https://www.cisco.com/c/en/us/support/docs/security/umbrella/224921-enable-roaming-client-trace-logs.html#toc-hId--1891865857
1 - Enable trace logging (logs more detail for the dart)
https://www.cisco.com/c/en/us/support/docs/security/umbrella/224921-enable-roaming-client-trace-logs.html
On windows machines in: C:\ProgramData\Cisco\Cisco Secure Client\Umbrella\data
Create a file called loglevel.flag (ensure the file extension is correct)
just have "trace" in the file with no quotes
2 - Once the file is in place restart the CSC services
You may be able to complete these actions with a with GPO/Script etc.
3 - Wait for the issue to happen again and collect the DART bundle again. Send DART to cisco for review.
