Viewing Trellix Agent logs

Trellix Agent Status Monitor — You can open the Trellix Agent Status Monitor window from the Trellix Agent tray icon (McTray).

Single System Troubleshooting — You can view the Trellix Agent logs of a managed system from the ePO - On-prem console remotely for troubleshooting. SST allows you to retrieve logs for both the Agent and integrated point products. The Zipped log file size limit for product logs is 50 MB by default, and can be adjusted up to 200 MB in the Trellix Agent policy under the Product logging section in Logging tab.

You can enable remote logging by enabling the Enable Remote Logging option under the General policy Logging tab. The default line limit for the remote log is 200 lines and can go up to 5000 lines.

Trellix Agent product logs — You can record all Trellix Agent activities related to policy enforcement, agent-server communication, product deployment, update logging, and event forwarding in the respective log files.

You can configure the Logging policy options under the General policy tab to enable Trellix Agent logging on the managed systems and ePO - On-prem. Configuring the Application Logging option allows Trellix Agent to record the activities in the Trellix Agent log files. In addition to the information stored in the Trellix Agent log, you can view detailed log that contains troubleshooting messages. You can enable detailed logging by enabling the Enable detailed logging option. The default file size is 2 MB and can go up to 100 MB. The default rollover count is 1 and can go up to 10. In Trellix Agent versions 5.7.7 to 5.8.2, the maximum file size of McScript.log is 10 MB and 10 rollover counts. From version 5.8.3 and later, the file size limit and the number of rollover counts are based on the settings defined in the assigned policy.

You can view all installation-related activities in the installation log files.

By default, the Trellix Agent logs on Windows client systems are saved in <ProgramData>\McAfee\Agent\Logs.

The Windows installation logs on the client system are saved in:

The Non-Windows installation logs on client system are saved in /var/log/ if Trellix Agent is installed using Trellix Smart Installer.

Whenever there is a manifest integrity failure or an error in the policy database validation, the Trellix Agent logs an error message in the mapolicy_<hostname>.log file. The maximum file size is 5 MB for 1 rollover count and there is no impact on this file size by the Trellix Agent policy.

The table lists the Trellix Agent logs and installation log files for Windows and Non-Windows client systems.