Enable debug logging to troubleshoot Endpoint Security issues

Technical Articles ID: KB91797
Last Modified: 3/10/2022

Environment

Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.x
ENS Firewall 10.x
ENS Platform 10.x
ENS Threat Prevention 10.x
ENS Web Control 10.x
Endpoint Security Storage Protection 2.x

Summary

This article describes how to enable debug logging for ENS. With debug logging enabled, you can collect data to troubleshoot common ENS issues.

Enable debug logging using the steps below. Then, either run the Minimum Escalation Requirements (MER) tool to collect the logs, or manually collect the logs, which are at %ProgramData%\McAfee\Endpoint Security\Log.

Solution 1

To enable debug logging using ePolicy Orchestrator (ePO):

Log on to the ePO console.
Navigate to Menu, Systems, System Tree.
Select This Group and All Subgroups in the Preset list.
Use the Quick Find field to search for the affected system.
Select the system and then click Actions, Agent, Modify Policies on a Single System.
For the Product, select Endpoint Security Common, and then select Options. The Options policies display.
Click Edit Assignment and select Break inheritance and assign the policy and settings below.
Click New Policy. The Create a new policy dialog box displays. Type a policy name, for example, "Enable ENS Debug Logging."
Click Show Advanced and set Client Interface Mode to Full access. This option removes the password protection for the ENS console.
Under Client Logging, Debug Logging, select the options below to enable debug logging for all modules.
- Enable for Adaptive Threat Protection (Windows only)
- Enable for Firewall
- Enable for Threat Prevention
  - Enable for Access Protection (Windows only)
  - Enable for Exploit Prevention (Windows only)
  - Enable for On-access scan (Windows only)
  - Enable for On-demand scan (Windows only)
- Enable for Web Control (Windows and Mac only)
- Enable for Storage Protection (Windows only)
NOTE: Enabling debug logging for any module also enables debug logging for Self-Protection.
Click Save two times to return to the System Tree.
To enforce the policy changes on the system, select the affected system, and perform an agent wake-up call.

Solution 2

To enable debug logging from an ENS client system:

From the local ENS console, navigate to Settings, Common, Show Advanced, Client Logging, and click Enable.

NOTE: This debug logging setting is overwritten during an agent wake-up call with the ePO policy settings.

Related Information

KB86691 - Minimum data collection steps for Endpoint Security issues

How to verify whether debug logging is enabled on a client system:
Open the logs created after enabling debug logging. Determine whether each module log file at C:\ProgramData\McAfee\Endpoint Security\Logs has a debug value assigned to it. Or, verify that the debug logging for ENS modules has a value of 1, as shown below in the ENS file \Program Files\McAfee\Endpoint Security\Endpoint Security Platform\LoggerBL.xml.

Enabled for Access Protection - <ENABLE_AP>1</ENABLE_AP>
Enabled for Adaptive Threat Protection - <ENABLE_THREATINTELLIGENCE>1</ENABLE_THREATINTELLIGENCE>, <ENABLE_DAC>1</ENABLE_DAC>, <ENABLE_ATP>1</ENABLE_ATP>
Enabled for ENS console - <ENABLE_MFECONSOLE>1</ENABLE_MFECONSOLE>
Enabled for Exploit Prevention - <ENABLE_BO>1</ENABLE_BO>
Enabled for Firewall - <ENABLE_FW>1</ENABLE_FW>
Enabled for on-access scanner - <ENABLE_OAS>1</ENABLE_OAS>
Enabled for on-demand scanner - <ENABLE_ODS>1</ENABLE_ODS>
Enabled for Platform - <ENABLE_Common>1</ENABLE_Common>
Enabled for Self-Protection - <ENABLE_SP>1</ENABLE_SP>
Enabled for Web Control - <ENABLE_WP>1</ENABLE_WP>

Affected Products

Diagnostic Data Collection
Endpoint Security Adaptive Threat Protection
Endpoint Security Firewall 10.7.x
Endpoint Security Firewall 10.6.x
Endpoint Security Storage Protection 2.x
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Web Control 10.7.x
Endpoint Security Web Control 10.6.x
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro
Chinese Simplified

Knowledge Center

Enable debug logging to troubleshoot Endpoint Security issues

Environment

Summary

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Enable debug logging to troubleshoot Endpoint Security issues

Environment

Summary

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Choose your region

Title

Title