Patch Manager Logging and Troubleshooting

Some common questions to ask would be: 

1. What part of Patch Manager is not working as expected?
2. Has this functionality ever worked?
3. When did the problem start?
4. Has anything changed or is different in the process to how it is usually performed?
5. Does to problem happen for all users accounts?

The above questions seem obvious but they make cases easy, if you can define the problem everything else is easier. There are other such questions, feel free to add them to this doc.

Having a clear definition of the problem in this way also insures that the Support system of one issue per case can be well followed from the start. 

At this point determine if the issue is with the process being performed, i.e.

1. is the user performing the correct actions to achieve their goal
2. is the goal achievable
3. is the functionality of Patch Manager giving issue

This requires having some knowledge of the product and experience with the functionality. If the issue is insufficient knowledge of the product then remedy by demonstrating and providing documentation on the process, once this is done there is no need for further troubleshooting as the customer's goal will be achieved.

If it is determined there is a flaw in the operation in the deployment then there is an error that must be investigated further. 

Based on the problem description you can isolate the problem to a specific part of Patch Manager or a specific process. 

A very simple troubleshooting process which resolves many issues is to repeat the steps that error and review the logs of that process for the time you performed the action. Below are details on where Patch Manager logs are located and some of the configuration options available.

• The date/time of the creation of the entry
• The Process ID (PID followed by a number)
• The Thread ID (TID followed by a number)
• Usually (not always), the class name (depending on the developer), followed by the method name, & the method 

At this point you have should have an error message either through the GUI or in the logs. If there are no errors or events in your logs confirm you have identified the correct issue and the correct logs. Increase the logging level if you are sure you have identified the core issue, not just a symptom of the issue and that you are checking the correct logs.

To increase the log level see the below or use the Patch Manager Log Adjuster. The Log Adjuster is accessibly through the MMC console by selecting "Patch Manager->Patch Manager System Configuration" and in the middle pane select "Log Adjuster"

At this point there should be a clear definition of the problem, an error message and logs of the problem. The next step would be to research the error message, any error in the logs and the process being following.

Logging

1. Patch Manager Server + Console
   1. Enabling:
      1. Patch Manager\Patch Manager System Configuration\Patch Manger Servers
      2. Select server, go to Automation Server Settings, select Logging options and select Enabled
      3. Restart PaM console - logs should now be created under Server and Console folders:
         1. EminentWare.DataGridService
         2. EminentWare.WorkerProcess
         3. EminentWare.UI.Console
             
2. Orion installation logs
   1. c:\Documents and Settings\administrator.PACMAN\Local Settings\Temp\1\SWOrionSetup\ on older (win2k3)
   2. c:\Users\administrator.PACMAN\AppData\Local\Temp\2\SWOrionSetup\ on newer systems
       
3. PaM Installation (Configuration Wizard, Setup Helper, ...) + Orion logs
   1. Documents and Settings\All Users\Application Data\Solarwinds\ on older (win2k3)
   2. ProgramData\Solarwinds on newer systems
4. WMI providers + Agent
   1. Enable WMI providers logging - this also works for agent
      1. run regedit, go to HKEY_LOCAL_MACHINE\SOFTWARE\EminentWare\Logging, add DWORD (key=value):
         1. Enable=1
         2. Options=1
         3. Logging=15 (maximum logging level)
   2. Enable agent logging through PaM console
      1. Go to Patch Manager System Configuration\Policy Editor
      2. Either create new policy and then assign it to desired scope or edit the default policy
      3. Edit 6 entries:
         1. Agent Logging
            1. Logging Enabled=1
            2. Logging Level=15
            3. Logging Options=1
         2. Worker Process
            1. Logging Enabled=1
            2. Logging Level=15
            3. Logging Options=1
                
5. WSUS logs
   1. Client logs
      1. c:\Windows\WindowsUpdate.log
          
   2. Server logs
      1. %ProgramFiles%\Update Services\LogFiles

         1.  

            Change.log	Provides information about the WSUS server database information that has changed.
            SoftwareDistribution.log	Provides information about the software updates that are synchronized from the configured update source to the WSUS server database.

6. SCCM logs
   1. 2012 - http://www.acupofit.com/2012/05/sccm-2012-log-file-reference.html (content provided by ZeusABJ, available at www.acupofit.com, obtained on April 3, 2019)
   2. 2007 - http://technet.microsoft.com/en-us/library/bb892800.aspx (© 2019 Microsoft, Inc., available at docs.microsoft.com, obtained on April 3, 2019)
7. Agent logs always on Agent nodes
   1. C:\ProgramData\Solarwinds\Logs\PM
8. Collect Patch Manager Web Console Logs
9. The log file to check on the Orion Server is Information Service v3 
10.  C:\ProgramData\SolarWinds\InformationService\v3.0

Log Locations 

Default logging looks to be verbose [VERB]

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.