Loading...

Knowledge Center

Are you a home/consumer customer? Visit the Home/Consumer Support Site

How to enable Orion Debug for McAfee Active Response related extension

Technical Articles ID: KB94786
Last Modified: 8/20/2021

Environment

McAfee Active Response (MAR)
McAfee ePolicy Orchestrator (ePO)

Summary

When you troubleshoot MAR-related extension issues, you need to gather Debug logging from the ePO server, solely for the extension.

Solution

Open a session on your local ePO server.
Open the file:
C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\conf\orion\log-config.xml in a text editor of your choice.
Go to bottom of the file and locate the section:
<root>
<priority value ="Warn" />
<appender-ref ref="ROLLING"/>

</root>
Add the following lines, before the <root> entry, based on which extension you want to Debug.
- For Workspace Extension add:
  <logger name="com.intel.edr">
  <level value="debug"/>
  </logger>
- For MAR Server Extension add:
  <logger name="com.intel.mar">
  <level value="debug"/>
  </logger>
  
  For example:
  <logger name="com.intel.edr">
  <level value="debug"/>
  </logger>
  
  <logger name="com.intel.mar">
  <level value="debug"/>
  </logger>
  
  <root>
  <priority value ="Warn" />
  <appender-ref ref="ROLLING"/>
  
  </root>
Reproduce the issue.
Locate the orion.log file on the ePO server and share it with Technical Support.

Affected Products

Diagnostic Data Collection
McAfee Active Response 2.x
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro