Retrieving Verbose Logs from a Controller/Agent

ALERT  LEGACY ARTICLE: The content in this article is no longer updated and is available for reference purposes only. Features and workflows described may be deprecated, significantly changed, or no longer supported.

Environment

  • Datto EDR

Description

Use verbose logs when

  • Regular logs are not giving enough information about the issue.

  • You have already done the necessary troubleshooting steps, such as troubleshooting the network and normal 'info' logs

  • Obtaining the verbose logs for a deeper dive into a scan:

Agent:

To obtain the 'verbose' logs of the agent we will need to modify the config.toml file which is located in C:\Program Files\Datto EDR\Agent → config.toml. Here are the following steps to get the 'verbose' logs of the agent now that we have the path:

  1. Open Notepad as Admin on the Host

  2. In Notepad go to File → Open → Navigate to C:\Program Files\Datto EDR\Agent.

  3. Change the file type to All Documents →Open the config.toml file.

  4. Change the log-level from info to verbose.

  5. Save the new config.toml file (reopen the config.toml file to make sure it was changed correctly).

  6. Restart the Datto EDR Hunt Agent service.

  7. Now conduct an individual scan on this host and retrieve the new logs.

Verbose_Agent.png

Controller

To obtain the 'verbose' logs for the controller we will need to modify the config.json file which is located in C:\Program Files\Datto EDR\Hunt Controller → config.json. Here are the following steps to get the 'verbose' logs for the controller now that we have the path:

  1. Open Notepad as Admin on the controller machine/

  2. In Notepad go to File→ Open→ Navigate to C:\Program Files\Datto EDR\Hunt Controller→ config.json.

  3. Change the file type to All Documents → Open the config.json file.

  4. Change the log-level from info to verbose.

  5. Save the new config.json file (reopen the config.json file to make sure it was changed correctly).

  6. Restart the Datto EDR Hunt Controller service.

  7. Conduct a temp scan and retrieve the new logs.

Controller_Verbose_Logs.png

The logs will now be verbose and will give us more information on the scan.