trace logging for cisco secure client (anyconnect)

 https://www.cisco.com/c/en/us/support/docs/security/umbrella/224921-enable-roaming-client-trace-logs.html#toc-hId--1891865857

1 - Enable trace logging (logs more detail for the dart)

https://www.cisco.com/c/en/us/support/docs/security/umbrella/224921-enable-roaming-client-trace-logs.html

On windows machines in: C:\ProgramData\Cisco\Cisco Secure Client\Umbrella\data

Create a file called loglevel.flag (ensure the file extension is correct)

just have "trace" in the file with no quotes

2 - Once the file is in place restart the CSC services

You may be able to complete these actions with a with GPO/Script etc.

3 - Wait for the issue to happen again and collect the DART bundle again. Send DART to cisco for review.