Client logs collections in Configuration Manager (SCCM) – 4sysops

The following prerequisites must be met:

Enabling the Notify resource permission

The site sends a client notification message to the client to upload logs. The client then sends the logs to the management point, which sends them to the site server as software inventory data.

The client log size limit is 100 MB of compressed data. Once the logs are sent to the site server, you can view the logs in the resource explorer by right-clicking the client in the console.

Launch the Configuration Manager console, navigate to Assets and Compliance, and select the device or device collections for which you want to view the logs. Right-click the device and then click Client Diagnostics > Collect Client Logs.

Choose Collect Client Logs from the console

The device will be notified to collect logs if it is online. Click OK to proceed with the log collection.

Click OK to collect logs

On the client, check Diagnostics.log to verify whether the logs have been sent to the management point. The screenshot below shows that the log report was sent successfully.

Client sent CCM logs to MP

The MP_SinvCollFile.log contains the report forwarded from the management point to the inbox folder on the site server. The log will be copied to C:\Program Files\Microsoft Configuration Manager\inboxes\auth\sinv.box. Log collection uses the software inventory process to copy the logs from the client to the site server database. Make a note of the file name, as it will be helpful for tracking the collection process flow and for troubleshooting.

The management process contains the report to the site server inbox folder

Navigate to the Configuration Manager installation directory and then to inboxes > sinv.box > FileCol. You'll find the folder contains the log report. The folder name is the resource ID of the client and is unique for each client in the SCCM.

Report copied to inbox folder

You can find the resource ID for the client in the SCCM console. Right-click the client and navigate to Properties. On the General tab, search the resource ID. Another way to find the resource ID is to add a column to the collection that lists the IDs for all clients in the collection.

Resource ID for the client

Sinvproc.logshows the inventory file processed from the inbox folder to the database. Once the report is updated in the database, you can use the SCCM console to view/export the logs under the resource explorer on the device.

The site server processes the report from the inbox folder to database

Launch the SCCM console, go to Assets and Compliance > Devices, select the device, right-click, and open the Resource Explorer. You can see the collected log details under Diagnostics files. The collection date, file name, and file path details are listed. You can view the logs either via the support center or by saving and extracting them.

Open Diagnostic Files via the Support Center

Open the logs via the Support Center. They contain details regarding Full file path, File name, and Size. Select the specific log and click Open.

Support Center view

Right-click the collected files and save them to the folder. Extract the zip folder, and find the log file you want to investigate.

Save diagnostic files

The logs below are collected from the client machine under the C:\Windows\CCM\Logs folder.

Extracted log details

There are two maintenance tasks available in SCCM to delete aged diagnostic logs from the site server.

By default, the above maintenance tasks are enabled. The default value is 14 days to perform cleanup and does not delete other files. It will delete files stored under Inboxes\sinv.box\FileCol on the site server. You need to configure maintenance tasks on the primary site; they cannot be configured from the central administration site or secondary sites.

Want to write for 4sysops? We are looking for new authors.

4sysops members can earn and read without ads!