When Layer8Insight is installed, the 'dcacsvc' windows service (process 'dcac.exe') and the 'uxmtr.exe' process must be running for data to be captured and reported. The 'dcacsvc' service acts as a watchdog to restart 'uxmtr.exe' if it stops for any reason, but it is not required for successful use of Layer8Insight.
The 'dcacsvc' windows service should automatically restart if it stops from an error.
If you run into any issues with Layer8Insight not performing as expected, it is recommended that you inspect the output of any of the following debug / log output forms:
- Status page: open a browser on the endpoint / client and go to the page http://127.0.0.1:50291/status. This page prints out status information for the running Layer8Insight components. It is enabled if the Layer8Insight configuration file (config.ini) includes the setting
StatusReport=1in the [dcacConfig] stanza.
- Diagnostic Log Viewer: both the 'dcacSvc' service and the 'uxmtr.exe' process will produce debug output that is visible using the included Layer8Insight diagnostic viewer application found in the 32-bit Program Files folder "OctoInsight\Layer8Insight". The diagnostic output to the Layer8Insight Diagnostic Viewer is enabled in the config.ini file by setting the options
DCACDiagLogEnabled=1in the [dcacConfig] stanza and the options
UXMTRDiagLogEnabled=1in the [uxmtrConfig] stanza
- DbgView output: both the 'dcacsvc' service and the 'uxmtr.exe' process will produce debug output that is visible using Windows' debug utility, DbgView. This tool can be obtained from the SysInternals package (https://technet.microsoft.com/en-us/sysinternals/debugview.aspx). Download this tool and run it as Administrator and hit Ctrl + K to enable kernel output capture. The DbgView output is enabled in the configuration file (config.ini) by setting the option
DebugOutput=1in both [dcacConfig] and [uxmtrConfig] stanza.
- Windows Event Log: by default the Layer8Insight software will output debug information to the Windows Event Log. There is a specific folder named 'OctoInsight' under the 'Application and Service Logs' folder that will contain all events emitted by the Layer8Insight agents. The setting 'ErrorEventLog' under the [commonConfig] stanza of the configuration file (config.ini) controls the Windows Event Log output. It is enabled by default, but it can be forced using
- License Expiration: if the Layer8Insight agents stop running or don't seem to be producing data, double-check that your license has not expired. License expiration errors should be in the Windows Event Log and produced as logged events in the Layer8Insight data output (e.g., you can search for license expiration messages in Splunk).