Active Response Data Collection (Server-side issues)

Technical Articles ID: KB92032
Last Modified: 2023-05-30 10:18:22 Etc/GMT

Active Response 2.x
Data Exchange layer (DXL) 5.x, 4.x
ePolicy Orchestrator (ePO) 5.x
Threat Intelligence Exchange (TIE) 2.x

Technical Support might request the data below when investigating an issue that involves the Active Response Server.

You experience an issue that involves the Active Response Server.

Use the following process if Technical Support requests server-side logs to investigate an issue.

Make sure that the correct level of logging is enabled on your client.
1. Log on to your ePO console.
2. Click Menu, Policy, Policy Catalog.
3. From the Product drop-down list, select Active Response.
4. Click the General policy, or create a new policy.
5. Click the Logger tab.
6. Select the required logging level.
  
  NOTE: For most Server issues, the Default level is sufficient, but we might direct you to select a different level.
7. Click Save.
8. Make sure that the policy is assigned to the client.
9. Send an agent wake-up call to the client.
Run a search on the end nodes to reproduce the issue:
1. Open the ePO console.
2. Click Menu, McAfee Active response search.
3. Run a search to reproduce the issue.
Gather MERS:
- Obtain an MER from the client; for details, see KB92004 - Active Response Debug Data Collection (Client-side issues).
- Obtain an MER from the DXL Broker with which the client communicates; for details, see KB82851 - How to use the Data Exchange Layer server MER tool for Linux or UNIX.
  
  NOTE: To understand which DXL Broker the client is communicating with, perform the steps below:
  1. Click the McAfee Agent tray icon.
  2. Click About.
  3. View the DXL properties.
    The Broker DNS name identifies the name of the Broker where the client is connected.

If your case concerns an issue with Active Response policies (for example, empty policies or a failure during the change of a policy):

Enable Orion debug on the ePO server; for details, see KB52369 - How to enable debug logging in the Orion.log.
Reproduce the issue; either open the policy or attempt to save it, depending on the issue.
Note the time when you successfully reproduce the issue.
Obtain an MER from the ePO server; for details, see KB59385 - How to use MER tools with supported Trellix products.
Gather an MER from the Active Response server; for details, see KB87957 - How to use the MER tool for Active Response.

If your issue is with Active Response 2.3 acting as a service on the TIE platform, you need to gather MERs from the TIE server and DXL Broker.

This article is available in the following languages:

Knowledge Center