Configure KDF Logs for Secure Client on Windows and MacOS

Available Languages

Download Options

PDF (907.0 KB)
View with Adobe Reader on a variety of devices
ePub (1.0 MB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (593.8 KB)
View on Kindle device or Kindle app on multiple devices

Updated:April 27, 2026

Document ID:225409

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

Windows and MacOS FLAGS

Collecting KDF Logs, Wireshark and DART Bundle

Windows

MacOS

Related Information

Introduction

This document describes how to collect KDF logs and other important troubleshooting logs on Windows and MacOS.

Windows and MacOS FLAGS

DNS Related (When OpenDNS is involved):	0x20801FF
Web flow (SWG) proxy and DNS Related:	0x70C01FF
ZTA	0x400080152

Collecting KDF Logs, Wireshark and DART Bundle

Note: When you submit the results, always let the TAC Team know what settings were used and be open to changing as TAC requires.

Windows

Open a CMD with admin privileges and run the next command:

"%ProgramFiles(x86)%\Cisco\Cisco Secure Client\acsocktool.exe" -sdf [FLAG]

Download DebugView from SysInternal to capture the KDF log.
Run DebugView as administrator and enable the next menu options.
Click Capture.
- Checkmark Capture Kernel.
- Checkmark Enable Verbose Kernel Output.
Options
- Checkmark Clock Time.
- Checkmark Show Milliseconds.

DebugView 1

DebugView 2

Restart the client service via admin prompt:

net stop csc_vpnagent && net start csc_vpnagent

If net stop csc_vpnagent && net start csc_vpnagent does not work, restart Cisco Secure Client service from services.msc.

Services.msc

Start Wireshark Capture.
Select all the interfaces, and start the packet capture.

Wireshark

Reproduce the issue, and save KDF Logs and Wireshark Capture, then follow the steps to capture DART Bundle.
Open the Cisco Secure Client Diagnostics & Reporting Tool (DART) with administrator privileges.

Click Custom.
- Include System Information Extensive and Network Connectivity Test.

Note: Collect all the logs: KDF Logs, Wireshark Capture and DART Bundle to the TAC Case.

To stop the KDF from logging on Windows use the next command:

"%ProgramFiles(x86)%\Cisco\Cisco Secure Client\acsocktool.exe" -cdf

MacOS

Open terminal and follow the next command chain to enable KDF Logging on MacOS:

Stop Service.

sudo "/opt/cisco/secureclient/bin/Cisco Secure Client - AnyConnect VPN Service.app/Contents/MacOS/Cisco Secure Client - AnyConnect VPN Service" uninstall

Enable Flag.

echo debug=[Flag Value] | sudo tee /opt/cisco/secureclient/kdf/acsock.cfg

Start Service.

open -a "/opt/cisco/secureclient/bin/Cisco Secure Client - AnyConnect VPN Service.app"

Start Wireshark Capture.
Select all the interfaces, and start the packet capture.

Wireshark

Reproduce the issue, and save KDF Logs and Wireshark Capture, then follow the steps to capture DART Bundle.
Open the Cisco Secure Client - DART.

DART 3

Checkmark the next options:
- Include Legacy - Cisco AnyConnect Secure Mobility Client Logs.
- Include System Logs.
Click Run.

DART 4