When logging a case with Technical Support for a MAR client-side issue, perform the following data gathering before opening your support case.
Gathering troubleshooting information before you submit your case speeds up the resolution process.

NOTE: Technical Support might request further data, depending on the issue:

First enable debug logging on the client. Modify the client's policy on your ePolicy Orchestrator (ePO) server:

1. Log on to the ePO console.
2. Click Menu, Policy, Policy Catalog.
3. From the Product drop-down list, select Active Response.
4. Click the General policy. Or, create a policy.
5. Click the Logger tab.
6. Select the needed logging level.
   
   NOTE: For most issues, Debug level is sufficient, but we might direct you to select a different level.
    
7. Click the General tab.
8. Deselect Enable data folder protection.
9. Click Save.
10. Make sure that the policy is assigned to the client.
11. Send an agent wake-up call to the client.                

The Active Response client has two features. Specific data is needed, depending on which feature is experiencing issues.

• File Hashing and Network Flow feature:
  1. Enable Debug logging.
  2. Reproduce the issue.
  3. Obtain a Minimum Escalations Requirements (MER) from the client. For details, see KB59385 - How to use MER tools with supported McAfee Enterprise products.
  4. Obtain the MER from the Server. For details, see KB87957 - How to use the MER tool for McAfee Active Response.
      
• Trace feature:
  1. Enable Debug logging.
  2. Reproduce the issue.
  3. Obtain an MER from the client. For details, see KB59385 - How to use MER tools with supported McAfee Enterprise products.
  4. Obtain an MER from the DXL broker with which the client communicates. See KB82851 - How to use the Data Exchange Layer server MER tool for Linux or UNIX.
     
     NOTE: To understand which DXL broker the client is communicating with, perform the steps below:
     1. Click the McAfee Agent tray icon.
     2. Click About.
     3. View the McAfee Data Exchange Layer properties.
        The Broker DNS name identifies the name of the Broker where the client is connected.

 
To fully understand an issue, you need logging from the client and server sides of the conversation.
It's important that we have logs from both the Active Response Client and Active Response Server, which cover the same time period and show the issue.

An MER from both the client and server is needed if the logging alone doesn't fully explain the issue.
Many times, data included in the MER is needed, which includes the following:

• Environmental variables
• Running processes
• Other managed products installed
• Exact version numbers of all our products such as ePO, Endpoint Security, McAfee agent, DXL.