Loading...

Knowledge Center


How to enable Log Level 8 for ePolicy Orchestrator troubleshooting
Technical Articles ID:   KB56207
Last Modified:  6/11/2019
Rated:


Environment

McAfee ePolicy Orchestrator (ePO) 5.x

Summary

Technical Support might request debug level log files when troubleshooting an issue. Registry settings control the ePO logging level.
  • The default log level has a registry setting of 7.
  • Debug level logging requires a registry setting of 8.
Log Level 8 produces many more log entries, including every SQL query and whether there is an error. Log Level 8 provides all communication details needed to troubleshoot network and proxy server issues. Because Log Level 8 generates so many more entries, the size of the logs must be increased to capture the additional information. The default log size is 1 MB.
 
Guidance for enabling Log Level 8
  • It is important that you enable Log Level 8 before trying to reproduce a problem. If you enable Log Level 8 for an issue that cannot be reproduced, it does not provide adequate information for troubleshooting.
  • If you are investigating client and server issues, you must enable Log Level 8 on both the client and server before trying to reproduce the problem. Enabling Log Level 8 on both the client and server is needed to successfully capture the additional logging required to help investigate the issue. For information about debug logging for client-related issues, see:
  • Use the advice in this article to define a suitable log size to contain all information. Write the log to drives with sufficient space. McAfee recommends a larger log file size rather than a smaller one to ensure the relevant data is captured. If the log is too small, relevant data might not be captured.

Solution

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a REG file that is not confirmed to be a genuine registry import file.


To enable Log Level 8:
  1. Edit the registry:
     
    1. Click Start, Run, type regedit, then click OK.
    2. Locate the following registry key:

      64-bit:
      [HKEY_Local_Machine\SOFTWARE\WOW6432Node\Network Associates\ePolicy Orchestrator]
      [HKEY_Local_Machine\SOFTWARE\WOW6432Node\McAfee\ePolicy Orchestrator]
       
      32-bit:
      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator] 
       
    3. Right-click the REG_DWORD entry LogLevel and select Modify (create the entry if it does not exist).
    4. In the Value data box, type 8.
    5. Click OK.
       
  2. Create a DWORD value for LogSize if it does not exist:
     
    1. Right-click the ePolicy Orchestrator key and select New, DWORD Value.
    2. Type LogSize in the New Value field and press Enter. The named DWORD Value is created.

      NOTE: This value defines the size of the log in megabytes. The default value is 1. The value needed for Log Level 8 logging varies, depending on the evaluated function.
       
    3. To set the log file size value, right-click LogSize and select Modify.

      To decide the LogSize value: 
       
      -
       
      If troubleshooting an updating issue (client or server side) that is reproduced immediately, a 5-MB log file size is required.
      For the DWORD value, type 5.
      -
       
      If troubleshooting an ePO server issue that is not reproducible on demand, a 30-MB log file size is required.
      For the DWORD value, type 30.
       
    4. Click Registry, Exit.

      NOTE: For most logs, the logging level changes become effective after one minute.
       
  3. Generate logging time stamps with high resolution:

    NOTE: High-resolution logging is included by default if McAfee Agent 4.5 Update 3 or later is installed on the ePO server. Technical Support might require increased logging for the time stamp, which can be done with the High-Resolution Timer registry key. The time stamps contain additional digits to indicate milliseconds. Disable this option after the needed data has been collected.
     
    1. Right-click the ePolicy Orchestrator key and select New, DWORD Value.
    2. To create a value, type LogHiRes in the New Value field and press Enter.
    3. Right-click LogHiRes and select Modify.
    4. Type 1 in the Value data box.
    5. Click OK.

    DWORD values for the LogHiRes key:

    0 = Disabled
    1 = Enabled

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.