Logging & nxlog

GFN rigs ship all logs to a central logging server using nxlog — a cross-platform log shipping agent. Logs are forwarded as syslog over UDP/TCP.

nxlog Configuration

Managed by config_nxlog.py. The config is written to:

C:\Program Files (x86)\nxlog\conf\nxlog.conf

Log Server Discovery

The script discovers the logging server in priority order:

Priority	Method	Description
1	userdata.LoggingServerAddresses	Explicit addresses from metadata
2	DNS	log.{vpc_id}-log.svc.cluster.local
3	CSR API	Config Service Registry service lookup
4	Config Service	Zone properties lookup
5	Fallback	127.0.0.1 (localhost)

Example: 10.223.251.221 (from captured rig)

VM Type Templates

Different rig types use different nxlog templates:

VM Type	Service Name	Template
gameseat	winevents-gameseat	nxlog_template.conf
storage	winevents-storage	nxlog_template_storage.conf
pm (Provision Manager)	winevents-pm	nxlog_template_pm.conf
mgmt (default)	—	nxlog_template_mgmt.conf

Protocol

• Default: UDP syslog (port 514)
• TCP enabled when tcprsyslogenabled = true in metadata

What Gets Logged

The log uploader collects from all of these paths:

Session Logs

%AG_LOGS%\*.txt
%AG_LOGS%\GCIS\**\*.*            ← Plugin logs (ElmPlugin, GciPlugin, etc.)
%AG_LOGS%\SessionMngr\*.log      ← Session manager
%AG_LOGS%\AutoOnboarder\**\*.*   ← CTMT platform controller
%AG_LOGS%\NDC\**\*.*             ← Network data capture service
%AG_LOGS%\GSP\**\*.*             ← GSP configurator/service logs
%AG_LOGS%\Morph\**\*.*           ← Morph transition service logs
%AG_LOGS%\StutterShark\**\*.*    ← Runtime stutter diagnostics
%AG_LOGS%\Startup\*.*            ← Boot sequence
%AG_LOGS%\pcap\*.pcap            ← Packet captures (technical)

NVIDIA Service Logs

C:\Programdata\NVIDIA Corporation\NvStream\*.*
C:\Programdata\NVIDIA Corporation\NvStreamSrv\*.*
C:\Programdata\NVIDIA Corporation\nvstreamsvc\*.*
C:\Programdata\NVIDIA Corporation\GCIS\*.*
C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem\messagebus.conf

Driver & FBC Logs

C:\ProgramData\NVIDIA Corporation\NvFBC\logError.txt
C:\ProgramData\NVIDIA Corporation\NvFBC\logStartup.txt
C:\ProgramData\NVIDIA Corporation\NvTelemetry\*.*       ← Telemetry (behavioral)
C:\ProgramData\Nvidia Corporation\NvVad\*.*             ← Virtual audio driver

Crash Dumps

C:\Programdata\NVIDIA Corporation\Crashdumps\*.*
C:\temp\Crashdumps\*.*
C:\Windows\MEMORY.DMP
C:\Windows\minidump\*.dmp

Windows Event Logs

Application.evtx
Security.evtx
Setup.evtx
System.evtx
ForwardedEvents.evtx
Microsoft-Windows-Sysmon%4Operational.evtx    ← Sysmon security events
Microsoft-Windows-AppLocker%4EXE and DLL.evtx  ← AppLocker

Configuration (uploaded alongside logs)

C:\Asgard\conf\*.txt
C:\Asgard\conf\*.log

User-Space Logs

C:\users\kiosk\Appdata\Local\NVIDIA Corporation\nvstreamsvc\steam*.log
C:\users\kiosk\Appdata\Local\NVIDIA\NvBackend\*.log*
C:\users\kiosk\Appdata\Local\Nvidia Corporation\Lightning\light-*.log
C:\users\kiosk\Appdata\Local\NVIDIA Corporation\NvStream\*.*

Log Consent Levels

Each log path has a consent level controlling when it can be collected:

Consent Level	Description
functional	Always collected (session operation)
technical	Collected for technical support
technical_behavioral	Behavioral data (telemetry)

Upload Settings

{
  "LogUploader": {
    "compressionAlgorithm": "zlib_deflate",
    "compressionLevel": -1,
    "uploadTimeoutSec": 600
  }
}

GCIS Plugin Log Files

Each plugin writes its own log under C:\Asgard\logs\GCIS\:

File	Plugin	Typical Size
ElmPluginCurrent.log	ElmPlugin	16,358+ lines
GciPluginCurrent.log	GciPlugin	7,507+ lines
GcpPluginCurrent.log	GcpPlugin	~54 lines
LkmPluginCurrent.log	LkmPlugin	~62 lines
UadMLPluginCurrent.log	UadMLPlugin	~88 lines
UadMLPluginData.log	UadMLPlugin	Feature data
UadPluginCurrent.log	UadPlugin (legacy)	2,231+ lines
GssmPluginCurrent.log	GssmPlugin	Mandatory plugin/session guard
Smithy/Smithy.log	Smithy	Security hardening

MessageBus Log Files

Two high-volume message bus pipe logs are generated per session:

MessageBus_1224_0x1873A7233B0.log   → 28,200 lines
MessageBus_4552_0x22A8D482650.log   → 34,292 lines

These log all IPC traffic between the GCIS plugins and the Bifrost message bus.