Knowledge Center

Data Collection - How to enable Log Level 8 for ePolicy Orchestrator troubleshooting
Technical Articles ID:   KB56207
Last Modified:  9/5/2019


McAfee ePolicy Orchestrator (ePO) 5.x


Technical Support might request debug level log files when troubleshooting an issue as part of Data Collection. Registry settings control the ePO logging level.
  • The default log level has a registry setting of 7.
  • Debug level logging requires a registry setting of 8.
Log Level 8 produces many more log entries, including some SQL queries and whether there is an error. Log Level 8 provides all communication details needed to troubleshoot network and proxy server issues. Because Log Level 8 generates so many more entries, the size of the logs must be increased to capture the additional information. The default log size is 1 MB.
Guidance for enabling Log Level 8
  • IMPORTANT: Enable Log Level 8 before you try to reproduce a problem. Enabling Log Level 8 for an issue that can't be reproduced, does not provide adequate information for troubleshooting.
  • If you are investigating client and server issues, you must enable Log Level 8 on both the client and server before trying to reproduce the problem. Enabling Log Level 8 on both the client and server is needed to successfully capture the additional logging needed to help investigate the issue. For information about debug logging for client-related issues, see:
  • Use the advice in this article to define a suitable log size to contain all information. Write the log to drives with sufficient space. McAfee recommends a larger log file size rather than a smaller one to make sure that the relevant data is captured. If the log is too small, relevant data might not be captured.


CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a REG file that is not confirmed to be a genuine registry import file.

To enable Log Level 8:
  1. Edit the registry:
    1. Click Start, Run, type regedit, then click OK.
    2. Locate the following registry key:

      [HKEY_Local_Machine\SOFTWARE\WOW6432Node\Network Associates\ePolicy Orchestrator]
      [HKEY_Local_Machine\SOFTWARE\WOW6432Node\McAfee\ePolicy Orchestrator]
      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator] 
    3. Right-click the REG_DWORD entry LogLevel and click Modify (create the entry if it does not exist).
    4. In the Value data box, type 8.
    5. Click OK.
  2. Create a DWORD value for LogSize if it does not exist:
    1. Right-click the ePolicy Orchestrator key and select New, DWORD Value.
    2. Type LogSize in the New Value field and press Enter. The named DWORD Value is created.

      NOTE: This value defines the size of the log file in megabytes. The default value is 1. The value needed for Log Level 8 logging varies, depending on the evaluated function.
      1. To set the log file size value, right-click LogSize and click Modify.

        To decide the LogSize value: 
        When troubleshooting an update issue, client or server, that is reproduced immediately. Then a 5-MB log file size is needed.
        For the DWORD value, type 5.
        If troubleshooting an ePO server issue that is not reproducible on demand, a 30-MB log file size is needed.
        For the DWORD value, type 30.
    3. Click Registry, Exit.

      NOTE: For most logs, the logging level changes become effective after one minute. A services restart might be needed for some logs too.
  3. Generate logging time stamps with high resolution:

    NOTE: High-resolution logging is included by default if McAfee Agent 4.5 Update 3 or later is installed on the ePO server. Technical Support might require increased logging for the time stamp, which can be done with the High-Resolution Timer registry key. The time stamps contain more digits to indicate milliseconds. Disable this option after the needed data has been collected.
    1. Right-click the ePolicy Orchestrator key and select New, DWORD Value.
    2. To create a value, type LogHiRes in the New Value field and press Enter.
    3. Right-click LogHiRes and click Modify.
    4. Type 1 in the Value data box.
    5. Click OK.

    DWORD values for the LogHiRes key:

    0 = Disabled
    1 = Enabled

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms

 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.