Centrify DirectControl for Mac OS XQuestion:
When working on group policy issues with Centrify Support, it is sometimes necessary to gather deeper-level debug logging from the processes being investigated.
What are the steps needed to enable the higher-level logging status?Answer:
To trace extensive logging for group policy issues, the /etc/centrifydc/centrifydc.conf
file needs to be edited to raise the trace level of specific policy mappers.
To enable detailed logging for all group policy issues use either of the following steps: Option 1: Enabling manually for a single machine:
Option 2: Enabling via Group Policy for multiple machines:
- Login to the Mac as Local Admin and open the config file for editing:
- Add the following line to the bottom of the file:
- Save the file and then run:
- sudo /usr/local/share/centrifydc/bin/centrifydc restart
- adinfo -c
- Make sure the added line now appears in the list of active parameters.
- Once confirmed, Debug Mode can be enabled and the issue can be reproduced with enhanced logging enabled.
- Enable the GP at:
- Computer Configuration / Centrify Settings / DirectControl Settings / "Add centrifydc.conf properties"
- (If the DirectControl Settings folder cannot be seen, make sure the "centrifydc_settings.xml" template has been added into the GPO)
- Add the following entry:
- Name: log.gp.mappers
- Value: TRACE
- Save the GPO and run refresh the GPs on the target machine(s) to apply the new configuration.
- The trace-level setting can also be applied to individual group policy mapper scripts for a more focussed logging output.
- For example, to set the trace-level logging to debug certificate-related policy issues, use the following entries in /etc/centrifydc/centrifydc.conf:
- log.gp.mappers.certgp.pl: TRACE
- log.gp.mappers.certgp_mac.pl: TRACE
- Or via GP:
- The GP mapper scripts can be found under:
- For versions 5.2.3 and below:
- For versions 5.2.4 and above:
- See the following KB for further info on troubleshooting group policy issues on Mac systems:
- Once the logging level has been raised, the Mac Diagnostic Tool can be used to capture issues as normal: