Agent log files

The Datto RMM log files are text files created by Datto RMM that contain a detailed record of events in the Datto RMM Agent. These log files are used for Agent troubleshooting and diagnosis.

Separate log files are created for the main Datto RMM Agent Service and the Datto RMM Agent Process. The location and behavior of the log files vary per operating system.

The Datto RMM Agent Process (AEMAgent.exe) is a child process of the main Datto RMM Agent Service (CagService) and is dedicated solely to performing endpoint monitoring tasks. Audit and other data submissions are performed by the main Datto RMM Agent Service.

For further information about Agent requirements, refer to Supported operating systems and Agent requirements.

Location of the log files

NOTE  The Datto RMM Agent Process log files are encoded in UTF-8.

Operating System Datto RMM Agent Service Datto RMM Agent Process
Windows Log location
• 32-bit version of Windows: %Program Files\CentraStage\log.txt
• 64-bit version of Windows: %Program Files (x86)\CentraStage\log.txt

Notes
• Daily at midnight, the current log.txt file is moved to a directory named archives in the log location and logging begins a new file.
• The archive log files have the following naming convention log.yyyy-mm-dd.0.txt (that is, log.2023-09-20.3.txt) with a date stamp in in the format of yyyy-mm-dd and a number indicating the correct order.
• The most recent archive log file will have the most recent date and highest number (for example, log.2023-09-20.10.txt is more recent than log.2023-09-20.3.txt)
• A maximum of 30 days' log files or a total of 30 log files, if they are large in size, are archived.
• Upon Agent uninstallation, the current log file is moved to %ProgramData%\CentraStage\Logs with a prepended time stamp in the format yyyyMMddHmmss (that is, 2017060185607_log.txt). The archive log files are not moved to this location upon Agent uninstallation.		 Log location
%ProgramData%\CentraStage\AEMAgent\DataLog\aemagent.log


Notes
• Daily at midnight or, if it grows larger than 10 MB, the current aemagent.log file is moved to a directory named Archives in the log location and logging begins a new file.
• The archive log files have the naming convention [date].[number].aemagent.log (that is, 20170704.0.aemagent.log) with a date stamp in the format yyyyMMdd and a number indicating the correct order.
• The most recent archive log file will have the highest number, while the oldest archive log file will have the smallest number (starting from 0).
• A maximum of 30 days' log files or a total of 30 log files, if they are large in size, are archived.
• Upon Agent uninstallation, all log files remain untouched.
macOS Log location
/var/log/AEMAgentlog.txt

Notes
• Daily at midnight, the current AEMAgentlog.txt file is renamed with the following naming convention AEMAgentlog.[number].txt (that is, AEMAgentlog.0.txt) and logging begins a new file.
• The most recent archive log file is AEMAgentlog.0.txt with older files having incrementing numbers moving back in time.
• A maximum of 30 days' logs are archived (AEMAgentlog.0.txt - AEMAgentlog.29.txt).
• Upon Agent uninstallation, the Agent log files are moved to usr/local/share/CentraStage/Logs.		 Log location
/usr/local/share/CentraStage/AEMAgent/DataLog/aemagent.log

Notes
• Daily at midnight or, if it grows larger than 10 MB, the current aemagent.log file is moved to a directory named Archives in the log location and logging begins a new file.
• The archive log files have the naming convention [date].[number].aemagent.log (that is, 20170704.0.aemagent.log) with a date stamp in the format yyyyMMdd and a number indicating the correct order.
• The most recent archive log file will have the highest number, while the oldest archive log file will have the smallest number (starting from 0).
• A maximum of 30 days' logs or a total of 30 log files, if they are large in size, are archived.
• Upon Agent uninstallation, all log files remain untouched.
Linux Log location
/opt/CentraStage/log.txt

Notes
• Daily at midnight, the current log.txt file is moved to a directory named archives in the log location and logging begins a new file.
• The archive log files have the following naming convention log.[year]-[month]-[day].txt (that is, log.2024-11-27.txt).
• The most recent archive log file is log.0.txt with older files having the day they were created in the name.
• A maximum of 30 days' logs are archived.
• Upon Agent uninstallation, the Agent log files are moved to usr/local/share/CentraStage/Logs.		 Log location
/usr/local/share/CentraStage/AEMAgent/DataLog/aemagent.log

Notes
• Daily at midnight or, if it grows larger than 10 MB, the current aemagent.log file is moved to a directory named Archives in the log location and logging begins a new file.
• The archive log files have the naming convention [date].[number].aemagent.log (that is, 20170704.0.aemagent.log) with a date stamp in the format yyyyMMdd and a number indicating the correct order.
• The most recent archive log file will have the highest number, while the oldest archive log file will have the smallest number (starting from 0).
• A maximum of 30 days' logs or a total of 30 log files, if they are large in size, are archived.
• Upon Agent uninstallation, all log files remain untouched.

Once you have located the log files, you can copy them for troubleshooting purposes. The methods outlined below will explain how to copy a log file by using a command line on Windows, macOS, or Linux devices. It will also detail how to copy the files when you are connected to a remote device through the Agent Browser.

  1. Change directory to the location of the log file you would like to copy. For example, if you would like to copy the Datto RMM Agent Service log file on a 64-bit device, use the following command:
cd "C:/Program Files (x86)/CentraStage"

NOTE  If you are using a 32-bit operating system, delete the (x86) portion of the command.

  1. Press Enter.
  2. When you are in the directory, type the following:
copy log.txt <give new filename here>.txt

EXAMPLE  copy log.txt logCopy.txt

  1. Press Enter.
  1. Open terminal. If you would like to copy the Datto RMM Agent Service log file, type the following:
cd /var/log
  1. Press Enter.
  2. Then type the following:
cp AEMAgentlog.txt <give new filename here>.txt

EXAMPLE  cp AEMAgentlog.txt AEMAgentlogCopy.txt

  1. Press Enter.
  1. Open terminal. If you would like to copy the Datto RMM Agent Service log file, type the following:
cd /opt/CentraStage
  1. Press Enter.
  2. Then type the following without brackets:
cp log.txt <give new filename here>.txt

EXAMPLE  cp log.txt logCopy.txt

  1. Press Enter.

You can locate and copy the Datto RMM Agent log files of a remote computer when you are connected to it through the Agent Browser.

  1. Log in to the Agent Browser and connect to a device as outlined in this topic: Agent Browser.
  2. Click on the File Management tool. For information on permissions, refer to File Manager in Remote control tools.
  3. Locate the log file you would like to copy. Refer to Location of the log files.
  4. Click on the log file and click the Copy to my desktop icon.
  5. To obtain the log file which is actively being written to, click on the Command Shell tool and use the command line method. For instructions, refer to Windows, macOS, and Linux.
  1. Click on the copied log file and click the Copy to my desktop icon.

The Datto RMM Agent Service (CagService) logs audit messages in the Agent log files in the form of Audit reason: REASON (for example, Audit reason: REQUESTED_BY_PLATFORM). For a list of the reasons, refer to Audit reasons logged in the Agent log files.