Logshark - ACE for Administrators

Though Tableau Server is very stable in its functioning and it also depends on how the Administrator configures and reviews its vitals regularly to avoid any outages, but still there would be cases where we run into some issues and need to diagnose them. The tool named Logshark comes to the rescue in these cases.

Logshark is a command-line tool that you have to run against Tableau Server logs which produce some workbooks that provide Tableau Server vital which can help for diagnostics. This not just helps with the reactive approach where the problem occurs and we can identify the reason but you can regularly run this to make sure your Tableau Server is not showing any sign of stress which can cause the problem in the future.

At this moment Logshark can be executed on Windows and macOS and we will cover details of windows here.

 

• Windows operating system 64bit (2008R2 and higher).
• Tableau Desktop 10.5 (or higher) to visualize workbooks generated by Logshark.
• A performant system with a good CPU, Memory, and a faster disk will improve Logshark performance.
• Elevated account to install and run Logshark.
• Hyper API for C++.

Once we have a system with the needed configuration we would need Tableau Server logs on which Logshark would need to be executed to produce the workbooks for diagnostic. We will need to generate the same using "tsm maintenance ziplogs" on Tableau Server. If you are running on Linux based Tableau Server then would need to generate the zip logs to the server and copy these archive logs to a windows server where you needed system requirements and then execute Logshark on top of it. 

Install Logshark will need first to download the software and the latest version can be download from 

https://github.com/tableau/Logshark

This link may change in the future, in case it's changed and you are not able to open it just perform a quick good search and you will be able to locate the latest link. Once downloaded the zip file of the software we need to unzip the software in the directory where one may want to keep it.

Execute LogShark is very straight forward and once the previous steps have been performed like mentioned below for recap we can proceed to the next steps:

• You met operating system requirements.
• You have an archive log from Tableau Server.
• Downloaded the Logshark software.

Following are the sequence of steps needed to run the Logshark utility

• Launch the command prompt for the windows server.
• Navigate to the directory where Logshark software has been unpacked. In case you want to avoid doing it can be added the PATH to the variable on the server. To list the options with Logshark utility use

        LogShark --help

• For executing the utility and processing the Tableau Server log we need to execute LogShark.exe with archive log details.

        Logshark <LogSetLocation> <RunId> [Options]

        where

        LogSetLocation - Location of server logs to process

        RunId - Unique identifier to use for the output of this execution.

        Example

        Logshark E:\tableau_server_logs.zip

        Logshark E:\tableau_server_logs.zip -c CustomLogsharkConfig.json

        Logshark E:\tableau_server_logs.zip --plugins "Backgrounder;ClusterController" 

The above example shows different flavors of execution like basic execution without any flag, with -c flags to run the Logshark execution with customized configuration, and --plugins for specific tableau plugins.

Generated Output would be saved at \Logshark_run_location>\Output folder and Logshark creates \Output directory if not already exists. 

Under \Output folder, one more directory is created with the name DateTime-Hostname-FileName where Hostname is the name of your machine and FileName is the name of the archive file. Under this directory, we will have a workbooks folder that contains all workbooks generated by Logshark for analysis.

For example, when you have tableau_server_logs.zip archive and hostname is computer1 then the output directory would be generated as DateTime-computer1-tableau_server_logs. DateTime would the time when logs were processed. 

Processing time logs through Logshark utility would depend upon

• Processing speed and configuration of the server where we are running this utility.
• The size of logs would also be an important factor in this.

To view, the workbooks generated under the workbooks folder double-click on the Tableau workbook you want to view. For example, Backgrounder.twbx workbook will contain information like Backgrounder utilization, Background Error Analysis, Extract Track Details, etc. Every Logshark plugin generates its workbooks which contain a lot of information, it's important to understand these plugins and the information they possess. We can also generate workbooks with a specific plugin like only for backgrounder or Backgrounder with Apache using

        LogShark tableau_server_logs.zip --plugins Backgrounder

        LogShark tableau_server_logs.zip --plugins "Backgrounder;Apache"

Description of each plugin needed to be understood, to understand which workbooks to look for your problem. For Plugin named Art, workbook generated with name Art.twbx and consists of information like view loads. Let's see the details of all the plugins:

• Art - Performance details of views logs.
• Apache - Information from Apache http log files includes viz load times, errors, and warnings.
• Backgrounder - Information about backgrounder tasks and jobs from backgrounder log files.
• ClusterController - Information from Cluster Controller events and errors from clustercontroller and zookeeper logs. This also includes information about disk performance.
• Config - Information on Tableau Server Topology and configuration settings from log files.
• Filestore - Information on File store events and errors.
• Hyper - Information about Hyper activity includes extract generation and extract query details.
• Netstat - Information about port reservations from netstat output. We should use -n option with the ziplogs option to have netstat data.
• Postgres - Information about repository events and errors which includes application query results.
• ResourceManager - Information about CPU and Memory utilization.
• SearchServer - Information about Tableau Server Search & Browser service.
• Tabadmin - Information about Tableau Server stops, start, backup, and error history.
• VizPortal - Information about Application Server events like API issues, authentications.
• VizqlDesktop - Information from Tableau Desktop vizql log files. 

LogShark Configuration can also be modified and its default file named LogSharkConfig.json exists under directory <LogShark_install_location>\Config\. These configurations can be changed and here are some examples if you want to perform:

• To change the output directory modify "Outpurdir" to the location where you want these workbooks to be written.
• LogShark logs are usually written under directory <LogShark_install_location>\Log and its format can be also changed into JSON format. To achieve this specify

"Json": true,

Publish Logshark Workbooks to Tableau Server functionality is already provided which is very good for enterprises who want to regularly run LogShark and publish its workbooks for its' support and development team to analyze them further. The best part of this all can be automated with some programming skills in python or shell.

To publish one would need to update LogSharkConfig.json file under the config folder for the section shown in the snippet below

  "TableauServer": {

    "Url": "<EnterServerUrlHere>",

    "Site": "<EnterSiteNameHere>",

    "Username": "<EnterUsernameHere>",

    "Password": "<EnterPasswordHere>",

    "Timeout": 240,

    "GroupsToProvideWithDefaultPermissions": [],

    "ParentProject": {

      "Id": "",

      "Name": ""

    }

Let's discuss the parameters in details

• Url should contain the full URL address of the tableau server when we need to publish Logshark workbooks.
• Site, as the name speaks, represents the site to which you like to publish the works. 
• Username and Password is the account on Tableau Server with publisher permissions.
• Parent Project - Specify either Id or Name to the project if you want your Logshark to be published as a sub-project under this parent project. It's a good idea.
• Specify permissions for workbooks using GroupsToProvideWithDefaultPermissions to the group that exists on Tableau Server. This group will be added in addition to all the default permissions. 

We also need to use the flag -p or --publishworkbooks with your LogShark command along with the configuration done in the previous section. An example of this execution would be

        LogShark <LogSetLocation> <RunId> -p

In case one needs to append the processing to the previous execution we can use 

        LogShark <LogSetLocation> <RunId> --append-to <RunId of run to append to>

We have learned how the LogShark tool can be used to process Tableau Server log into beautiful workbooks to make them more useful for end-users who need to understand various parameters of Tableau Server. This tool is also used by the Tableau team to debug the problems and I would highly recommend using this. An Administrator day would be easy if they have access and understand this tool, it's like a secret mantra to them. This tool has grown a lot from its previous version and is consistently being loaded with a lot more functionality which is making it an ace in the pocket.