Your Workspace ONE UEM deployment has several essential, or core, services that enable your deployment to run successfully. These services include the console, device-services, API, and AWCM. If you have issues with any of these core services, VMware provides logging data to help you diagnose the problem.

The core services of Workspace ONE UEM are its foundation, the pieces required for your deployment to run properly and efficiently. If the service you need assistance with does not display here, view the Integrated Component Logging section for an extensive list of integrated services and their log information.

There are two logging levels that proivide different levels of detail. If you are not troubleshooting a service, set the logging level to disabled to reduce use of hardware resources.
  1. In the console, navigate to Groups & Settings > All Settings > Admin > Diagnostics > Logging.
  2. Select any service that needs an increased logging level. Set the service logging to Enabled.
  3. After you finish troubleshooting, revert the logging level back to Disabled to preserve hardware resources.

How to Read a Workspace ONE UEM Log Entry

The ability to read a Workspace ONE UEM log entry is key to succesfully analyzing and troubleshooting any issues you may encounter with your Workspace ONE UEM deployment.

Every log entry contains the following key information,
  1. Date and time for the log entry.
  2. Server identifier for the log entry.
  3. Server communication thread identifier for the log entry.
  4. Device or user identifier for the log entry.
  5. VMware AirWatch internal code for the log entry.
  6. Logging level for the log entry.
  7. Associated service of the log entry.
  8. Log message for the log entry.

Error Log Example

Workspace ONE UEM error logs use the following format:

2017/06/21 19:07:12.243[1]	EX-DS111[2]	11aaabbccc-dddee-1111-22ff-06gggg777777[3]	[0000000-0000000][4]   (14)[5] 	Error[6]	AirWatch.CloudConnector.Client.AccServiceClient.SendRequest[7] 	Received a Failure message from AWCM: Destination not reachable at this moment[8]

Information Log Example

Workspace ONE UEM Information logs use the following format:

2017/09/07 14:46:57.852[1]             EX-DS111[2]           ca9562a7-c87c-4c3b-a1e1-ca35a88555ab[3]               [0000052-0000000][4]   (20)[5]             Info[6]                WanderingWiFi.AirWatch.Console.Web.Controllers.HomeController[7]          Method: WanderingWiFi.AirWatch.Console.Web.Controllers.HomeController.Index; LocationGroupID: 7; UserID: 52; UserName: TEST_USER; Parameters: <N/A>;  69eddd96-9a81-47e9-a78a-dd20c845426b

Console Logging

Learn more about the Workspace ONE UEM logging functions available for the Console service. The API service is installed by default. All Logs are located in the /VMware/AirWatch/Logs folder unless otherwise specified.

Folder

Log Name

Description

AirWatch API

AW_Core_Api.log

Contains information on calls made to the API endpoint for available API commands.

AirWatch API

AW_MAM_Api.log

Contains information relating to specifically the /API/MAM endpoint.

AirWatch API

AW_MCM_Api.log

Contains information relating to specifically the /API/MCM endpoint.

AirWatch API

AW_MDM_Api.log

Contains information relating to specifically the /API/MDM endpoint.

AirWatch API

AW_MEM_Api.log

Contains information relating to specifically the /API/MEM endpoint.

AirWatch Services

AWServices.log

Contains information on the AirWatch SOAP API.

IIS>W3SVC1

u_ex####.log

Contains history of IIS web endpoints accessed and response codes delivered (Ex: /AirWatch & /Enroll).

Inetpub > Logs > FailedReqLogFiles

Fr####.xml

Contains failed IIS request log traces. You must enable this log as it is disabled by default.

Services

AirWatchGemAgent.log

Contains information on the GEM License assessing service and its back-end connections.

Services

ApiWorkflowService.log

This service log cites processed device commands from the REST API.

Services

AW.Meg.Queue.Service.log

Contains information on the email policy updates for SEG or Powershell integration, associated MSMQ reader information, SQL connection errors, and encryption ciphers.

Services

AW.IntegrationService.log

Contains information on all AW third-party integrations such as Apple School Manager APIs, VPP, and App Scan.

Services

BackgroundProcessorServiceLogFile.txt

Contains information on multiple different jobs that are processed in the background asynchronously such as console exports or report generation.

Services

BulkProcessingServiceLogFile.txt

Contains information on bulk commands such as SDK, certificates, APNS messages, DEP APIs, command queues, users, user groups, profiles, and apps.

Services

ContentDeliveryService.log

Contains information on content delivery and relay server communication for product provisioning.

Services

ChangeEventQueue.log

Contains information on event log entries, the batch save of those logs, syslog configuration loads, and policy updates for AW Tunnel.

Services

DirectorySyncServiceLogFile.txt

Contains information on directory user and group syncs such as member lists and LDAP mapping and definitions.

Services EntityReconcileService.log

Contains information on reconcile and sync for entities linked to smart groups.

Services

MessagingServiceLog.txt

Contains information on notifications sent to the various 3rd party messaging services (APNs, GCM, WNS).

Services

PolicyEngine.log

Contains information on the device policies queue and products information related to user, OG and device compliance. It will also include information on product provisioning processing and delivery.

Services

SchedulerService.log

Contains information on the various jobs that are executed by the scheduler service such as Automatic sync, VPP user invite sync, bulk notification push, and AD sync triggers. For an exhaustive list please see Groups & Settings > All Settings > Admin > Scheduler.

Services

SmartGroupServiceLogFile.txt

Contains information relating to reconciliation of smart group mappings resulting from enrollments, changes in device or user state, and reports the resulting change for smart groups.

Services

SMSService.log

Contains information on batch SMS sent to devices.

Services

ComplianceSerivce.log

Logs Compliance service data

Services

ChangeEventOutboundQueueService.txt

Sends event notifications from source component to a central location (Ex: Syslog)

Services PurgeUtility.log Information about database blob file garbage collection
Services Ws1.Tunnel.Kestrel.log Tunnel services logs related to .net core based microservices

Web console

WebLogFile.txt

Contains information on the console user interface.

TargetedLogging

####Airwatch.log

Contains information on targeted logging enabled devices.

Device Services and Self-Service Portal Logging

Learn more about the Workspace ONE UEM logging functions available for Device Services. The API service is installed by default. All Logs are located in the /VMware/AirWatch/Logs folder unless otherwise specified.

Folder

Log Name

Description

AirWatch API

AW_Core_Api.log

Contains information on calls made to the API endpoint for available API commands.

AirWatch API

AW_MAM_Api.log

Contains information relating to specifically the /API/MAM endpoint.

AirWatch API

AW_MCM_Api.log

Contains information relating to specifically the /API/MCM endpoint.

AirWatch API

AW_MDM_Api.log

Contains information relating to specifically the /API/MDM endpoint.

AirWatch API

AW_MEM_Api.log

Contains information relating to specifically the /API/MEM endpoint.
AirWatch API ws1.gateway.log WS1-Services logs.

AirWatch Services

AWServices.log

Contains information on the AirWatch services including logging level and service details. This log also contains SOAP API related information.

AppCatalog

AppCatalogLogFile.txt

Contains information related to the application catalog such as application assignment, device requests when loading the app catalog, and user authentication.

DeviceManagement

DeviceManagement.log

Contains information on the early stages of enrollment including token or group ID validation, restriction checks, and authentication.

DeviceServices

DeviceServicesLog.txt

Contains information related to all device communications with Workspace ONE UEM.

DeviceService

DevicesGateway.log

Logging for the subset of APIs dedicated to devices.
Enroll Shortcut EnrollShortcut.log Information on URL redirects such as /enroll.
IdentityService IdentityService.log Information about the SAML web endpoint.

IIS>W3SVC1

u_ex####.log

Contains history of IIS web endpoints accessed and response codes delivered (Ex: /DeviceServices & /DeviceManagement).

Inetpub > Logs > FailedReqLogFiles

Fr####.xml

Contains failed IIS request log traces. This log must be enabled as it is turned off by default.

MyDevice

WebLogfile.txt

Contains information on actions taken within the self-service portal.
Services ws1tunnel.kestrel All the DB queries from Microservice. Log level is OFF by default.
Services ws1.tunnel.log Tunnel Microservice application/functional logs. These logs also contain the equivalent of IIS logs about API status, time taken, etc.

Services

APIWorkflowService.log

Contains information on the API such as logging level, MSMQ reader errors and SQL connection errors.

Services

AW.IntegrationService.log

Contains information on all AW third-party integrations such as Apple School Manager APIs, VPP, and App Scan.

Services

AW.Meg.Queue.Service.log

Contains information on the email policy updates for SEG or Powershell integration, associated MSMQ reader information, SQL connection errors, and encryption ciphers.

Services

BulkProcessingServiceLogFile.txt

Contains information on bulk commands related to SDK, certificates, APNS messages, DEP APIs, command queues, users, user groups, profiles, and apps.

Services

ChangeEventQueue.log

Contains information on event log entries, the batch save of those logs, syslog configuration loads, and policy updates for AW Tunnel.
Services EntityReconcileService.log

Contains information on reconcile and sync for entities linked to smart groups.

Services

InterrogatorQueueService.log

Contains information related to processed device samples for all platforms to be updated to the DB such as Application and Profile samples from device.

Services

MessagingServiceLog.txt

Contains information on sends and response times to the various third-party messaging services (APNs, GCM, WNS).

Services

ProvisioningPackageServicelogfile.txt

Logs provisioning package information for auto enrollment of applicable Windows 10 device

Services

ChangeEventOutboundQueueService.txt

Sends event notifications from source component to a central location (Ex: Syslog)

Services SmartGroupServiceLogfile.log Information relating to reconciliation of smart group mappings resulting from enrollments or changes in device or user state, and the resulting change for smart groups.

TargetedLogging

####Airwatch.log

Contains information on targeted logging enabled devices.

Trust Service TrustService.log

Logging associated with an on-premises instance of the Trust Service that is used for Certificate Pinning.

API Logging

Learn more about the Workspace ONE UEM logging functions available for the API service. All Logs are located in the /VMware/AirWatch/Logs folder unless otherwise specified.

Folder

Log Name

Description

AirWatch API

AW_Core_Api.log

Contains information on calls made to the API endpoint for available API commands.

AirWatch API

AW_MAM_Api.log

Contains information relating to specifically the /API/MAM endpoint.

AirWatch API

AW_MCM_Api.log

Contains information relating to specifically the /API/MCM endpoint.

AirWatch API

AW_MDM_Api.log

Contains information relating to specifically the /API/MDM endpoint.

AirWatch API

AW_MEM_Api.log

Contains information relating to specifically the /API/MEM endpoint.
AirWatch API CiscoiseLogfile.txt Information about CiscoISE integration.

AirWatch Services

AWServices.log

Contains information on the Workspace ONE UEM services including logging level and service details. This log also contains SOAP API-related information.

IIS>W3SVC1

u_ex####.log

Contains history of IIS web endpoints accessed and response codes delivered (Ex: /ActiveSyncIntegrationServiceEndPoint).

Inetpub > Logs > FailedReqLogFiles

Fr####.xml

Contains failed IIS request log traces. This log must be enabled as it is turned off by default.

Services

APIWorkflowService.log

Contains information on handing bulk requests from the API server such as bulk commands to devices.

Services

AW.IntegrationService.log

Contains information on all AW third-party integrations such as Apple School Manager APIs, VPP, and App Scan.

Services

AW.Meg.Queue.Service.log

Contains information on the email policy updates for SEG or Powershell integration, associated MSMQ reader information, SQL connection errors, and encryption ciphers.

Services

BulkProcessingServiceLogFile.txt

Contains information on bulk commands related to SDK, certificates, APNS messages, DEP APIs, command queues, users, user groups, profiles, and apps.

Services

ChangeEventQueue.log

Contains information on event log entries, the batch save of those logs, and syslog configuration loads.
Services EntityReconcileService.log

Contains information on reconcile and sync for entities linked to smart groups.

Services

MessagingServiceLog.txt

Contains information on sends and response times to the various third-party messaging services (APNs, GCM, WNS).

Services

ChangeEventOutboundQueueService.txt

Log file for entering information into the MSMQ to be sent to central outbound component (Ex: Syslog)

Services

SmartGroupServiceLogfile.log

Information relating to reconciliation of smart group mappings resulting from enrollments or changes in device or user state, and the resulting change for smart groups.
Services DataPlatformService.log Information about sending Windows 10 samples (requires Workspace ONE Intelligence)

AWCM Logging

Learn more about the Workspace ONE UEM logging functions available for the AWCM service. All Logs are located in the /VMware/AirWatch/Logs folder unless otherwise specified.

Folder

Log Name

Description

AWCM

Awcm.log

Contains information on AWCM such as status, history, properties, and additional sub-services.

AWCM

AWCMservice.log

Contains log information on AWCM Java service wrapper.