Skip to main content

Understanding and obtaining Pega log files

Suggest edit Updated on June 2, 2022

Using Pega Cloud and theMy Pega Cloud portal, you have many options for log file access and management to help you monitor and troubleshoot your applications in Pega Cloud.

You can obtain and view the types of logs in the following table for your Pega Cloud by using one of the following methods:

Pega log types available from Pega Cloud environments

Log TypeLog File NameDescription
Pega ApplicationPegaRULES.logContains useful debugging information about the system running your Pega application, including:
  • System errors
  • Exceptions (with stack trace statements)
  • Debug statements
  • Messages not specified as alerts

This log includes Pega activity-related messages and standard rules-generated messages.

Pega ApplicationPegaRULES-2*.logContains similar content as outlined for PegaRULES.log
Cluster (Infrastructure) LogsPegaCLUSTER*.logContains information about the setup and run time behavior of the underlying infrastructure on which your Pega environment runs.
Pega AlertsPegaRULES-ALERT*.log

Contains diagnostic messages for failures and system events that exceed performance thresholds. Each message includes the following type of details:

  • Event description
  • Value that exceeded the threshold
  • Type of requestor (for example, browser)
  • Alert-triggering Pega activity or stream

The performance alert message name format is PEGAnnnn, where nnnn is the message ID of the system event that generated the alert.

Security AlertsPegaRULES-ALERTSECURITY*.log

Contains messages about alerts Pega Platform generates when the security of a Pega web node is at risk.

The security alert message name format is SECUnnnn, where nnnn is the message ID of the security event that generated the alert.

Security EventsPegaRULES-SecurityEvent*.log

Contains messages about security events generated by a Pega web node. Each message includes the following information:

  • appName
  • eventCategory
  • eventType
  • ID
  • ipAddress
  • nodeID
  • outcome
  • tenantID
  • timestamp

Specific events may contain additional information (such as “message” or “failedOperator”).


Contains the events that affect the data flow runs and queue processors, which internally initiate data flow runs. These logs make it possible to view the events involved in the life cycle of the data flow run, which you can use to debug data flow issues on multinode setups.

Usage PegaUSAGE*.logContains performance details for each requestor that Pega Platform generates once each hour and at logoff. For more details on these logs, see System-wide usage and the Log-Usage class.
Localhost Accesslocalhost_access_log.*

Contains a record of each request to your application as a separate log event that includes the following parameters:

  • X-Forwarded-For (XFF) HTTP Header (%i)
  • Remote IP address (%h) - Source IP address of the requestTime stamp

    The IP address can be public (as observed by the load balancer) or can originate from infrastructure using a private subnet or the localhost address (for example, healthchecking).

  • Date and time (%t)
  • HTTP verb, URI, protocol and version. For example: GET /prweb/PRRestService/monitor/pingService/ping HTTP/1.1 (%r)
  • HTTP Response code (%s)
  • Bytes sent, excluding HTTP headers (%b)
  • Response Time (%D)
  • Thread Name (%I)

For more information about the generation of and the attributesthat are in this Tomcat log, see the Access Logging section of Apache Tomcat 9 Configuration Reference.

Did you find this content helpful? YesNo

Have a question? Get answers now.

Visit the Support Center to ask questions, engage in discussions, share ideas, and help others.

We'd prefer it if you saw us at our best. is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us