# Troubleshooting

# Apple MDM Troubleshooting

Use this article to start troubleshooting Apple MDM enrollment and push-notification issues in FileWave.

Before digging into logs, confirm the basics first:

1. Your FileWave Server should use a fully qualified DNS name. This is the DNS name entered in FileWave Central under Preferences &gt; Mobile.
2. If you changed the Server DNS Name in Preferences &gt; Mobile, regenerate the certificate and trust the new certificate from the enrollment page, for example [https://dns:20443/ios](https://dns:20443/ios).
3. If the APNs certificate upload fails, confirm that the certificate was created from the matching FileWave Server DNS name and is not password protected.
4. If those checks are correct and the issue continues, create an admin user account for Django MDM debugging on the FileWave Server:  
    sudo fwcontrol mdm addadminuser
5. Another important log file is "/usr/local/filewave/log/filewave\_django.log"
6. Make sure FileWave Central shows "iOS/MDM Service OK" before expecting Apple devices to enroll or receive management commands.

The following are some of the problems encountered before:

#### **Enrollment error: FileWave MDM Configuration is invalid**

The profile "FileWave MDM Configuration" is invalid. The MDM payload  
"Mobile Device Management" contains an invalid topic.

This usually points to an APNs certificate problem. Regenerate the APNs certificate and confirm it matches the current FileWave Server configuration.

#### **Connection problems**

If iOS or iPadOS devices fail to enroll, you may see an MDM check-in connection error in the server logs:

error  
(61, 'Connection refused')  
Request Method: PUT  
Request URL: https://fwxserver.example.org:20443/ios/mdm\_checkin  
Exception Type: error  
Exception Value:  
(61, 'Connection refused')

Older APNs troubleshooting often referenced provider port 2195. Apple's current APNs network guidance uses TCP 443 or 2197 for sending notifications to APNs, and TCP 5223 for Apple devices to maintain their APNs connection.

Check current firewall requirements against [Default TCP and UDP Port Usage](https://kb.filewave.com/books/filewave-general-info/page/default-tcp-and-udp-port-usage) and Apple's [Apple Push Notification service network guidance](https://support.apple.com/en-us/102266).

Do not open legacy APNs ports from old notes without checking the current FileWave and Apple requirements for your environment.

#### **TCP 5223: Apple devices to APNs**

TCP port 5223 must be open so Apple devices can maintain their APNs connection and receive push notifications.

For the FileWave-side port list, see [Default TCP and UDP Port Usage](https://kb.filewave.com/books/filewave-general-info/page/default-tcp-and-udp-port-usage).

# Backup Procedures for FileWave Hosted Servers

# What

This article explains what FileWave backs up for Hosted FileWave Servers, how often those backups run, and when a restore request usually applies.

# When/Why

FileWave performs daily backups for Hosted FileWave Servers and retains those backups for 30 days. These backups support recovery from hosted-server data loss, database or file corruption, and similar server-side recovery scenarios.

# How

Backups run daily and are stored in highly available AWS S3 buckets. The backup set includes FileWave server data, configuration, certificates, logs, and related service paths, including:

- /usr/local/filewave/fwxserver/DB
- /private/var/log
- /usr/local/filewave/fwxserver/Data Folder
- /usr/local/filewave/instrumentation\_data
- /usr/local/filewave/apache/conf
- /usr/local/filewave/apache/logs
- /usr/local/filewave/apache/passwd
- /usr/local/filewave/django/filewave
- /usr/local/filewave/conf
- /usr/local/filewave/certs
- /usr/local/filewave/fwcld
- /usr/local/filewave/ipa
- /usr/local/filewave/log
- /usr/local/filewave/media
- /usr/local/filewave/tmp
- /var/log
- /usr/local/filewave/scripts
- /usr/local/etc
- /tmp
- /usr/local/filewave/nats
- /install/docker-entrypoint.sh
- /usr/local/filewave/tls
- /etc/filewave\_init
- /etc/filewave\_setup

Hosted customers do not have direct access to these backup files. If a hosted restore is needed, contact FileWave Technical Support. Restore requests are generally handled for situations such as database corruption, file corruption, or hosted-infrastructure recovery after a major service incident.

## Related Links

- [FileWave Server Backup and Restore](https://kb.filewave.com/books/filewave-server/page/filewave-server-backup-and-restore "FileWave Server Backup and Restore") for self-managed/on-premises FileWave Servers

# Digging Deeper

Self-managed FileWave Servers use the separate backup and restore process linked above. Hosted FileWave customers should work through FileWave Technical Support because hosted-server backup storage and restore operations are managed by FileWave.

# FileWave Error Codes

### Server

<table id="bkmrk-error-context-explan"><tbody><tr style="background-color: rgb(251, 238, 184);"><td>Error</td><td>Context</td><td>Explanation</td><td>Solution</td></tr><tr><td>-8</td><td>During Database Verification</td><td>There are some orphaned objects in the database</td><td>The first thing to do is to run a DB compact. You can run it from Xserver monitor which is in /Applications/FileWave. This should solve the issue. If the compact is not fixing it, then we must be missing a certain type of cleanup in that operation. Generally, this doesn't pose a problem. If you'd like, you can stop the server and zip up the /fwxserver/Data Folder/\*dat and\*idx files and post them to our ftp site.</td></tr><tr><td>-1</td><td>While doing a Model Update you see a blank window</td><td>error creating Fileset File: XXXXXX, folderID: YYYYYYY not found, database damaged, call FileWave Tech Support   
889|0xb0513000|FATAL|Error: -1 when updating filesets during model update</td><td>This issue is fixed in FileWave version 4.1.1.  
  
If you are hitting this issue please upgrade Filewave Admin to 4.1.1.</td></tr><tr><td>14</td><td>Error 14 on file, found process: fwxserver/XXXXX exiting due to database error: 14 (Only Applicable to Server 3.7.4)</td><td>This is a soft database failure caused by a hard restart of the FileWave Server, it doesn't actually reflect a serious issue, but will cause the server to stop.</td><td>Upgrade to 3.7.5 to 4.0.X</td></tr><tr><td>`<br>fwxserver conflicts with fw-mdm-server-10.1.1-1.0.x86_64<br>`</td><td>upgrading to FileWave 11.x from a previous version</td><td>This is normally caused by upgrading from a system that originally installed filewave with two packages:  
  
fw-mdm-server  
  
fwxserver</td><td>As of version 11, FileWave installs both servers with just the single fwxserver installer.   
To fix this simply remove the mdm component before updating the server.   
This will not remove any of your MDM data  
  
`<br>sudo yum remove -y fw-mdm-server<br>`</td></tr></tbody></table>

### Client / Admin

<table id="bkmrk-error-context-explan-1"><tbody><tr style="background-color: rgb(251, 238, 184);"><td>Error</td><td>Context</td><td>Explanation</td><td>Solution</td></tr><tr><td>-150</td><td> </td><td>the file size downloaded to disk does not match the file size stored in the database of the FileWave Server</td><td>Delete this file from the Fileset and add a fresh copy from the Admin's hard disk</td></tr><tr><td>-125</td><td>Client downloading fileset</td><td>Booster does not have the file to serve to the client yet and so the client will try again later</td><td>Please wait</td></tr><tr><td>-13</td><td>fwgui is not running</td><td>On the client fwgui process is not running</td><td>Restart the filewave client from terminal :  
  
**macOS / Linux**  
  
`<br>sudo fwcontrol client restart<br>`</td></tr><tr><td>-3</td><td>During Admin File Upload</td><td>On slow networks an upload may timeout.</td><td> </td></tr><tr><td>-1</td><td>Not in inventory</td><td>That comes from a client attempting to activate a fileset before it has downloaded it. After the model update, it adds the activation action back into the queue</td><td>Please wait for sometime as the client is still downloading the fileset and once it has finished downloading it will activate</td></tr><tr><td>2</td><td>reading file from disk</td><td>This error is due to a wrong offset request</td><td>Upgrade to 3.7.5 or 4.0.4 will solve this issue</td></tr><tr><td>15</td><td> </td><td>This could happen if there is no or very less disk space left on the booster that the client is downloading the filesets from</td><td>Please check if the booster has enough free disk space. If the disk space is enough and still you are seeing this error contact support [help.filewave.com](https://help.filewave.com/)</td></tr><tr><td>32</td><td>while trying to send file data XXXXXD (Where XXXXX is the file ID)</td><td>Error 32 means broken pipe in the network. Generally this error should resolve by itself if everything in the network is fine. Troubleshooting : check to ping from the booster/server to client and vice versa and check if the problem doesn't exist in the network</td><td>1. If you see this error for long time try to remove the association of this fileset with the client and than associate again. This should solve the problem.  
2. Update to latest Filewave 3.7.X or 4.0.X</td></tr><tr><td>Failed CRC Validation</td><td> </td><td>A CRC check is a form of a checksum which is used to make sure data in files is the same on the client as on the server. The error "failed CRC validation" means that files on the client for whatever reason are being altered compared to what is on the server.</td><td>Please send the client log file from the client exhibiting this issue to support [help.filewave.com](https://help.filewave.com)</td></tr><tr><td>Kiosk Errors</td><td> </td><td>See: [VPP Kiosk Errors](https://kb.filewave.com/books/apple-school-business-manager/page/vpp-kiosk-error-details "VPP Kiosk Error Details")</td><td> </td></tr></tbody></table>

### Booster

<table id="bkmrk-error-context-explan-2" style="width: 100%;"><tbody><tr style="background-color: rgb(251, 238, 184);"><td style="width: 7.911%;">Error</td><td style="width: 12.5985%;">Context</td><td style="width: 55.1394%;">Explanation</td><td style="width: 24.3511%;">Solution</td></tr><tr><td style="width: 7.911%;">Failed CRC Validation</td><td style="width: 12.5985%;"> </td><td style="width: 55.1394%;">A CRC check is a form of a checksum which is used to make sure data in files is the same on the client as on the server. The error "failed CRC validation" means that files on the client for whatever reason are being altered compared to what is on the server</td><td style="width: 24.3511%;">Please send the booster log file from the booster exhibiting this issue to [help.filewave.com](https://help.filewave.com/)</td></tr></tbody></table>

# FileWave Log File Locations

The following lists the locations of log files, as well as some additional files used by FileWave across the FileWave family of products

<p class="callout info">**How to read the tables:** The **File** column lists the log filename or filename pattern, and the **Location** column lists where that file is stored. When sending logs to a collector, combine the directory and filename pattern. A trailing `*` means rotated log files may also exist, for example `nats-booster.err.log`, `nats-booster.err.log.1`, and `nats-booster.err.log.2`.</p>

## FileWave Admin

### FileWave Admin Logs

<table id="bkmrk-details-file-locatio" style="width: 100%;"><tbody><tr style="background-color: rgb(251, 238, 184);"><td style="width: 24.349067%;">**Details**</td><td style="width: 32.634864%;">**File**</td><td style="width: 43.016069%;">**Location**</td></tr><tr><td style="width: 24.349067%;">**FileWave Admin Log**  
  
Logs all FileWave Admin Connection Activity</td><td style="width: 32.634864%;">FileWaveAdmin.log, FileWaveAdmin.log.\*</td><td style="width: 43.016069%;">macOS  
  
`~/Library/Application Support/FileWave/FileWaveAdmin.log`  
  
Windows  
  
`C:\ProgramData\FileWave\FileWaveAdmin.log`</td></tr><tr><td style="width: 24.349067%;">**Client Logs**  
  
Retrieved Client Logs</td><td style="width: 32.634864%;">ClientLog\_**$IP\_$Port\_$date**.log</td><td style="width: 43.016069%;">macOS  
  
`~/Library/Application Support/FileWave/Client Logs/`  
  
Windows  
  
`C:\ProgramData\FileWave\Client Logs\`</td></tr><tr><td style="width: 24.349067%;">**Server Logs**  
  
Retrieved Server Logs  
  
FileWave Admin &gt; Server &gt; Get Logfile</td><td style="width: 32.634864%;">fwxserver\_**$timestamp**.log</td><td style="width: 43.016069%;">macOS  
  
`~/Library/Application Support/FileWave/Server Logs/`  
  
Windows  
  
`C:\ProgramData\FileWave\Server Logs\`</td></tr></tbody></table>

### FileWave Admin Files

<table id="bkmrk-details-file-locatio-1" style="width: 100%;"><tbody><tr style="background-color: rgb(251, 238, 184);"><td style="width: 24.234461%;">**Details**</td><td style="width: 37.446627%;">**File**</td><td style="width: 38.318912%;">**Location**</td></tr><tr><td style="width: 24.234461%;">**FileWave Admin Settings**  
  
Settings for the local FileWave Admin App</td><td style="width: 37.446627%;">**macOS**

- com.filewave.FileWaveAdmin.plist
- com.filewave.admin.plist

**Windows**

- Registry

</td><td style="width: 38.318912%;">macOS  
  
`~/Library/Preferences/`  
  
Windows  
  
`HKCU\Software\FileWave\FileWave Admin`</td></tr><tr><td style="width: 24.234461%;">**Exported Views**  
  
Views saved from FileWave Admin:  
  
\* Views &gt; Export Current View</td><td style="width: 37.446627%;">Filesets Export (**$date**).txt</td><td style="width: 38.318912%;">macOS  
  
`~/Library/Application Support/FileWave/Exports`  
  
Windows  
  
`C:\ProgramData\FileWave\Exports`</td></tr></tbody></table>

## FileWave Booster

### Booster Logs

<table id="bkmrk-details-file-locatio-2" style="width: 100%;"><tbody><tr style="background-color: rgb(251, 238, 184);"><td style="width: 22.1692%;">**Details**</td><td style="width: 31.5835%;">**File**</td><td style="width: 46.2472%;">**Location**</td></tr><tr><td style="width: 22.1692%;">**Booster Log**  
  
Global Booster activity</td><td style="width: 31.5835%;">fwbooster.log</td><td style="width: 46.2472%;">macOS/Linux  
  
`/private/var/log/fwbooster.log`  
  
Windows  
  
`C:\ProgramData\FileWave\FWBooster\fwbooster.log`</td></tr><tr><td style="width: 22.1692%;">**NATS**  
  
NATS Booster Logs</td><td style="width: 31.5835%;">**macOS/Linux**

- nats-booster.err.log\*
- nats-booster.out.log\*

**Windows**

- nats-booster.log

</td><td style="width: 46.2472%;">macOS/Linux  
  
`/private/var/log/`  
  
Windows  
  
`C:\ProgramData\FileWave\FWBooster\NATS\nats-booster.log`</td></tr><tr><td style="width: 22.1692%;">**Discovery Log**  
  
Only exists when discovery configured and run</td><td style="width: 31.5835%;">**macOS/Linux**

- fwdiscovery.log

</td><td style="width: 46.2472%;">macOS/Linux  
  
`/private/var/log/fwdiscovery.log`</td></tr><tr><td style="width: 22.1692%;">**NGINX**

Only for Boosters connecting to Hosted FW Servers

</td><td style="width: 31.5835%;">**macOS/Windows/Linux**

- fwbooster\_nginx\_access.log
- fwbooster\_nginx\_error.log

</td><td style="width: 46.2472%;">macOS/Linux

`/private/var/log/`

Windows

`C:\FWBooster\Data Folder\`

</td></tr></tbody></table>

## FileWave Client

### FileWave Client Logs

<table id="bkmrk-details-file-locatio-3" style="width: 100%;"><tbody><tr style="background-color: rgb(251, 238, 184);"><td style="width: 19.308701%;">**Details**</td><td style="width: 40.882002%;">**File**</td><td style="width: 39.809297%;">**Location**</td></tr><tr><td style="width: 19.308701%;">**Client Logs**  
  
Global Client activity</td><td style="width: 40.882002%;">fwcld.log</td><td style="width: 39.809297%;">macOS  
  
`/var/log/fwcld.log`  
  
Windows  
  
`C:\ProgramData\FileWave\FWClient\fwcld.log`</td></tr><tr><td rowspan="2" style="width: 19.308701%;">**Kiosk Logs**  
  
Kiosk application activity  
  
</td><td style="width: 40.882002%;">**Kiosk V1**

- FWGUI.log

</td><td style="width: 39.809297%;">macOS  
  
`~/Library/Application\ Support/FileWave/FWGUI.log`  
  
Windows  
  
`C:\ProgramData\FileWave\FWGUI.log`</td></tr><tr><td style="width: 40.882002%;">**Kiosk V2**

- kiosk.log

</td><td style="width: 39.809297%;">macOS

`~/Library/Application\ Support/FileWave/kiosk.log`

Windows

`C:\ProgramData\FileWave\kiosk.log`

</td></tr><tr><td style="width: 19.308701%;">**Fileset Script Logs**  
  
Logs generated by Fileset scripts</td><td style="width: 40.882002%;">macOS  
  
**$Fileset\_ID**/**$script\_name\_from\_fileset**.log  
  
Windows  
  
**$Fileset\_ID**\\**$script\_name\_from\_fileset**.log</td><td style="width: 39.809297%;">macOS  
  
`/var/log/fwcld/`  
  
Windows  
  
`C:\ProgramData\FileWave\log\fwcld\`</td></tr><tr><td style="width: 19.308701%;">**Custom Field Logs**  
  
Logs generated by Custom Fields</td><td style="width: 40.882002%;">custom\_field\_script.**$script\_type**.log  
e.g.

- custom\_field\_script.ps1.log
- custom\_field\_script.sh.log

</td><td style="width: 39.809297%;">macOS  
  
`/var/log/fwcld/1/`  
  
Windows  
  
`C:\ProgramData\FileWave\log\fwcld\1\`</td></tr><tr><td style="width: 19.308701%;">**Fileset Blocker Script Logs**  
  
Logs generated by Blocker Scripts</td><td style="width: 40.882002%;">blocker\_script.**$script\_type**.log  
e.g.

- blocker\_script.py.log
- blocker\_script.bat.log

</td><td style="width: 39.809297%;">macOS  
  
`/var/log/fwcld/1/`  
  
Windows  
  
`C:\ProgramData\FileWave\log\fwcld\1\`</td></tr><tr><td style="width: 19.308701%;">**Installer (PKG / MSI) Logs**  
  
Logs generated from PKG/MSI Filesets</td><td style="width: 40.882002%;">**$Fileset\_ID**.log</td><td style="width: 39.809297%;">macOS  
  
`/usr/local/etc/FileWaveInstallerLogfiles/`  
  
Windows  
  
`C:\ProgramData\FileWave\FileWaveInstallerLogfiles\`</td></tr><tr><td style="width: 19.3087%;">**Upgrade Logs**

Windows Filewave Client Upgrade Log

</td><td style="width: 40.882%;">upgradeClient.log

FileWaveClient.log

</td><td style="width: 39.8093%;">For Upgrade Client log on Windows

`C:\temp\upgradeClient.log`

For MSI log of FW Client Install

`C:\temp\filewaveclient.log`

</td></tr></tbody></table>

### FileWave Client Files

<table id="bkmrk-details-file-locatio-4" style="width: 100%;"><tbody><tr style="background-color: rgb(251, 238, 184);"><td style="width: 26.959972%;">**Details**</td><td style="width: 31.383662%;">**File**</td><td style="width: 41.779975%;">**Location**</td></tr><tr><td style="background-color: rgb(194, 224, 244); width: 26.959972%;">**FileWave Client Settings**  
  
Settings for the FileWave Client</td><td style="width: 31.383662%;">**macOS**

- fwcld.plist

**Windows**

- Registry

</td><td style="width: 41.779975%;">macOS  
  
`/usr/local/etc/`  
  
Windows  
  
`HKLM\SOFTWARE\Wow6432Node\Filewave\WinClient`</td></tr><tr><td style="background-color: rgb(194, 224, 244); width: 26.959972%;">**FileWave Client Preferences**  
  
Preference file containing unique client details</td><td style="width: 31.383662%;">**macOS**

- com.filewave.Client.plist

**Windows**

- client.ini

</td><td style="width: 41.779975%;">macOS  
  
`/Library/Preferences/`  
  
Windows  
  
`C:\ProgramData\FileWave\`</td></tr><tr><td style="background-color: rgb(194, 224, 244); width: 26.959972%;">**FileWave Client Certificate**  
  
Unique certificate &amp; key per client</td><td style="width: 31.383662%;">- client.crt
- client.key

</td><td style="width: 41.779975%;">macOS  
  
`/var/FileWave/`  
  
Windows  
  
`C:\ProgramData\FileWave\FWClient\`</td></tr><tr><td style="width: 26.959972%;">**Trust Store**  
  
Store for self-signed certificates</td><td style="width: 31.383662%;">\*.crt</td><td style="width: 41.779975%;">macOS  
  
`/private/var/FileWave/trust_store`  
  
Windows  
  
`C:\ProgramData\FileWave\FWClient\trust_store`</td></tr></tbody></table>

<p class="callout info">Cells highlighted in blue indicate files that are unique per client. These files should not be included when copying or migrating clients from one machine to another. To de-personalise a device, without removing the FileWave Client, some files would require editing, whilst others would need to be removed. If it was felt this was a requirement, consider contacting support to assist with this process.</p>

## FileWave Imaging Server (IVS)

### IVS Logs

<table id="bkmrk-details-file-locatio-5" style="width: 100%;"><tbody><tr style="background-color: rgb(251, 238, 184);"><td style="width: 29.295426%;">**Details**</td><td style="width: 36.604862%;">**File**</td><td style="width: 34.099712%;">**Location**</td></tr><tr><td style="width: 29.295426%;">**Django Imaging Server Logs**  
  
Django logs for requests regarding Serial numbers, names etc. made by netbooted clients</td><td style="width: 36.604862%;">filewave\_imaging\_server\*.log</td><td style="width: 34.099712%;">`/imaging/logs/`</td></tr><tr><td style="width: 29.295426%;">**Windows Image Upload Logs**  
  
Captured Windows image uploads</td><td style="width: 36.604862%;">fwadmin.log</td><td style="width: 34.099712%;">`/imaging/logs/fwadmin.log`</td></tr><tr><td style="width: 29.295426%;">**Windows Image Upload Logs**  
  
Captured Windows image uploads</td><td style="width: 36.604862%;">fwadmin-dlog.log</td><td style="width: 34.099712%;">`/var/log/fwadmin-dlog.log`</td></tr><tr><td style="width: 29.295426%;">**Messages Logs**  
  
Netboot/PXE Queries &amp; Responses,TFTP transfers, NFS Mounts</td><td style="width: 36.604862%;">dnsmasq Log</td><td style="width: 34.099712%;">CentoS

`/var/log/messages`

Debian

`/var/log/syslog`

</td></tr><tr><td style="width: 29.295426%;">**Apache Imaging Server Logs**  
  
Apache logs for requests regarding Serial numbers, names etc. made by netbooted clients</td><td style="width: 36.604862%;">netboot\_\*.log</td><td style="width: 34.099712%;">`/imaging/logs/`</td></tr><tr><td style="width: 29.295426%;">**Client Imaging Logs**  
  
Client logs - indicating progress of imaging operation of netbooted clients</td><td style="width: 36.604862%;">**$Serial/$Mac-$Date**</td><td style="width: 34.099712%;">`/imaging/logs/`</td></tr><tr><td style="width: 29.295426%;">**FileWave Client Log**  
  
IVS FileWave Client Log</td><td style="width: 36.604862%;">fwcld.log</td><td style="width: 34.099712%;">`/var/log/fwcld.log`</td></tr></tbody></table>

## FileWave Server

### FileWave Server Logs

<table id="bkmrk-details-file-locatio-6" style="width: 100%;"><tbody><tr style="background-color: rgb(251, 238, 184);"><td style="width: 22.126082%;">**Details**</td><td style="width: 43.881335%;">**File**</td><td style="width: 33.992583%;">**Location**</td></tr><tr><td style="width: 22.126082%;">**Apache Logs**  
  
Server Apache logs</td><td style="width: 43.881335%;">- access\_log, access\_log.\*
- error\_log, error\_log.\*
- forensic\_log
- httpd.pid

</td><td style="width: 33.992583%;">`/usr/local/filewave/apache/logs/`</td></tr><tr><td style="width: 22.126082%;">**Apache Exporter Logs**  
  
Server Apache Exporter Logs</td><td style="width: 43.881335%;">- apache\_exporter.out.log
- apache\_exporter.err.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Alert Manager Logs**  
  
Server Alert Manager logs</td><td style="width: 43.881335%;">- alertmanager.out.log
- alertmanager.err.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**FileWave Admin Audit Logs**  
  
Audit logs from FileWave Admin</td><td style="width: 43.881335%;">audit.log</td><td style="width: 33.992583%;">`/usr/local/filewave/log/audit.log`</td></tr><tr><td style="width: 22.126082%;">**FileWave Admin Audit Logs**

Audit logs from FileWave Admin

</td><td style="width: 43.881335%;">fwaaudit-\[date\].txt

</td><td style="width: 33.992583%;">`/private/var/log/FWAdmin Audit/`  
</td></tr><tr><td style="width: 22.126082%;">**FileWave Dotenv file**

Environment variable like configs across services.

</td><td style="width: 43.881335%;">\*.env</td><td style="width: 33.992583%;">`/usr/local/etc/filewave/.env`</td></tr><tr><td style="width: 22.126082%;">**Django Logs**  
  
Server Django logs, including FileWave Anywhere, MDM enrollment, VPP, and Classroom activity. For MDM enrollment failures such as *enrolling with management server failed* or secure-connection errors, start with `filewave_django.log` and its rotated files.</td><td style="width: 43.881335%;">- filewave\_django.log, filewave\_django.log.\*
- filewave\_django\_vpp.log
- filewave\_django\_classroom.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**LDAP Logs**  
  
Logs from LDAP</td><td style="width: 43.881335%;">fwldap.log, fwldap.log.\*</td><td style="width: 33.992583%;">`/private/var/log/`</td></tr><tr><td style="width: 22.126082%;">**Software Update Logs**  
  
Software Update logs</td><td style="width: 43.881335%;">fwsu.log</td><td style="width: 33.992583%;">`/private/var/log/fwsu.log`</td></tr><tr><td style="width: 22.126082%;">**FWX Process Logs**  
  
Various fwx process logs</td><td style="width: 43.881335%;">- fwxadmin.log
- fwxother.log
- fwxserver.log

</td><td style="width: 33.992583%;">`/private/var/log/`</td></tr><tr><td style="width: 22.1261%;">**Model Update Service Log**</td><td style="width: 43.8813%;">model\_update\_service.log

</td><td style="width: 33.9926%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Migration Logs**  
  
Server migration logs</td><td style="width: 43.881335%;">fwxserver-migration-\*</td><td style="width: 33.992583%;">`/var/log/fwxserver-migration-*`</td></tr><tr><td style="width: 22.126082%;">**Grafana Logs**</td><td style="width: 43.881335%;">- grafana.log
- grafana.out.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Installer Logs**  
  
Linux installer logs</td><td style="width: 43.881335%;">install.log</td><td style="width: 33.992583%;">`/private/var/log/install.log`</td></tr><tr><td style="width: 22.126082%;">**mtail Logs**  
  
Server mtail logs</td><td style="width: 43.881335%;">- mtail.out.log
- mtail.err.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**NATS Logs**  
  
NATS logs</td><td style="width: 43.881335%;">- nats-server.out.log
- nats-server.err.log
- nats-server-jwt.out.log
- nats-server-jwt.err.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Web Admin Logs**</td><td style="width: 43.881335%;">- node\_exporter.out.log
- node\_exporter.err.log
- task\_executor.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Postgres Exporter Logs**</td><td style="width: 43.881335%;">- postgres\_exporter.out.log
- postgres\_exporter.err.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Postgres Database Logs**</td><td style="width: 43.881335%;">postgresql-**$day**.log</td><td style="width: 33.992583%;">`/usr/local/filewave/fwxserver/DB/pg_data/pg_log/*.log`</td></tr><tr><td style="width: 22.126082%;">**Prometheus Logs**</td><td style="width: 43.881335%;">- prometheus\_pushprox.out.log
- prometheus\_pushprox.err.log
- prometheus.out.log
- prometheus.err.log
- redis\_exporter.out.log
- redis\_exporter.err.log
- redis.out.log
- redis.err.log
- redis.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**FileWave Server Logs**</td><td style="width: 43.881335%;">request\_errors.log</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**SQL Logs**</td><td style="width: 43.881335%;">sql.log</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Update Controller Logs**  
  
Removed in FileWave 14.10</td><td style="width: 43.881335%;">- update\_controller\_access.log
- update\_controller.log

</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Client Monitor**</td><td style="width: 43.881335%;">client\_monitor.log</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**FileWave Log Messages**</td><td style="width: 43.881335%;">task\_executor.log</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr><tr><td style="width: 22.126082%;">**Scheduler Log Messages**</td><td style="width: 43.881335%;">huey.log</td><td style="width: 33.992583%;">`/usr/local/filewave/log/`</td></tr></tbody></table>

## Additional Logging

All of the above will default to standard log level. There are 3 levels of logging available:

- 10 – Standard Log Level
- 99 – Debug Log Level
- 101 – Trace Log Level

The level of logging may be set as per our guide:

[How to set FileWave Server components to debug mode](https://kb.filewave.com/books/filewave-server/page/how-to-set-filewave-server-components-to-debug-mode "How to set FileWave Server components to debug mode")

# How to Restart FileWave Components

There may be times where you will need to restart all components within the FileWave server, or just a single component (postgres or apache). From your macOS or Linux server you can type "fwcontrol", which should give examples of fwcontrol usage.

### macOS or Linux Server

You need to prefix commands with sudo to run them with elevated privileges.

<p class="callout info">Starting in FileWave 16.3 on macOS Server, `fwcontrol` uses **supervisord** under the hood for FileWave service control and status reporting. The commands below stay the same. The main change is that status and service detail output is clearer and no longer reflects the older LaunchDaemon-based behavior.</p>

At a command prompt:

```
sudo fwcontrol server stop
sudo fwcontrol server start
```

You can also accomplish the same end goal by performing a single command:

```
sudo fwcontrol server restart
```

It is a matter of preference, but some admins will prefer to execute a stop, then a manual start so that they can see all processes are indeed stopped.

Subcomponents can be individually stopped as follows:

```
sudo fwcontrol apache start|stop|restart

sudo fwcontrol postgres start|stop|restart

sudo fwcontrol scheduler start|stop|restart



sudo fwcontrol client start|stop|restart

sudo fwcontrol booster start|stop|restart
```

### Troubleshooting

If you find that the fwcontrol control command is not found, you re-create the alias by inputting this command and then try the fwcontrol commands again:

```shell
alias fwcontrol='/usr/local/bin/fwcontrol'
```

# Resolving Network Issues with FileWave Server or Boosters on macOS when using Carbon Black EDR Extension

## **What**

FileWave has observed network issues when the Carbon Black EDR (Endpoint Detection and Response) system extension and network filter are installed on a FileWave Server or Booster running on macOS. The most common symptom is that the Booster stops responding, which can interrupt device check-ins and content delivery.

## **When/Why**

This is most likely to appear under high network traffic, where the Carbon Black network filter is inspecting traffic on the same macOS system that is serving FileWave clients. That combination can create performance or connectivity problems for FileWave services.

## **How**

If FileWave network issues begin after Carbon Black EDR is installed on the same macOS Server or Booster, check whether the Carbon Black system extension and network filter are active. On macOS, use this command in Terminal.app:

```
systemextensionsctl list
```

The output will appear like this:

```
--- com.apple.system_extension.endpoint_security
enabled    active    teamID    bundleID (version)    name    [state]
*    *    7AGZNQ2S2T    com.vmware.carbonblack.cloud.se-agent.extension (3.7.2fc81/3.7.2fc81)    com.vmware.carbonblack.cloud.se-agent.extension    [activated enabled]
```

Check the output for the Carbon Black EDR extension or network filter. If removing or disabling the extension restores FileWave service responsiveness, work with your security team and Carbon Black/Broadcom support before redeploying it to the FileWave Server or Booster.

## **Related Content**

- [General Troubleshooting and Errors](https://kb.filewave.com/books/general-troubleshooting-and-errors "General Troubleshooting and Errors")
- [FileWave Log File Locations](https://kb.filewave.com/books/filewave-general-info/page/filewave-log-file-locations "FileWave Log File Locations")
- [Booster Installation](https://kb.filewave.com/books/boosters "Boosters")
- [Broadcom Carbon Black EDR system extension and network filtering](https://techdocs.broadcom.com/us/en/carbon-black/edr/edr-sensors/index/sensor-ig-edr/GUID-91738780-17C1-4C1F-AD01-2319A35B2F11-en/GUID-9D8CA91D-B508-4AF1-BB8F-691769DCB272-en/GUID-5F99CAF5-7F4E-4280-8F94-2C35BEBB3ADE-en.html "Broadcom Carbon Black EDR macOS system extension and network filtering")

## **Digging Deeper**

Modern macOS security products often use System Extensions and Network Extensions instead of older kernel extensions. Carbon Black EDR uses this model on current macOS versions so it can inspect endpoint and network activity.

That inspection can still affect network-heavy systems. FileWave Servers and Boosters handle repeated client communication and content delivery, so they are more sensitive to anything inserted into the local network path.

The `systemextensionsctl list` command is a quick way to confirm whether the Carbon Black extension is active. Treat this as a troubleshooting signal, not a request to remove security tooling without approval.

If you need to exclude a FileWave Server or Booster from the Carbon Black network filter, coordinate that decision with the customer security owner and Carbon Black/Broadcom support.

# What is Compatibility Mode?

FileWave 13.1 introduced new security options and a mode to allow older clients to connect.

<p class="callout info">Compatibility Mode was removed in FileWave 15.4.0 in favor of only using secure connections.</p>

## Problem

I don't know what compatibility mode is and what enable and disable do for me.

![compatibility_mode-prefs.png](https://kb.filewave.com/uploads/images/gallery/2023-06/8cvsbtpr4tlYp0xL-compatibility-mode-prefs.png)

## Environment

FileWave 13.1 introduces a new method of certificate-based security for communication between components (client, booster, server and IVS). Only 13.1 and greater components are able to generate and properly use certificates to communicate with other components using the new method. Therefore, if your server is running 13.1 but you have components that are older than 13.1 they can not generate the needed certificates to have the highest level of security, and will not be able to communicate together.

## Resolution

##### Compatibility Mode Enabled

The server allows older clients, boosters, and IVS to communicate with the server with or without valid certificates

##### Compatibility Mode Disabled

The server will not allow any client, booster, or IVS to communicate with the server unless it has a valid and unique certificate. Boosters and clients are also checking peer certificates and will only communicate if the peer certificate is valid.

## Additional Information

When you disable compatibility mode (uncheck the box in preferences) you will receive a warning of clients, boosters, and imaging appliances (AKA IVS), that may potentially be disconnected by you enabling this mode. If you get this warning, it is recommended that you cancel, and resolve the issue before compatibility mode is disabled.

![compat_disable.png](https://kb.filewave.com/uploads/images/gallery/2023-06/itIxGxlnoPEGp3cy-compat-disable.png)

## Related Content

- For approving devices see: [Enrolling Computer Clients](https://kb.filewave.com/books/filewave-client/page/enrolling-computer-clients-into-filewave "Enrolling Computer Clients in to FileWave")
- For approving boosters see: [Booster installation](https://kb.filewave.com/books/boosters/page/booster-installation "Booster Installation")

# FileWave Automation Scripts

<p class="callout info">This article contains the scripts used by the Downloads page. The scripts are here for documentation purposes. Note that you don't need to directly deal with this page aside from reference documentation. Each download page has the right 1-liner for upgrading to that version.</p>

FileWave provides supported upgrade scripts to help you safely upgrade FileWave components on Debian-based systems. These scripts automate required checks, ensure compatibility, and guide you through the correct upgrade path for your environment.

The scripts have been used internally and by customers for many releases. This page explains <span class="s1">**what they do**</span>, <span class="s1">**how they behave**</span>, and <span class="s1">**what to expect during an upgrade**</span>.

## What the Upgrade Scripts Do

At a high level, each upgrade script:

- Detects the currently installed FileWave version (if present)
- Validates system requirements and available disk space
- Applies the requested FileWave upgrade
- Applies recommended Debian OS updates when appropriate
- Handles required service restarts and pre-upgrade checks
- Writes a detailed log file to <span class="s1">/var/log</span>
- Schedules a system reboot when required

The scripts are designed to be <span class="s2">**safe to re-run**</span> and will stop early if an unsupported upgrade or downgrade is detected.

## Interactive and Unattended Use

The scripts support both interactive and unattended operation:

- When run interactively, progress is displayed on screen and the script may pause briefly before rebooting.
    
    
    - You may press <span class="s1">**Enter**</span> to reboot immediately.
    - You may press <span class="s1">**Ctrl-C**</span> to cancel the reboot.
- When run unattended, the script proceeds automatically and reboots without waiting for user input.

The scripts work correctly when run:

- Over SSH
- From a local console
- Inside a <span class="s1">screen</span> session
- <span class="s1">Using </span>wget | bash

Running upgrades inside a <span class="s2">screen</span> session is strongly recommended.

---

## FileWave Server: Important Upgrade Behavior (16.3.0 and Later)

Starting with <span class="s2">**FileWave Server 16.3.0**</span>, significant changes were introduced, including:

- An upgrade of the underlying operating system from <span class="s1">**Debian 12 to Debian 13**</span>
- New PostgreSQL components used by FileWave Server

Because of these changes, the FileWave Server upgrade script includes additional safety logic.

### Staged Upgrade Requirement (Older Versions)

If your system is running a <span class="s2">**very old FileWave Server version**</span> (prior to 16.0.0):

- <span class="s1">The script will </span>**first upgrade the server to FileWave Server 16.2.3**
- The upgrade will then <span class="s1">**stop and reboot**</span>
- You must verify that FileWave Server 16.2.3 is working correctly
- After verification, re-run the upgrade script to proceed to <span class="s1">**16.3.0 or newer**</span>

This staged approach is required to ensure database compatibility and prevent data loss.

### Why This Is Necessary

- Older FileWave Server versions used older PostgreSQL components
- FileWave Server 16.0–16.2 introduced newer PostgreSQL components while retaining compatibility for upgrades
- FileWave Server 16.3.0 and later remove older PostgreSQL libraries and introduce newer database components
- Attempting to skip directly from very old versions to 16.3.0 is not supported

The upgrade script automatically enforces this safe upgrade path and clearly explains what is happening when a staged upgrade is required.

---

## Operating System Upgrades

- FileWave Server versions <span class="s1">**prior to 16.3.0**</span> run on <span class="s1">**Debian 12**</span>
- FileWave Server <span class="s1">**16.3.0 and later**</span> upgrade the system to <span class="s1">**Debian 13**</span> as part of the process

The script will only perform a Debian OS upgrade when required by the target FileWave version.

---

## Logging and Troubleshooting

Each script writes a detailed log file that can be used for troubleshooting or when opening a support case:

- **FileWave Server:**
    
    /var/log/filewave\_server\_update.log
- **FileWave IVS:**
    
    /var/log/filewave\_ivs\_update.log
- **FileWave Booster:**
    
    /var/log/filewave\_booster\_update.log

If you contact FileWave Support, include the relevant log file along with a brief description of what you were upgrading to.

---

## Best Practices

- Always ensure you have a current backup before upgrading
- Run upgrades during a maintenance window
- Use a <span class="s1">screen</span> session for long upgrades
- Allow the system to reboot when prompted
- Follow any on-screen instructions if a staged upgrade is required

---

## Scripts

### FileWave Server Upgrade

[fwxserver\_upgrade.sh](https://kb.filewave.com/attachments/411) - This script is used by the Download page fro FileWave Server upgrades on Debian. Some details;

To run this script, use the following 1-liner for example:

```shell
sudo DEBIAN_FRONTEND=noninteractive bash -c 'set -e; apt-get update -y; apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" screen wget; ts=$(date +%Y%m%d%H%M%S); scr=fwxserver_upgrade_$ts; tmp=/tmp/fwxserver_upgrade_$ts.sh; wget -qO "$tmp" https://kb.filewave.com/attachments/411; chmod +x "$tmp"; echo "Starting upgrade in screen session: $scr"; echo "Detach with Ctrl-A then D, reattach with: sudo screen -r $scr"; exec screen -S "$scr" bash -lc "\"$tmp\" -v 16.3.0 -r 1 -p -y"'
```

---

### FileWave Booster Upgrade

[fwbooster\_upgrade.sh](https://kb.filewave.com/attachments/412) - This script is used by the Download page fro FileWave Booster upgrades on Debian. Some details;

To run this script, use the following 1-liner for example:

```shell
sudo DEBIAN_FRONTEND=noninteractive bash -c 'set -e; apt-get update -y; apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" screen wget; ts=$(date +%Y%m%d%H%M%S); scr=fwbooster_upgrade_$ts; tmp=/tmp/fwbooster_upgrade_$ts.sh; wget -qO "$tmp" https://kb.filewave.com/attachments/412; chmod +x "$tmp"; echo "Starting upgrade in screen session: $scr"; echo "Detach with Ctrl-A then D, reattach with: sudo screen -r $scr"; exec screen -S "$scr" bash -lc "\"$tmp\" -v 16.3.0 -r 1 -p -y"'
```

---

### FileWave IVS Upgrade

[ivs\_upgrade.sh](https://kb.filewave.com/attachments/408) - This script is used by the Download page for IVS upgrades on Debian. Some details;

To run this script, use the following 1-liner for example:

```shell
sudo DEBIAN_FRONTEND=noninteractive bash -c 'set -e; apt-get update -y; apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" screen wget; ts=$(date +%Y%m%d%H%M%S); scr=ivs_upgrade_$ts; tmp=/tmp/ivs_upgrade_$ts.sh; wget -qO "$tmp" https://kb.filewave.com/attachments/408; chmod +x "$tmp"; echo "Starting upgrade in screen session: $scr"; echo "Detach with Ctrl-A then D, reattach with: sudo screen -r $scr"; exec screen -S "$scr" bash -lc "\"$tmp\" -v 16.3.0 -r 1 -p -y"'
```

### Universal One Liner

You can also use this more universal one liner that doesn't hard code anything and you can just enter what you want to do.

```shell
sudo DEBIAN_FRONTEND=noninteractive bash -c 'set -e; read -p "Component (Server/Booster/IVS): " c; case "${c,,}" in server) att=411; name=fwxserver ;; booster) att=412; name=fwbooster ;; ivs) att=408; name=ivs ;; *) echo "Invalid component"; exit 1 ;; esac; read -p "Version (e.g. 16.3.0): " v; [[ "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Invalid version format"; exit 1; }; read -p "Release (Prod/Dev/Beta): " r; case "${r,,}" in prod) f=-p ;; dev) f=-d ;; beta) f=-b ;; *) echo "Invalid release type"; exit 1 ;; esac; apt-get update -y; apt-get install -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" screen wget; ts=$(date +%Y%m%d%H%M%S); scr=${name}_upgrade_$ts; tmp=/tmp/${name}_upgrade_$ts.sh; wget -qO "$tmp" https://kb.filewave.com/attachments/$att; chmod +x "$tmp"; echo "Starting upgrade in screen session: $scr"; echo "Detach with Ctrl-A then D, reattach with: sudo screen -r $scr"; exec screen -S "$scr" bash -lc "\"$tmp\" -v $v -r 1 $f -y"'
```