Enable or disable logging
To enable or disable logging, use the
Host Intrusion Prevention TroubleShooting (
hipts) command line tool at
...\opt\McAfee\hip\hipts.
NOTE: The debug log setting only affects the HipShield.log and HipClient.log files.
Available commands:
NOTE: Logging must never be enabled for long periods of time. The log files can grow without limit and have adverse effects.
| Logging type |
Command |
| To enable logging |
hipts logging on |
| To disable logging |
hipts logging off |
The following log files are located in:
\opt\McAfee\hip\hipts\log
- HipShield.log
This file contains all messages pertinent to interactions between the agent (HipClient-bin) and the low-level code for the shield engines.
- HipClient.log
The agent (HipClient-bin) logs activities to this file.
- HipMgtPlugin.log
This file is written by the HipMgtPlugin.so plug-in. This shared object is loaded by the Common Management Agent (CMA), and runs as part of a CMA process.
- hipus.log
This log file is for the HIPUS daemon (daemon designated to communicate with the kernel module).
Log File Rotation for Unix Host Intrusion Prevention Agents:
Log file rotation for UNIX is controlled by the entries
log_rotate_size_kb and
log_rotate_count in the
local.conf file. When enabled (by setting
log_rotate_size_kb to a nonzero value), no log file is permitted to grow substantially beyond the specified size (in kilobytes).
NOTE: The log file rotation setting only affects the
HipShield.log and
HipClient.log files.
After the specified size is exceeded, the file is closed and renamed with the suffix ".1". If a file with that name exists, the suffix is incremented by one, with the highest number specified in the variable log_rotate_count. When the specified number of backup files is reached, the oldest will be deleted.
Example: When the log file HipShield.log reaches the threshold size, it is renamed as HipShield.log.1. If a file with that name exists, the new file gets named as HipShield.log.2.
To enable rotation:
- Disable Host Intrusion Prevention.
-
Navigate to
.../opt/McAfee/hip/.
-
To add the entries below with the values needed, edit the local.conf file:
-
log_rotate_size_kb=500
This variable controls how large any of the log files can grow in KB before being rotated. The default value of 0 means that there is no log file rotation.
-
log_rotate_count=2
This variable controls how many rotated log files are retained.
NOTE: If log_rotate_size_kb is set to 0, rotation is disabled.
- Enable Host Intrusion Prevention.
Enable Message Type logging
You can enable or disable message types when logging is enabled.
Nearly every line written to one of the log files begins with a time stamp and a message type. For example:
10-30 10:34:34 INFO: Called CTRL_SetShieldDb size = 145624
The type of this message is INFO, and can be enabled by using the following hipts command:
hipts message info:on
NOTE: This command enables INFO type messages in all log files.
The message types supported by non-Windows Host IPS clients are:
- ERROR
- WARNING
- DEBUG
- INFO
- VIOLATIONS
For troubleshooting, it is recommended to set message type to
DEBUG.
This setting can be enabled by using the following
hipts commands:
hipts message debug:on
hipts logging on
These commands enable
DEBUG type messages for all log files.
NOTE: Logging must never be left enabled for long periods of time.
