How To: Collect Logs from EMSS Endpoints (Windows, Mac, Linux)

Version 6
Created by mitchell.evans on Jun 22, 2018 9:14 AM. Last modified by derek.illum on Jan 22, 2019 1:14 PM.

    Purpose

     

    Show how to collect logs from each of the different Endpoint Operating Systems.

     

    Overview

    Increase Logging Level

    Before collecting logs you will almost certainly want to increase the logging level, see this article for instructions on how to raise the logging level for one endpoint: How to: Create a Trace Level Logging Policy for One Endpoint

    and this one to increase logging for all: How to enable TRACE-level logging for EMSS Agents

    Windows

    1. From an elevated command prompt, please navigate to: C:\Program Files\HEAT Software\EMSSAgent\live
    2. Run the following command:
    3. lmctl.exe collectlogs <agent uninstall password>
      1. If endpoint is hardened, the user will be prompted for the agent password
      2. User will be prompted for password if not entered on the command line
    4. The resulting log will be a zip file located in the C:\HEAT Software Diagnostics\computer name.
    5. For more information on lmctl.exe commands please go here: LMCTL.exe Commands

    Mac

     

    1. From a terminal, please navigate to:  /private/var/patchagent
    2. Run this command as root:
    3. ./patchservice archivelogs
    4. The resulting log will be a zip file located in the same directory you ran the command, it will be named Darwin.tar.gz

     

    Linux

     

    1. From a terminal, please navigate to:  /usr/local/patchagent
    2. Run this command as root
    3. ./patchservice archivelogs
    4. The resulting log will be a zip file located in the same directory you ran the command, it will be named Linux.tar.gz

    patchagent locations:

    The location where patchagent is stored depends on your version of linux, see below for the location for your version

     

    OSpatchagent Location

    SunOS

    /export/home/patchagent

    Linux

    /usr/local/patchagent

    Darwin

    /private/var/patchagent

    AIX

    /usr/local/patchagent

    HP-UX

    /usr/local/patchagent

    Any remainder

    /patchagent

    For more patch service commands see: Patchservice commands

     

    Additional Information

    Patchservice commands

    How to enable TRACE-level logging for EMSS Agents

    How to: Create a Trace Level Logging Policy for One Endpoint

    LMCTL.exe Commands

    Affected Products

    Ivanti Endpoint Security (IES) 8.5U1+

    Heat Endpoint Management and Security Suite (EMSS) 8.5 RTM

    Lumension Endpoint Management and Security Suite (LEMSS)