What to check first when troubleshooting a forwarder?

Check these items and then reach out to [email protected]

If there are issues with the Stairwell forwarder, sometimes it is necessary to identify, review, and provide logs to the Stairwell team for analysis. Below we've provided the most common things our team will need to ask for in order to analyze possible issues and help users resolve and restore forwarder functionality.

ℹ️

To update logging levels, please see our changing logging levels guide. It is recommended to leave the logging levels as default and to only change them temporarily.


Windows

Stairwell Forwarder v1.6 and later, or v1.4

  • To check logs on Windows systems running the Stairwell Forwarder, the location is
    C:\ProgramData\Stairwell\SwellService\logs
  • To check registry values on Windows systems running the Stairwell Forwarder, the location is
    HKLM\Software\Stairwell\SwellService
  • To check services on Windows systems running the Stairwell Forwarder, ensure the following are Running/Started
    StairwellForwarder
    SWAgent

Stairwell Forwarder v1.3 and earlier, or v1.5.1

  • To check logs on Windows systems running the Stairwell Forwarder, the location is
    C:\ProgramData\Stairwell\Inception\logs
  • To check registry values on Windows systems running the Stairwell Forwarder, the location is
    HKLM\Software\Stairwell\Inception
  • To check services on Windows systems running the Stairwell Forwarder, ensure the following are Running/Started
    InceptionForwarder
    SWAgent

Mac

On Mac systems, Stairwell logs are stored in the OS logging subsystem. To extract the InceptionForwarder.log and Totem.log from /tmp, perform the following steps.

  • Open Terminal.app (in Applications/Utilities) and run:
/usr/bin/log show --source --start $START_DATE --style syslog --predicate 'subsystem == "com.stairwell.Inception.ProcessMonitor"' --info --debug > $TEMP/InceptionForwarder.log
/usr/bin/log show --source --start $START_DATE --style syslog --predicate 'subsystem == "com.stairwell.Inception.totem"' --info --debug > $TEMP/Totem.log

When troubleshooting macOS, a debug bundle (containing the Mac Forwarder logs) may be needed. We have a script that can be run by customers to gather relevant information to provide to out engineering team.

cd ~/Downloads
chmod +x generateDebugLogs.zsh
sudo ./generateDebugLogs.zsh
  • Once the script has completed, which should take a minute or two, it should open a Finder window with a file named inceptionDiagnose.zip in it. Please provide this zip file to the FIT team.

Linux

Configuration

  • The local configurations is found in /etc/stairwell/config.json

Asset ID

  • The local asset information is found in /var/lib/stairwell/runtimeconfig.json

State File

  • The local backscan status is found in /var/lib/stairwell/scansession.json
    • Unspecified/Not started since restart = 0
    • Complete = 1
    • In Progress = 2
    • Stopped = 3
    • Failed = 4
    • Disabled = 5

Service

  • For RHEL 7 and above, logs are managed using system journal. If an error is encountered before logging can be initialized, information is found in /var/log/stairwell_failsafe.log. Otherwise, to save recent logs to a file, you can use the following command:
journalctl -u stairwell -S today --no-tail > stairwell_service.log
  • For RHEL 6, logs are managed using logrotate. Logs are stored in /var/log/stairwell with /var/log/stairwell/fileshipper.log being the most recent.