How do I retrieve MetaDefender Endpoint logs?

OPTION 1: Collect logs directly from the MetaDefender Endpoint device

Automatic Collection

Windows (Persistent MetaDefender Endpoint)

1. Download OPSWAT’s Log Collector tool, Here.
2. Extract and run the downloaded file.
3. The zipped log file, which may be very large, will automatically be placed on your desktop, to be forwarded to the OPSWAT team.

macOS (Persistent MetaDefender Endpoint)

1. Download OPSWAT’s Log Collector tool, Here.
2. Extract and run the downloaded file.
3. The zipped log file, which may be very large, will automatically be placed on your desktop, to be forwarded to the OPSWAT team.

Manual Collection

Windows (Persistent MetaDefender Endpoint)

1. Go to the relevant locations below to collect the required logs from File Explorer:

• Client logs:

  • Type %ProgramData% \OPSWAT\Gears\logs\ into the path bar and hit Enter

• Crash dumps:

  • Type %ProgramData% \OPSWAT\Gears\logs\reports into the path bar and hit Enter

• SDK logs:

  • Type %ProgramData% \OPSWAT\Gears\sdk into the path bar and hit Enter

• OPG (verification file) logs:

  • Type %HOMEPATH% \AppData\Local\OPSWAT\Gears\logs into the path bar and hit Enter

2. Copy the required logs, to be compressed (if necessary) and forward to the OPSWAT team.

Windows (On-Demand MetaDefender Endpoint)

1. Go to the relevant locations below to collect the required logs:

• Client logs:

  • Go to the folder where the MetaDefender Endpoint executable file is located
  • Collect the file named gears-ondemand.log

• Crash dumps:

  • Type %HOMEPATH% \AppData\Local\CrashDump into the path bar and hit Enter

If the On-demand MetaDefender Endpoint is triggered by third-party vendors, go to the relevant locations below to collect the required logs:

• Pulse Secure Host Checker:

  • Type %AppData% \Pulse Secure\Host Checker\policy_## into the path bar and hit Enter (for example: C:\Users\bob\AppData\Roaming\Pulse Secure\Host Checker\policy_1)

• Omnissa (VMware) Horizon Client:

  • Depending on the version oh Horizon Client in use, both the On-Demand MetaDefender Endpoint executable file and the log file can be found in one of the locations below:
    • C:\Users<username>\AppData\Local\VMware Horizon View Client\Code Cache<uuid>\
    • C:\Program Files (x86)\VMWare\VMware Horizon View Client\Code Cache<uuid>\

2. Copy the required logs, to be compressed (if necessary) and forward to the OPSWAT team.

macOS (Persistent MetaDefender Endpoint)

1. Open Finder and go to /Library/Logs/Gears/logs, as illustrated in the screenshot below:

2. Copy the required logs, to be compressed (if necessary) and forward to the OPSWAT team.

macOS (On-Demand MetaDefender Endpoint)

1. Go to the relevant locations below to collect the required logs:

• Client logs:

  • For MetaDefender Endpoint version 10.5.218.0 or earlier, go to /Desktop/gears-ondemand.log
  • For MetaDefender Endpoint version 10.5.222.0 or later, go to /Users/{username}/Library/Logs/Gears/logs

• Crash dumps:

  • Open Finder and go to /Library/Logs/DiagnosticReports

When running the macOS On-Demand MetaDefender Endpoint as Root, go to the locations below to collect the required logs:

• MetaDefender Endpoint logs:

  • Go to /var/root/Desktop/gears-ondemand.log

• Additional malware logs:

  • Go to /Library/Logs/Gears/logs/Metascan-Client-V2.log

2. Copy the required logs, to be compressed (if necessary) and forward to the OPSWAT team.

Linux V4 (Version 15.x.y.z)

1. Go to the location below to collect the required log:

• Client logs:
  • Go to /var/log/opswatclient

2. Copy the required log, to be compressed (if necessary) and forward to the OPSWAT team.

Linux V3 (Version 14.0.x.y)

1. Go to the relevant locations below to collect the required logs:

• Client logs:

  • Go to /var/log/gears/log

• Error logs:

  • Go to /var/log/gears.err

• Configuration logs:

  • Go to /etc/gears/gears.json

2. Copy the required logs, to be compressed (if necessary) and forward to the OPSWAT team.

Android/iOS

On mobile devices, logs are stored in memory, but can be emailed directly from the OPSWAT Mobile App by selecting the Report a Bug option.

OPTION 2: Retrieve logs remotely via the My OPSWAT Central Management Console

As a My OPSWAT Central Management account administrator, follow the steps below:

1. Log into the My OPSWAT Central Management Console and navigate to Inventory>Devices.
2. Use the Search field to locate the relevant MetaDefender Endpoint device.
3. Click on the chosen device, then access the Select Action drop-down menu in the top right-hand corner of the screen, directly under your username.
4. Select the Fetch log option, as illustrated in the screenshot below.

5. To view the log you fetched: Go to Inventory>Devices>selected device>Events>Device Logs, as illustrated below.