McAfee EPOLICY ORCHESTRATOR 4.0 - LOG FILES FOR User manual

Using Log Files for Troubleshooting in
ePolicy Orchestrator 4.0
Guide

COPYRIGHT
Copyright ©2007 McAfee, Inc. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form
or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.
TRADEMARK ATTRIBUTIONS
AVERT, EPO, EPOLICY ORCHESTRATOR, FLASHBOX, FOUNDSTONE, GROUPSHIELD, HERCULES, INTRUSHIELD, INTRUSION INTELLIGENCE,
LINUXSHIELD, MANAGED MAIL PROTECTION, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, MCAFEE.COM, NETSHIELD,
PORTALSHIELD, PREVENTSYS, PROTECTION-IN-DEPTH STRATEGY, PROTECTIONPILOT, SECURE MESSAGING SERVICE, SECURITYALLIANCE,
SITEADVISOR, THREATSCAN, TOTAL PROTECTION, VIREX, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc.
and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other
registered and unregistered trademarks herein are the sole property of their respective owners.
LICENSE INFORMATION
License Agreement
NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,
WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH
TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS
THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,
A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU
DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN
THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
License Attributions
Refer to the product Release Notes.
Using Log Files for Troubleshooting in ePolicy Orchestrator 4.02

Contents
Troubleshooting with Log Files...........................................................4
Log file names and locations.................................................................5
Typical issues addressed by logs..............................................................7
Logging levels for debugging.................................................................8
When setting changes take effect............................................................10
AdjustingtheTomcatloglevel...............................................................11
Logging agent updating and deployment scripts................................................11
Troubleshooting policy updates..............................................................11
Interpreting Windows error codes............................................................12
Agent activity log.........................................................................12
Use of the VirusScan update log.............................................................12
3Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

Troubleshooting with Log Files
ePolicy Orchestrator includes many log files that you can use for troubleshooting. This document
describes how to use the log files and provides the following information:
• Name and location of log files.
• Typical issues requiring troubleshooting, and the log files likely to be helpful.
• Setting the size of log files and the depth and scope of logging.
• When changes to logging settings take effect.
• Types of log files: McAfee Agent log files and ePolicy Orchestrator log files. Five of the files
are associated with the McAfee Agent:
•AGENT_<SYSTEM>.LOG
•FRMINST_<SYSTEM>.LOG
•MCSCRIPT.LOG
•PRDMGR_<SYSTEM>.LOG
•UPDATERUI_<SYSTEM>.LOG
All other log files are associated with ePolicy Orchestrator and its installer.
Contents
Log file names and locations
Typical issues addressed by logs
Logging levels for debugging
When setting changes take effect
Adjusting the Tomcat log level
Logging agent updating and deployment scripts
Troubleshooting policy updates
Interpreting Windows error codes
Agent activity log
Use of the VirusScan update log
Using Log Files for Troubleshooting in ePolicy Orchestrator 4.04

Log file names and locations
Table 1 lists the name and location of each ePolicy Orchestrator 4.0 log file. Table 2 explains
frequently repeated path variables.
Table 1: Log files and their locations
LocationLog file name
<AGENT DATA PATH>\DBAGENT_<SYSTEM>.LOG,
AGENT_<SYSTEM>_BACKUP.LOG
<INSTALLATION PATH>\DB\DEBUG (see
Troubleshooting with Log Files)
<AGENTGUID>-<TIMESTAMP>.XML (if registry value
has been set)
<CURRENT USER’S TEMP
DIRECTORY>\NAILOGS\EPO400-TROUBLESHOOT\ORION
FRAMEWORK
CORE-INSTALL.LOG
<CURRENT USER’S TEMP
DIRECTORY>\NAILOGS\EPO400-TROUBLESHOOT\ORION
FRAMEWORK
ENV-CORE-INSTALL.LOG
<CURRENT USER’S TEMP DIRECTORY>\NAILOGS\ORION
FRAMEWORK
ENV-INSTALL.LOG
<CURRENT USER’S TEMP
DIRECTORY>\NAILOGS\EPO400-TROUBLESHOOT\ORION
FRAMEWORK
ENV-TOMCAT-INSTALL.LOG
<INSTALLATION PATH>\DB\LOGSEPOAPSVR.LOG
<CURRENT USER’S TEMP DIRECTORY>\NAILOGSEPO400COMMONSETUP.LOG
<CURRENT USER’S TEMP
DIRECTORY>\NAILOGS\MERCURY FRAMEWORK
EPO-INSTALL.LOG
<CURRENT USER’S TEMP DIRECTORY>\NAILOGSEPO400-INSTALL-MSI.LOG
<INSTALLATION PATH>\MCAFEE\APACHE2\LOGSERRORLOG.<CURRENT_DATETIME>
<INSTALLATION PATH>\DB\LOGSEVENTPARSER.LOG, EVENTPARSER_BACKUP.LOG
C:\WINDOWS\NAILOGS or C:\WINDOWS\TEMP\NAILOGS
or C:\DOCUMENTS AND SETTINGS\<CURRENT
USER\LOCAL SETTINGS\TEMP\NAILOGS
FRMINST_<SYSTEM>.LOG
PROGRAMFILES\MCAFEE\EPOLICY
ORCHESTRATOR\SERVER\LOGS
JAKARTA_SERVICE_<DATE>.LOG
<CURRENT USER’S TEMP DIRECTORY>\NAILOGSLICENSING.LOG
PROGRAMFILES\MCAFEE\EPOLICY
ORCHESTRATOR\SERVER\LOGS
LOCALHOST_ACCESS_LOG.<DATE>.TXT
<AGENT DATA PATH>MCSCRIPT.LOG
<CURRENT USER’S TEMP DIRECTORY>\NAILOGSMIGRATION.LOG
PROGRAMFILES\MCAFEE\EPOLICYORCHESTRATOR\SERVER\LOGSORION.LOG
Troubleshooting with Log Files
Log file names and locations
5Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

LocationLog file name
<AGENT DATA PATH>\DBPRDMGR_<SYSTEM>.LOG,
PRDMGR_<SYSTEM>_BACKUP.LOG
<INSTALLATION PATH>\DB\LOGSREPLICATION.LOG
<INSTALLATION PATH>\DB\LOGSSERVER.LOG, SERVER_BACKUP.LOG
<CURRENT USER’S TEMP DIRECTORY>\NAILOGSSQL2K5bCINST.LOG
PROGRAMFILES\MCAFEE\EPOLICY
ORCHESTRATOR\SERVER\LOGS
STDERR.LOG
<CURRENT USER’S TEMP DIRECTORY>\NAILOGSUPDATERUI_<SYSTEM>.LOG
NOTE: Paths that include the folder EPO400-TROUBLESHOOT point to the log file generated
for a failed operation. If the operation succeeds, the path does not include the
EPO400-TROUBLESHOOT folder.
Table 2: Path variables
DescriptionVariable
The default location of the agent data files is
<DOCUMENTS AND SETTINGS>\ALL
<AGENT DATA PATH>
USERS\APPLICATION DATA\MCAFEE\COMMON
FRAMEWORK
<DOCUMENTS AND SETTINGS> is the location of the
DOCUMENTS AND SETTINGS folder, which depends on
the operating system. If the operating system does not
use a DOCUMENTS AND SETTINGS folder, the default
location is <AGENT INSTALLATION PATH>\DATA. To
determine the actual location of the agent data files,
view this registry key
HKEY-LOCAL_MACHINE\SOFTWARE\MCAFEE\TVD\SHARED
COMPONENTS\FRAMEWORK\DATA PATH. For more
information, see “Agent installation directory” in the
ePolicy Orchestrator 4.0 Product Guide or Help.
This is the currently logged on user’s Temp folder. To
access this folder, select Start | Run, then type %temp%
in the Open text box, and click OK.
<CURRENT USER’S TEMP DIRECTORY>
The default location of the ePolicy Orchestrator 4.0 server
software is C:\PROGRAMFILES\MCAFEE\EPOLICY
ORCHESTRATOR
<INSTALLATION PATH>
Log file size and BACKUP logs
When a log file reaches it maximum size, BACKUP is added to the file name extension and a
new log file is created. For example, when AGENT_<SYSTEM>.LOG reaches it maximum size,
its name becomes AGENT_<SYSTEM>_BACKUP.LOG. If a BACKUP log already exists, it is
overwritten. Depending on how recently the BACKUP was created, it may contain current entries.
Examine both log files to ensure comprehensiveness.
The default log size is 1MB. To change the size, create the DWORD value LOGSIZE in the registry
key HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK ASSOCIATES\EPOLICY ORCHESTRATOR,
then set the value data to the size desired. For example, 2=2MB.
Troubleshooting with Log Files
Log file names and locations
Using Log Files for Troubleshooting in ePolicy Orchestrator 4.06

Typical issues addressed by logs
Table 3 identifies the types of issues recorded in each ePolicy Orchestrator 4.0 log file.
Table 3: Typical issues and the log files to consult
See these log filesFor issues with...
AGENT_<SYSTEM>.LOG,
AGENT_<SYSTEM>_BACKUP.LOG
Agent: in general; client communication tasks
FRMINST_<SYSTEM>.LOGAgent: installation; uninstallation
EPOAPSVR.LOGAgent: push
UPDATERUI_<SYSTEM>.LOGAgent: updating client, managed products
EPOAPSVR.LOGAgent: wake-up
SERVER.LOGAgent-server communication
SQL2K5bCINST.LOGBackward Compatibility for SQL (if installed during ePolicy
Orchestrator installation)
AGENT_<SYSTEM>.LOG
AGENT_<SYSTEM>_BACKUP.LOG
Client tasks: communication
PRDMGR_<SYSTEM>.LOG
PRDMGR_<SYSTEM>_BACKUP.LOG
PRDMGR_<SYSTEM>.LOG
PRDMGR_<SYSTEM>_BACKUP.LOG, MCSCRIPT.LOG
Client tasks: scripts
AGENT_<SYSTEM>.LOG, SERVER.LOG,
SERVER_BACKUP.LOG
Communication: client-server
REPLICATION.LOG, EPOAPSVR.LOG, ORION.LOGDistributed repositories
ERRORLOG.<CURRENT_DATETIME>Error: Apache web server
STDERR.LOG, JAKARTA_SERVICE_<DATE>.LOG,
LOCALHOST_ACCESS_LOG.<DATE>.TXT
Error: Tomcat servlet container
EVENTPARSER.LOG, EVENTPARSER_BACKUP.LOGEvents, event update
CORE-INSTALL.LOG, ENV-CORE-INSTALL.LOG,
EPO-INSTALL.LOG, ENV-TOMCAT-INSTALL.LOG
Installation: ePolicy Orchestrator calls to background,
foundation, or other platforms and technologies
EPO400COMMONSETUP.LOGInstallation: ePolicy Orchestrator custom actions
EPO400-INSTALL-MSI.LOGInstallation: ePolicy Orchestrator
ORION.LOGInterface: Issues arising after changes to...
LICENSING.LOGLicense
MIGRATION.LOG, EPO400-INSTALL-MSI.LOGMigration: from earlier version
ORION.LOGNotifications
PRDMGR_<SYSTEM>.LOG,
PRDMGR_<SYSTEM>_BACKUP.LOG
Plug-in files
Troubleshooting with Log Files
Typical issues addressed by logs
7Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

See these log filesFor issues with...
AGENT_<SYSTEM>.LOG,
AGENT_<SYSTEM>_BACKUP.LOG, SERVER.LOG
Policies
<AGENTGUID>-<TIMESTAMP>.XML (if registry value
has been set)
Policy update
SERVER.LOGProduct property update
EPOAPSVR.LOG, ORION.LOG, REPLICATION.LOGPull
EPOAPSVR.LOGPush agent
EPOAPSVR.LOG, ORION.LOG, REPLICATION.LOGReplicate
AGENT_<SYSTEM>.LOGScript: client task
MCSCRIPT.LOGScripts: engine; messages
SERVER.LOG, SERVER_BACKUP.LOG, ORION.LOGServer: in general
EPO400COMMONSETUP.LOG, EPO400-INSTALL-MSI.LOGServer: installation
AGENT_<SYSTEM>.LOG,
AGENT_<SYSTEM>_BACKUP.LOG
Updating
UPDATERUI_<SYSTEM>.LOG
<AGENTGUID>-<TIMESTAMP>.XML (if registry value
has been set)
MIGRATION.LOG, EPO400-INSTALL-MSI.LOGUpgrading: from earlier version
ORION.LOGUser interface:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR, issues arising
after changes to...
Logging levels for debugging
This section provides information about setting logging levels for logs in general. For information
about adjusting the logging of the Tomcat servlet container, see Adjusting the Tomcat log level.
The scope and depth of the information in most log files are determined by the log level, a
value ranging from 1 to 8.
• Messages logged at each level include all messages at the current level and all lower logging
levels.
• The default value is 7, generally considered adequate for ordinary debugging.
• Log level 8 produces output, including every SQL query, whether or not there is an error.
Log level 8 also provides communication details for troubleshooting network and proxy server
issues.
Troubleshooting with Log Files
Logging levels for debugging
Using Log Files for Troubleshooting in ePolicy Orchestrator 4.08

Table 4 describes each message type and logging level. Table 5 lists the locations where the
values that control logging levels can be modified.
Table 4: Messages reported at each log level
Logging
level
DescriptionMessage type
1User error message, translatede (error)
2User warning message, translatedw (warning)
3User information message, translatedi (information)
4User extended information message, translatedx (extended data)
5Debug error message, English onlyE (error)
6Debug warning message, English onlyW (warning)
7Debug information message, English onlyI (information), or none
8Debug extended information message, English onlyX (extended data)
Table 5: Location of values controlling log levels
Location of controlling log level valueLog file
DWORD registry value at:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL
AGENT_<SYSTEM>.LOG
DWORD registry value at:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL
EPOAPPSVR.LOG
DWORD registry value at:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL
EVENTPARSER.LOG
DWORD registry value at:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL
FRMINST_<SYSTEM>.LOG
C:\PROGRAMFILES\MCAFEE\EPOLICY
ORCHESTRATOR\SERVER\CONF\ORION
ORION.LOG
\LOG-CONFIG.XML. See “MaxFileSize” parameter value
in “Rolling log file” section. See also Priority Value in
<root> section.
DWORD registry value at:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL
PRDMGR_<SYSTEM>.LOG
DWORD registry value at:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL
SERVER.LOG
DWORD registry value at:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL
UPDATERUI_<SYSTEM>.LOG
Troubleshooting with Log Files
Logging levels for debugging
9Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

When setting changes take effect
This section defines the interval between the moment that a log file setting is changed and the
moment the change takes effect.
• When a setting is changed using the registry, the interval is usually a minute or less. The
DWORD registry value that controls logging is: HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK
ASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL.
• When a setting is changed in an INI file or an XML file, the change usually takes effect
immediately.
• In some instances, when a change takes effect upon restarting the system, the user controls
the interval.
Table 6: When log setting changes take effect
Setting change takes effect...Log file name
Within one minuteAGENT_<SYSTEM>.LOG
Cannot changeCORE-INSTALL.LOG
Within one minuteEPOAPSVR.LOG
Immediately upon saving change to EPO400-DEBUG.INI,
located at <CURRENT USER’S TEMP
DIRECTORY>\NAILOGS
EPO400COMMONSETUP.LOG
Cannot changeEPO-INSTALL.LOG
Immediately upon saving change to EPO400-DEBUG.INI,
located at <CURRENT USER’S TEMP
DIRECTORY>\NAILOGS
EPO400-INSTALL-MSI.LOG
Upon startupERRORLOG<CURRENT_DATETIME>
Within one minuteEVENTPARSER.LOG
Upon startupFRMINST_<SYSTEM>.LOG
Upon startup of Tomcat serviceJAKARTA_SERVICE_<DATE>.LOG
Cannot changeLICENSING.LOG
Upon startup of Tomcat serviceLOCALHOST_ACCESS_LOG.<DATE>.TXT
Upon startupMCSCRIPT.LOG
Upon startup of Tomcat serviceORION.LOG
Within one minutePRDMGR_<SYSTEM>.LOG
Within one minuteREPLICATION.LOG
Upon startupSERVER.LOG, SERVER_BACKUP.LOG
Cannot changeSQL2K5bCINST.LOG
Cannot changeSTDERR.LOG
Troubleshooting with Log Files
When setting changes take effect
Using Log Files for Troubleshooting in ePolicy Orchestrator 4.010

Setting change takes effect...Log file name
Within one minuteUPDATERUI_<SYSTEM>.LOG
Adjusting the Tomcat log level
The file name of the Tomcat log is ORION.LOG. To adjust its logging level, do the following.
Task
1Open the LOG-CONFIG.XML file, located at:
C:\PROGRAMFILES>\McAfee\ePolicyOrchestrator\Server\conf\orion
2In the following line of text, replace “warn” with “info” or “debug”: <root><priority value
="warn"/><appender-ref ref="ROLLING" /><appender-ref ref="STDOUT/></root>
3Save and close the file.
Tomcat automatically adjusts the log level when the service is restarted.
Logging agent updating and deployment scripts
The agent uses MCSCRIPT.LOG to report script commands used during updating and deployment.
To enable, set the following DWORD value on the client’s registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK ASSOCIATES\TVD\SHARED
COMPONENTS\FRAMEWORK\DWDEBUGSCRIPT=2
McAfee recommends that you delete this key when you are done troubleshooting.
Troubleshooting policy updates
To troubleshoot incremental policy update issues from the server-side, do the following:
Task
1Create the DWORD registry value SAVEAGENTPOLICY = 1 in
HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK ASSOCIATES\EPOLICY
ORCHESTRATOR.
2Restart all ePolicy Orchestrator services.
Detailed descriptions of failures, including source files and line numbers, appear in the
application log for the component experiencing issues. The ePolicy Orchestrator server
creates the file <AGENTGUID>-<TIMESTAMP>.XML at <INSTALLATION PATH>\DB\DEBUG,
which contains a copy of the content that the server deployed.In the following line of text,
replace “warn” with “info” or “debug”.
3Save and close the file.
Troubleshooting with Log Files
Adjusting the Tomcat log level
11Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

Interpreting Windows error codes
To understand Windows error messages, identify the error code and look it up in the MSDN
library.
1Locate messages of type e or E in the log file.
2Identify the time that the problem occurred, if known.
3Note the Windows error code associated with the problem event.
4Find the error code in the MSDN library at:
http://msdn2.microsoft.com/en-us/library/ms681381.aspx
For example, when tracking down an error message that includes code 1326, navigate to
and click the code in the list of system error codes. The explanation of the code is displayed:
1326 ERROR_LOGON_FAILURE Logon failure: unknown user name or bad password
NOTE: You can also use the ERRLOOK.EXE utility to determine the cause of these error
codes. This utility is distributed with Microsoft Visual Studio
Agent activity log
The agent activity log (AGENT_<SYSTEM>.XML) contains copies of messages from the
AGENT_<SYSTEM>.LOG, including translated messages, of types “e”, “w”, and “i”, (corresponding
to logging levels 1 – 3). This file is not intended for debugging, but as information for users not
likely to be troubleshooting. Messages of type “x” (logging level 4) can be included in the activity
log. For information on setting levels, see Logging levels for debugging.
Information in the activity log also appears in the Agent Monitor.
If you enable remote access to the agent activity log file, you can also view the agent debug
log files remotely by clicking View debug log (current or previous) in the agent activity log
file. For instructions, see “Agent Activity Logs” and “Viewing the agent activity log” in the ePolicy
Orchestrator 4.0 Product Guide.
Use of the VirusScan update log
The UPDATETXT.LOG file in VirusScan Enterprise 8.0i and 8.5i provides information derived
from the AGENT_<SYSTEM>.LOG. It does not provide any additional information than the agent
log provides. However, VirusScan reformats the information for compatibility with previous
versions. In addition, users can control the content that is displayed in the UPDATETXT.LOG
and can designate its location.
Troubleshooting with Log Files
Interpreting Windows error codes
Using Log Files for Troubleshooting in ePolicy Orchestrator 4.012