Views:

To turn on debug log in WFBS Security Server:

  1. Log on to the Security Server.
  2. Click the letter 'R' in the word "TREND".
  3. Mark Enable debug log check box.
  4. Enter the Log Filename.
  5. Click Save.

    Open Debug Log Tool

  6. You will get "You have successfully turned debug on." message. Click Close.
ModuleDebug Log location 
Security ServerSecurity Server debug log (ofcdebug.log)Refer to log Filename you specified.
Active Update%ServerFolder%\Web\Service\AU_log\Tmudump.txt
--- Advanced ---
Server side
  1. Go to ..\PCCSRV\Admin.
  2. Modify the configuration file"aucfg.ini".
  3. Copy aucfg.ini to ..
    \PCCSRV\Web\Service folder.
  4. Add
    =======
    [debug]
    level=-1
    =======
    Default is 5.
  5. Restart the Security Server Master Service.
  6. Log path C:\TM\SS\PCCSRV\Web\Service\
    AU_Data\AU_Log \ TmuDump.txt
Install/Upgrade/Uninstall%WINDIR%\Temp\WFBS_Debug folder
In addition,ofcdebug.log if LogServer
is launched separately.
Smart Scan ServerUpdate%ServerFolder%\WSS\AU.ini
%ServerFolder%\WSS\FRSVersion.ini
%ServerFolder%\WSS\UpdatePattern.ini
%ServerFolder%\WSS\service.ini
%ServerFolder%\WSS\diagnostic.log
%ServerFolder%\WSS\Access.log
%ServerFolder%\WSS\AU_Data\AU_
Log\TmuDump.txt
%ServerFolder%\WSS\spsc\log\*.log

To turn on the debug log on the Security Agent:

  1. Go to client installation folder.
  2. Find and copy the following files to root C:\:
    1. ofcdebug.ini
    2. LogServer.exe
    3. TmDbg20.dll.
  3. Modify ofcdebug.ini under root C:\
    c:\ofcdebug.ini
    [debug]
    debuglevel=9
    debuglevel_new=d
    debugSplitSize=104857600
    debugRemoveAfterSplit=0
    debugSplitPeriod=24
    RequireFreeSpace=209715200
    debuglog=c:\Ofcdebug.log
  4. Double-click LogServer.exe to run debug.
ModuleLog location 
Client LogVirus log%ClientFolder%
\misc\pccnt35.log
Clean up log%ClientFolder%\report\YYYYMMDD.log 
Connection Status%ClientFolder%\ConnLog\Conn_xxxxxxxx.log 
Login Script\Winnt\ofcNT.log 
Upgrade%ClientFolder%\temp\upgrade.log 
Smart Client%ClientFolder%\ssNotify.ini
%ClientFolder%\icrc.dat
%ClientFolder%\BF.ptn		 
ActiveupdateClient side
  1. Go %ClientFolder%.
  2. Modify the configuration file“aucfg.ini”
    Add
    =======
    [debug]
    level=-1
    =======
    Default is 5.
  3. Reload the Client
  4. Log path %ClientFolder%\AU_Data\AU_Log\TmuDump.txt
 
Client
Debug Log		Install/Upgrade/UninstallAll installation /upgrade methods:
%WINDIR%\Temp\WFBS_Debug folder
In addition, for remote install:
ofcdebug.log on the SS
Upgrade failed from WFBS
%ClientFolder%\Temp\upgrade*.log
TSC
  1. Open %ClientFolder%\tsc.ini
  2. Change the value of "DebugInfoLevel" to "3".
  3. Save the file, and then reproduce.
    Debug log will be created at:
    %ClientFolder%\Debug\ TSCDebug.log
If DebugInfoLevel=4 or 5, you have to
replace tsc.exe with tsc_qa.exe which will
be provided by engine team.
 
VSAPI%systemroot%\tmfilter.log
  • Method 1: Use setdbg.exe
  • Method 2: Change registry below:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
    services\TMFilter\Parameters\DebugLogFlags=0x3eff
 
SSAPI
  1. Add a DWORD Value in the registry:
    1. Open the Registry Editor.
    2. Go to HKLM\Software\TrendMicro\
      PC-cillinNTCorp\Current Version\Misc.\
    3. Create a DWORD (32-bit) Value with
      the following values:
      1. Name: EnableSSAPILog
      2. Value Data: 1
  2. Collect C:\SSAPI.log and c:\ofcdebug.log.
 
PFW rule table
  1. Go to %ClientFolder%\, and type "TmPfw dump".
  2. Get the log "!PfwDump.txt" under %ClientFolder%.
 
Behavior Monitoring
  1. Open the Registry Editor, and go to HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\AEGIS.
  2. Add DWORD(32-bit) and type 'DebugLogFlags' with a Hexadecimal value of 32 (e.g. DebugLogFlags REG_DWORD x00000032(50)).
  3. Reload the Security Agent.
  4. Replicate the problem.
  5. The AEGIS logs will be written to ..\Trend Micro\BM\log\*.log folder on the SA side.
  6. Collect the following logs as well:
    • TrendMicro\BM\log\*.log
    • Trend Micro\BM\Eyes\log\*.log (After 11 SP1 CP1)
    • TrendMicro\Security Agent\Log\TMBMCliyyyymmdd_nn.log
 
Firewall
  1. Open %ClientFolder%\TmPfw.ini.
  2. Modify Enable=1 under InteractiveSession and ServiceSession,
    and then reproduce the issue.
  3. Collect the following logs:
    1. C:\temp\ddmmyyyy_NSC_TmPfw.log
    2. C:\ofcdebug.log
 
POP3
mail scan
and IM		From TMAS:
  1. Open %ClientFolder%\TMAS_OL\TMAS_OL.ini,
    and then set debug=1.
  2. Open %ClientFolder%\TMAS_OE\TMAS_OE.ini,,br> and then set debug=1.
  3. Collect the Debug logs from the following locations:
    • <ProgramData>\Trend Micro\OL\Users\
      <user name>\log
    • On Windows XP, <ProgramData>=C:\Documents
      and Settings\All Users\Application Data
    • On Window Vista, <ProgramData> = c:\ProgramData\
Note: If TMAS has enable/disable problem, collect registry
in HKCU\Software\Microsoft\OEMonCtl and
HKCU\Software\Microsoft\Office\Outlook\Addins.

For TmProxy:
  1. Open %Program Files%\Trend Micro\Client Server
    Security Agent\TmProxy.ini with a text editor.
    (e.g. Notepad)
  2. Modify the entries as follows:
    [InteractiveSession] Enable=1
    [ServiceSession] Enable=1
  3. Collect C:\temp\ddmmyyyy_NSC_TmProxy.log.
 
Web Reputation
and URL Filtering
  1. Open %Program Files%\Trend Micro\Security Agent\TmOsprey.ini with a text editor. (e.g. Notepad)
  2. Modify the entries as follows:
    [InteractiveSession] Enable=1
    [ServiceSession] Enable=1
  3. Collect C:\temp\ddmmyyyy_EE_TmOsprey.etl.
  4. Use OspreyEtl2Txt tool to convert ETL file to TXT file.
    1. Unzip Tools_pwd_novirus.zip to C:\.
    2. Run command prompt as administrator.
    3. Run the following command:
      C:\OspreyEtl2Txt\[x86/x64]>TmOpEtl2txt.bat <etl filename> <SA path>
      Example:
      TmOpEtl2txt.bat 2012-05-18_EE_TmOsprey.etl C:\Program Files\Trend Micro\Security Agent
 
PLMServer side:
  1. Install: PCCSRV\PLMLog.txt
    Uninstall: %TEMP%\PLMLog.txt
    Note: This will not generate the log if PLM is
    uninstalled from Add/Remove Programs
  2. C:\ofcdebug.log
Client side:
  1. C:\ofcdebug.log
  2. tmudump
 
TMAS Toolbar
  1. Open %ClientRoot%\TMAS\TMAS_OL\TMAS_OL.ini.
  2. Change the value of "Debug" to "1".
  3. Reproduce the issue.
  4. Collect the log from the following location:
    C:\ProgramData\Trend Micro\OL\Users\
    <User mail account>\log\*.log
 

Messaging Security Agent:

ScenarioLog Location 
MSA LogInstall/Uninstall/Upgrade\\source server\%WinDir%\OFCMAS.LOG
\\source & target servers\%WinDir%\Temp\*.log
\\source & target servers\%TEMP%\*.log
\\target server\<MSA>\SMEX_DatabaseCreation.log
\\target server\<MSA>\web_server_info.ini
\\target server\<MSA>\Debug\*.log
\\GC, DC, DNS, source and target servers\Application event logs
\\GC, DC, DNS, source and target servers\System event logs
\\source and target servers\ ==> IIS Manager ==> %WinDir%\system32\LogFiles\*\*.logs
\\target server\ ==> regedit ==> HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ScanMail for Exchange\*
\\source and target servers\ ==> ipconfig /all ==> everything on the screen
Others\\source server\ ==> Turn on SS debug log, reproduce bugs, collect SS debug logs and then turn off SS debug log
\\target server\ ==> Turn on MSA debug log, reproduce bugs, collect <MSA>\Debug\*.log and then turn off MSA debug log
\\target server\<MSA>\web_server_info.ini
\\GC, DC, DNS, source and target servers\Application event logs
\\GC, DC, DNS, source and target servers\System event logs
\\source and target servers\ ==> IIS Manager ==> %WinDir%\system32\LogFiles\*\*.logs
\\target server\ ==> regedit ==> HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\ScanMail for Exchange\*
\\source and target servers\ ==> ipconfig /all ==> everything on the screen

To turn on/off debug for MSA:

  1. Log on to the Security Server.
  2. Go to Devices.
  3. Select the Messaging Security Agent.
  4. Click Configure Policy.

    MSA Configure Policy

    Click image to enlarge.

  5. A new screen appears. Go to Operations > Support/Debugger.

    MSA Debugger

    Click image to enlarge.

Turn on RM Agent debug log step:

  1. Go to the installation folder of WFRM agent (e.g C:\Program Files\Trend Micro\WFRMAgentForWFBS).
  2. Find and open the AgentLocalConfig.xml.
  3. Enable the Debug log level to ALL.

    Example:
    <DebugLogLevel>LL_FOR_ALL</DebugLogLevel>
    PS: Original level: <DebugLogLevel>LL_FOR_ERROR</DebugLogLevel>
  4. Restart the WFRM Agent Service.

Below is the WFRM Agent debug log path:

<RM Agent Installed folder>\log (e.g. C:\Program Files\Trend Micro\WFRMAgentForWFBS\log)

If LMP-RM automatic agent installation fails, follow the debug procedure below.

If RM agent fails to install automatically, collect debug log information from the server.

  1. Make sure that the following requirements are met:

    When troubleshooting Licensing Management Platform (LMP), Verify if the activation code used is issued from a valid LMP account.

    To verify the AC:
    Go to Administration > Product License. Replace the AC with an LMP WFBS issued license.

    Check AC

    Click image to enlarge.

  2. Uninstall any existing TMR agent.
  3. Turn on debug log in WFBS Security Server.
    1. Log on to the Security Server.
    2. Click the letter M under the word "TREND".

      Open Debug Log Tool

      Click the image to enlarge.

    3. Tick the Enable debug log option.
    4. Enter the log file name.
    5. Click Save.
    6. Trigger Remote Manager Agent Installation
      1. Modify the registry below.

        For x64 HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\TrendMicro
        \OfficeScan\service\PrThread Set PerformPrCheckNow (DWORD) to 1

        For x86 HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro
        \OfficeScan\service\PrThread Set PerformPrCheckNow (DWORD) to 1
      2. Refresh the Regedit page and wait for the DWORD to change to "0".
      3. Wait for a few minutes. The TMRM Agent installation process will start automatically.
    7. Disable debug.
    8. Search and submit ofcdebug.log to Trend Micro if RM agent fails to install.

TypeOSlog location
System Event LogAllC:\Windows\System32\winevt\Logs\System.evtx
Application Error2008 and aboveC:\Windows\System32\winevt\Logs\Application.evtx
BlueScreen2008 and aboveC:\WinNT\memory.dmp
C:\Windows\Mini####.dmp
IIS2008 and aboveC:\inetpub\logs\LogFiles\W3SVC1 (when using default website)
C:\inetpub\logs\LogFiles\W3SVC# (when using virtual website; check Site # of OfficeScan in IIS Manager).
Keywords: Debugging,DEBUG,Checklist,Submission Checklist,Logs,dns lookup,debug log,debug logging,debug folders,debug location,aegis debug flags,aegis debuglogflags,wfbs log,worry-free logs