Enable debug logging to troubleshoot Endpoint Security issues

Technical Articles ID: KB91797
Last Modified: 8/18/2020

Environment

McAfee Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.x
McAfee ENS Firewall 10.x
McAfee ENS Platform 10.x
McAfee ENS Threat Prevention 10.x
McAfee ENS Web Control 10.x

Summary

This article describes how to enable debug logging for ENS as part of the data collection steps to troubleshoot common ENS issues.

Enable debug logging using the steps below. Then, either run the Minimum Escalation Requirements (MER) tool to collect the logs, or manually collect the logs, which are at %ProgramData%\McAfee\Endpoint Security\Log.

Solution

To enable debug logging using ePolicy Orchestrator (ePO):

Log on to the ePO console.
Navigate to Menu, Systems, System Tree.
Select This Group and All Subgroups in the Preset list.
Use the Quick Find field to search for the affected system.
Select the system and then click Actions, Agent, Modify Policies on a Single System.
For the Product, select Endpoint Security Common, and then select Options. The Options policies display.
Click Edit Assignment and select Break inheritance and assign the policy and settings below.
Click New Policy. The Create a new policy dialog box displays. Type a policy name, for example, "Enable ENS Debug Logging."
Click Show Advanced and set Client Interface Mode to Full access. This option removes the password protection for the ENS console.
Under Client Logging, Debug Logging, select the checkboxes below to enable debug logging for all modules.
- Enable for Adaptive Threat Protection (Windows only)
- Enable for Firewall
- Enable for Threat Prevention
  - Enable for Access Protection (Windows only)
  - Enable for Exploit Prevention (Windows only)
  - Enable for On-access scan (Windows only)
  - Enable for On-demand scan (Windows only)
- Enable for Web Control (Windows and Mac only)
NOTE: Enabling debug logging for any module also enables debug logging for Self-Protection.
Click Save two times to return to the System Tree.
To enforce the policy changes on the system, select the affected system, and perform an agent wake-up call.

Solution

To enable debug logging from an ENS client system:
From the local ENS console, navigate to Settings, Common, Show Advanced, Client Logging, and click Enable.

NOTE: This debug logging setting is overwritten during an agent wake-up call with the ePO policy settings.

Related Information

KB86691 - Minimum data collection steps for Endpoint Security issues

How to verify whether debug logging is enabled on a client system:
Open the logs created after enabling debug logging. Each module log file (at C:\ProgramData\McAfee\Endpoint Security\Logs) should have a debug value written to it. Or, verify that the debug logging for ENS modules has a value of 1 as shown below in the ENS file \Program Files\McAfee\Endpoint Security\Endpoint Security Platform\LoggerBL.xml.

Enable for Access Protection - <ENABLE_AP>1</ENABLE_AP>
Enable for Adaptive Threat Protection - <ENABLE_THREATINTELLIGENCE>1</ENABLE_THREATINTELLIGENCE>, <ENABLE_DAC>1</ENABLE_DAC>, <ENABLE_ATP>1</ENABLE_ATP>
Enabled for ENS console - <ENABLE_MFECONSOLE>1</ENABLE_MFECONSOLE>
Enable for Exploit Prevention - <ENABLE_BO>1</ENABLE_BO>
Enable for Firewall - <ENABLE_FW>1</ENABLE_FW>
Enable for on-access scanner - <ENABLE_OAS>1</ENABLE_OAS>
Enable for on-demand scanner - <ENABLE_ODS>1</ENABLE_ODS>
Enabled for Platform - <ENABLE_Common>1</ENABLE_Common>
Enabled for Self-Protection - <ENABLE_SP>1</ENABLE_SP>
Enable for Web Control - <ENABLE_WP>1</ENABLE_WP>

Affected Products

Diagnostic Data Collection
Endpoint Security Adaptive Threat Protection
Endpoint Security Firewall 10.7.x
Endpoint Security Firewall 10.6.x
Endpoint Security Firewall 10.5.x
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Threat Prevention 10.5.x
Endpoint Security Web Control 10.7.x
Endpoint Security Web Control 10.6.x
Endpoint Security Web Control 10.5.x
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Enable debug logging to troubleshoot Endpoint Security issues

Environment

Summary

Solution

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions:Draft for New Nav

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Enable debug logging to troubleshoot Endpoint Security issues

Environment

Summary

Solution

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title