Knowledge Center

Endpoint Security events are not displaying in the Threat Event Log, but events for other products are displaying properly
Technical Articles ID:   KB88975
Last Modified:  3/22/2017


McAfee Endpoint Security (ENS) Threat Prevention 10.5.x, 10.2.x


Only ENS events are not displaying in the ePolicy Orchestrator (ePO) Threat Event Log. Events for other products are displaying properly. XML is not generated for ENS events on local systems under Programdata/McAfee/Agent/Upload. XML is generated for events for other products.

NOTE: If there are issues with the events for other products too, check the following:
  • The ePO database size is normal.
  • The ENS, McAfee Validation Trusted Protection, and ePO services are running.
  • There was not an ePO outage.
  • Agent-to-server communication is successful.


The Endpoint Security Common policy option Send events to McAfee ePO is disabled. Enabling this option sends all events logged to the Event Log on the ENS client to ePO.


Enable the option Send events to McAfee ePO:
  1. Log on to the ePO console.
  2. Click Menu, Policy, Policy Catalog.
  3. Select Endpoint Security Common from the Product drop-down menu.
  4. Click the policy name.
  5. Click Show Advanced.
  6. Select Send events to McAfee ePO.
  7. Click Save.

Rate this document


This article is available in the following languages:

English United States
Spanish Spain

Glossary of Technical Terms

 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.