You can configure a custom log destination using the command-line interface. This configuration applies automatically to Threat Prevention, Firewall, and platform services.
Important
Self-protection does not support a custom log path outside the Trellix ENS Linux installation directory. For more information on self-protection, see Enabling self protection support
Directory requirements
You must not run an On-Demand Scan or DAT update during this task.
You must specify an absolute path.
The directory must already exist and must be empty.
Ensure that the destination has a minimum of 10 MB of free disk space.
The root user must have read, write, and execute permissions for the directory.
You must provide only the base directory. Do not include component suffixes.
File system restrictions
The destination must reside on a local file system. The product does not support network-based file systems such as
nfs, nfs4, cifs, smbfs, fuse.sshfs, and fuse.gvfsd-fuse.
Path restrictions
The destination must not be a restricted system directory. Restricted path prefixes include
/tmp/, /var/tmp/, /proc/, /sys/, /dev/, and /run/.
Other restricted prefixes are /mnt/, /media/, /etc/, and /boot/. The product also restricts /lib/, /lib64/, /sbin/, /bin/, /usr/bin/, and /usr/lib/.
Log on to the system as a user with administrator rights.
Change directory to the
bindirectory of the product.Threat Prevention:
cd /opt/McAfee/ens/tp/binFirewall:
cd /opt/McAfee/ens/fw/bin
Run the command to configure the new log destination.
Replace <custom_path> with your custom base directory.
Note
Verify that your custom log path meets all validation rules listed in prerequisites before you run this command.
Threat Prevention:
./mfetpcli --setcustomlogpath <custom_path>Firewall:
./mfefwcli --setcustomlogpath <custom_path>
Wait for the services to restart automatically.
Run the command to verify the new log destination appears againt
TP/FW Product Log Path.Threat Prevention:
./mfetpcli --showlogsettingsFirewall:
./mfefwcli --showlogsettings