Getting familiar with the Intune Management Extension log files

This week is another post about the Intune Management Extension (IME). This week the focus is on the log files of the IME. Probably not the most interesting subject, but definitely an important subject. Especially as an IT administrator, it’s important to be familiar with the available log files of the IME and to understand the usage of those log files. Besides that, it can also be interesting to be familiar with the configuration options for those log files. Together that will help with a better understanding of the logging capabilities of the IME and the log files that should be used to find the information related to a specific problem. This post will have a closer look at the IME log files and the configuration options for those log files.

Note: At the moment of writing, there are 9 log files available that are related to the IME, the health check and the sensor.

Understanding the available log files

The number of log files of the IME started really small. Not really surprising, as in the early days the functionality provided by the IME was also a lot smaller. But, as the functionality was growing, it also became more important for the information to be stored in separate log files. The information was simply getting cluttered and an actual view on what’s happening was getting lost. Nowadays, the information is more and more logged in separate log files. The number of log files is still growing. At the moment of writing, the number of IME log files is at 9. The currently available log files are described below, including a short description about the component that uses the log file and the configuration file that is used to set that log file.

• AgentExecutor.log: This log file contains the information provided by the AgentExecutor component. That component executes the different actions that are performed by the IME. The log file is configured in the AgentExecutor.exe.config.
• AppActionProcessor.log: This log file contains the information provided by the AppActionProcessorTrace component. That component processes the actions for assigned apps that are performed by the IME. The log file is configured in the Microsoft.Management.Services.IntuneWindowsAgent.exe.config.
• ClientHealth.log: This log file contains the information provided by the ClientHealth component. That component checks the client health of the IME. The log file is configured in the ClientHealthEval.exe.config.
• DeviceHealthMonitoring.log: This log file contains the information provided by the DataCollection component. That component collects data about hardware readiness, device inventory, and more. The log file is configured in the Microsoft.Management.Services.IntuneWindowsAgent.exe.config.
• HealthScripts.log: This log file contains the information provided by the HealthScripts component. That component runs the assigned detection and remediation scripts, at the required schedule, that are performed by the IME. The log file is configured in the Microsoft.Management.Services.IntuneWindowsAgent.exe.config.
• ImeUI.log: This log file contains the information that is provided by the ImeUI component. That component runs the UI that is shown to the user, via notifications, by the IME. The log file is configure in the ImeUI.exe.config.
• IntuneManagementExtension.log: This is one of the log files that it started with and it is still the main log file around the IME. Most of the main activities of the IME are still logged in this log file. When different components are used for the actual execution, the detailed logging will also move the log files that belong to the used component. The log file is configured in the Microsoft.Management.Services.IntuneWindowsAgent.exe.config, the AgentExecutor.exe.config, the ClientHealthEval.exe.config, and the ImeUI.exe.config.
• Sensor.log: This log file contains the information provided by the SensorFramework component. That component subscribes to different events on the devices, to gather usage information, via the related scheduled task.
• Win32AppInventory.log: This log file contains the information provided by the Win32AppInventory collector. That component collects the inventory of the installed Win32 applications. The log file is configured in the Microsoft.Management.Services.IntuneWindowsAgent.exe.config.

Note: Keep in mind that this list of IME log files might be growing further in the (near) future.

Configuring the name of the log file

After being familiar with the different log files, it’s also interesting to see what can actually be configured, specifically around the different log files. Within the configuration file of the different executables that are used for the different IME components, there are also some minimal configuration options for those log files. That includes the name of the log file that should be used for that specific component. Besides that, there is also a switch that can be used to set the log level. Below in Figure 2 is a simple example of an adjusted log file name and the corresponding behavior on the device.

Configuring the location, size and history of the log files

When looking further at the growing number of available log files for the IME, it’s also interesting what else can be tuned. So, on one hand it’s the basic configuration that is available via the different configuration files, for the different components of the IME. And on the other hand it’s the more generic configuration that is available via the registry. The latter configuration enables the IT administrator to set the log location, log history and the maximum log size, for all log files. Those configurations can be achieved by using the following registry values and data, as also shown below in Figure 3.

• Set the maximum log number of log files that should be contained as history (see number 1):
  • Value location: HKLM\SOFTWARE\Microsoft\IntuneWindowsAgent\Logging
  • Value name: LogMaxHistory
  • Value type: String
  • Value data: Specify the number of log files
• Set the maximum size of the log files before it should continue in a new log file (see number 2):
  • Value location: HKLM\SOFTWARE\Microsoft\IntuneWindowsAgent\Logging
  • Value name: LogMaxSize
  • Value type: String
  • Value data: Specify the size of log files in bytes
• Set the location of the log files (see number 3):
  • Value location: HKLM\SOFTWARE\Microsoft\IntuneWindowsAgent\Logging
  • Value name: LogDirectory
  • Value type: String
  • Value data: Specify the location of the log files

Note: The Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon.dll provides the easiest insights around these registry keys in the LogTraceListener class.

Once that configuration is in place, and the IME is reading that configuration, the log files will start behaving differently. The log files will start behaving conform the newly applied configuration, as shown below in Figure 4. That provides an overview of the adjusted behavior. The default behavior of the log history has changed, as there are already four log files available. Besides that, the default size of 3MB has changed with the latest log file.

More information

This process is currently not documents in the Microsoft docs.