Where are Application and Device Control logs stored on a Symantec Endpoint Protection (SEP) client?

Products

• Endpoint Protection

Issue/Introduction

How to find the Application and Device Control (ADC) logs on a Symantec Endpoint Protection (SEP) client.

Cause

The Application and Device Control logs may be useful to troubleshoot policy configuration by the user, or sent to Symantec Technical Support for analysis.

Resolution

The log events are viewable in the SEP interface in View logs -> Client Management -> View Logs -> Control Log

The events are stored in processlog.log.  The location of the log varies depending on SEP and OS version.

• C:\Program Files\Symantec\Symantec Endpoint Protection\
• C:\Program Data\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs\

It is also possible to examine the ADC events from managed SEP clients in the Symantec Endpoint Protection Manager (SEPM) console.