To use the Case Diagnostic Tool, follow the steps below or watch an audio-video guide for instructions:

1. Download the CDT zip file.

   Make sure to select the latest version available for your operating system.

2. Extract all the content of the zip file into a local directory on your computer.
3. Run the CDT.
4. Start the application.
   1. Accept the agreement.

      

   2. Click Start.

      A window appears showing Trend Micro products being detected.

      

5. Select Scan Related Issue > Collect AEGIS debug information then click Next.

   

6. Reproduce the issue:

   1. Click Start Debug Mode.

      

   2. Wait for the debug mode to change to “ON”.

      

   3. At this point you are ready to reproduce the issue. Collect a screenshot of any message you might see on the screen.

   If you are not able to reproduce the issue, or debugging is not required, then you can click Skip and go to Step 7.

7. Once the issue has been reproduced, click Stop Debug Mode and it will be turned off.

   

8. Collect the logs.
   1. Name a folder where the logs will be saved.
   2. Select Today's logs.

      

   3. Write any comment you want to add, or a detailed description of the issue (if not already provided). If you have nothing to add, just write “nothing to add”.

      You need to write something here. Otherwise, you will get this error message:

      

9. Generate the logs.

   

   
   When the application is complete, a new folder and zip file will be created in the directory you named in Step 8a.

   

10. Click Open Folder to open the folder where the CDT report was saved.
11. Click Finish to close the CDT.

To enable debugging:

1. Unload the Security agent or stop the Apex One Real-Time Scan Service.
2. Open the Registry Editor and modify the following registry keys:
    

   Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

    
   • For 32 bit:
     • HKLM\SOFTWARE\TrendMicro\Aegis\DebugLogFlags = dword:0000000xff
     • HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration\DACPolicyDump = dword:00000001
   • For 64 bit:
     • HKLM\SOFTWARE\TrendMicro\Aegis\DebugLogFlags = dword:0000000xff
     • HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration\DACPolicyDump = dword:00000001

   This will create a file called dac_policy_dump.log, which is a DAC policy dump file under \Apex One\Misc.

3. Close the Registry Editor.
4. Download and extract the AEGISExpert file located in the links below:
   • For 32 bit: AEGISExpert.zip
   • For 64 bit: AEGISExpertx64.zip
5. Put the extracted files in ..\Trend Micro\Apex One\.
6. Reload the Apex One client or restart the Apex One Real-Time Scan Service.
7. Open a command prompt and go to ..\Trend Micro\Apex One\.
8. Execute the following command:

   AEGISExpert.exe -start -timeout=60 -query > summary.txt

   The command will collect AEGIS raw event for the next 60 seconds. Replicate the issue during this period. If 60 seconds is not enough, change the -timeout value in the command above.

9. When AEGISExpert stops, collect the following files and send them to Trend Micro Technical Support:
   • RawEvent.log and summary.txt in ..\Trend Micro\Security Agent\
   • All files in ..\Trend Micro\BM\log\
   • All files in ..\Trend Micro\BM\Profiles\
   • dac_policy_dump.log in ..\Trend Micro\Security Agent\Misc\
   • TMBMCliyyyymmdd_nn.log in ..\TrendMicro\Security Agent\Log

To disable debugging:

1. Open the Registry Editor and modify the following registry keys:
    

   Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.

    
   • For 32 bit:
     • HKLM\SOFTWARE\TrendMicro\Aegis\DebugLogFlags = dword:00000000
     • HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration\DACPolicyDump = dword:00000000
   • For 64 bit:
     • HKLM\SOFTWARE\TrendMicro\Aegis\DebugLogFlags = dword:00000000
     • HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration\DACPolicyDump = dword:00000000
2. Close the Registry Editor.
3. Restart Apex One RealTime Scan to disable debugging.