You need to know how to interpret AV log files for Symantec Endpoint Protection (SEP).
This article applies only to the AV logs on SEP Windows and Linux clients. The SEP Mac client uses a different log format. The recommended method for viewing these files is with the SEP client GUI, or the SEPM. The Linux client does not yet have a log viewer GUI. The AV logs folder contains a series of log files, one file for each day of log entries. The files are named MMDDYYYY.log, where MMDDYYYY indicates the date of the log entries.
Each comma-delimited log file is a plain text file that can be viewed in Notepad or Excel.
AV logs are stored in the following locations, depending on the version and operating system:
Path - C:\ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\AV
Windows XP/Windows 2003 - \Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Logs\AV
Other Windows - \ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\AV
Windows XP /Windows 2003- \Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Logs\AV
Other Windows - \ProgramData\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\AV
\Documents and Settings\All Users\Application Data\Symantec\Symantec Endpoint Protection\Logs\AV
When opening AV log files in Excel, the attached macro-enabled workbook can be used to insert column headers that indicate what each of the columns are, and convert much of the raw fields into human-readable terms.
To run the macro against AV log files:
Note: You may need to enable macros in Excel for this to work. For more information on running macros, see Run a macro on support.office.com.