How to get the node log entries for flows that have executed?

To identify which node picked up the async flow when creating a record or submitting a catalog item, review the node logs after determining the node.

Kingston and above

When creating a record or submitting a catalog item that is expecting an async flow to execute, there is a corresponding event "flow.start" in the [sysevent] table.

1. Review the state of the sysevent record. If it shows "processed", then the FEEH (Flow Engine Event Handler) picked up the event and processed the flow.
2. [sys_flow_context] sys_id will be in the instance name of the [sysevent] record.
3. From the claimed_by field of the sysevent record you can see which node picked up the flow event, then can be furthered confirmed by the sys_update_by which would show "system".
4. With the sys_updated_on timestamp, using Splunk it can search this node at this time for when the worker processed the flow event.
5. The node log entry would start with:
   

   2020-02-12 12:48:49 (234) worker.2 worker.2 txid=fa621873db7e *** Start  Background transaction - system, user: system
   2020-02-12 12:48:49 (236) worker.2 worker.2 txid=fa621873db7e Name: Flow Engine Event Handler
   Job Context:

6. If a Null Pointer Exception is found, then the sys_id of the [sysevent] and [sys_flow_context record] will show:
   

   2020-03-14 10:34:59 (581) worker.6 worker.6 txid=255fc3611be7 SEVERE *** ERROR *** Failed to process event: sysevent[e74f4fe91b6340100e24a717ec4bcba7], targetContext: sys_flow_context[ef4f4fe91c634010b4b2503c2a9d8da6], exception:com.snc.process_flow.exception.ProcessAutomationException:  is not a valid component

Configure the following Splunk query to search for node logs. Refine the search to a particular node, txid, worker, etc.:

instance=<instance_name_prod> sourcetype=appnode_localhost_log "Search" | sort_time