This article provides basic information about the Minimum Data Collection steps for troubleshooting common ENSL issues.

Make sure that all logs are collected from the same system that experiences the issue, and that all logs are collected at the same time. The logging data time stamps can be used to troubleshoot the problem.

Mismatched logs from different systems, or logs collected at different times, can't be used for troubleshooting. They might result in having to recollect all Minimum Data Collection logs.

IMPORTANT: The following files are needed for Technical Support:

• Minimum Escalation Requirements (MER) file for ENSL is needed for all issues. For instructions to capture a full ENSL MER, see KB88197 - Collect the Minimum Escalation Requirements file for ENSL. Use this article in scenarios where the ENSL installation is already present on the system. In scenarios where ENSL isn't present, use the following article as mentioned below, unless otherwise directed by Technical Support: KB69543 - Data collection - Manual MER collection for non-Windows McAfee Agent issues.
• Collect other files and logs for each issue as described below.

Contents
Click to expand the section you want to view:
 

Slow performance - high CPU usage

1. To determine whether the issue is related to exclusions, follow the steps mentioned in KB89354 - Troubleshoot high CPU use by the real-time antimalware scanner.
2. Enable debug logging and capture data while the issue is occurring.  
3. If the high resource consumption can be improved by disabling the on-access scanner, collect the on-access scanner activity monitor log during the high resource consumption. For instructions, see KB89711 - How to view files scanned by Endpoint Security for Linux On-Access Scan (using the On-Access Scan activity monitor).
4. Collect an ENSL MER file. For instructions, see KB88197 - Collect the Minimum Escalation Requirements file for ENSL.

System crash or hang

1. Collect a kernel core dump. This process can vary based on distribution, although the standard utility is kdump.
   Examples:
   • Red Hat Enterprise Linux: See Introduction to kdump.
   • SUSE: See Introduction to kdump.
   • Ubuntu: See Introduction to kdump.
2. Collect an ENSL MER file. For instructions, see KB88197 - Collect the Minimum Escalation Requirements file for ENSL.

Installation issues

Take the appropriate action based on the type of failure:

• ePolicy Orchestrator (ePO) based installation or upgrade failure:
  1. Collect a McAfee Agent MER file from the local system. For instructions, see KB69543 - Data collection - Manual MER collection for non-Windows McAfee Agent issues.
  2. Collect the following log file from the local system:
     
     /tmp/ensltp-epo-setup.log
      
• Local installation failure:
  1. Rerun the installation. Use the appropriate command:
     
     For ENSL 10.6.6 and later:
     $ bash -x ./install-mfetp.sh
     
     For ENSL 10.6.5 and earlier:
     $ bash -x ./install-isectp.sh
      
  2. When the installation fails, collect a copy of the console output and save it to a file. Also, collect the generated log file:
     
     /tmp/ensltp-standalone-setup.log

Upgrade issues

1. Rerun the installation. Use the appropriate command:
   
   For ENSL 10.6.6 and later:
   $ bash -x ./install-mfetp.sh
   
   For ENSL 10.6.5 and earlier:
   $ bash -x ./install-isectp.sh
    
2. When the installation fails, collect a copy of the console output and save it to a file. Also, collect the generated log file:
   
   /tmp/ensltp-standalone-setup.log
    
3. Collect an ENSL MER file. For instructions, see KB88197 - Collect the Minimum Escalation Requirements file for ENSL.

DAT update failure, policy not enforcing, or tasks not executing

1. (For DAT update failures) To determine whether DAT content can be updated locally, follow the steps mentioned in KB88234 - Manually update DAT and Extra.DAT files for ENSL.
2. Collect an ENSL MER file. For instructions, see KB88197 - Collect the Minimum Escalation Requirements file for ENSL.