Apex One enables debug logging at an error level by default.

• On the Apex One server, the logs created by this process will be created in the \Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Log folder.
• On the Apex One endpoint, the logs created by this process will be created in the \Program Files (x86)\Trend Micro\OfficeScan Client\Temp\LogServer\Log folder.

To enable Debug level logging on the Apex One endpoint:

1. Copy the contents of the C:\Program Files (x86)\Trend Micro\OfficeScan Client\Temp\LogServer\ (upgrade) or C:\Program Files (x86)\Trend Micro\Security Agent\Temp\LogServer\ (fresh install) excluding the Log folder, to a new folder on the machine.

   For example: to C:\temp\LogServer

   The files can also be found on the Apex One Server at \Program Files (x86)\Trend Micro\Apex One\PCCSRV\Private\LogServer folder.

2. Edit the ofcdebug.ini file now located in the new folder you copied to in the previous step.

   For example: C:\temp\LogServer\ofcdebug.ini

   1. Change DebugLog=.\Log\ofcdebug.log to "DebugLog=.\ofcdebug.log". (if you create a Log sub-folder in the folder where you moved the files to store the logs instead, this step can be skipped).
   2. Change debugLevel_new=E to "debugLevel_new=D".

   3. Change ForceStopOtherLogserver=0 to "ForceStopOtherLogserver=1".

      • If larger logs are desired, you can edit the debugSplitSize line. The default is 10 MB before splitting and zipping the old file.
      • By default, DebugMaxSplit=100, this limits the total number of split logs to 100 files.
   4. Save the file.

3. Run LogServer.exe as Admin.

   • You will now see the ofcdebug.log file created in the same folder.
   • When the file rolls-over, it will compress the old file with a .7z and start a new ofcdebug.log.
4. Reproduce the issue.
5. Close the LogServer.exe window to stop the debug log.
6. Delete the files copied from Step 1, without deleting any of the log or 7z files.
7. Collect all files starting with ofcdebug.log (including those ended in .7z) to analyze from either the same folder as Logserver.exe or the Log sub-folder (depending on the configuration chosen on step 2a).

To enable Debug level logging on the Apex One Server:

1. Copy the contents of the \Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Private\LogServer or \Program Files (x86)\Trend Micro\Apex One\PCCSRV\Private\LogServer folder (depends on whether the server was an upgrade from OfficeScan or an Apex One fresh install) to a new folder on the machine.

   For example: to C:\temp\LogServer

2. Edit the ofcdebug.ini file now located in the new folder you copied to in the previous step.

   For example: C:\temp\LogServer\ofcdebug.ini

   1. Change DebugLog= C:\Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Log\ofcdebug.log to "DebugLog=.\ofcdebug.log".
   2. Change debugLevel_new=I to "debugLevel_new=D".
   3. Change ForceStopOtherLogserver=0 to "ForceStopOtherLogserver=1".
      • If larger logs are desired, you can edit the debugSplitSize line. Default is 10 MB before splitting and zipping the old file.
      • By default DebugMaxSplit=500, this limits the total number of split logs to 500 files.
   4. Save the file.
3. Run LogServer.exe as Admin.
   • You will now see the ofcdebug.log file created in the same folder.
   • When the file rolls-over, it will compress the old file with a .7z and start a new ofcdebug.log.
4. Reproduce the issue.
5. Close the LogServer.exe window to stop the debug log.
6. Delete the files copied from \Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Private\LogServer.
7. Collect all files starting with ofcdebug.log (including those ended in .7z) to analyze or provide to Trend Micro Technical Support.

The ofcdebug.log can consume large disk space under \Trend Micro\Apex One\PCCSRV\Log\. If this occurs, check the debug level was set to "Debug".

To prevent the ofcdebug to consume large disk space, do the following:

1. Log on to the web console.
2. On the banner of the web console, click T in "Trend Micro Apex One".

   

3. Select "Error" for the Debug Level.
4. Click Save.