Primary logs used for monitoring Endpoint Protection Manager and clients

Products

• Endpoint Protection

Issue/Introduction

You plan to monitor important Symantec Endpoint Protection (SEP) log files as a preventative measure, and want to know which logs to watch for both the Symantec Endpoint Protection Manager (SEPM) and SEP clients.

Environment

Release : 14.x

Resolution

SEP client primary logs

• syslog.log - Primary SEP log
  
  %programdata%\Symantec\Symantec Endpoint Protection\CurrentVersion\Data\Logs
  
  
• CVE.Log - Client communication logs
  
  %programdata%\Symantec\Symantec Endpoint Protection\current version\Data\Logs

SEPM primary logs

• scm-server-*.log - Primary SEPM log
  
  %Program Files%\Symantec\Symantec Endpoint Protection Manager\Tomcat\Logs
  
  
• Error.log - HTTP Apache Server Logs
  
  %Program Files%\Symantec\Symantec Endpoint Protection Manager\Apache\Logs
  
  
• Access.log - HTTP Apache Server Logs
  
  %Program Files%\Symantec\Symantec Endpoint Protection Manager\Apache\Logs
  
  
• Reporting.log - Documents SEPM Reporting task to the SQL database
  
  %Program Files%\Symantec\Symantec Endpoint Protection Manager\Apache\Logs