Data Collection - How to enable Log Level 8 for ePolicy Orchestrator troubleshooting

Technical Articles ID: KB56207
Last Modified: 2023-01-30 19:20:18 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.x

Summary

Technical Support might request debug level log files when troubleshooting an issue as part of Data Collection. Registry settings control the ePO logging level.

The default log level has a registry setting of 7.
Debug level logging requires a registry setting of 8.

Log Level 8 produces many more log entries, including some SQL queries and whether there's an error. Log Level 8 provides all communication details needed to troubleshoot network and proxy server issues. Because Log Level 8 generates so many more entries, the size of the logs must be increased to capture additional information. The default log size is 1 MB.

Guidance for enabling Log Level 8

IMPORTANT: Enable Log Level 8 before you try to reproduce a problem. Enabling Log Level 8 for an issue that can't be reproduced doesn't provide adequate information for troubleshooting.

If you're investigating client and server issues, you must enable Log Level 8 on both the client and server before trying to reproduce the problem. Enabling Log Level 8 on both the client and server is needed to successfully capture the additional logging needed to help investigate the issue. For information about debug logging for client-related issues, see the articles below:
- KB82170 - How to enable debug logging for McAfee Agent to troubleshoot Windows.
- KB69542 - How to enable debug logging for troubleshooting McAfee Agent for non-Windows issues.
Use the advice in this article to define a suitable log size to contain all information. Write the log to drives with sufficient space. We recommend a larger log file size, rather than a smaller one. Doing so makes sure that the relevant data is captured. If the log is too small, relevant data might not be captured.

Solution

CAUTION: This article contains information about opening or modifying the registry.

The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
Do not run a REG file that is not confirmed to be a genuine registry import file.

To enable Log Level 8:

Edit the registry:
1. Click Start, Run, type regedit, then click OK.
2. Locate the following registry key:
  
  64-bit:
  [HKEY_Local_Machine\SOFTWARE\WOW6432Node\Network Associates\ePolicy Orchestrator]
  [HKEY_Local_Machine\SOFTWARE\WOW6432Node\McAfee\ePolicy Orchestrator]
  
  32-bit:
  [HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\ePolicy Orchestrator]
3. Right-click the REG_DWORD entry LogLevel and click Modify (create the entry if it doesn't exist).
4. In the Value data field, type 8.
5. Click OK.
Create a DWORD value for LogSize if it doesn't exist:
1. Right-click the ePolicy Orchestrator key and select New, DWORD Value.
2. Type LogSize in the New Value field and press Enter. The named DWORD Value is created.
  
  NOTES:
  - This value defines the size of the log file in megabytes.
  - The default value is 1.
  - The maximum size of the log file is limited to 500 MB.
  - The value needed for Log Level 8 logging varies, depending on the evaluated function.
3. To set the log file size value, right-click LogSize and click Modify.

To decide the LogSize value:

If troubleshooting an update issue, client or server, that's reproduced immediately, a 5-MB log file size is needed.
For the DWORD value, type 5.
If troubleshooting an ePO server issue that's not reproducible on demand, a 30-MB log file size is needed.
For the DWORD value, type 30.

Click Registry, Exit.

NOTE: For most logs, the logging level changes become effective after one minute. A services restart might be needed for some logs too.

Generate logging time stamps with high resolution:

NOTE: Technical Support might require increased logging for the time stamp, which can be done with the High-Resolution Timer registry key. The time stamps contain more digits to indicate milliseconds. Disable this option after the needed data is collected.

DWORD values for the LogHiRes key:

0 = Disabled
1 = Enabled

Right-click the ePolicy Orchestrator key and select New, DWORD Value.
To create a value, type LogHiRes in the New Value field and press Enter.
Right-click LogHiRes and click Modify.
Type 1 in the Value data field.
Click OK.

Related Information

For additional information about ePO and Mcafee Agent logging, see the ePolicy Orchestrator Log File Reference Guide. This guide contains information about topics such as the following:

Names and locations of the log files
Types of issues recorded in each log file and times to analyze them
Format of information displayed
Logs affected by Log Level 8 logging
Conditions for logging level changes to take effect (one minute or restart)

For product documents, go to the Product Documentation portal.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Data Collection - How to enable Log Level 8 for ePolicy Orchestrator troubleshooting

Environment

Summary

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Data Collection - How to enable Log Level 8 for ePolicy Orchestrator troubleshooting

Environment

Summary

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title