How to enable debug logging to troubleshoot Endpoint Security issues

Technical Articles ID: KB91797
Last Modified: 12/5/2019

Environment

McAfee Endpoint Security (ENS) Firewall 10.x
McAfee ENS Platform 10.x
McAfee ENS Threat Prevention 10.x
McAfee ENS Web Control 10.x

Summary

This article describes how to enable debug logging for ENS 10.x as part of the data collection steps to troubleshoot common ENS issues.

Perform the following steps to enable debug logging. Then, either run the Minimum Escalation Requirements (MER) tool to collect the required logs, or manually collect the logs, which are located at %ProgramData%\McAfee\Endpoint Security\Log.

Solution

To enable debug logging using ePolicy Orchestrator (ePO):

Log on to the ePO console.
Navigate to Menu, Systems, System Tree.
Select This Group and All Subgroups in the Preset list.
Use the Quick Find field to search for the affected system.
Select the system and then select Actions, Agent, Modify Policies on a Single System.
For the Product, select Endpoint Security Common, and then select Options. The Options policies display.
Click Edit Assignment and select Break inheritance and assign the policy and settings below.
Click New Policy. The Create a new policy dialog box displays. Type a policy name, for example, "Enable ENS Debug Logging."
Click Show Advanced and set Client Interface Mode to Full access. This option removes the password protection for the ENS console.
Under Client Logging, Debug Logging, select the checkboxes below to enable debug logging for all modules.
- Enable for Adaptive Threat Protection (Windows only)
- Enable for Firewall
- Enable for Threat Prevention
  - Enable for Access Protection (Windows only)
  - Enable for Exploit Prevention (Windows only)
  - Enable for On-Access Scan (Windows only)
  - Enable for On-Demand Scan (Windows only)
- Enable for Web Control (Windows and Mac only)
NOTE: Enabling debug logging for any module will also enable debug logging for Self Protection.
Click Save two times to return to the System Tree.
Select the affected system, and perform an agent wake-up call to enforce the policy changes on the system.

Solution

To enable debug logging from an ENS client system:
From the local ENS console, navigate to Settings, Common, Show Advanced, Client Logging, and select Enable.

NOTE: This debug logging setting will be overwritten during an agent wake-up call with the ePO policy settings.

Related Information

KB86691 - Minimum Data Collection steps for troubleshooting Endpoint Security issues

How to verify whether debug logging is enabled on a client system:
Open the logs created after enabling debug logging. Each module log file (located at C:\ProgramData\McAfee\Endpoint Security\Logs) should have a debug value written to it. Alternatively, verify the debug logging for ENS modules has a value of 1 as shown below in the ENS file \Program Files\McAfee\Endpoint Security\Endpoint Security Platform\LoggerBL.xml.

Enable for Access Protection - <ENABLE_AP>1</ENABLE_AP>
Enable for Adaptive Threat Protection - <ENABLE_THREATINTELLIGENCE>1</ENABLE_THREATINTELLIGENCE>, <ENABLE_DAC>1</ENABLE_DAC>, <ENABLE_ATP>1</ENABLE_ATP>
Enabled for ENS console - <ENABLE_MFECONSOLE>1</ENABLE_MFECONSOLE>
Enable for Exploit Prevention - <ENABLE_BO>1</ENABLE_BO>
Enable for Firewall - <ENABLE_FW>1</ENABLE_FW>
Enable for on-access scanner - <ENABLE_OAS>1</ENABLE_OAS>
Enable for on-demand scanner - <ENABLE_ODS>1</ENABLE_ODS>
Enabled for Platform - <ENABLE_Common>1</ENABLE_Common>
Enabled for Self Protection - <ENABLE_SP>1</ENABLE_SP>
Enable for Web Control - <ENABLE_WP>1</ENABLE_WP>

Affected Products

Diagnostic Data Collection
Endpoint Security Firewall 10.6.x
Endpoint Security Firewall 10.5.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Threat Prevention 10.5.x
Endpoint Security Web Control 10.6.x
Endpoint Security Web Control 10.5.x
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Japanese
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

Environment

Summary

Solution

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Knowledge Center

Environment

Summary

Solution

Solution

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title