How to enable Debug logging in Security for Microsoft Exchange 8.x
Technical Articles ID:
KB79515
Last Modified: 5/31/2022
Environment
Security for Microsoft Exchange (SME) 8.x
Microsoft Exchange 2013, 2010, 2007
Summary
This article explains how to enable Diagnostic Logging (also known as Debug logging) in SME 8.x.
You should only enable Diagnostic Logging when troubleshooting a specific issue or when asked to do so by your Technical Support Representative. Logging can be CPU intensive, and the logs created can take up a lot of disk space. So, when troubleshooting is complete, always disable Diagnostic Logging.
Technical Support will only ask for logs that have been run at High Level (Level 3 in the registry).
IMPORTANT: If you're troubleshooting issues relating to Transport Scanning (such as antispam issues), or are troubleshooting on Hub or Edge role Exchange servers, do not select or use <Desktop> as a debug file location. Choosing this location results in the transport scanning logs not being created; so, the logs don't contain the required information.
Solution
1
Use the following steps to enable Debug logging in MSME 8.x:
NOTE: If the server is managed by ePolicy Orchestrator (ePO), stop the McAfee Framework Service. (This stops the ePO policies from overwriting local settings.)
- Create a destination folder for the Debug logs:
- Open Windows Explorer.
- On a local drive, create a folder to store the Debug logs (for example, C:\MSMELogs).
- Close Windows Explorer.
- Enable Debug logging in the SME console:
- Click Start, All Programs, McAfee, Security for Microsoft Exchange, Product Configuration.
NOTE: You can also choose Product Configuration (Web Interface).
- Click Settings and Diagnostics.
- Click Diagnostics, and then click the Debug Logging tab.
- Set Level to High.
- Optional: Select Limit size of Debug log files.
IMPORTANT: We recommend that you not set a size limit for the debug logs because important information will be overwritten when the log files are truncated. Instead, enable debug logging only for the time necessary to reproduce the issue, and then disable debug logging.
- Select Specify location for Debug files.
- In the Debug file location drop-down list, select (full path).
- In the Debug file location field, type the name of the folder created above (for example, C:\MSMELogs).
- Click Apply.
- Leave Debug logging enabled for enough time to capture the issue.
With Debug logging enabled, replicate the issue. The length of time to have debug logging enabled varies depending on the issue that you're investigating. When the issue is replicated, proceed to the next step to disable debug logging.
- Disable Debug logging:
- Click Start, All Programs, McAfee, Security for Microsoft Exchange, Product Configuration.
NOTE: You can also choose Product Configuration (Web Interface).
- Click Settings and Diagnostics.
- Click Diagnostics, and then click the Debug logging tab.
- Set Level to None.
- Click Apply.
Solution
2
CAUTION: This article contains information about opening or modifying the registry.
- The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
- Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
- Do not run a REG file that is not confirmed to be a genuine registry import file.
Depending on the type of problem, you might need to enable debug through the registry. If so, perform the following steps:
- Stop the McAfee Security for Microsoft Exchange service:
- Click Start, Run, type services.msc, and then click OK.
- If the server is managed by ePO, right-click the McAfee Framework Service and select Stop. (This stops the ePO policies from overwriting the local settings).
- Right-click McAfee Security for Microsoft Exchange and select Stop.
- Minimize the Services window.
- Enable debug logging via the registry:
- Click Start, Run, type regedit, and then click OK.
- Navigate to the following key:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\McAfee\MSME\trace]
- Set the keys to the following values:
NOTE: If any of the listed keys don't exist, click Edit, New, and select either DWORD Value or String Value.
|
Key Name
|
Key Type
|
Base Type
|
Value
|
|
Level
|
DWORD
|
Hex
|
3
|
|
MaxFileSize
|
DWORD
|
Decimal
|
10240
|
|
Path
|
STRING
|
|
C:\MSMELogs
|
IMPORTANT: MaxFileSize is an optional value. This key isn't required if you don't want to set a maximum file size. We don't recommend that a size limit be set for the debug logs because important information is overwritten when the log files are truncated. Instead, enable debug logging only for the time necessary to capture the error or issue, and then disable it.
- Close the Registry Editor.
- Start the Security for Exchange services, and open the Product Console:
- Maximize the Services window.
- Perform the following two steps only if the server is managed by ePO:
- Right-click McAfee Security for Microsoft Exchange and select Properties.
- In the Startup Type section, select Automatic from the drop-down list, and then click Apply.
- Right-click McAfee Security for Microsoft Exchange and select Start.
- Minimize the Services window.
- Open the SME Console or perform the steps and actions that you want to be captured in the debug logs.
- When enough debug information has been captured, remove the debug settings from the registry:
- Click Start, Run, type regedit and then click OK.
- Navigate to the following key:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\McAfee\MSME\trace]
- Right-click Level and change the value to 0.
- Close the registry editor.
- Restart the Security for Exchange service:
- In the Services window, right-click McAfee Security for Microsoft Exchange and select Restart.
- Close the Services window.
- Set the McAfee Framework Service back to Automatic and start the service.
- Collect the required files, and contact Technical Support.
IMPORTANT: The following files are required for Technical Support:
Additional file to collect: MSMELogs
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.
|
