Knowledge Center

Description and primary log locations for the ePolicy Orchestrator services
Technical Articles ID:   KB81641
Last Modified:  9/25/2019


McAfee ePolicy Orchestrator (ePO) 5.x, 4.x


ePO is comprised of three server-side services and a Microsoft SQL database, each of which serves a different purpose:
  • The Application Server service (or Tomcat) is responsible for displaying the ePO console GUI.
  • The Event Parser service takes events uploaded from clients in the environment and parses them into the SQL database.
  • The Server service (or Apache) processes and receives all Agent-to-Server communication in the environment.
NOTE: It is important to note that all three services require and depend on a constant and high-speed connection to the SQL database.

The following are the primary log locations for these services:
  • Application Server service (Tomcat): orion.log or orion_servername.log located in:
  • Event Parser service: eventparser.log or eventparser_servername.log located in:
  • Server service (Apache): server.log or server_servername.log located in:

Rate this document


This article is available in the following languages:

English United States

Glossary of Technical Terms

 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.