epo 40 troubleshooting de arquivos log

Using Log Files for Troubleshooting inePolicy Orchestrator 4.0Guide

COPYRIGHT

Copyright © 2007 McAfee, Inc. All Rights Reserved.

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any formor by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FLASHBOX, FOUNDSTONE, GROUPSHIELD, HERCULES, INTRUSHIELD, INTRUSION INTELLIGENCE,LINUXSHIELD, MANAGED MAIL PROTECTION, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, MCAFEE.COM, NETSHIELD,PORTALSHIELD, PREVENTSYS, PROTECTION-IN-DEPTH STRATEGY, PROTECTIONPILOT, SECURE MESSAGING SERVICE, SECURITYALLIANCE,SITEADVISOR, THREATSCAN, TOTAL PROTECTION, VIREX, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc.and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All otherregistered and unregistered trademarks herein are the sole property of their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICHTYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTSTHAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOUDO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURNTHE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

License Attributions

Refer to the product Release Notes.

Using Log Files for Troubleshooting in ePolicy Orchestrator 4.02

ContentsTroubleshooting with Log Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Log file names and locations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Typical issues addressed by logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Logging levels for debugging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

When setting changes take effect. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Adjusting the Tomcat log level. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Logging agent updating and deployment scripts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Troubleshooting policy updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Interpreting Windows error codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Agent activity log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Use of the VirusScan update log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3Using Log Files for Troubleshooting in ePolicy Orchestrator 4.0

Troubleshooting with Log FilesePolicy Orchestrator includes many log files that you can use for troubleshooting. This documentdescribes how to use the log files and provides the following information:

• Name and location of log files.

• Typical issues requiring troubleshooting, and the log files likely to be helpful.

• Setting the size of log files and the depth and scope of logging.

• When changes to logging settings take effect.

• Types of log files: McAfee Agent log files and ePolicy Orchestrator log files. Five of the filesare associated with the McAfee Agent:

• AGENT_<SYSTEM>.LOG

• FRMINST_<SYSTEM>.LOG

• MCSCRIPT.LOG

• PRDMGR_<SYSTEM>.LOG

• UPDATERUI_<SYSTEM>.LOG

All other log files are associated with ePolicy Orchestrator and its installer.

Contents

Log file names and locations

Typical issues addressed by logs

Logging levels for debugging

When setting changes take effect

Adjusting the Tomcat log level

Logging agent updating and deployment scripts

Troubleshooting policy updates

Interpreting Windows error codes

Agent activity log

Use of the VirusScan update log


Log file names and locationsTable 1 lists the name and location of each ePolicy Orchestrator 4.0 log file. Table 2 explainsfrequently repeated path variables.

Table 1: Log files and their locationsLocationLog file name

<AGENT DATA PATH>\DBAGENT_<SYSTEM>.LOG,AGENT_<SYSTEM>_BACKUP.LOG

<INSTALLATION PATH>\DB\DEBUG (seeTroubleshooting with Log Files)

<AGENTGUID>-<TIMESTAMP>.XML (if registry valuehas been set)

<CURRENT USER’S TEMPDIRECTORY>\NAILOGS\EPO400-TROUBLESHOOT\ORIONFRAMEWORK

CORE-INSTALL.LOG


ENV-CORE-INSTALL.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGS\ORIONFRAMEWORK

ENV-INSTALL.LOG


ENV-TOMCAT-INSTALL.LOG

<INSTALLATION PATH>\DB\LOGSEPOAPSVR.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSEPO400COMMONSETUP.LOG

<CURRENT USER’S TEMPDIRECTORY>\NAILOGS\MERCURY FRAMEWORK

EPO-INSTALL.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSEPO400-INSTALL-MSI.LOG

<INSTALLATION PATH>\MCAFEE\APACHE2\LOGSERRORLOG.<CURRENT_DATETIME>

<INSTALLATION PATH>\DB\LOGSEVENTPARSER.LOG, EVENTPARSER_BACKUP.LOG

C:\WINDOWS\NAILOGS or C:\WINDOWS\TEMP\NAILOGSor C:\DOCUMENTS AND SETTINGS\<CURRENTUSER\LOCAL SETTINGS\TEMP\NAILOGS

FRMINST_<SYSTEM>.LOG

PROGRAMFILES\MCAFEE\EPOLICYORCHESTRATOR\SERVER\LOGS

JAKARTA_SERVICE_<DATE>.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSLICENSING.LOG


LOCALHOST_ACCESS_LOG.<DATE>.TXT

<AGENT DATA PATH>MCSCRIPT.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSMIGRATION.LOG

PROGRAMFILES\MCAFEE\EPOLICYORCHESTRATOR\SERVER\LOGSORION.LOG

Troubleshooting with Log FilesLog file names and locations


LocationLog file name

<AGENT DATA PATH>\DBPRDMGR_<SYSTEM>.LOG,PRDMGR_<SYSTEM>_BACKUP.LOG

<INSTALLATION PATH>\DB\LOGSREPLICATION.LOG

<INSTALLATION PATH>\DB\LOGSSERVER.LOG, SERVER_BACKUP.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSSQL2K5bCINST.LOG


STDERR.LOG

<CURRENT USER’S TEMP DIRECTORY>\NAILOGSUPDATERUI_<SYSTEM>.LOG

NOTE: Paths that include the folder EPO400-TROUBLESHOOT point to the log file generatedfor a failed operation. If the operation succeeds, the path does not include theEPO400-TROUBLESHOOT folder.

Table 2: Path variablesDescriptionVariable

The default location of the agent data files is<DOCUMENTS AND SETTINGS>\ALL

<AGENT DATA PATH>

USERS\APPLICATION DATA\MCAFEE\COMMONFRAMEWORK

<DOCUMENTS AND SETTINGS> is the location of theDOCUMENTS AND SETTINGS folder, which depends onthe operating system. If the operating system does notuse a DOCUMENTS AND SETTINGS folder, the defaultlocation is <AGENT INSTALLATION PATH>\DATA. Todetermine the actual location of the agent data files,view this registry keyHKEY-LOCAL_MACHINE\SOFTWARE\MCAFEE\TVD\SHAREDCOMPONENTS\FRAMEWORK\DATA PATH. For moreinformation, see “Agent installation directory” in theePolicy Orchestrator 4.0 Product Guide or Help.

This is the currently logged on user’s Temp folder. Toaccess this folder, select Start | Run, then type %temp%in the Open text box, and click OK.

<CURRENT USER’S TEMP DIRECTORY>

The default location of the ePolicy Orchestrator 4.0 serversoftware is C:\PROGRAMFILES\MCAFEE\EPOLICYORCHESTRATOR

<INSTALLATION PATH>

Log file size and BACKUP logs

When a log file reaches it maximum size, BACKUP is added to the file name extension and anew log file is created. For example, when AGENT_<SYSTEM>.LOG reaches it maximum size,its name becomes AGENT_<SYSTEM>_BACKUP.LOG. If a BACKUP log already exists, it isoverwritten. Depending on how recently the BACKUP was created, it may contain current entries.Examine both log files to ensure comprehensiveness.

The default log size is 1MB. To change the size, create the DWORD value LOGSIZE in the registrykey HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK ASSOCIATES\EPOLICY ORCHESTRATOR,then set the value data to the size desired. For example, 2=2MB.

Troubleshooting with Log FilesLog file names and locations


Typical issues addressed by logsTable 3 identifies the types of issues recorded in each ePolicy Orchestrator 4.0 log file.

Table 3: Typical issues and the log files to consultSee these log filesFor issues with...

AGENT_<SYSTEM>.LOG,AGENT_<SYSTEM>_BACKUP.LOG

Agent: in general; client communication tasks

FRMINST_<SYSTEM>.LOGAgent: installation; uninstallation

EPOAPSVR.LOGAgent: push

UPDATERUI_<SYSTEM>.LOGAgent: updating client, managed products

EPOAPSVR.LOGAgent: wake-up

SERVER.LOGAgent-server communication

SQL2K5bCINST.LOGBackward Compatibility for SQL (if installed during ePolicyOrchestrator installation)

AGENT_<SYSTEM>.LOGAGENT_<SYSTEM>_BACKUP.LOG

Client tasks: communication

PRDMGR_<SYSTEM>.LOGPRDMGR_<SYSTEM>_BACKUP.LOG

PRDMGR_<SYSTEM>.LOGPRDMGR_<SYSTEM>_BACKUP.LOG, MCSCRIPT.LOG

Client tasks: scripts

AGENT_<SYSTEM>.LOG, SERVER.LOG,SERVER_BACKUP.LOG

Communication: client-server

REPLICATION.LOG, EPOAPSVR.LOG, ORION.LOGDistributed repositories

ERRORLOG.<CURRENT_DATETIME>Error: Apache web server

STDERR.LOG, JAKARTA_SERVICE_<DATE>.LOG,LOCALHOST_ACCESS_LOG.<DATE>.TXT

Error: Tomcat servlet container

EVENTPARSER.LOG, EVENTPARSER_BACKUP.LOGEvents, event update

CORE-INSTALL.LOG, ENV-CORE-INSTALL.LOG,EPO-INSTALL.LOG, ENV-TOMCAT-INSTALL.LOG

Installation: ePolicy Orchestrator calls to background,foundation, or other platforms and technologies

EPO400COMMONSETUP.LOGInstallation: ePolicy Orchestrator custom actions

EPO400-INSTALL-MSI.LOGInstallation: ePolicy Orchestrator

ORION.LOGInterface: Issues arising after changes to...

LICENSING.LOGLicense

MIGRATION.LOG, EPO400-INSTALL-MSI.LOGMigration: from earlier version

ORION.LOGNotifications

PRDMGR_<SYSTEM>.LOG,PRDMGR_<SYSTEM>_BACKUP.LOG

Plug-in files

Troubleshooting with Log FilesTypical issues addressed by logs


See these log filesFor issues with...

AGENT_<SYSTEM>.LOG,AGENT_<SYSTEM>_BACKUP.LOG, SERVER.LOG

Policies

<AGENTGUID>-<TIMESTAMP>.XML (if registry valuehas been set)

Policy update

SERVER.LOGProduct property update

EPOAPSVR.LOG, ORION.LOG, REPLICATION.LOGPull

EPOAPSVR.LOGPush agent

EPOAPSVR.LOG, ORION.LOG, REPLICATION.LOGReplicate

AGENT_<SYSTEM>.LOGScript: client task

MCSCRIPT.LOGScripts: engine; messages

SERVER.LOG, SERVER_BACKUP.LOG, ORION.LOGServer: in general

EPO400COMMONSETUP.LOG, EPO400-INSTALL-MSI.LOGServer: installation

AGENT_<SYSTEM>.LOG,AGENT_<SYSTEM>_BACKUP.LOG

Updating

UPDATERUI_<SYSTEM>.LOG<AGENTGUID>-<TIMESTAMP>.XML (if registry valuehas been set)

MIGRATION.LOG, EPO400-INSTALL-MSI.LOGUpgrading: from earlier version

ORION.LOGUser interface:HKEY_LOCAL_MACHINE\SOFTWARE\NETWORKASSOCIATES\EPOLICY ORCHESTRATOR, issues arisingafter changes to...

Logging levels for debuggingThis section provides information about setting logging levels for logs in general. For informationabout adjusting the logging of the Tomcat servlet container, see Adjusting the Tomcat log level.

The scope and depth of the information in most log files are determined by the log level, avalue ranging from 1 to 8.

• Messages logged at each level include all messages at the current level and all lower logginglevels.

• The default value is 7, generally considered adequate for ordinary debugging.

• Log level 8 produces output, including every SQL query, whether or not there is an error.Log level 8 also provides communication details for troubleshooting network and proxy serverissues.

Troubleshooting with Log FilesLogging levels for debugging


Table 4 describes each message type and logging level. Table 5 lists the locations where thevalues that control logging levels can be modified.

Table 4: Messages reported at each log levelLogginglevel

DescriptionMessage type

1User error message, translatede (error)

2User warning message, translatedw (warning)

3User information message, translatedi (information)

4User extended information message, translatedx (extended data)

5Debug error message, English onlyE (error)

6Debug warning message, English onlyW (warning)

7Debug information message, English onlyI (information), or none

8Debug extended information message, English onlyX (extended data)

Table 5: Location of values controlling log levelsLocation of controlling log level valueLog file

DWORD registry value at:HKEY_LOCAL_MACHINE\SOFTWARE\NETWORKASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL

AGENT_<SYSTEM>.LOG


EPOAPPSVR.LOG


EVENTPARSER.LOG


FRMINST_<SYSTEM>.LOG

C:\PROGRAMFILES\MCAFEE\EPOLICYORCHESTRATOR\SERVER\CONF\ORION

ORION.LOG

\LOG-CONFIG.XML. See “MaxFileSize” parameter valuein “Rolling log file” section. See also Priority Value in<root> section.


PRDMGR_<SYSTEM>.LOG


SERVER.LOG


UPDATERUI_<SYSTEM>.LOG

Troubleshooting with Log FilesLogging levels for debugging


When setting changes take effectThis section defines the interval between the moment that a log file setting is changed and themoment the change takes effect.

• When a setting is changed using the registry, the interval is usually a minute or less. TheDWORD registry value that controls logging is: HKEY_LOCAL_MACHINE\SOFTWARE\NETWORKASSOCIATES\EPOLICY ORCHESTRATOR\LOGLEVEL.

• When a setting is changed in an INI file or an XML file, the change usually takes effectimmediately.

• In some instances, when a change takes effect upon restarting the system, the user controlsthe interval.

Table 6: When log setting changes take effectSetting change takes effect...Log file name

Within one minuteAGENT_<SYSTEM>.LOG

Cannot changeCORE-INSTALL.LOG

Within one minuteEPOAPSVR.LOG

Immediately upon saving change to EPO400-DEBUG.INI,located at <CURRENT USER’S TEMPDIRECTORY>\NAILOGS

EPO400COMMONSETUP.LOG

Cannot changeEPO-INSTALL.LOG

Immediately upon saving change to EPO400-DEBUG.INI,located at <CURRENT USER’S TEMPDIRECTORY>\NAILOGS

EPO400-INSTALL-MSI.LOG

Upon startupERRORLOG<CURRENT_DATETIME>

Within one minuteEVENTPARSER.LOG

Upon startupFRMINST_<SYSTEM>.LOG

Upon startup of Tomcat serviceJAKARTA_SERVICE_<DATE>.LOG

Cannot changeLICENSING.LOG

Upon startup of Tomcat serviceLOCALHOST_ACCESS_LOG.<DATE>.TXT

Upon startupMCSCRIPT.LOG

Upon startup of Tomcat serviceORION.LOG

Within one minutePRDMGR_<SYSTEM>.LOG

Within one minuteREPLICATION.LOG

Upon startupSERVER.LOG, SERVER_BACKUP.LOG

Cannot changeSQL2K5bCINST.LOG

Cannot changeSTDERR.LOG

Troubleshooting with Log FilesWhen setting changes take effect


Setting change takes effect...Log file name

Within one minuteUPDATERUI_<SYSTEM>.LOG

Adjusting the Tomcat log levelThe file name of the Tomcat log is ORION.LOG. To adjust its logging level, do the following.

Task

1 Open the LOG-CONFIG.XML file, located at:C:\PROGRAMFILES>\McAfee\ePolicyOrchestrator\Server\conf\orion

2 In the following line of text, replace “warn” with “info” or “debug”: <root><priority value="warn"/><appender-ref ref="ROLLING" /><appender-ref ref="STDOUT/></root>

3 Save and close the file.

Tomcat automatically adjusts the log level when the service is restarted.

Logging agent updating and deployment scriptsThe agent uses MCSCRIPT.LOG to report script commands used during updating and deployment.To enable, set the following DWORD value on the client’s registry key:HKEY_LOCAL_MACHINE\SOFTWARE\NETWORK ASSOCIATES\TVD\SHAREDCOMPONENTS\FRAMEWORK\DWDEBUGSCRIPT=2

McAfee recommends that you delete this key when you are done troubleshooting.

Troubleshooting policy updatesTo troubleshoot incremental policy update issues from the server-side, do the following:

Task

1 Create the DWORD registry value SAVEAGENTPOLICY = 1 inHKEY_LOCAL_MACHINE\SOFTWARE\NETWORK ASSOCIATES\EPOLICYORCHESTRATOR.

2 Restart all ePolicy Orchestrator services.

Detailed descriptions of failures, including source files and line numbers, appear in theapplication log for the component experiencing issues. The ePolicy Orchestrator servercreates the file <AGENTGUID>-<TIMESTAMP>.XML at <INSTALLATION PATH>\DB\DEBUG,which contains a copy of the content that the server deployed.In the following line of text,replace “warn” with “info” or “debug”.

3 Save and close the file.

Troubleshooting with Log FilesAdjusting the Tomcat log level


Interpreting Windows error codesTo understand Windows error messages, identify the error code and look it up in the MSDNlibrary.

1 Locate messages of type e or E in the log file.

2 Identify the time that the problem occurred, if known.

3 Note the Windows error code associated with the problem event.

4 Find the error code in the MSDN library at:http://msdn2.microsoft.com/en-us/library/ms681381.aspxFor example, when tracking down an error message that includes code 1326, navigate toand click the code in the list of system error codes. The explanation of the code is displayed:1326 ERROR_LOGON_FAILURE Logon failure: unknown user name or bad password

NOTE: You can also use the ERRLOOK.EXE utility to determine the cause of these errorcodes. This utility is distributed with Microsoft Visual Studio

Agent activity logThe agent activity log (AGENT_<SYSTEM>.XML) contains copies of messages from theAGENT_<SYSTEM>.LOG, including translated messages, of types “e”, “w”, and “i”, (correspondingto logging levels 1 – 3). This file is not intended for debugging, but as information for users notlikely to be troubleshooting. Messages of type “x” (logging level 4) can be included in the activitylog. For information on setting levels, see Logging levels for debugging.

Information in the activity log also appears in the Agent Monitor.

If you enable remote access to the agent activity log file, you can also view the agent debuglog files remotely by clicking View debug log (current or previous) in the agent activity logfile. For instructions, see “Agent Activity Logs” and “Viewing the agent activity log” in the ePolicyOrchestrator 4.0 Product Guide.

Use of the VirusScan update logThe UPDATETXT.LOG file in VirusScan Enterprise 8.0i and 8.5i provides information derivedfrom the AGENT_<SYSTEM>.LOG. It does not provide any additional information than the agentlog provides. However, VirusScan reformats the information for compatibility with previousversions. In addition, users can control the content that is displayed in the UPDATETXT.LOGand can designate its location.

Troubleshooting with Log FilesInterpreting Windows error codes


epo 40 troubleshooting de arquivos log

Documents

hkey local machine software network associates epolicy orchestrator loglevel

tomcat servlet container

agent data files

virusscan update log

change takes effect

tomcat log level

epolicy orchestrator 4

epolicy orchestrator