Press CTRL+K to open search

Auditing malware scans in the xAgent log

  • Published on Sep 8, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

Use the xAgent log to audit on-access and on-demand malware scans on your host endpoints. The agent log includes the following information for each malware scan performed on your host endpoint:

  • Malware scan start time

  • Scan completion status

  • Cause for incomplete malware scans (Example: a reboot an error caused an incomplete scan.)

  • Malware scan duration

  • Number of files scanned

  • Number of detections identified

  • Malware scan type (full, quick, or active memory)

This section describes how to extract the log from the xAgent on your host endpoint.

To extract the agent log:

C:<installdir>xagt.exe -g <LogFileName>

The example below extracts the agent log file (log.ext) from the \Program Files (x86)\fireeye\ directory.

\Program Files (x86)\fireeye\xagt\xagt.exe -g log.txt

  1. Using administrator access, open command line prompt on a host endpoint currently running Trellix Endpoint Security (HX) xAgent version 28.

  2. Enter the following command to extract the agent log:

:
Related articles
  • Auditing malware scans in the xAgent log
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > xAgent Configuration > Configuring On-Demand Malware Scans
  • xAgent log
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > xAgent Configuration > Malware protection overview > Understanding Malware Protection
  • Malware scan log fields
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Appendixes > CEF Logs and Output