General Agent Run-time Troubleshooting

When Layer8Insight is installed, the 'dcacsvc' windows service (process 'dcac.exe') and the 'uxmtr.exe' process must be running for data to be captured and reported. The 'dcacsvc' service acts as a watchdog to restart 'uxmtr.exe' if it stops for any reason, but it is not required for successful use of Layer8Insight.

The 'dcacsvc' windows service should automatically restart if it stops from an error.

If you run into any issues with Layer8Insight not performing as expected, it is recommended that you inspect the output of any of the following debug / log output forms:

  • Status page: open a browser on the endpoint / client and go to the page This page prints out status information for the running Layer8Insight components. It is enabled if the Layer8Insight configuration file (config.ini) includes the setting StatusReport=1 in the [dcacConfig] stanza.

  • Diagnostic Log Viewer: both the 'dcacSvc' service and the 'uxmtr.exe' process will produce debug output that is visible using the included Layer8Insight diagnostic viewer application found in the 32-bit Program Files folder "OctoInsight\Layer8Insight". The diagnostic output to the Layer8Insight Diagnostic Viewer is enabled in the config.ini file by setting the options DebugEnabled=1 and DCACDiagLogEnabled=1 in the [dcacConfig] stanza and the options DebugEnabled=1 and UXMTRDiagLogEnabled=1 in the [uxmtrConfig] stanza

  • DbgView output: both the 'dcacsvc' service and the 'uxmtr.exe' process will produce debug output that is visible using Windows' debug utility, DbgView. This tool can be obtained from the SysInternals package ( Download this tool and run it as Administrator and hit Ctrl + K to enable kernel output capture. The DbgView output is enabled in the configuration file (config.ini) by setting the option DebugOutput=1 in both [dcacConfig] and [uxmtrConfig] stanza.

  • Windows Event Log: by default the Layer8Insight software will output debug information to the Windows Event Log. There is a specific folder named 'OctoInsight' under the 'Application and Service Logs' folder that will contain all events emitted by the Layer8Insight agents. The setting 'ErrorEventLog' under the [commonConfig] stanza of the configuration file (config.ini) controls the Windows Event Log output. It is enabled by default, but it can be forced using ErrorEventLog=1.

  • License Expiration: if the Layer8Insight agents stop running or don't seem to be producing data, double-check that your license has not expired. License expiration errors should be in the Windows Event Log and produced as logged events in the Layer8Insight data output (e.g., you can search for license expiration messages in Splunk).
Have more questions? Submit a request


Please sign in to leave a comment.
Powered by Zendesk