Using the Cloud Services Appliance activity recorder

You can use the Cloud Services Appliance (CSA) activity recorder log to understand what your CSAs are doing and their relative workloads.

Core servers use a service (BrokerService.exe) to communicate with Cloud Services Appliances. On the core server, each CSA that the core server is configured to use has its own BrokerService.exe process. The service writes CSA activity to a .csv format log file. You can use an application like Microsoft Excel to chart and understand log data.

The Activity Recorder is controlled by an XML file on the core server:

  • C:\Program Files\LANDesk\ManagementSuite\BrokerServiceConfig.xml

Comments in this file include directions on how to use it. The main options you may want to change are these:

  • <Enabled>: True turns on the activity logger, false turns it off. True is the default.
  • <Logging>: True turns on some extra logging in the activity logger. False is the default.
  • <ActivityLogMaxSize>: Maximum size in bytes of the debug log before it is rolled over. The default is 10 megabytes (10000000).

Here is a sample log entry:

10 Apr 2013 14:55:54, 3440, 6616,, {D226EC08-A522-6C4B-8AC3-29C0EA7061DA}, LMCORE95B:5007, Inventory

Each log entry contains the following items (the parentheses contain that item from the example above):

  • Date/time (10 Apr 2013 14:55:54)
  • Broker service process ID (3440)
  • Broker service thread ID (6616)
  • Gateway name (
  • Client device unique ID (D226EC08-A522-6C4B-8AC3-29C0EA7061DA)
  • Service URL accessed (LMCORE95B:5007)
  • Feature, as provided by the feature map (Inventory)

Customizing activity recorder feature mapping

CSA requests from clients are in a URL format. The BrokerServiceConfig.xml XML configuration file specifies case-sensitive substrings in the URL and maps occurrences of those substrings to a feature. The substring matching algorithm is plain text and it doesn't support wildcards or regular expressions. The configuration file includes defaults for the main features, but you can customize the strings if you want.

For example, this XML entry detects "vulscanresults" in the URL and when that occurs, it creates a log entry for "Patch".


In the XML file, the following attributes control feature mapping:

  • <DefaultFeature>: If a configured substring can't be found in the URL, it will be categorized by the name given here. <OutputDefaultFeature> must be set to True for <DefaultFeature> entries to appear in the log.
  • <OutputDefaultFeature>: If a configured substring can't be found in the URL and this is false, it isn't written to the activity log. If true, it is.
  • <FeatureMapping>: This is a list of substrings that the activity recorder looks for when watching URL traffic. As soon as it finds one by searching from top to bottom, it logs the entry in the log file and the feature name provided is used in the last column of the log.