Views:

To use the Case Diagnostic Tool, follow the steps below or watch an audio-video guide for instructions:

  1. Download the CDT zip file.

    Make sure to select the latest version available for your operating system.

  2. Extract all the content of the zip file into a local directory on your computer.
  3. Run the CDT.
  4. Start the application.
    1. Accept the agreement.

      License Agreement - Case Diagnostic Tool

    2. Click Start.

      A window appears showing Trend Micro products being detected.

      Detecting Trend Micro products - Case Diagnostic Tool

  5. Select Scan Related Issue > Collect AEGIS debug information then click Next.

    CDT_Collect_AEGIS_debug_information

  6. Reproduce the issue:

    1. Click Start Debug Mode.

      Start Debug Mode - Case Diagnostic Tool

    2. Wait for the debug mode to change to “ON”.

      debug mode ON - Case Diagnostic Tool

    3. At this point you are ready to reproduce the issue. Collect a screenshot of any message you might see on the screen.

    If you are not able to reproduce the issue, or debugging is not required, then you can click Skip and go to Step 7.

  7. Once the issue has been reproduced, click Stop Debug Mode and it will be turned off.

    Stop Debug mode - Case Diagnostic Tool

  8. Collect the logs.
    1. Name a folder where the logs will be saved.
    2. Select Today's logs.

      Select Today's log - Case Diagnostic Tool

    3. Write any comment you want to add, or a detailed description of the issue (if not already provided). If you have nothing to add, just write “nothing to add”.

      You need to write something here. Otherwise, you will get this error message:

      Case Diagnostic Tool error message

  9. Generate the logs.

    Generating diagnostic data - Case Diagnostic Tool


    When the application is complete, a new folder and zip file will be created in the directory you named in Step 8a.

    Diagnosis completed - Case Diagnostic Tool

  10. Click Open Folder to open the folder where the CDT report was saved.
  11. Click Finish to close the CDT.

To enable debugging:

  1. Unload the Security agent or stop the Apex One Real-Time Scan Service.
  2. Open the Registry Editor and modify the following registry keys:
     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
     
    • For 32 bit:
      • HKLM\SOFTWARE\TrendMicro\Aegis\DebugLogFlags = dword:0000000xff
      • HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration\DACPolicyDump = dword:00000001
    • For 64 bit:
      • HKLM\SOFTWARE\TrendMicro\Aegis\DebugLogFlags = dword:0000000xff
      • HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration\DACPolicyDump = dword:00000001

    This will create a file called dac_policy_dump.log, which is a DAC policy dump file under \Apex One\Misc.

  3. Close the Registry Editor.
  4. Download and extract the AEGISExpert file located in the links below:
  5. Put the extracted files in ..\Trend Micro\Apex One\.
  6. Reload the Apex One client or restart the Apex One Real-Time Scan Service.
  7. Open a command prompt and go to ..\Trend Micro\Apex One\.
  8. Execute the following command:

    AEGISExpert.exe -start -timeout=60 -query > summary.txt

    The command will collect AEGIS raw event for the next 60 seconds. Replicate the issue during this period. If 60 seconds is not enough, change the -timeout value in the command above.

  9. When AEGISExpert stops, collect the following files and send them to Trend Micro Technical Support:
    • RawEvent.log and summary.txt in ..\Trend Micro\Security Agent\
    • All files in ..\Trend Micro\BM\log\
    • All files in ..\Trend Micro\BM\Profiles\
    • dac_policy_dump.log in ..\Trend Micro\Security Agent\Misc\
    • TMBMCliyyyymmdd_nn.log in ..\TrendMicro\Security Agent\Log

To disable debugging:

  1. Open the Registry Editor and modify the following registry keys:
     
    Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
     
    • For 32 bit:
      • HKLM\SOFTWARE\TrendMicro\Aegis\DebugLogFlags = dword:00000000
      • HKLM\SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration\DACPolicyDump = dword:00000000
    • For 64 bit:
      • HKLM\SOFTWARE\TrendMicro\Aegis\DebugLogFlags = dword:00000000
      • HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration\DACPolicyDump = dword:00000000
  2. Close the Registry Editor.
  3. Restart Apex One RealTime Scan to disable debugging.