtain an alternate location from your vendor.
   The following additional fields for the alternate location are displayed:
   - <font color="#323232">**Host/IP**</font>**&#x20;or&#x20;**<font color="#323232">**URL** </font>**(e.g., https\://support.ivanti.com)**
   - **User Name**
   - **Password**
   - **Confirm Password**
9. Click <font color="#323232">**SFTP Upload**, **HTTPS Upload**</font>**&#x20;or&#x20;**<font color="#323232">**Download**</font>.