Need to understand Netbackup logs

[Mohankumar_K]

Hi Experts .

I need to understand netbackup logs why we are getting numeric stamp before it starts writing the log entry immediate after time stamp?

like  as below, could you some one explain... how this numeric value help us understanding more details in the troubleshooting point of view.

<2>

<4>

<8>

<16>

<32> 

19:00:58.235 [6300.12728] <2> volume_cleanup_delete_fragment: deletion of ctxalweb2.Corp.CtxAL.net_1418195605, copy number 1, fragment number 1, resume number 0 media id D:\ succeeded

19:00:58.251 [6300.12728] <4> volume_cleanup: ending volume D:\: Kbytes total capacity: 1153417212, used space: 6393594

19:00:16.283 [13844.6524] <8> vnet_vnetd_connect_forward_socket_begin: [vnet_vnetd.c:460] ipc_string 22343

7:27:40.579 PM: [10012.11012] <16> dos_backup::tfs_clear_archive_bit: TRV - error clearing archive bit: 'C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT' (WIN32 5: Unknown error)

7:27:40.579 PM: [10012.11012] <16> dos_backup::tfs_clear_archive_bit: TRV - error clearing archive bit: 'C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys' (WIN32 5: Unknown error)

[revarooo]

These numeric stamps between the < > determine the level/severity of the messages.

2 4 and 8 are usually informational only.

16 and 32 are warnings or errors and these are the ones to look out for when looking in the logs to troubleshoot. Sometimes you will need to look backwards in the logs from the error upwards and sometimes what's in the 2s 4s and 8s can also help.

[Possible · Accepted solution]

Two things you need to know about NBU logs:

1. debug codes in these brackets: < >

<2> debug
<4> info
<8> warning
<16> error
<32> sever error

2. Process id in square brackets [ ]

[mph999]

Or ...

<2> we ignore

<4> double take

<8> raised eyebrows

<16> consider hiding under desk

<32>  head off to pub

[watsons]

lol, Martin!

Anyway, <16> is usually what we see as major ERROR, <32> is rare but mostly associated with "core dump or crash" (or not...). Sometimes having a <16> does not mean error at all...

But all these are not 100% accurate, it's better you grep for the exact PID from the logs and look through it. In your example, the PID which has a <16> is: 10012 

[Marianne]

Couple of weeks later, but want to add my 2c: 

See my post in this discussion:

How to use logs