Skip to main content

NinjaOne Backup — Log File Locations & How to Read Them

Audience: T2 Use when: NinjaOne console doesn't give you enough detail on a backup failure, or NinjaOne support asks for logs before they'll engage.

Where Lockhart Logs Live

The primary log directory on every backed-up Windows device:

C:\ProgramData\NinjaRMM\NinjaOneBackup\logs\

# Verify the path exists and show file list (newest first)
$logPath = "C:\ProgramData\NinjaRMM\NinjaOneBackup\logs"
Get-ChildItem $logPath | Sort-Object LastWriteTime -Descending | Select Name, LastWriteTime, @{N='SizeMB';E={[math]::Round($_.Length/1MB,2)}}

If this path doesn't exist, Lockhart has either never installed successfully or was removed. See: NinjaOne Backup — Agent Won't Install.

Log Files and What Each Does

File What It Contains
lockhart.log Primary operational log — backup job activity, errors, service events
lockhart-YYYY-MM-DD.log Rotated daily logs — same format, previous days
install.log Agent installation/upgrade log
crash.log Lockhart crash reports (if present, take this seriously)

The active lockhart.log is the one to start with. Older rotated logs are useful when the issue started on a prior date.

How to Read the Log

Each line follows this pattern:

[TIMESTAMP] [LEVEL] [COMPONENT] Message text

Example:

2026-04-13 00:02:14 INFO  BackupJob     Starting image backup job for volume C:\
2026-04-13 00:02:15 INFO  VSS           Requesting VSS snapshot on volume C:\
2026-04-13 00:02:31 ERROR VSS           VSS snapshot failed: 0x80042302 (VSS_E_PROVIDER_NOT_REGISTERED)
2026-04-13 00:02:31 ERROR BackupJob     Job failed with error code 132

Log levels:

Level Meaning
INFO Normal operation — job started, progress, completed
WARN Something notable but not fatal — open file skipped via VSS, etc.
ERROR A failure occurred — the line after usually contains the error code
FATAL Service-level crash — check crash.log if present

Quick Log Triage Commands

# Set the log path
$logPath = "C:\ProgramData\NinjaRMM\NinjaOneBackup\logs\lockhart.log"

# Show last 100 lines
Get-Content $logPath -Tail 100

# Show only errors and fatals from today
Get-Content $logPath | Where-Object {$_ -match "ERROR|FATAL"}

# Find the last job result
Get-Content $logPath | Where-Object {$_ -match "Job (completed|failed|error code)"} | Select-Object -Last 5

# Find a specific error code (e.g., 360)
Get-Content $logPath | Where-Object {$_ -match "error code 360|ERROR.*360"}

# Search across all rotated logs for an error code
Get-Content "$logPath-*.log" | Where-Object {$_ -match "error code 132"} | Select-Object -Last 20

Checking the NinjaOne Console Backup Activity Log

Before pulling local logs, check the console — it surfaces the error code without remoting in:

  1. NinjaOne → search for the device
  2. Device page → Backup tab
  3. Click the failed job entry → expand the details
  4. The error code and message are shown here

The console log is sufficient for most T1 triage. Pull local Lockhart logs when the console message is ambiguous or NinjaOne support needs the raw log.

Collecting Logs for a Support Ticket

# Zip all Lockhart logs into a single file for NinjaOne support
$logPath = "C:\ProgramData\NinjaRMM\NinjaOneBackup\logs"
$dest = "C:\Temp\NinjaBackupLogs_$(Get-Date -Format 'yyyyMMdd_HHmm').zip"

if (-not (Test-Path "C:\Temp")) { New-Item -ItemType Directory -Path "C:\Temp" | Out-Null }
Compress-Archive -Path "$logPath\*" -DestinationPath $dest -Force
Write-Host "Logs zipped to: $dest"

Attach this zip to the NinjaOne support ticket. Also include the output of:

# System context for support
[PSCustomObject]@{
    Hostname     = $env:COMPUTERNAME
    OS           = (Get-CimInstance Win32_OperatingSystem).Caption
    OSBuild      = (Get-CimInstance Win32_OperatingSystem).BuildNumber
    LockharStatus = (Get-Service | Where-Object {$_.DisplayName -like "*Lockhart*"}).Status
    Time         = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
} | Format-List
Back to top