BES Logs ... What's in them? Part 2 of 20 (ALRT log)
Posted 06-23-2009 at 04:00 AM by hdawg
Tags alrt log, bb backup connector, bes log, blackberry alert log, blackberry logs, blackberry server logs, cbck log
Welcome to Part 2 of at least a 20 part series looking at the BES logs. (Part 1)
Each day I'll talk about a specific type of log file and hopefully we'll all learn something.
The ALRT log is fed data through the BlackBerry Alert service. The BlackBerry Alert service also feeds data to the Windows Application log. You'll notice a duplication of data in the ALRT log and Windows Application log.
For those of us that do event log scraping or have triggers based on events, we probably never go into the ALRT log, but rather just see what is happening in the Windows Application Event Log ... the rough thing about using the Windows Application Log is that sometimes BES logging can be chatty making it difficult to to decipher what is actually important.
So let's dive into it. One of my favorite log entries that you'll in 99.9% of all ALRT logs is:
This is the most harmless alarm I've ever seen ... but if you want to get rid of this error: KB14472 - Userdump.exe not found.
You'll also notice that the logs start at 00:00 and go through 23:59 ... they'll roll each day and you'll see virtually the same information at the top of each log every day.
The ALRT log is really a consolidation of everything that you might want to spend some time looking at. Events you'll see in the ALRT log will also be in other logs. An example:
This entry is straight from the ALRT log ... but if you check the BlackBerry Dispatcher Log (DISP) or the BlackBerry Router Log (ROUT), you'll see entries at the corresponding time. Also, you'll see the surrounding events that may have caused the error to be generated or at least some symptoms leading up to this.
So if it is the ALRT log, why am I receiving notifications about user activations?!??!
Well, adding a user to a BES is a major event. If we were to check out the BlackBerry Messaging Agent 1 (MAGT_01) log on the BES, we'd see this user being added, along with all of the things that happen to a user when being added. We could then follow the entire Enterprise Activation process for this user. By putting this event in the ALRT log, it helps us further troubleshoot any EA problems.
The ALRT log is a great first place to start for any troubleshooting. I personally find it much easier to go through this log instead of going through the Windows Application Event Log.
If you've got any questions about other specific entries in the ALRT log feel free to post a question / comment in response to this post, or in the forum.
Tomorrow, we'll touch upon the Backup Connector Log (CBCK)
Each day I'll talk about a specific type of log file and hopefully we'll all learn something.
The ALRT log is fed data through the BlackBerry Alert service. The BlackBerry Alert service also feeds data to the Windows Application log. You'll notice a duplication of data in the ALRT log and Windows Application log.
For those of us that do event log scraping or have triggers based on events, we probably never go into the ALRT log, but rather just see what is happening in the Windows Application Event Log ... the rough thing about using the Windows Application Log is that sometimes BES logging can be chatty making it difficult to to decipher what is actually important.
So let's dive into it. One of my favorite log entries that you'll in 99.9% of all ALRT logs is:
Code:
[30000] (06/01 00:00:12.058):{0x7E0} [Alarm::ActivateAlarm] Queuing alarm: <N/A> | BlackBerry Controller (Application Event Log on TESTBES1) | 06/01/2009 00:00:12 (AFFF4E20) -> EventID:afff4e20[CFG] Controller won't generate userdump files. Userdump.exe not found.
You'll also notice that the logs start at 00:00 and go through 23:59 ... they'll roll each day and you'll see virtually the same information at the top of each log every day.
The ALRT log is really a consolidation of everything that you might want to spend some time looking at. Events you'll see in the ALRT log will also be in other logs. An example:
Code:
[30000] (06/01 19:26:27.557):{0x7E0} [Alarm::ActivateAlarm] Queuing alarm: <N/A> | BlackBerry Dispatcher TESTBES1 (Application Event Log on TESTBES1) | 06/01/2009 19:26:27 (6FFFC3B1) -> [SRP] Dispatcher\SRP Connection dropped, Error=0
So if it is the ALRT log, why am I receiving notifications about user activations?!??!
Code:
[30000] (06/01 11:40:37.044):{0x7E0} [Alarm::ActivateAlarm] Queuing alarm: <N/A> | BlackBerry Messaging Agent TESTBES1 Agent 1 (Application Event Log on TESTBES1) | 06/01/2009 11:40:32 (6FFFC3B6) -> [AUDIT] testuser1@port3101.org - User activated on the BES
The ALRT log is a great first place to start for any troubleshooting. I personally find it much easier to go through this log instead of going through the Windows Application Event Log.
If you've got any questions about other specific entries in the ALRT log feel free to post a question / comment in response to this post, or in the forum.
Tomorrow, we'll touch upon the Backup Connector Log (CBCK)
Total Comments 0
