How to enable debug logging in the Orion.log

Technical Articles ID: KB52369
Last Modified: 10/1/2021

Environment

McAfee ePolicy Orchestrator (ePO) 5.x

Summary

You can set the log level to debug to collect more data when you are troubleshooting problems related to multiple ePO issues.

After debugging is enabled, the Orion.log reports:

If the user is using an incorrect user name or password
Any communication with the ePO database
Anything that happens on the console

The Tomcat service (ePolicy Orchestrator 5.x Application Server) records information in Orion.log (Server\logs folder).

IMPORTANT: Make sure that you disable the debug log setting after you troubleshoot and collect logs.

The instructions differ based on the version of ePO you are using. Make sure you follow the correct solution based on your ePO version.

Solution

Instructions for ePO 5.10 Update 10 and earlier:

IMPORTANT: If you are using ePO 5.10 Update 5 or later, it is recommended that you adjust the log level using the User Interface the instructions in Solution 3.

Enable debug log level logging for the Orion.log file:

Open Windows Explorer and go to <ePO_Install_folder>\Server\conf\orion.
Right-click LOG-CONFIG.XML and click Edit to open the file in Notepad.
Scroll down to the bottom of the file and locate the following section:

<root>
<priority value ="WARN" />
<appender-ref ref="ROLLING" />
<appender-ref ref="STDOUT"/>
</root>
Change <priority value ="WARN" /> to <priority value ="DEBUG" />.

NOTE: If needed, you can adjust the size of Orion.log by following steps 5 and 6. Skip to step 7 to retain the default size.
Locate the appropriate line by searching for the term MaxFileSize.
Change <param name="MaxFileSize" value="2MB"/> to <param name="MaxFileSize" value="20MB"/>.

NOTE: You can set a smaller or higher value, for example 10 MB or 80 MB, if needed.
Click File, Save.
Click File, Close.

NOTE: A service restart is not needed; the log change takes effect within a few minutes.

Disable debug log level logging:
Only complete these steps after you capture the data for troubleshooting.

Open Windows Explorer and go to <ePO_Install_Folder>\Server\conf\orion.
Right-click LOG-CONFIG.XML and click Edit to open the file in Notepad.
Scroll down to the bottom of the file and locate the following section:

<root>
<priority value ="DEBUG" />
<appender-ref ref="ROLLING" />
<appender-ref ref="STDOUT"/>
</root>
Change <priority value ="DEBUG" /> to <priority value ="WARN" />.
Locate the appropriate line by searching for the term MaxFileSize.
Change <param name="MaxFileSize" value="20MB"/> to <param name="MaxFileSize" value="2MB"/>.
Click File, Save.
Click File, Close.

NOTE: A service restart is not needed; the log change takes effect within a few minutes.

Solution

Instructions for ePO 5.10 Update 11 and later

IMPORTANT: If you are using ePO 5.10 Update 5 or later, it is recommended that you adjust the log level using the User Interface the instructions in Solution 3.

Enable debug log level logging for the Orion.log file:

Open Windows Explorer and go to <ePO_Install_folder>\Server\conf\orion.
Right-click LOG-CONFIG.XML and click Edit to open the file in Notepad.
Scroll down to the bottom of the file and locate the following section:

<Root level="WARN ">
<AppenderRef ref="ROLLING"/>
</Root>
Change <Root level="WARN "> to <Root level="DEBUG">.

NOTE: If needed, you can adjust the size of Orion.log by following steps 5 and 6. Skip to step 7 to retain the default size.
Locate the appropriate line by searching for the term: SizeBasedTriggeringPolicy.
Change the section below where:
- SizeBasedTriggeringPolicy is the size of each Orion.log file in megabytes.
- DefaultRolloverStrategy controls the number of backup logs ePO retains.
  
  <Policies>
  <SizeBasedTriggeringPolicy size="64M"/>
  </Policies>
  <DefaultRolloverStrategy max="13"/>
  
  NOTE: You can set a smaller or higher value, for example 10 M or 80 M, if needed.
Click File, Save.
Click File, Close.

NOTE: A service restart is not needed; the log change takes effect within a few minutes.

Disable debug log level logging:
Only complete these steps after you capture the data for troubleshooting.

Open Windows Explorer and go to <ePO_Install_Folder>\Server\conf\orion.
Right-click LOG-CONFIG.XML and click Edit to open the file in Notepad.
Scroll down to the bottom of the file and locate the section stated below:

<Root level="DEBUG ">
<AppenderRef ref="ROLLING"/>
</Root>
Change <Root level="DEBUG "> to <Root level="WARN">.
Locate the appropriate line by searching for the term SizeBasedTriggeringPolicy.
Change the section where:
- SizeBasedTriggeringPolicy is the size of each orion.log file in megabytes.
- DefaultRolloverStrategy controls the number of backup logs ePO retains (default values shown).

Click File, Save.
Click File, Close.

NOTE: A service restart is not needed; the log change takes effect within a few minutes.

Solution

A new user-friendly graphical interface has been introduced in ePO 5.10 Update 5 and later. It can be used to modify the log-config.xml, as explained above.

To access the interface, go to the following URL on your ePO server:

https://localhost:8443/core/config-log

Where:

localhost - Can be the name as your ePO server
Port 8443 - Is the default tomcat port, adjust the port to your own environment

NOTES:

The above URL requires ePO administrative credentials. If a user without administrator rights tries to log on, a message is displayed: "Only administrators can access this page"
After the user authenticates, a set of loggers is displayed. Some of them are ON by default. Others are set to OFF by default. Some of the loggers are meant to be OFF by default, and must not be turned on, unless specified by Technical Support. Turning on the loggers for an indefinite period, can lead to performance issues on your ePO server. Issues similar to the ones described in KB86593 - Performance issues on ePO 5.x when debug logging is enabled.
After you edit LOG-CONFIG.XML via the user interface, the changes take effect within minutes by default, even without restarting this service.

Technical Support might provide you specific loggers to debug different extensions. You can debug by clicking the '+' symbol, and adding the logger provided by support.

Related Information

NOTE: For more information about how to enable other debugging, see your ePO product documentation.

For product documents, go to the Enterprise Product Documentation portal.

Common search terms to find this article: EPO Data Collection, Diagnostic Data Collection

Previous Document ID ^(Secured)

615070

Affected Products

Diagnostic Data Collection
ePolicy Orchestrator 5.9 (EOL)
ePolicy Orchestrator 5.10.x
Troubleshooting

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

How to enable debug logging in the Orion.log

Environment

Summary

Solution

Solution

Solution

Related Information

Previous Document ID ^(Secured)

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

How to enable debug logging in the Orion.log

Environment

Summary

Solution

Solution

Solution

Related Information

Previous Document ID (Secured)

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title

Previous Document ID ^(Secured)