Logs and Diagnostics

Each Cygna Forest Recovery service writes its own log file and also sends warnings and errors to the Windows Event Log. The DC agent keeps a transcript of every backup and restore on the domain controller. Diagnose most problems from the console first: the Backup Jobs detail sheet shows a backup's error and transcript, and a restore run's page shows what the machine reported. Turn to the files in this topic when the console does not say enough, or when a service cannot reach the Manager at all.

Service logs

Component Folder File name
Manager %ProgramData%\Cygna Labs\Disaster Recovery Suite Manager\logs manager-yyyyMMdd.log
DC agent %ProgramData%\Cygna Labs\Disaster Recovery Suite DC Agent\logs dc-agent-yyyyMMdd.log
Storage agent %ProgramData%\Cygna Labs\Disaster Recovery Suite Storage Agent\logs storage-agent-yyyyMMdd.log
Isolated Recovery Host agent %ProgramData%\Cygna Labs\Disaster Recovery Suite Isolated Recovery Host Agent\logs host-agent-yyyyMMdd.log

The folders are readable by SYSTEM and Administrators only. A component installed on the same machine as another writes to its own folder.

  • Rotation—A new file is started each day, and when the current file reaches 32 MB.
  • Retention—Files older than 30 days are deleted. The Log retention (days) setting changes this for each machine; 0 keeps every file.
  • Format—One line per entry: a UTC timestamp, the level (TRACE, DEBUG, INFO, WARN, ERROR, or CRIT), the source, and the message. For example: 2026-09-03 18:55:01.234Z INFO Firebreak.DcAgent.AgentWorker Dialing the manager at https://10.0.0.10:5211
  • Level—Information and above by default. To change it, set Logging:LogLevel:Default in the component's appsettings.json, or Logging:CygnaDRFile:LogLevel:Default to change the file alone, and restart the service.
  • Location—The Log folder setting moves the log for one machine. An empty value turns the file log off; that is the only way to turn it off.

To follow a log while the service runs, use Get-Content -Wait in PowerShell. Some editors ask for exclusive access and refuse to open a file the service holds open.

At startup each service logs the configuration it came up with, the Manager address it dials (for agents), and the CA fingerprint it trusts. These lines are the first thing to check when an agent does not appear on the Agents screen.

Windows Event Log

Each service also writes warnings, errors, and critical entries to the Windows Application log. The Manager adds one informational entry at every start, giving its CA fingerprint:

Cygna DR manager CA fingerprint: <fingerprint>. Agents are installed with this value, and cdr asks you to confirm it the first time it connects.

Otherwise the Event Log holds warnings and errors only; use the log files for anything below a warning.

Job transcripts on domain controllers

The DC agent keeps the wbadmin transcript of each backup in %ProgramData%\Cygna Labs\Disaster Recovery Suite DC Agent\job-logs on the domain controller. It keeps the newest 50; the Job transcripts kept setting changes the number. The transcript is also sent to the Manager, so you can usually read it in the Transcript section of the job's detail sheet on the Backup Jobs screen.

A restore keeps its own record and transcript on the domain controller, separate from the job transcripts. The restore run's page in the console shows the end of the transcript and gives the path of the full transcript on the machine. When a restore stops and needs an operator, the agent also leaves a note on the machine's disk.

After a full system recovery, if the restored system cannot apply its planned network settings, the DC agent writes what went wrong to POST-RECOVERY-README.txt on the machine and reports it once it connects.

Recovery environment output

The recovery agent runs inside the recovery image, from memory, so it has no log file of its own on the machine. It shows its progress on the machine's console and reports each phase to the Manager, where the restore run's page shows it. If a full system recovery fails, the machine stays at the recovery prompt with the output on screen, so you can read it there before you restart. If the Manager does not confirm the result, restart the machine by hand with wpeutil reboot.

Push installation logs

When a push installation of the DC agent fails, the Windows Installer log stays in %SystemRoot%\Temp on the target, and the deployment's result names its path. After a successful installation the log is removed. cdr agent deploy --json includes each target's full transcript.

Recovery image builds

The storage agent writes the DISM log of each recovery image build to the Build working folder, where you can collect the log of a failed build.

What to collect for support

When you contact Cygna Labs Corp. support, create a support package. It is one zip file with what support needs for a case, collected over the agents' own connections, so nobody has to sign in to each domain controller to gather files.

Create it in one of these ways:

Creating, downloading, and removing a support package needs the config.export capability, held by the System Admin role and the break-glass account. Each is recorded in the audit trail.

What a support package contains

  • Manager service log—The log files last written within the period you choose: by default the last 3 days, or everything still retained.
  • Manager database copy—A copy of the Manager database with every credential removed (see below).
  • Host and configuration facts—The Manager's build, operating system, time zone, CA fingerprint and whether the CA key has an escrow copy, database and snapshot details, free disk space, and the agents connected at the time with their versions. Also the Manager's own configuration values; a value whose name refers to a token, password, passphrase, secret, credential, or key is shown only as set or not set.
  • DC agent files—From each connected DC agent: its service log, its backup job transcripts, and its state file.
  • Storage agent files—From each connected storage agent: its service log and its state file. Never the vault, the staging area, or the OS media library.
  • Isolated Recovery Host agent files—From each connected Isolated Recovery Host agent: its service log and its state file.
  • A description of the package—A README.txt, and a package.json that records what each machine sent, what was left out and why, and what was removed from the database copy.

Each agent sends its newest files first, up to a limit per agent (512 MB unless you set another with cdr support package --max-agent-mb); anything over the limit or unreadable is left out and listed. A DC agent never sends the folder a restore uses on the domain controller, because it can hold a protected credential during a restore.

An agent that is not connected when you create the package is listed as offline. Collect that machine's log folder by hand, or create the package again once the agent is connected.

What the database copy leaves out

The Manager database holds the operator accounts and the Manager CA, so the package never carries the live database. It carries a copy with these removed:

  • The Manager CA's private key and its escrow copy. The CA fingerprint is kept.
  • Operator password hashes, and every session.
  • Recovery enrollment tokens.
  • Every secret setting, such as the SMTP password.
  • The typed name of a failed sign-in that matches no operator, because it is often a password typed in the username field.

The copy is compacted after the removal, so the removed values are not left in its free space, and checked before the package is written. If the check fails, no package is written. Because the copy has no CA key, a support package cannot restore a Manager; use the database snapshots and the recovery passphrase for that (see Recovering the Manager).

Note: Important: A support package is not encrypted, and it still describes your forest in detail: domain controllers, addresses, shares, accounts named in logs, and the audit trail. Store and send it as you would your own network documentation, and delete it when the support case is closed.

Where packages are kept on the Manager

The Manager builds each package in the support folder beside its database, by default %ProgramData%\Cygna Labs\Disaster Recovery Suite Manager\support, which is readable by SYSTEM and Administrators only. The file is named cygnadr-support-<manager>-<yyyyMMdd-HHmmss>.zip, with the time in UTC.

  • Only one package can be collected at a time. Starting another while one is being collected is refused.
  • A package is refused when the Manager's data disk has less than 2 GB free. Below 1 GB free, agents not yet started are skipped.
  • A finished package is kept on the Manager for 24 hours, then deleted. Every package is also deleted when the Manager service starts.
  • cdr support package removes the package from the Manager once it has saved it. After a download from the console, remove it yourself with Remove from the manager.

When the Manager service does not start

Run this command on the Manager, in an elevated command prompt in the Manager's program folder. It builds the Manager's part of a support package—its logs, the database copy with every credential removed, and host facts—without the service:

CygnaDR.Manager.exe support package [path] [--days N | --all-logs]
  • path—The file to write. Default: the standard file name in the current folder. An existing file is not overwritten.
  • --days N—Logs last written within this many days, from 1 to 366. Default: 3.
  • --all-logs—Every log file still retained, whatever its age.

The package has no agent files, because there are no agent connections without the service. Collect the agents' log folders by hand if support needs them. The command is recorded in the audit trail against the Windows account that ran it. When the service is running, use cdr support package instead, which adds every agent's files.

Also include

With the support package, or instead of it if you cannot create one, send:

  • The Cygna Forest Recovery version, shown in the account menu in the console and by cdr --version.
  • If you cannot create a support package, the service log files from the Manager and from each machine involved, covering the time of the problem.
  • For a backup problem, the job's error code and transcript from the Backup Jobs detail sheet, or the transcript from the DC's job-logs folder.
  • For a restore problem, the restore run's page, and the restore transcript from the domain controller.
  • The output of relevant commands with --json, such as cdr agent list --json, cdr config show --agents --json, cdr alert list --json, and cdr restore show <run> --json.
  • Warnings and errors from the Application log on each machine involved.

Note: Important: Do not send the Manager database (cygnadr.db) itself or its snapshots unless support asks for them: they hold the operator accounts, their password hashes, and the Manager CA. The database copy in a support package has these removed, and is the copy to send. Do not send an installer log from an installation that was given ENROLLMENTTOKEN, because the log can contain the token.