---
title: Debugging ACI issues
description: "Diagnose unexpected access control behavior by enabling the Debug ACI Logger, which records the server's access control decisions."
component: pingdirectory
version: 10.2
page_id: pingdirectory:pingdirectory_security_guide:pd_sec_debug_aci_issues
canonical_url: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_security_guide/pd_sec_debug_aci_issues.html
llms_txt: https://docs.pingidentity.com/pingdirectory/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2023-09-13T00:00:00Z
superseded_by: https://docs.pingidentity.com/pingdirectory/11.1/pingdirectory_security_guide/pd_sec_debug_aci_issues.html
---

# Debugging ACI issues

If you encounter a scenario in which the server seems to exhibit a behavior that is not in-line with the expected access control configuration, you can use the Debug ACI Logger to obtain detailed information about the access control decisions the server is making.

You can do this with the following configuration change.

```
dsconfig set-log-publisher-prop \
     --publisher-name "Debug ACI Logger" \
     --set enabled:true
```

After you enable it, this logger records information about its access control decisions to the `logs/debug-aci` file. Because the server can write huge amounts of data to this file on a busy production server, you might want to try this on a separate instance that has been populated with the same set of access control rules. Alternatively, you can configure the logger with criteria that only matches the operations you are trying to investigate.