Where Them
Logs AppWTLA-01

Cisco Secure Client

5 log locations · Windows, Linux

Cisco Systems, Inc.

Where Cisco Secure Client keeps its logs

Cisco Secure Client logs to Event Viewer > Applications and Services Logs > Cisco Secure Client on Windows. 2 other Windows log locations are recorded below. These paths were verified for msi installs - a different installer, or a portable copy, can put them somewhere else.

Cisco Secure Client logs to /var/log/syslog on Linux. 1 other Linux log location is recorded below, including paths for Ubuntu and Red Hat.

Paths are printed exactly as Cisco Secure Client writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.

Finding your way around Windows and Linux.

WIN

Cisco Secure Client

Cisco Systems, Inc.
VPNEvent Viewer > Applications and Services Logs > Cisco Secure Client- Cisco sends Windows VPN logs to Event Viewer, not to a folder. Zero Trust Access has its own channel, Cisco Secure Client - Zero Trust Access
client%LOCALAPPDATA%\Cisco\Cisco Secure Client\Logs\
installer (web deploy upgrade)%WINDIR%\Temp\cisco-secure-client-win-<version>-core-vpn-webdeploy-k9-install-<timestamp>.log
msisystemper-userper-machine
Wrong path? Add a variant

How to turn on debug logging for Cisco Secure Client

  1. Windows: For route debugging, create the DWORD value DebugRoutesEnabled under HKEY_LOCAL_MACHINE\SOFTWARE\Cisco\Cisco Secure Client (under WOW6432Node on 64-bit Windows); output goes to debug_routechangesv4.txt and debug_routechangesv6.txt in the system temp folder.
  2. macOS and Linux: For route debugging, run sudo touch /opt/cisco/secureclient/vpn/debugroutes.
  3. Windows: For kernel driver debugging, run "%ProgramFiles(x86)%\Cisco\Cisco Secure Client\acsocktool.exe" -sdf <flag>.
  4. Windows: Restart the agent with net stop csc_vpnagent && net start csc_vpnagent and capture the output with Sysinternals DebugView.
  5. Windows: Switch kernel driver debugging off afterwards with acsocktool.exe -cdf.
  6. Windows: For Umbrella SWG (5.0 MR3 or later), create SWGConfigOverride.json containing {"logLevel": "1"} in C:\ProgramData\Cisco\Cisco Secure Client\Umbrella\SWG\, then restart.
  7. macOS: For Umbrella SWG, create the same file in /opt/cisco/secureclient/umbrella/swg/, then restart.
  8. For Network Access Manager, turn on Extended Logging in the app, then collect a DART bundle.

How to collect Cisco Secure Client logs

  1. Windows: Open DART from the Start menu, or from the Secure Client gear icon > Advanced Window > Diagnostics.
  2. macOS: Open Applications > Cisco > Cisco DART, or choose Generate Diagnostic Report from the app menu.
  3. Linux: Run /opt/cisco/secureclient/dart/dartui (AnyConnect 4.x: /opt/cisco/anyconnect/dart/dartui).
  4. Run DART with admin rights on macOS and on some Linux releases.
  5. Attach DARTBundle.zip, which DART saves to the Desktop by default.
  6. Windows: For an install problem, rerun the installer with a log: msiexec /i cisco-secure-client-win-<version>-predeploy-k9.msi /lvx ac-install.log.