• Understanding Agent log files
• Enabling Agent logging
• Logging of Rules and Exceptions
• Engine Debug messages
• Firewall Component log files

• The primary IPS log file used by the Host IPS 8.0 systems is the HipShield.log. This file is located in c:\Documents And Settings\All Users/Application Data\McAfee\Host Intrusion Prevention\HipShield.log.
   
• When Host IPS is running on Windows Vista or later platforms, the file is located in c:\Program Data\McAfee\Host Intrusion Prevention\HipShield.log. The HipShield log file grows to 128 MB and rotates with one backup. The registry keys log_rotate_count and log_rotate_size_kb control the size and the number of rotated HipShield.log files. (See the Log Rotation section for further details.) 

1. Double-click on the Host IPS tray icon and unlock the Host IPS client console. You need an administrator or time-based password to unlock the console.
2. Open HelpTroubleshooting.
3. Select the required logging settings:
   1. Check Enable Logging for IPS and Firewall logging.
   2. Select All for IPS and Firewall logging.
      
      These locally configured settings remain in effect until the client console is locked/stopped.
      Also, a policy enforcement from ePO overrides the local policy (if the client console is locked/stopped).

• Lines that begin with In install modules new describe file copy actions that are part of the start of the Host IPS component. Failure to copy these files prevents the Host IPS component from starting.
• A line that begins with Scrutinizer initialized successfully indicates that the Host IPS component has been successfully loaded through the initialization of the Scrutinizer. The initialization of the Scrutinizer depends on the above-mentioned file copy actions.
• A line that begins with New Process: Pid= indicates that the Host IPS component can monitor process creation. 
• A line that begins with IIS - Start indicates that the Host IPS component can monitor IIS. 
• A line that begins with Scrutinizer started successfully (ACTIVATED status) indicates that the Scrutinizer has successfully started. 
• A line that begins with Hooking xxx indicates that process hooking is proceeding. The number xxx indicates the PID (process ID) of the process being hooked. 
• A series of lines that begin with Processing Buffer xxx.scn report the results of the Scanner processing of scan file xxx.scn, where xxx is a name like EnterceptMgmtServer, as shown above. Errors in the processing of scan files are reported here. 
• Lines in the format signature=111 level=2, log=True report that an individual signature has been loaded. The signature ID and level are included with an indication of whether logging is enabled for this signature.

Host IPS Component Logging of Rules and Exceptions
Shield.db and except.db are created in the Agent directory only when you enable debugging. These files contain a dump of the rules and exceptions that are sent to the kernel after the AgentNT.dll has processed the content.

Host IPS Component HTTP Engine Log File/Engine Debug messages

1. Click Start, Run, type regedit, then click OK.
2. Navigate to and select the registry key below:
   
   [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\HIP\Engines\ISAPIControl]
    
3. In the right pane, verify that a String Value named DebugFile exists. If it does not, right-click a blank space, select New, String Value, and name the new string DebugFile.
4. Right-click the DebugFile value and select Modify.
5. In the Value data field, type the full path to the file where the engine writes debug messages.
   
   NOTE: The file referenced in the path (for example, c:\http.txt) must exist for the debug messages to be successfully written.
   
   After this key is created, debug logging to the specified file will begin immediately.
   
   You can also set this entry to the special value debug. In this case, the debug messages are written using DbgPrint and can be viewed using DbgView. It is useful for IIS6 because IIS6 prevents a server from writing to locations outside of its directories. But, if permissions are configured for a server to write to locations outside of its directories, it still does so.
    
6. Stop and Restart the IIS service for this debug setting to take effect.

• S denotes that the message came from the Stub part of the filter.
• E means that the message came from the Engine part.