The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Use SFTP to retrieve logs

  • Published on Sep 12, 2026
  • 1 minute(s) read
Prev Next

Configure the Trellix Enterprise Security Manager - Enterprise Log Manager to allow SFTP access to retrieve logs.

You must have ELM SFTP Access rights.

  1. Open an SFTP client such as WinSCP 5.11, Filezilla, CoreFTP LE, or FireFTP.

  2. Connect to the Trellix Enterprise Security Manager - Enterprise Log Manager using its IP address and the configured SFTP port.

    Note

    The date indicates when the system inserted the log to the Trellix Enterprise Security Manager - Enterprise Log Manager.

    The files are presented in two ways: 1) by data source then data and 2) by date then data source.

  3. Select the logs and transfer them. Specific steps to accomplish this vary based on the SFTP client you are using.

    Important

    Maximum number of files for SFTP transfers is 20,000.

Related articles
  • Use SFTP to retrieve logs
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > Finding threats > How log search works
  • Set up Trellix ESM logging
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > PG - ESM - Tuning McAfee ESM > Device configuration > Enterprise Log Manager (ELM) > Store logs on a Trellix Enterprise Log Manager (ELM)
  • Set up Trellix ESM logging
    Enterprise Security Manager > Enterprise Security Manager 11.6.x > ESM 11.6.x Product Guide > PG - ESM - Tuning McAfee ESM > Device configuration > Enterprise Log Manager (ELM) > Store logs on a Trellix Enterprise Log Manager (ELM)