Loading...

Knowledge Center


Data Collection - How to enable Log Level 8 for ePolicy Orchestrator troubleshooting
Technical Articles ID:   KB56207
Last Modified:  9/5/2019
Rated:


Environment

McAfee ePolicy Orchestrator (ePO) 5.x

Summary

Technical Support might request debug level log files when troubleshooting an issue as part of Data Collection. Registry settings control the ePO logging level.
  • The default log level has a registry setting of 7.
  • Debug level logging requires a registry setting of 8.
Log Level 8 produces many more log entries, including some SQL queries and whether there is an error. Log Level 8 provides all communication details needed to troubleshoot network and proxy server issues. Because Log Level 8 generates so many more entries, the size of the logs must be increased to capture the additional information. The default log size is 1 MB.
 
Guidance for enabling Log Level 8
  • IMPORTANT: Enable Log Level 8 before you try to reproduce a problem. Enabling Log Level 8 for an issue that can't be reproduced, does not provide adequate information for troubleshooting.
  • If you are investigating client and server issues, you must enable Log Level 8 on both the client and server before trying to reproduce the problem. Enabling Log Level 8 on both the client and server is needed to successfully capture the additional logging needed to help investigate the issue. For information about debug logging for client-related issues, see:
  • Use the advice in this article to define a suitable log size to contain all information. Write the log to drives with sufficient space. McAfee recommends a larger log file size rather than a smaller one to make sure that the relevant data is captured. If the log is too small, relevant data might not be captured.

Solution

CAUTION: This article contains information about opening or modifying the registry.
  • The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
  • Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see: http://support.microsoft.com/kb/256986.
  • Do not run a REG file that is not confirmed to be a genuine registry import file.


To enable Log Level 8:
  1. Edit the registry:
     
    1. Click Start, Run, type regedit, then click OK.
    2. Locate the following registry key:

      64-bit:
      [HKEY_Local_Machine\SOFTWARE\WOW6432Node\Network Associates\ePolicy Orchestrator]
      [HKEY_Local_Machine\SOFTWARE\WOW6432Node\McAfee\ePolicy Orchestrator]
       
      32-bit:
      [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator] 
       
    3. Right-click the REG_DWORD entry LogLevel and click Modify (create the entry if it does not exist).
    4. In the Value data box, type 8.
    5. Click OK.
       
  2. Create a DWORD value for LogSize if it does not exist:
     
    1. Right-click the ePolicy Orchestrator key and select New, DWORD Value.
    2. Type LogSize in the New Value field and press Enter. The named DWORD Value is created.

      NOTE: This value defines the size of the log file in megabytes. The default value is 1. The value needed for Log Level 8 logging varies, depending on the evaluated function.
       
      1. To set the log file size value, right-click LogSize and click Modify.

        To decide the LogSize value: 
         
        -
         
        When troubleshooting an update issue, client or server, that is reproduced immediately. Then a 5-MB log file size is needed.
        For the DWORD value, type 5.
        -
         
        If troubleshooting an ePO server issue that is not reproducible on demand, a 30-MB log file size is needed.
        For the DWORD value, type 30.
         
    3. Click Registry, Exit.

      NOTE: For most logs, the logging level changes become effective after one minute. A services restart might be needed for some logs too.
       
  3. Generate logging time stamps with high resolution:

    NOTE: High-resolution logging is included by default if McAfee Agent 4.5 Update 3 or later is installed on the ePO server. Technical Support might require increased logging for the time stamp, which can be done with the High-Resolution Timer registry key. The time stamps contain more digits to indicate milliseconds. Disable this option after the needed data has been collected.
     
    1. Right-click the ePolicy Orchestrator key and select New, DWORD Value.
    2. To create a value, type LogHiRes in the New Value field and press Enter.
    3. Right-click LogHiRes and click Modify.
    4. Type 1 in the Value data box.
    5. Click OK.

    DWORD values for the LogHiRes key:

    0 = Disabled
    1 = Enabled

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.