Capturing SPE, CSAPI and Stargate logs for Protection Engine 8.2 or later on Windows

Products

• Protection Engine for NAS
• Protection Engine for Cloud Services

Issue/Introduction

Procedure to configure logging parameters in Symantec Protection Engine environment to capture Stargate, CSAPI and SPE required for troubleshooting of any issue. 

Resolution

The following steps assume that SPE is currently using the default configuration for logging levels. The default levels of logging for each component are optimal for most production environments and will not record a log entry when SPE returns a verdict of CLEAN for a file. For tracing through reproductions, SPE logging should be set to VERBOSE level.
 

1. Stop SPE service
2. Enable VERBOSE logging
3. Start SPE service
4. Use symdiag to collect CSAPI and WPP logs (which contain Stargate logs) - see below for detailed steps
5. Stop SPE service
6. Disable VERBOSE logging
7. Start SPE service

 

To stop SPE service

• Do one of the following
  • At the Administrator cmd prompt, type:
    net stop SYMCScan
    
    
  • Within the Windows service.cpl control panel, right click on Symantec Protection Engine Service, then click Stop

 

To enable VERBOSE SPE logging

• For steps, see: https://knowledge.broadcom.com/external/article/159007

 

To start SPE service

• Do one of the following
  • At the Administrator cmd prompt, type:
    net start SYMCScan
    
    
  • Within the Windows service.cpl control panel, right click on Symantec Protection Engine Service, then click Start

 

 

To use symdiag to collect CSAPI and WPP(Stargate) logs on Windows

1. After downloading symdiag, execute symdiag.
2. To confirm symdiag version is higher than 2.1.314.11248, click Help > About. If version is lower then 2.1.314, download a new copy of symdiag.
3. Click the button "Collect Data for Support".
4. On the "1 Select Products" tab, check "Protection Engine" on the right pane if it is not already selected. Click Next.
5. On the "2 Select Data Type" tab, click the "All data" radio button. Below "Debug Logging", check "Protection Engine" if it is not already selected.
6. For recording a complex reproduction, set "How long would you like debug log gathering to run?" to twice as many minutes as the longest interval between reproductions.
7. Click Advanced. On the PE tab, click the dropdown box next to Trace level. Click VERBOSE. Click OK. 
8. Click Next.
9. On the tab "3 Additional Options", click Next.
10. On the tab "4 Reproduce Your Issue", if support requested procmon or wireshark logs, start procmon or wireshark recording as requested.
11. Reproduce the issue.
12. If you are also recording with procmon or wireshark, stop recording within procmon or wireshark.
13. Click Next.
14. To confirm you completed reproduction, click "Yes" in the dialog box which appears.
15. On the tab "5 Collect", wait for symdiag to collect the evidence into an .sdbz archive file. When the Next button appears, click Next.
16. On the tab "6 Attach to case", click the radio button "Save deiagnostic file locally". Click Next.
17. Fill in the data for the Customer Information form. Click Save.
18. Perform any file transfer within your organization to place the .sdbz file on a machine which can upload the file to the csae within the BROADCOM support portal.

 

 

Additional Information

Wrong platform?

For collecting SPE VERBOSE logs, CSAPI debug logs, and Stargate VERBOSE logs on Linux, see:

https://knowledge.broadcom.com/external/article/164895/how-to-enable-csapi-debug-logging-in-pro.html