How to Use Agent Logs

Overview

In Spirion Sensitive Data Platform, the Agent Log page is the "Technical Pulse" of your Spirion deployment. It provides the granular, machine-level evidence needed to ensure that your discovery and protection tasks are executing correctly, reliably, and across your entire intended scope.

The Agent Log page is the primary interface for monitoring the technical health and operational activity of your distributed scan Agents.

• The Audit Log tracks human actions in the console
• The Agent Log tracks machine actions on the endpoints

What the Agent Logs Page Does

The Agent Log page provides a centralized view of the technical events generated by Spirion Agents as they execute their tasks.

• It acts as a "remote console" for the logs that are generated locally on each agent host, enabling administrators to troubleshoot issues without needing direct access to the endpoint's file system.

Who can use the Agent Logs Page

The page can be used by users of the following roles:

• Admin
• Data Privacy Admin
• Compliance Privacy Admin
• Activity Monitor Admin

What Does the Agent Logs Page Contain?

The Agent Log aggregates events from the 3 core functional roles of an Agent:

1. Endpoint Service (EPS) Events:
2. • Registration & Heartbeats: Confirmation that the Agent is successfully communicating with the console.
   • Service Status: Start, stop, and restart events for the Agent services.
   • Connectivity Errors: Failures to reach the console or proxy issues.
2. Discovery & Search (IDF/SystemSearch) Events:
3. • Scan Lifecycle: When a scan starts, pauses, resumes, or completes.
   • Target Enumeration: Records of the Agent connecting to specific targets (for example, "Connected to File Share X").
   • Access Denied/Errors: Specific files or directories that the agent could not scan due to permission issues or file locks.
   • Match Summaries: High-level indicators that sensitive data was found (without revealing the raw data itself).
3. Shipper (IFS) Events:
4. • Result Delivery: Confirmation that the results payload was successfully sent to the SaaS ingestion layer.
   • Retry Loops: Records of the Agent attempting to re-send results after a network interruption.
   • Correlation IDs: Unique identifiers used to track a specific result set from the Agent to the console.

What are Agent Logs Used For?

The Agent Log is the "first responder" tool for technical troubleshooting and operational oversight:

• Troubleshooting Scan Failures: If a scan is "Stuck" or "Failed," the Agent Log reveals the specific error (for example, "Invalid Credentials" or "Network Timeout").
• Verifying Coverage: Administrators use the logs to confirm that the Agent actually reached the intended targets and did not skip critical folders due to permission errors.
• Monitoring Performance: By reviewing start and end times in the logs, you can identify "long-running" scans that may need to be optimized or rescheduled.
• Confirming Remediation: When a playbook executes a "Shred" or "Quarantine" action, the Agent Log provides the technical confirmation that the local file system operation was successful.
• Health Checks: Agent logs are used to identify "Silent Failures"—Agents that are heartbeating but failing to execute their assigned search tasks.

Recommendations

• Filter by Time Window: When investigating an issue, always filter the Agent Log to the specific window (~10 minutes before and after the event) to avoid being overwhelmed by "noise.")
• Look for "Access Denied": This is the most common cause of incomplete scans. Regularly search the Agent Log for this string to identify targets where the agent's service account needs elevated permissions.
• Check the Shipper Status: If you see findings on the agent but not in the console, check the IFS/Shipper logs in the Agent Log page. These logs tell you if the results are "stuck" in the local queue due to an outbound network block.

How to Access and View Platform Logs

Procedure:

1. From the left menu, click Reports.
   
   
2. Click Agent Logs.
   
   
3. The Agent Logs page appears.
   
   

About the Agent Logs Table

The Agent Logs page displays the Agent logs collected via Gather Data requests in a table.

• You can search for a specific log and view upload counts.

Agent Log Table Columns

Agent Logs are displayed by the following columns.

• You can filter the list by column(s) based on your business needs.
• Select one or more filters using the drop-down lists in the Filters section and enter your criteria.
• See How to Use Filters to Find Agent Logs below, for more information.
  
  

How to Search for an Agent Log

To search for an Agent Log:

1. Type an Agent or File name in the search box.
   
   
2. Click the lens icon or Enter on your keyboard.
3. The results are displayed in the list below.
4. Click the x to clear the results.

How to Download Gather Data

To download the Gather Data zip file use the following steps:

1. First, you must populate the Agent Logs page with Gather Data extracted from individual Agents.
2. You can perform Gather Data requests on individual Agents listed on the Agent Management page (from the more options menu at the far right of the table).
3. Once the Agent Logs page table is populated (there is a small delay between executing the Gather Data request and the entry appearing in the Agent Logs table), you can continue.
4. For a specific entry click the more options menu in the far right column.
   
   
5. Click Download Gather Data. The ZIP file is downloaded to your local computer.
   
   

How to Extract Logs from the Gather Data ZIP to View Support and Diagnostic Information

Procedure:

1. Once your Gather Data zip file is downloaded to your local machine, extract the contents.
2. The "Gather Data" zip file contains a comprehensive set of diagnostic information, configuration files, and logs from a Spirion Windows agent. This package is typically used by Spirion Support to troubleshoot Agent behavior, connectivity, and scan issues

Log Folders

The Gather Data zip file contains several specialized log families (found on the local Agent machine under C:\ProgramData\Identity Finder\Logs):

Log & Component Folders

• AdminData: Stores administrative settings, local agent registration state, and console sync metadata.
• Application: Contains application-level state files, client binaries metadata, and runtime execution data.
• EPSLogFiles: Endpoint Service Logs (idfEndpoint.exe): Contains logs with measurements of Agent health. Information includes the Agent supervisor service, tracking Agent startup, health heartbeats, local database/schema maintenance, and queue monitoring.
• EWSLogFiles: Exchange Web Services Logs. Contains logs detailing email discovery, mailbox scanning, and message retrieval through Microsoft Exchange/EWS connectors.
• FCILogLogFiles: File Classification Infrastructure Logs. Contains logs related to Windows Server FCI integration, file tagging, and metadata classification actions.
• IFSLogFiles: Identity Finder Shipper Logs (IDFMessagingSvc.exe). Contains logs tracking the packaging and HTTPS transmission of scan results from the local shipper queue to the SaaS Ingress service.
• LogFiles: General diagnostic logs from the core Identity Finder/Spirion desktop client interface and execution wrappers.
• Machine Feature Set History: Historical records of detected machine capabilities, hardware profiles, and feature support evaluations over time.
• MC Task Data: Management Console task files, incoming scan instructions, and scheduled job payloads dispatched from the control plane.
• SMSLogFiles: Spirion Messaging Service Logs. Contains logs tracking internal message bus events, local service-to-service communication, and queue operations.
• SystemSearchLogFiles: System Search Engine Logs (identityfinderCMD.exe). Detailed logs of the core scanning engine, covering file enumeration, content parsing, AnyFind regex matching, OCR processing, and match discoveries.

Root Configuration and Environment Files

These files describe how the Agent is set up and the environment it is running in:

• AppData.txt: Details the directory structure and file listings found within the local %AppData% / %LocalAppData% paths for Spirion/Identity Finder.
• GlobalSettings.xml: Contains global client/Agent configurations, default settings, and baseline communication endpoints applied across the installation.
• GUID (example: e7b71fea-6c59-47ea-a78f-d57b344437a5.xml).xml: XML file. A GUID-named policy or task definition XML containing the specific scan configuration, rules, or diagnostic payload active during the execution.
• identityfinder.lic: The license file associated with the Agent. Verifies product entitlement, enabled feature sets, expiration dates, and licensed capabilities.
• idfhkcu.reg: An export of the HKEY_CURRENT_USER (HKCU) registry hive containing user-specific Spirion preferences and settings.
• idfhklm.reg: An export of the HKEY_LOCAL_MACHINE (HKLM) registry hive containing machine-wide settings (such as console URLs, service registration, and logging levels).
• LiveSettings.xml: The active runtime settings XML reflecting the effective policy rules, detector definitions, and overrides currently applied to the running Agent.
• Permissions.txt: Details user, service account, and NTFS filesystem access rights across Spirion working directories to troubleshoot access-denied issues.
• Processes.txt: A point-in-time snapshot of active running processes, services, PIDs, and memory usage on the host machine when the diagnostic bundle was gathered.
• Systemprofile.txt: Captures the system environment configuration, machine hardware baseline, OS details, and environment variables under the system profile context.

Summary of Use

This specific collection of files enables qualified personnel to see the following:

• Exactly what the Agent was doing (via logs)
• How the Agent was told to do it (via XML settings and Registry files)
• What might have stopped the Agent (via permissions, process lists, and environment snapshots).

How to Delete Gather Data

To delete a Gather Data entry:

1. Click the more options menu in the far right column.
   
   
2. Click Delete Gather Data.
   Note: This action is immediate and cannot be undone.

How to Use Filters to Find Agent Logs

To use the filter feature to find Audit Log based on specific criteria:

• In the upper left of the screen, go to the Filters .

For the below selection criteria, select one or more items from the drop-down list:

• File Name
• Date Requested
• Date Uploaded
• Status
  
  

Procedure:

1. Click the Apply button to apply the filter to the Agent Logs list.
   
   
2. Click the Clear button and then click the Apply buttonto remove the filter.
   
   
3. Click Clear All link to remove all the set filters.