Handbook
Indexing and Search Logs

Log files

The directory for the Mindbreeze enterprise search services log files can be configured in "Advanced Settings".

It is entered by default under Linux “/var/opt/mindbreeze/log“ and under Windows “c:/Users/<service user>/App Data/Local/Temp“. In the following chapters, this directory is referred to as "Log Directory".

Client service log files

The client service log files are located in the directory "Log Directory/log-mesclientservice-<client-port>", where a subdirectory with the corresponding time stamp is created for each restart.

Query service log files

• The query service log files are located under "Log Directory/log-mesindex<index path>" with subdirectories for each restart. Relevant query service log files are:
• log-mesindex.log
• performance-findservlet.csv  

The following columns of the "performance-findservlet.csv" file have an essential role in the analysis of search queries:

• Starting Timestamp: Start time
• Query: Contains the search term
• Authorized Hit Count: The number of authorized documents
• Rejected Hit Count: The number of unauthorized documents

The authorization and contextualization as part of the query service will be performed in separate processes. The log files are located under "Log Directory/log-messdkjavasandbox-bootstrapped-<query-port>", "Log Directory/log-messdkcsandbox-<query-port>" or in the file "Log Directory/log-messdknetsandbox-<query-port>.txt", depending on the implementation (Java, C or .NET).

Crawler log files

The crawler logs are located in the "Log Directory/log-mescrawler-launchedservice-<Category>_<Source Name>" directory.

Microsoft Exchange 2010

log-mescrawler_launchedservice_Microsoft_Exchange_<Source Name>.log includes all information such as: start time, mailboxes found (AD), crawler status fetch, time when a mailbox search is completed, and end time with the collected statistics on the total number of documents found, indexed, and deleted.

Additionally, CSV log files are generated. The names of the CSV log files correspond to the associated "crawl run" or "scope". The following files have a significant role in the analysis of delta indexing:

per-folder-finditems-<crawlrun>_<scope>.csv: Contains the information of all found folders of the mailboxes that were created or modified within the time frame (scope). The main columns are:

• Timestamp: Start time
• Mailbox: E-mail address
• Path: Path of the folder <mailbox>/ordner/unterordner/…
• PerFolderFoundItemsSize: Number of found items that are newly created or modified.

mindbreeze-dispatcher-<crawlrun>_<scope>.csv: All documents or e-mails that have been sent to the filter service. The main columns are:

• Timestamp: Start time
• Key:
• Mailbox: E-mail address
• Folder: The folder in which the e-mail is located

Filesystem

"Log Directory/log-mesfscrawler_<indexpath>.log" contains all information that is generated by the filesystem crawler.

Filter service log files

The filter service log files are located in the directory "Log Directory/log-mesfilterservice-<port>" The statistic-filter-rpc.csv file provides information, for example about the filter plugin used, file extensions and possible errors in filtering. The main columns are:

• Timestamp: Start time
• Extension: file extension
• Used Filter ID: Filter plugin
• Internal Exception: possible errors

The actual filtering happens in separate processes. Depending on the implementation of the filter plugins (Java, C or .NET), the "Log Directory/log-messdkjavasandbox2-Filter@<port>", "Log Directory/log-messdkcsandbox2-Filter@<port>" directories or the "Log Directory/log-messdknetsandbox-<port>.txt" file will be generated.

Index service log files

The index service log files are located in the "Log Directory/log-mesindex<index path>“ directory. All information concerning the state of the indexing (inverting, merging and announcements) is located in the file log-mesindex.log.

performance-servlet-mes3_indexeddocuments.csv provides information about the number of documents that have been obtained by the index service.

performance-servlet-mes3_deletedocuments.csv provides information about the number of documents that have been deleted from the index.

performance-servlet-mes3_updatedocuments.csv provides information about the number of documents that have been updated in the index.

System log files (G7)

Mindbreeze InSpire appliances collect logs from sources including the following:

• System logs of the host system
• Logs for the docker container
• Logs of the reverse proxy and the Keycloak server
• Logs of Mindbreeze processes

These are automatically forwarded to the syslog server in the InSpire container and to app.telemetry.

Distribution to log files

• /var/log/messages contains messages from Mindbreeze services as well as start messages from the host and the containers
• /var/log/reverse-proxy contains messages from the reverse proxy server
• /var/log/cron contains messages from the cron jobs
• /var/log/secure contains audit and authentication messages (such as login, logout)

Filtered log pools in app.telemetry

In app.telemetry, the log messages are visible in the log pool: “Syslog Events.”
Additionally, there are the following “filtered log pools”:

• Syslog Audit Events: is equivalent to /var/log/secure
• Syslog Reverse Proxy Events: is equivalent to /var/log/reverse-proxy

Use Case: retrieve audit logs

The audit logs (/var/log/secure) can be retrieved using the file manager:

Forwarding to an external syslog server

It is also possible to forward the above logs to a syslog server.
To do this, the server must be entered in the file “/config/rsyslog/remote.conf” as follows:

*.*@<hostname oder ip>:<port> (uses UDP)

or

*.*@@<hostname oder ip>:<port> (uses TCP)

This forwards all log messages. To configure the forwarding more precisely, please use the documentation for rsyslog.

Encrypted transport of syslog messages is also possible if it is supported by the target server. For this you have to configure the correct certificates. E.g:

$DefaultNetstreamDriverCAFile /config/rsyslog/ca-cert.cer

$DefaultNetstreamDriverCertFile /config/rsyslog/client-cert.cer

$DefaultNetstreamDriverKeyFile /config/rsyslog/cliet-cert.key

$DefaultNetStreamDriver gtls

$ActionSendStreamDriverMode 1

$ActionSendStreamDriverAuthMode anon

For configuration details please also refer to rsyslog.

Thread dumps

Thread dumps can be created to obtain information about the current state of a process.

The process ID (PID) is required for all types of processes. It is located in the log directory of the process (xxxxx.pid) and xxxxx corresponds to the PID.

Thread dumps of Java processes

To create a thread dump of Java processes, the “QUIT” signal must be sent to the respective process.

kill-QUIT <PID>

The thread dump is then located in the log file of the process.

Thread dumps of native processes

To create a thread dump of a native process (e.g. mesindex) you can use the auxiliary script “thread-dump-native.sh”

/opt/mindbreeze/scripts/thread-dump-native.sh <PID>

The thread dump is output directly, but can be redirected to a file.