To turn on debug log in WFBS Security Server:
- Log on to the Security Server.
- Click the letter 'R' in the word "TREND".
- Mark Enable debug log check box.
- Enter the Log Filename.
- Click Save.
- You will get "You have successfully turned debug on." message. Click Close.
Module | Debug Log location | |
---|---|---|
Security Server | Security Server debug log (ofcdebug.log) | Refer to log Filename you specified. |
Active Update | %ServerFolder%\Web\Service\AU_log\Tmudump.txt --- Advanced --- Server side
| |
Install/Upgrade/Uninstall | %WINDIR%\Temp\WFBS_Debug folder In addition,ofcdebug.log if LogServer is launched separately. | |
Smart Scan Server | Update | %ServerFolder%\WSS\AU.ini %ServerFolder%\WSS\FRSVersion.ini %ServerFolder%\WSS\UpdatePattern.ini %ServerFolder%\WSS\service.ini %ServerFolder%\WSS\diagnostic.log %ServerFolder%\WSS\Access.log %ServerFolder%\WSS\AU_Data\AU_ Log\TmuDump.txt %ServerFolder%\WSS\spsc\log\*.log |
To turn on the debug log on the Security Agent:
- Go to client installation folder.
- Find and copy the following files to root C:\:
- ofcdebug.ini
- LogServer.exe
- TmDbg20.dll.
- Modify ofcdebug.ini under root C:\
c:\ofcdebug.ini[debug]
debuglevel=9
debuglevel_new=d
debugSplitSize=104857600
debugRemoveAfterSplit=0
debugSplitPeriod=24
RequireFreeSpace=209715200
debuglog=c:\Ofcdebug.log - Double-click LogServer.exe to run debug.
Module | Log location | |
---|---|---|
Client Log | Virus log | %ClientFolder% \misc\pccnt35.log |
Clean up log | %ClientFolder%\report\YYYYMMDD.log | |
Connection Status | %ClientFolder%\ConnLog\Conn_xxxxxxxx.log | |
Login Script | \Winnt\ofcNT.log | |
Upgrade | %ClientFolder%\temp\upgrade.log | |
Smart Client | %ClientFolder%\ssNotify.ini %ClientFolder%\icrc.dat %ClientFolder%\BF.ptn | |
Activeupdate | Client side
| |
Client Debug Log | Install/Upgrade/Uninstall | All installation /upgrade methods: %WINDIR%\Temp\WFBS_Debug folder In addition, for remote install: ofcdebug.log on the SS Upgrade failed from WFBS %ClientFolder%\Temp\upgrade*.log |
TSC |
If DebugInfoLevel=4 or 5, you have to
replace tsc.exe with tsc_qa.exe which will be provided by engine team. | |
VSAPI | %systemroot%\tmfilter.log
| |
SSAPI |
| |
PFW rule table |
| |
Behavior Monitoring |
| |
Firewall |
| |
POP3 mail scan and IM | From TMAS:
Note: If TMAS has enable/disable problem, collect registry
in HKCU\Software\Microsoft\OEMonCtl and HKCU\Software\Microsoft\Office\Outlook\Addins. For TmProxy:
| |
Web Reputation and URL Filtering |
| |
PLM | Server side:
Client side:
| |
TMAS Toolbar |
|
Messaging Security Agent:
Scenario | Log Location | |
---|---|---|
MSA Log | Install/Uninstall/Upgrade | \\source server\%WinDir%\OFCMAS.LOG |
\\source & target servers\%WinDir%\Temp\*.log | ||
\\source & target servers\%TEMP%\*.log | ||
\\target server\<MSA>\SMEX_DatabaseCreation.log | ||
\\target server\<MSA>\web_server_info.ini | ||
\\target server\<MSA>\Debug\*.log | ||
\\GC, DC, DNS, source and target servers\Application event logs | ||
\\GC, DC, DNS, source and target servers\System event logs | ||
\\source and target servers\ ==> IIS Manager ==> %WinDir%\system32\LogFiles\*\*.logs | ||
\\target server\ ==> regedit ==> HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ScanMail for Exchange\* | ||
\\source and target servers\ ==> ipconfig /all ==> everything on the screen | ||
Others | \\source server\ ==> Turn on SS debug log, reproduce bugs, collect SS debug logs and then turn off SS debug log | |
\\target server\ ==> Turn on MSA debug log, reproduce bugs, collect <MSA>\Debug\*.log and then turn off MSA debug log | ||
\\target server\<MSA>\web_server_info.ini | ||
\\GC, DC, DNS, source and target servers\Application event logs | ||
\\GC, DC, DNS, source and target servers\System event logs | ||
\\source and target servers\ ==> IIS Manager ==> %WinDir%\system32\LogFiles\*\*.logs | ||
\\target server\ ==> regedit ==> HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ScanMail for Exchange\* | ||
\\source and target servers\ ==> ipconfig /all ==> everything on the screen |
Turn on RM Agent debug log step:
- Go to the installation folder of WFRM agent (e.g C:\Program Files\Trend Micro\WFRMAgentForWFBS).
- Find and open the AgentLocalConfig.xml.
- Enable the Debug log level to ALL.
Example:<DebugLogLevel>LL_FOR_ALL</DebugLogLevel>
PS: Original level: <DebugLogLevel>LL_FOR_ERROR</DebugLogLevel> - Restart the WFRM Agent Service.
Below is the WFRM Agent debug log path:
If LMP-RM automatic agent installation fails, follow the debug procedure below.
If RM agent fails to install automatically, collect debug log information from the server.
- Make sure that the following requirements are met:
When troubleshooting Licensing Management Platform (LMP), Verify if the activation code used is issued from a valid LMP account.
To verify the AC:
Go to Administration > Product License. Replace the AC with an LMP WFBS issued license.Click image to enlarge.
- Uninstall any existing TMR agent.
- Turn on debug log in WFBS Security Server.
- Log on to the Security Server.
- Click the letter M under the word "TREND".
Click the image to enlarge.
- Tick the Enable debug log option.
- Enter the log file name.
- Click Save.
- Trigger Remote Manager Agent Installation
- Modify the registry below.
For x64 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro
\OfficeScan\service\PrThread Set PerformPrCheckNow (DWORD) to 1
For x86 HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro
\OfficeScan\service\PrThread Set PerformPrCheckNow (DWORD) to 1 - Refresh the Regedit page and wait for the DWORD to change to "0".
- Wait for a few minutes. The TMRM Agent installation process will start automatically.
- Modify the registry below.
- Disable debug.
- Search and submit ofcdebug.log to Trend Micro if RM agent fails to install.
Type | OS | log location |
---|---|---|
System Event Log | All | C:\Windows\System32\winevt\Logs\System.evtx |
Application Error | 2008 and above | C:\Windows\System32\winevt\Logs\Application.evtx |
BlueScreen | 2008 and above | C:\WinNT\memory.dmp C:\Windows\Mini####.dmp |
IIS | 2008 and above | C:\inetpub\logs\LogFiles\W3SVC1 (when using default website) C:\inetpub\logs\LogFiles\W3SVC# (when using virtual website; check Site # of OfficeScan in IIS Manager). |