McAfee EPOLICY ORCHESTRATOR 4.0 - LOG FILES FOR User manual

Using Log Files for Troubleshooting in

ePolicy Orchestrator 4.0

Guide

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form

or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FLASHBOX, FOUNDSTONE, GROUPSHIELD, HERCULES, INTRUSHIELD, INTRUSION INTELLIGENCE,

LINUXSHIELD, MANAGED MAIL PROTECTION, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, MCAFEE.COM, NETSHIELD,

PORTALSHIELD, PREVENTSYS, PROTECTION-IN-DEPTH STRATEGY, PROTECTIONPILOT, SECURE MESSAGING SERVICE, SECURITYALLIANCE,

SITEADVISOR, THREATSCAN, TOTAL PROTECTION, VIREX, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc.

and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other

registered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,

WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH

TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS

THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,

A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU

DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN

THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

License Attributions

Refer to the product Release Notes.

Using Log Files for Troubleshooting in ePolicy Orchestrator 4.02

Contents

Troubleshooting with Log Files...........................................................4

Log file names and locations.................................................................5

Typical issues addressed by logs..............................................................7

Logging levels for debugging.................................................................8

When setting changes take effect............................................................10

AdjustingtheTomcatloglevel...............................................................11

Logging agent updating and deployment scripts................................................11

Troubleshooting policy updates..............................................................11

Interpreting Windows error codes............................................................12

Agent activity log.........................................................................12

Use of the VirusScan update log.............................................................12

3Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

Troubleshooting with Log Files

ePolicy Orchestrator includes many log files that you can use for troubleshooting. This document

describes how to use the log files and provides the following information:

• Name and location of log files.

• Typical issues requiring troubleshooting, and the log files likely to be helpful.

• Setting the size of log files and the depth and scope of logging.

• When changes to logging settings take effect.

• Types of log files: McAfee Agent log files and ePolicy Orchestrator log files. Five of the files

are associated with the McAfee Agent:

•AGENT_<SYSTEM>.LOG

•FRMINST_<SYSTEM>.LOG

•MCSCRIPT.LOG

•PRDMGR_<SYSTEM>.LOG

•UPDATERUI_<SYSTEM>.LOG

All other log files are associated with ePolicy Orchestrator and its installer.

Contents

Log file names and locations

Typical issues addressed by logs

Logging levels for debugging

When setting changes take effect

Adjusting the Tomcat log level

Logging agent updating and deployment scripts

Troubleshooting policy updates

Interpreting Windows error codes

Agent activity log

Use of the VirusScan update log

Using Log Files for Troubleshooting in ePolicy Orchestrator 4.04

Log file names and locations

Table 1 lists the name and location of each ePolicy Orchestrator 4.0 log file. Table 2 explains

frequently repeated path variables.

Table 1: Log files and their locations

LocationLog file name

<AGENT DATA PATH>\DBAGENT_<SYSTEM>.LOG,

AGENT_<SYSTEM>_BACKUP.LOG

<INSTALLATION PATH>\DB\DEBUG (see

Troubleshooting with Log Files)

<AGENTGUID>-<TIMESTAMP>.XML (if registry value

has been set)

<CURRENT USER’S TEMP

DIRECTORY>\NAILOGS\EPO400-TROUBLESHOOT\ORION

FRAMEWORK

CORE-INSTALL.LOG

<CURRENT USER’S TEMP

DIRECTORY>\NAILOGS\EPO400-TROUBLESHOOT\ORION

FRAMEWORK

ENV-CORE-INSTALL.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGS\ORION

FRAMEWORK

ENV-INSTALL.LOG

<CURRENT USER’S TEMP

DIRECTORY>\NAILOGS\EPO400-TROUBLESHOOT\ORION

FRAMEWORK

ENV-TOMCAT-INSTALL.LOG

<INSTALLATION PATH>\DB\LOGSEPOAPSVR.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSEPO400COMMONSETUP.LOG

<CURRENT USER’S TEMP

DIRECTORY>\NAILOGS\MERCURY FRAMEWORK

EPO-INSTALL.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSEPO400-INSTALL-MSI.LOG

<INSTALLATION PATH>\MCAFEE\APACHE2\LOGSERRORLOG.<CURRENT_DATETIME>

<INSTALLATION PATH>\DB\LOGSEVENTPARSER.LOG, EVENTPARSER_BACKUP.LOG

C:\WINDOWS\NAILOGS or C:\WINDOWS\TEMP\NAILOGS

or C:\DOCUMENTS AND SETTINGS\<CURRENT

USER\LOCAL SETTINGS\TEMP\NAILOGS

FRMINST_<SYSTEM>.LOG

PROGRAMFILES\MCAFEE\EPOLICY

ORCHESTRATOR\SERVER\LOGS

JAKARTA_SERVICE_<DATE>.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSLICENSING.LOG

PROGRAMFILES\MCAFEE\EPOLICY

ORCHESTRATOR\SERVER\LOGS

LOCALHOST_ACCESS_LOG.<DATE>.TXT

<AGENT DATA PATH>MCSCRIPT.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSMIGRATION.LOG

PROGRAMFILES\MCAFEE\EPOLICYORCHESTRATOR\SERVER\LOGSORION.LOG

Troubleshooting with Log Files

Log file names and locations

5Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

LocationLog file name

<AGENT DATA PATH>\DBPRDMGR_<SYSTEM>.LOG,

PRDMGR_<SYSTEM>_BACKUP.LOG

<INSTALLATION PATH>\DB\LOGSREPLICATION.LOG

<INSTALLATION PATH>\DB\LOGSSERVER.LOG, SERVER_BACKUP.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSSQL2K5bCINST.LOG

PROGRAMFILES\MCAFEE\EPOLICY

ORCHESTRATOR\SERVER\LOGS

STDERR.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSUPDATERUI_<SYSTEM>.LOG

NOTE: Paths that include the folder EPO400-TROUBLESHOOT point to the log file generated

for a failed operation. If the operation succeeds, the path does not include the

EPO400-TROUBLESHOOT folder.

Table 2: Path variables

DescriptionVariable

The default location of the agent data files is

<DOCUMENTS AND SETTINGS>\ALL

USERS\APPLICATION DATA\MCAFEE\COMMON

FRAMEWORK

<DOCUMENTS AND SETTINGS> is the location of the

DOCUMENTS AND SETTINGS folder, which depends on

the operating system. If the operating system does not

use a DOCUMENTS AND SETTINGS folder, the default

location is <AGENT INSTALLATION PATH>\DATA. To

determine the actual location of the agent data files,

view this registry key

HKEY-LOCAL_MACHINE\SOFTWARE\MCAFEE\TVD\SHARED

COMPONENTS\FRAMEWORK\DATA PATH. For more

information, see “Agent installation directory” in the

ePolicy Orchestrator 4.0 Product Guide or Help.

This is the currently logged on user’s Temp folder. To

access this folder, select Start | Run, then type %temp%

in the Open text box, and click OK.

The default location of the ePolicy Orchestrator 4.0 server

software is C:\PROGRAMFILES\MCAFEE\EPOLICY

ORCHESTRATOR

Log file size and BACKUP logs

When a log file reaches it maximum size, BACKUP is added to the file name extension and a

new log file is created. For example, when AGENT_<SYSTEM>.LOG reaches it maximum size,

its name becomes AGENT_<SYSTEM>_BACKUP.LOG. If a BACKUP log already exists, it is

overwritten. Depending on how recently the BACKUP was created, it may contain current entries.

Examine both log files to ensure comprehensiveness.

The default log size is 1MB. To change the size, create the DWORD value LOGSIZE in the registry

key HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK ASSOCIATES\EPOLICY ORCHESTRATOR,

then set the value data to the size desired. For example, 2=2MB.

Troubleshooting with Log Files

Log file names and locations

Using Log Files for Troubleshooting in ePolicy Orchestrator 4.06

Typical issues addressed by logs

Table 3 identifies the types of issues recorded in each ePolicy Orchestrator 4.0 log file.

Table 3: Typical issues and the log files to consult

See these log filesFor issues with...

AGENT_<SYSTEM>.LOG,

AGENT_<SYSTEM>_BACKUP.LOG

Agent: in general; client communication tasks

FRMINST_<SYSTEM>.LOGAgent: installation; uninstallation

EPOAPSVR.LOGAgent: push

UPDATERUI_<SYSTEM>.LOGAgent: updating client, managed products

EPOAPSVR.LOGAgent: wake-up

SERVER.LOGAgent-server communication

SQL2K5bCINST.LOGBackward Compatibility for SQL (if installed during ePolicy

Orchestrator installation)

AGENT_<SYSTEM>.LOG

AGENT_<SYSTEM>_BACKUP.LOG

Client tasks: communication

PRDMGR_<SYSTEM>.LOG

PRDMGR_<SYSTEM>_BACKUP.LOG

PRDMGR_<SYSTEM>.LOG

PRDMGR_<SYSTEM>_BACKUP.LOG, MCSCRIPT.LOG

Client tasks: scripts

AGENT_<SYSTEM>.LOG, SERVER.LOG,

SERVER_BACKUP.LOG

Communication: client-server

REPLICATION.LOG, EPOAPSVR.LOG, ORION.LOGDistributed repositories

ERRORLOG.<CURRENT_DATETIME>Error: Apache web server

STDERR.LOG, JAKARTA_SERVICE_<DATE>.LOG,

LOCALHOST_ACCESS_LOG.<DATE>.TXT

Error: Tomcat servlet container

EVENTPARSER.LOG, EVENTPARSER_BACKUP.LOGEvents, event update

CORE-INSTALL.LOG, ENV-CORE-INSTALL.LOG,

EPO-INSTALL.LOG, ENV-TOMCAT-INSTALL.LOG

Installation: ePolicy Orchestrator calls to background,

foundation, or other platforms and technologies

EPO400COMMONSETUP.LOGInstallation: ePolicy Orchestrator custom actions

EPO400-INSTALL-MSI.LOGInstallation: ePolicy Orchestrator

ORION.LOGInterface: Issues arising after changes to...

LICENSING.LOGLicense

MIGRATION.LOG, EPO400-INSTALL-MSI.LOGMigration: from earlier version

ORION.LOGNotifications

PRDMGR_<SYSTEM>.LOG,

PRDMGR_<SYSTEM>_BACKUP.LOG

Plug-in files

Troubleshooting with Log Files

Typical issues addressed by logs

7Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

See these log filesFor issues with...

AGENT_<SYSTEM>.LOG,

AGENT_<SYSTEM>_BACKUP.LOG, SERVER.LOG

Policies

<AGENTGUID>-<TIMESTAMP>.XML (if registry value

has been set)

Policy update

SERVER.LOGProduct property update

EPOAPSVR.LOG, ORION.LOG, REPLICATION.LOGPull

EPOAPSVR.LOGPush agent

EPOAPSVR.LOG, ORION.LOG, REPLICATION.LOGReplicate

AGENT_<SYSTEM>.LOGScript: client task

MCSCRIPT.LOGScripts: engine; messages

SERVER.LOG, SERVER_BACKUP.LOG, ORION.LOGServer: in general

EPO400COMMONSETUP.LOG, EPO400-INSTALL-MSI.LOGServer: installation

AGENT_<SYSTEM>.LOG,

AGENT_<SYSTEM>_BACKUP.LOG

Updating

UPDATERUI_<SYSTEM>.LOG

<AGENTGUID>-<TIMESTAMP>.XML (if registry value

has been set)

MIGRATION.LOG, EPO400-INSTALL-MSI.LOGUpgrading: from earlier version

ORION.LOGUser interface:

HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR, issues arising

after changes to...

Logging levels for debugging

This section provides information about setting logging levels for logs in general. For information

about adjusting the logging of the Tomcat servlet container, see Adjusting the Tomcat log level.

The scope and depth of the information in most log files are determined by the log level, a

value ranging from 1 to 8.

• Messages logged at each level include all messages at the current level and all lower logging

levels.

• The default value is 7, generally considered adequate for ordinary debugging.

• Log level 8 produces output, including every SQL query, whether or not there is an error.

Log level 8 also provides communication details for troubleshooting network and proxy server

issues.

Troubleshooting with Log Files

Logging levels for debugging

Using Log Files for Troubleshooting in ePolicy Orchestrator 4.08

Table 4 describes each message type and logging level. Table 5 lists the locations where the

values that control logging levels can be modified.

Table 4: Messages reported at each log level

Logging

level

DescriptionMessage type

1User error message, translatede (error)

2User warning message, translatedw (warning)

3User information message, translatedi (information)

4User extended information message, translatedx (extended data)

5Debug error message, English onlyE (error)

6Debug warning message, English onlyW (warning)

7Debug information message, English onlyI (information), or none

8Debug extended information message, English onlyX (extended data)

Table 5: Location of values controlling log levels

Location of controlling log level valueLog file

DWORD registry value at:

HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL

AGENT_<SYSTEM>.LOG

DWORD registry value at:

HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL

EPOAPPSVR.LOG

DWORD registry value at:

HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL

EVENTPARSER.LOG

DWORD registry value at:

HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL

FRMINST_<SYSTEM>.LOG

C:\PROGRAMFILES\MCAFEE\EPOLICY

ORCHESTRATOR\SERVER\CONF\ORION

ORION.LOG

\LOG-CONFIG.XML. See “MaxFileSize” parameter value

in “Rolling log file” section. See also Priority Value in

<root> section.

DWORD registry value at:

HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL

PRDMGR_<SYSTEM>.LOG

DWORD registry value at:

HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL

SERVER.LOG

DWORD registry value at:

HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL

UPDATERUI_<SYSTEM>.LOG

Troubleshooting with Log Files

Logging levels for debugging

9Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

When setting changes take effect

This section defines the interval between the moment that a log file setting is changed and the

moment the change takes effect.

• When a setting is changed using the registry, the interval is usually a minute or less. The

DWORD registry value that controls logging is: HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK

ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL.

• When a setting is changed in an INI file or an XML file, the change usually takes effect

immediately.

• In some instances, when a change takes effect upon restarting the system, the user controls

the interval.

Table 6: When log setting changes take effect

Setting change takes effect...Log file name

Within one minuteAGENT_<SYSTEM>.LOG

Cannot changeCORE-INSTALL.LOG

Within one minuteEPOAPSVR.LOG

Immediately upon saving change to EPO400-DEBUG.INI,

located at <CURRENT USER’S TEMP

DIRECTORY>\NAILOGS

EPO400COMMONSETUP.LOG

Cannot changeEPO-INSTALL.LOG

Immediately upon saving change to EPO400-DEBUG.INI,

located at <CURRENT USER’S TEMP

DIRECTORY>\NAILOGS

EPO400-INSTALL-MSI.LOG

Upon startupERRORLOG<CURRENT_DATETIME>

Within one minuteEVENTPARSER.LOG

Upon startupFRMINST_<SYSTEM>.LOG

Upon startup of Tomcat serviceJAKARTA_SERVICE_<DATE>.LOG

Cannot changeLICENSING.LOG

Upon startup of Tomcat serviceLOCALHOST_ACCESS_LOG.<DATE>.TXT

Upon startupMCSCRIPT.LOG

Upon startup of Tomcat serviceORION.LOG

Within one minutePRDMGR_<SYSTEM>.LOG

Within one minuteREPLICATION.LOG

Upon startupSERVER.LOG, SERVER_BACKUP.LOG

Cannot changeSQL2K5bCINST.LOG

Cannot changeSTDERR.LOG

Troubleshooting with Log Files

When setting changes take effect

Using Log Files for Troubleshooting in ePolicy Orchestrator 4.010

This manual suits for next models

Table of contents

Other McAfee Software manuals

McAfee

McAfee VIRUSSCAN 5.1 User manual

McAfee

McAfee VIRUSSCAN WIRELESS 1.0 - User manual

McAfee

McAfee MIS09EMB3RAA - Internet Security 2009 User manual

McAfee

McAfee INTERNET SECURITY 2008 User manual

McAfee

McAfee VIRUSSCAN HOME EDITION 7.0 User manual

McAfee

McAfee ENDPOINT ENCRYPTION ENTERPRISE - BEST PRACTICES... User manual

McAfee

McAfee Agent 4.0 Instruction Manual

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 2 - S... Instruction Manual

McAfee

McAfee MSA09EMB1RAA - Site Advisor Plus 2009 User manual

McAfee

McAfee TSA00M005PAA - Total Protection Service User manual

McAfee

McAfee EPOLICY ORCHESTRATOR 3.6 - WALKTHROUGH GUIDE User manual

McAfee

McAfee DFFCDE-AA-DA - Endpoint Encryption For Files User manual

McAfee

McAfee TEECDE-AA-AA - Total Protection For Endpoint User manual

McAfee

McAfee MANAGEMENT EDITION 2.5 User manual

McAfee

McAfee AGENT 4.0 PATCH 2 - FOR WINDOWS S 10-03-2009 Instruction Manual

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0 PATCH 5 - S... Instruction Manual

McAfee

McAfee PASCDE-AB-IA - Policy Auditor For Servers User manual

McAfee

McAfee INTERNET GUARD DOG 3.0 User manual

McAfee

McAfee WEBSHIELD SMTP User manual

McAfee

McAfee INTERNET SECURITY 5.0 User manual

McAfee

McAfee SMEFCE-AI-DA - Email Security Service... Instruction Manual

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - User manual

McAfee

McAfee VirusScan User manual

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual