TLSPilot writes events to the Windows Event Viewer and to log files. The logs are also available in the Desktop Admin console under Tools → View logs & audit…, see chapter Logging, and with Get-TLSPilotLog.
Where TLSPilot writes events and logs| Where | What you find there |
|---|
| Event Viewer → Applications and Services Logs → iTrain-TLSPilot → Operational | Cycle, issue, renewal, deployment, Health, license and service events. |
| … → iTrain-TLSPilot → Audit | Changes by users, for example certificates, credentials, RBAC, settings, opened views and revealed passwords. |
| … → iTrain-TLSPilot → Debug | Details such as HTTP calls to the CA (1542), DNS providers (1801) and Microsoft Graph (1802). |
| Event Viewer → Windows Logs → Application and System | Start failures of the services as reported by Windows, for example from the sources Service Control Manager, .NET Runtime or Application Error. The details are in service-<date>.log or webservice-<date>.log. |
%ProgramData%\iTrain\TLSPilot\logs\service-<date>.log | Log of the management service, kept for 30 days. |
…\logs\webservice-<date>.log | Log of the WebUI service. |
…\logs\issue-diagnostic.log | Details of internal errors while issuing. |
Event IDs of TLSPilot| Event IDs | Area |
|---|
| 1100–1106 | Daily cycle: trigger, start, complete, failed, per certificate, skipped |
| 1200–1232 | Certificates: create, issue, renew, fail (1213), Force renew, revoke, renewal window, rollback, export, CA emergency (1221), move to tenant (1232) |
| 1300–1322 | Deployments and Health: start, ok, fail (1302), dry run, warning (1305), Health ok (1321) and fail (1322) |
| 1400–1422 | Credentials and external credential stores |
| 1500–1570 | RBAC, configuration, backup, license (1530–1538), ACME account, alerts, tenants, Entra test |
| 1600–1603 | Private CA: generate, renew, decommission, restore |
| 1700–1716 | Opened views (Audit) |
| 1800–1802 | Scheduler and HTTP calls (Debug) |
| 1900–1990 | Services, Event Log registration (1910), API errors (1990) |
| 1000–1002, 2000–2002, 3000–3002 | Other events in the channels Audit, Operational and Debug |
Troubleshooting: logs and diagnosis
| Symptom | Cause | Solution |
|---|
| Event 1910: Event Log registration failed or channels are not published. | The channels iTrain-TLSPilot/* are not registered. | Run Register-TLSPilotEventLogs.cmd from the installation folder (for example C:\Program Files\iTrain\TLSPilot\Tools) as administrator, or repair the installation with Setup.exe. |
| Log: Event log manifest missing (<file>). Reinstall with Setup.exe so channels can be created. | The manifest of the event channels is missing. | Repair the installation with Setup.exe. |
