Use the following process if Technical Support requests Server-side logs to investigate an issue.

1. Make sure that the correct level of logging is enabled on your client.
   1. Log on to your ePO console.
   2. Click Menu, Policy, Policy Catalog.
   3. From the Product drop-down list, select Active Response.
   4. Click the General policy. Or, create a new policy.
   5. Click the Logger tab.
   6. Select the required logging level.
      NOTE: For most Server issues, the Default level is sufficient, but McAfee might direct you to select a different level.
       
   7. Click Save.
   8. Make sure that the policy is assigned to the client.
   9. Send an agent wake-up call to the client.
       
2. Run a search on the end nodes to reproduce the issue:
   1. Open the ePO console.
   2. Click Menu, McAfee Active response search.
   3. Run a search to reproduce the issue.
       
3. Gather MERS:
   • Obtain an MER from the client: See KB92004.
   • Obtain an MER from the DXL broker with which the client communicates. See KB82851.
     
      NOTE: To understand which DXL broker the client is communicating with:
     1.     Click the McAfee Agent tray icon.
     2.     Click About.
     3.     View the McAfee Data Exchange Layer properties.
            The Broker DNS name identifies the name of the Broker where the client is connected.

If your case concerns an issue with MAR policies (for example, empty policies or a failure during the change of a policy):

1. Enable Orion debug on the ePO server. See KB52369.
2. Reproduce the issue, either open the policy or attempt to save it, depending on the issue.
3. Note the time when you successfully reproduce the issue.
4. Obtain an MER from the ePO server. See KB59385.
5. Gather an MER from the MAR server. See: KB87957.

If your issue is with MAR 2.3 acting as a service on the TIE platform, you need to gather MERs from the TIE server and DXL broker.

• To gather an MER from the TIE server, see KB82850.
• To gather an MER from the DXL broker, see KB82851.