NOTE: 

• To speed up the resolution process, make sure that the troubleshooting information is gathered before you submit a case.
• Technical Support might request more data depending on the issue.

1. Enable Debug Logging

First enable debug logging on the Sensor device. Modify the client’s policy on the ePO server:

1. Log on to the ePO console.
2. Click Menu, Policy, Policy Catalog.
3. From the Product drop-down list, select McAfee Threat Intelligence Exchange Server Management <version>.
4. Select an existing policy and edit, or create a new policy.
5. In the policy page, click the Server Configuration tab and set Log Level to ‘DETAIL’.

NOTE: For most of the issues, INFO level is sufficient, but we might direct you to select a different level. 

6. Click Save.
7. Make sure that the policy is assigned to the client.
8. Send an agent wake-up call to the client.

2. Minimum Escalation Requirements (MER) Logs

The MER logs from both the client and server are needed if the logging doesn't fully explain the issue. Many times, the data included in the MER is needed. This data includes the following:

• Environmental variables
• Running processes
• Other managed products installed
• Exact version numbers of all our products (such as TIE, DXL, McAfee Agent).

 See the related article KB82850 - How to use the Threat Intelligence Exchange Server Minimum Escalation Requirements tool

3. Screenshots

The following screenshots are helpful:

• Server Settings, TIE Server Topology Management
• Server Settings, DXL Topology
• Data Exchange Layer Fabric  

4. ATP Debugging

When file data is not being forwarded to the TIE Server, it's recommended that ATP debug logging and issue reproduction are performed.​
 
First enable debug logging on the client. Modify the client’s policy on your ePO server:

1. Log on to the ePO console.
2. Click Menu, Policy, Policy Catalog.
3. From the Product drop-down list, select Endpoint Security Common.
4. Select an existing policy and edit or create a new policy.
5. Click Show Advanced.
6. Under Debug Logging, click Enable for Adaptive Threat Protection.
7. Click Save.
8. Make sure that the policy is assigned to the client.
9. Send an agent wake-up call to the client.
10. Replicate the issue and forward the MER logs from the TIE server and the Endpoint. 

NOTE: We recommend that the description provided in the raised Service Request is clear and concise for all products. It would help Technical Support resolve the issue at the earliest.