Overview of debug logging for LiveUpdate in Endpoint Protection for Mac

Products

• Endpoint Protection

Issue/Introduction

Overview of debug logging for LiveUpdate in Symantec Endpoint Protection (SEP) for Mac.

How to enable debug logging, where are the logs, how to gather them, and what to look for when troubleshooting LiveUpdate for Mac.

Environment

macOS

Resolution

Basic LiveUpdate logging in SEP for Mac is always enabled and can be found at the following location:.

• /Library/Application Support/Symantec/Silo/MES/LiveUpdate/Logs/lux.log

Extended LiveUpdate debug logging for Mac can be enabled in SEP 14 by creating/editing the lux.logging.conf file.

Location: /Library/Application Support/Symantec/Silo/MES/LiveUpdate/Conf/lux.logging.conf

Suggested steps for editing this file (some of these steps will require Administrator authentication to complete):

1. Copy the lux.logging.conf file to the desktop.
2. Edit the desktop copy of lux.logging.conf to enable debug logging:

   logger.enabled=true
   logger.level=debug
   logger.sink=file,console
   logger.sink.file.filepath=​/Library/Application Support/Symantec/Silo/MES/LiveUpdate/Logs/devlux.log
   

   Save changes.
3. Rename the original lux.logging.conf in /Library/Application Support/Symantec/Silo/MES/LiveUpdate/Conf to lux.logging.conf.old. 
4. Copy the new lux.logging.conf file from the desktop to /Library/Application Support/Symantec/Silo/MES/LiveUpdate/Conf.  Debug logging will now be enabled.
5. To disable debug logging, delete the new lux.logging.conf file and rename lux.logging.conf.old to lux.logging.conf. 

Note: lux.logging.conf parameters are case sensitive.

When enabled, separate devlux_####.log files will be generated in the same location as other LiveUpdate logs, each suffixed with the PID of the LiveUpdate process for that session.

 

These logs are best gathered by using the GatherSymantecInfo tool, which will generate a report including other useful troubleshooting information which can be provided to Symantec if a technical support case is opened.

When looking the LiveUpdate logging, check the URLs that are being used to download content. If the URLs appear correct, try them in a web browser on a different Mac (to check if there are connectivity issues affecting only one machine). See Listing of External URLs which the Symantec Endpoint Protection Manager needs access to for complete functionality. Look also in logging for exact wording of any errors, which may be used when searching in Symantec's Knowledge Base.