Event Log sends all events that were recorded on the client to ePO - On-prem.
Activity log
Activity log records all Trellix ENS for Linux Threat Prevention activities.
These log files sizes are monitored against the defined file size threshold in the product. If the file size exceeds the threshold, the log file is archived to the log archive directory through log rotation. You can define the log file size between 1 MB and 999 MB. The default size is 10 MB.
Log rotation happens on 2 scenarios:
When the log file size reaches the defined threshold.
When the
mfetpd(product) services are restarted.
In addition to these 2 scenarios, log rotation also happens:
When the product is shut down normally.
If the product is stopped under abnormal circumstances, log rotation does not happen.
When you start the product after the abnormal process termination, logs are appended to the older log file. But if the older log file size is greater than the threshold, the log file rotation happens first. The product then starts writing to a fresh log file.
Log rotation also happens in real time when the product's active log size exceeds the defined threshold.
Every time a log file is rotated, it also checks the log archive directory size. If the directory size exceeds the threshold, it deletes the oldest file.
Note
The threshold of the log archive directory is same as the limit defined in the product. For example, if the product uses the default limit of 10 MB, the log archive directory threshold is also 10 MB.
These thresholds are also applied to each log archive-related directory (such as mfeoasmgr, mfescanfactory, or mfeodscollector) in the default destination (/var/McAfee/ens/log/) or custom directories that you configured.
The archived logs are automatically deleted when the total size of the log archive directory exceeds the threshold (default limit * 5 times).
Each process of Endpoint Security for Linux Threat Prevention has its own dedicated archive log directory. If one of these directories exceeds the threshold (default limit * 5 times), the software deletes the oldest log file in that directory.
The oldest log file is the file that contains the smallest number in its secondary name. After deleting the oldest log file, the process again checks the log archive directory size. If the directory size is still greater than the threshold, the software again deletes the oldest log file from the existing files. This cycle continues until the directory size becomes lesser than the threshold value (default limit * 5 times).
For example, the log files names in the log archive directory are mfetpd.log, mfetpd.log00000, mfetpd.log00001, mfetpd.log0000.
mfetpd.log is the oldest log file in the Active Directory. mfetpd.log00000 is the next older file, then the next older file is mfetpd.log00001. But, when log rotation deletes the oldest log file mfetpd.log, it no longer appears in the archive directory, and the mfetpd.log00000 becomes the oldest log file. If mfetpd.log and mfetpd.log00000 are deleted, mfetpd.log00001 becomes the oldest log file.
If any process is never started or never executed (for example On-demand scan is never used), then its log file and log archive directory's size or age does not change.
Custom log destination
You can configure a custom destination for all product logs. When you configure a new custom destination, the system automatically creates the fw/, tp/, esp/, and archived_logs/ subdirectories.
The custom log destination must meet these rules:
The destination must be an absolute path.
The destination must reside on a local file system.
Network shares are not supported.
The destination must have a minimum of 10 MB of free disk space.
The root user must own the destination directory.
The destination must not be a restricted system directory. Restricted directories include
/tmp,/sys, and/etc.
Note
You cannot modify the log destination while an On-Demand Scan or DAT update runs.
Event log
When enabled, all events are recorded to the Event Log on the Trellix Endpoint Security (ENS) for Linux client, and sent to ePO - On-prem. You can also send all events to the Event Log on the client syslog on Linux clients. The location of syslog is configurable on Linux systems.