Debug logs contents

Overview

Resilio's diagnostic logs are operational metadata logs, not data logs. They record what the software did — which files it looked at, which peers it talked to, which operations succeeded or failed — in enough detail to reconstruct a problem after the fact.

• File and folder names, and their full paths, are recorded for troubleshooting purposes. Customers whose file names themselves are sensitive — patient identifiers, client matter names, unreleased project codenames — should treat log bundles as sensitive material.
• File contents are not recorded. No payload bytes from synchronized files are written to the log. Neither are share secrets, storage credentials, or passwords — these pass through an explicit redaction layer.

Nothing leaves the customer's environment automatically as a side effect of logging. Logs are written locally and rotated locally. They are transferred only when an administrator collects them for the purpose of troubleshooting, an end-user initiates a support request, or when a licensed automatic-upload is enabled (available in Resilio 6.0 and newer).

Resilio Agent logs

Location and retention

Property	Description
Primary log file	sync.log, in the Agent's storage folder.
Rotation	Rotated and compressed to .zip when the size exceeds the maximum.
Max size per file	Default: 1000 MB (uncompressed)
Archives retained	Default: 100
Retention (TTL)	Default: 90 days

You can adjust all three limits by adding log_size, log_ttl, max_compressed_logs custom parameters to the Agent profile. Each rotated file begins with a header recording Agent version, OS name/release/version/architecture, and local timezone.

A postmortem marker is also maintained so the Agent can report an unclean shutdown from the previous run.

Verbosity

Logging is enabled by default, but you can either disable it completely or select which subsystems events you want to exclude/include in logs.

Disable logging

To disable debug logging completely, set the Debug logging parameter in the Agent profile to No.

Manage logging verbosity

Logging is controlled by a bitmask of subsystem flags (network, files, filesystem events, etc.), plus severity levels, stored in debug.txt file in Agent's storage folder.

On a fresh install the Agent enables the full mask for verbose debug logging. The mask can be narrowed or reduced to errors-only, or you can disable debug logging completely.

To enable debug logging for only specific subsystems, set the bitmask in the the debug.txt file accordingly:

LOG_NETWORK       = 0x00000001,
LOG_FILES         = 0x00000002,
LOG_FSEVENTS      = 0x00000004,
LOG_FOLDER_SCANNER= 0x00000008,
LOG_UPNP          = 0x00000010,
LOG_PEERCONN      = 0x00000020,
LOG_MERGE         = 0x00000040,
LOG_DB            = 0x00000080,
LOG_TRACKER       = 0x00000100,
LOG_JS            = 0x00000200,
LOG_API           = 0x00000400,
LOG_DESKTOPUI     = 0x00000800,
LOG_ENCRYPTION    = 0x00001000,
LOG_MASTER_FOLDER = 0x00002000,
LOG_DISCOVERY     = 0x00004000,
LOG_GENERIC       = 0x00008000,
LOG_WEBUI         = 0x00010000,
LOG_ACL           = 0x00020000,
LOG_LICENSE       = 0x00040000,
LOG_NOTIFICATIONS = 0x00080000,
LOG_UPDATE        = 0x00100000,
LOG_SIT           = 0x00200000,
LOG_ANDROID       = 0x00400000,
LOG_MEMORY        = 0x01000000,

LOG_AS_DEBUG      = 0x10000000,
LOG_AS_INFO       = 0x20000000,
LOG_AS_WARN       = 0x40000000,
LOG_AS_ERROR      = 0x80000000

Included information

Host and identity

• Agent and client version, product branding
• Operating system name, release, version, CPU architecture
• Local timezone
• Device / host name
• The Agent's PeerID
• Share and peer references appear as short truncated identifiers (a 4-hex-digit suffix), not as full secrets

Files and folders — the largest category

• Full local file and folder paths, and file names
• File sizes, modification times, piece counts, content hashes
• Rename and conflict handling, including the conflict names assigned
• Scan progress, queue state, per-file state machine transitions
• Filesystem watcher events
• Ignore-list patterns (which are themselves customer-authored paths/globs)

Filesystem permission metadata

• On Windows: owner and group SIDs and SDDL security-descriptor strings, and ACL conversion failures. SDDL strings encode user and group identities.
• On POSIX: ownership and permission values
• On FUSE-mounted jobs (Linux/macOS): the name and PID of the process performing each file operation

Network

• Peer IP addresses and ports, transport in use (TCP / UTP / relay / tunnel)
• Tracker and relay server endpoints and responses
• Connection establishment, disconnect reasons, NAT traversal, UPnP/NAT-PMP, DNS resolution
• Transfer rates, piece requests, throughput and stall diagnostics

Job, policy and management-server activity

• Job IDs and job names, job paths, job run lifecycle
• Connection state to the Management Console
• The policy document delivered by the Management Console is written to the log — passed through the redaction layer
• Management protocol messages (also redacted)
• License state and licensing-server interactions
• Scripts from triggers and script jobs

Cloud storage connectors (S3, Azure Blob, Azure Files, Google Storage, OneDrive)

• Request URLs including bucket/container and object key (i.e. remote object paths)
• HTTP verbs, response codes, retry and expiry behaviour
• Credential status only ("credentials expired", "no credentials for …") — never credential values

Errors

• OS error codes and system error message strings
• Internal error descriptions and, on malformed protocol messages, a hex dump of the offending protocol record (metadata — not file payload)
• Crash minidumps are written as separate .dmp files alongside the log. They contain fragments of process memory along with some in-flight data, but they are collected only when explicitly requested, and are not included in the default log bundle.

Explicitly excluded

Resilio Agent log files do not include the following:

• Contents of synchronized files - no file payload is written to the log.
• Full share secrets - only the read/write class and a truncated identifier.
• Object-storage access keys, SAS tokens, and OAuth client secrets - these undergo redaction routine.

Redaction routine

Structured data written to the log passes through a redaction routine. Values under these keys are replaced:

Keys	Redacted to
secret, readonlysecret, read_only, read_write, key	RW*** / RO*** / ***
account, accessID, accessSecret, sasToken, folder, password, client_token, bootstrap_token, clientSecret	***
ATA key tokens (key_tokens)	***

Important

Folder path redaction applies to the structured data. Free-form log lines that print a path print that path verbatim, thus folder paths should be considered sensitive.

Management Console logs

Log files

File	Contents	Level
common.log	Main application log	debug You can change the log level in the Management Console's advanced settings.
db.log db-history.log	Queries against the main or the history database respectively	error You can change the log levels in the loggers section of the Management Console's configuration file. Default log level By default, db.log and db-history.log log only error-level messages, despite the logger being set to verbose. This is because database query logs can contain query parameters verbatim, which may include sensitive information. You can mitigate this by enabling sensitive data encryption.
audit.log	Administrative audit trail	info
mchost.log	Management Console host events	debug The mchost.log file is applicable to Resilio 6.0 and newer.

• Log files are stored in the Management Console's storage folder.
• By default, each rotates once the file exceeds 100 MB, keeping 10 files, gzip-compressed (except the audit.log). To change the rotation policy, edit the loggers section of the Management Console's configuration file.

common.log contents

• HTTP API activity: method, full request URL, response timing, and a caller identifier. Session IDs are logged in full; bearer and API tokens are obscured (only a leading fragment is shown).
• Agent protocol traffic: messages exchanged with Agents. High-volume payloads are summarized rather than dumped — event batches are logged as [N items] and file-query results as [N characters] — so the Management Console log does not accumulate full file listings.
• Agent connection lifecycle: connect/disconnect, IP and port, peer ID, version.
• Job, job-run, scheduler and worker activity, including job and job-run names and IDs.
• Browser-side UI messages: the Management Console web UI forwards its own client-side console output into common.log, tagged with the session ID.
• Server errors with stack traces.

audit.log contents

The audit.log is a deliberate record of administrative actions, and therefore is identity-rich by design:

• The acting user, user ID, user groups, and authentication token (obscured).
• Source IP address and device.
• For Agent-originated events: hostname, OS username, OS and version, device ID, CPU model, peer ID.
• Before/after values for configuration changes.

mchost.log contents

The mchost.log file contains events from various Management Console's back-end components.

Redaction on the Management Console

Structured data written to the log passes through a redaction routine that obscures values under these keys:

file_key, secret, rw_secret, ro_secret, password, password2, previousPassword, token, client_token, bootstrap_token, access_token, id_token, reset_password_token, credentials, peerCertKey, pass, cert, license, accessID, accessSecret, access_id, access_secret, key, sasToken, sas_token, client_secret, clientSecret

Obscuring keeps a leading fragment (roughly the first 20% of the string) and masks the remainder — enough to correlate a token across log lines without disclosing it.

Important: db.log and db-history.log

• The db and db-history loggers are configured without secure stringification. Database query logs can therefore contain query parameters verbatim. These files are the most sensitive of the four and should be handled accordingly. Optionally, you can mitigate this by enabling sensitive data encryption. For more information, see Sensitive data encryption.
• By default, only error-level messages are logged, despite the logger being set to verbose.

What actually leaves the customer's environment

Logging is local and the data moves only through one of these paths:

• Administrator-initiated log collection
• Support request packages
• Automatic upload
• End-user initiated support request

Administrator-initiated log collection

An administrator requests logs from selected Agents through the Management Console. The Management Console issues an upload action; each Agent packages and uploads its logs to the console, which zips them. The request carries three options:

Option	Default	Description
Time window	Last 7 days	Limits which rotated log files are included.
Send Management Console logs	On	Includes the Management Console's own logs in the package.
Include crash reports	Off	Attaches crash minidumps (and, on macOS, system DiagnosticReports).
Include Agents debug status	On	Attaches the Agent's debug status JSON file containing its activity and configuration.

Support request packages

A support request assembles a single archive containing:

• report.json — submitter email, description, subject, console version, license ID, affected job runs, and (for user-initiated requests) the initiating Agent's name and peer ID.
• Management Console state snapshots — Agents and proxies, transfers, jobs, job runs, groups, file policies, errors, Agent statuses, cluster snapshots, network policy (with sensitive data obscured).
• Hardware information — memory, CPU model and load, storage mount points.
• A directory tree of the Management Console's application data folder.
• Optional per-Agent debug status.
• The collected Agent log archives.
• The Management Console's own common.log and audit.log (optional).
• Management Console host logs.
• Any files the administrator attaches manually.

If Automatically upload to Resilio is selected, this archive is uploaded to Resilio support, where it's stored for 30 days after the ticket is closed and then permanently deleted. To inspect the archive before sending it, deselect that option and choose Save request, then download it from the Management Console. For details, see Getting help and contacting support.

Automatic upload

Licensing can enable an automatic support-request upload schedule, under which the above package is assembled and uploaded on a recurring basis without a per-incident administrator action. You can suspend or resume automatic logs upload from the Management Console at any time (requires Resilio 6.0.3 or newer).

End-user initiated support request

Feature availability

Available in Resilio 6.0 and newer.

End-users can initiate a support request from their locally installed Resilio Agent. By default, the request includes the Agent's debug status and its own logs.

Customer controls

Control	Where	Description
Log mask	Agent debug.txt	Reduce logging verbosity, or enable only specific subsystems.
Debug logging profile parameter	Agent profile	Toggle debug logging on and off.
log_size, log_ttl, max_compressed_logs	Agent settings	Cap on-disk footprint and retention (defaults: 1000 MB, 90 days, 100 archives).
Time window on log requests	Management Console log request	Ship only the relevant period.
Send Management Console logs	Management Console log request	Includes the Management Console's own logs in the package.
Include crash reports	Management Console log request	Leave off unless a crash is being investigated.
Include Agent debug status	Management Console log request	Include the debug status JSON file containing Agent's activity and configuration.
Console log levels and rotation	Console configuration	Per-logger level, max size, file count.
Inspect before sending	—	Support bundles are plain zip archives; they can be opened and reviewed before upload.