Diagnostic Records
Diagnostics (Collector) is the collector’s own log — startup, license, bind errors, storage, shutdown — not the syslog messages from the network.
On the Server toolbar, click Collector → Diagnostic Records (Collector).
A Diagnostics (Collector) tab opens.
Each entry has a level, a timestamp, a component, and the message text. Records are grouped by session — one session per collector run, from start to shutdown.
Toolbar Controls
| Control | Description |
|---|---|
Prev. Records |
Previous session (an older collector run). |
Started: <date/time> |
Jump to a session by start time. |
Next Records |
Next session (a newer collector run). |
Refresh |
Reload the current session. |
Show DEBUG records |
Include Debug-level entries. Off until needed for a reproduction. |
Save to File… |
Write the current view to a text file. |
Columns
| Column | Description |
|---|---|
Level |
Severity of the record: Info, Warning, Error, or Debug. Errors are highlighted in red. |
Timestamp (ISO Format) |
When the event occurred, in local-time ISO 8601 format. |
Component |
Subsystem of the collector that produced the entry — for example Main, Receiver, or Storage. |
Diagnostic record |
The event text. |
Typical Records
A session usually starts with a version banner and the active license, then interface bind results, then Collector started successfully with the syslog storage path.
Failed to create interface … Error 10048 means the port is already in use.
Find the other process (netstat -ano or Get-NetUDPEndpoint) and stop it, or change the collector port in Network Interfaces.
Use Save to File… before contacting support. Turn Show DEBUG records on only while reproducing a problem. Prev. Records compares a failed start with the last session that worked.
Related Topics
-
Monitoring — runtime statistics for messages received and processed
-
Windows Service — start and stop the collector