Run SymDiag.exe (with administrative rights) and accept the EULA
Select Option 2: "Collect Data for Support"
Leave the check box selected for "Endpoint Protection, Client" (Check the Console if you want to gather data for On-Prem SEPM), then click next
For Data Type, please select "All data"
For Debug Logging, select "Endpoint Protection Client". The default timer is 10 minutes, however you should change the timer value to allow yourself enough time to reproduce the issue/error.
Click Advanced.. for additional configuration of WPP.
Choose Trace Level: Verbose. Click OK, and Next. Note: Advanced settings will also allow you to enable WPP Reboot Logging, to debug issues present only during startup.
Unless asked by support to not include "Data collection options for Operating System", please leave these items checked. Click next
The timer will begin to count down. In this time, please reproduce the error/issue. Once reproduction of error/issue is completed, click next and confirm the issue has been reproduced. You do not need to wait for the timer to end to proceed once the issue has been reproduced.
Allow Symdiag to complete the rest of the log captures
You can Open or Update a Support Case by Log in to My Case - Broadcom support portal or Save Diagnostic file locally