Create a diagnostic package and logs

To diagnose an issue, your support provider may ask you to send a diagnostic package containing debug information for either or both:

• Deep Security Manager
• Deep Security Agent

Deep Security Manager diagnostics

Create a diagnostic package for Deep Security Manager

1. Go to Administration > System Information.

2. Click Create Diagnostic Package.

   The package will take several minutes to create. After the package has been generated, a summary will be displayed and your browser will download a ZIP file containing the diagnostic package.

Enable debug logs for Deep Security Manager

In addition to a diagnostic package, your support provider may ask you to enable diagnostic logging.

Don't enable diagnostic logging unless recommended by your support provider. Diagnostic logging can consume large amounts of disk space and increase CPU usage.

1. Go to Administration > System Information.

2. Click Diagnostic Logging.

3. In the wizard that appears, select the options requested by your support provider.

   While diagnostic logging is running, Deep Security Manager will display the message "Diagnostic Logging enabled" on the status bar. If you changed the default options, the status bar will display the message "Non default logging enabled" upon diagnostic logging completion.

4. To find diagnostic logging files, go to the root directory of the Deep Security Manager, and look for file names with the pattern server#.log.

Deep Security Agent diagnostics

For an agent, you can create a diagnostic package either:

• via the Deep Security Manager
• using the CLI on a protected computer (if the Deep Security Manager cannot reach the agent remotely)

For Linux-specific information on increasing or decreasing the anti-malware debug logging for the diagnostic package, see Increase debug logging for anti-malware in protected Linux instances.

Your support provider may also ask you collect:

• a screenshot of Task Manager (Windows) or output from top(Linux)
• debug logs
• Perfmon log (Windows) or Syslog
• memory dumps (Windows) or core dumps (Linux)

Create an agent diagnostic package via Deep Security Manager

Deep Security Manager must be able to connect to an agent remotely to create a diagnostic package for it. If the Deep Security Manager cannot reach the agent remotely, or if the agent is using agent-initiated activation, you must create the diagnostic package directly from the agent.

1. Go to Computers .
2. Double-click the name of the computer you want to generate the diagnostic package for.
3. Select the Actions tab.
   
4. Under Support, click Create Diagnostics Package.
   

5. Click Next.

   The package will take several minutes to create. After the package has been generated, a summary will be displayed and your browser will download a ZIP file containing the diagnostic package.
   

Create an agent diagnostic package via CLI on a protected computer

Linux

1. Connect to the server that you want to generate the diagnostic package for.
2. Enter the command:

   sudo /opt/ds_agent/dsa_control -d

   The output shows the name and location of the diagnostic package: /var/opt/ds_agent/diag

Windows

1. Connect to the computer that you want to generate the diagnostic package for.
2. Open a command prompt as an administrator.
3. Enter these commands:

   cd C:\Program Files\Trend Micro\Deep Security Agent

   dsa_control.cmd -d

   The output shows the name and location of the diagnostic package: C:\ProgramData\Trend Micro\Deep Security Agent\diag

Collect debug logs with DebugView

On Windows computers, you can collect debug logs using DebugView software.

Only collect debug logs if your support provider asks for them. During debug logging, CPU usage will increase, which will make high CPU usage issues worse.

1. Download the DebugView utility.
2. If self-protection is enabled, disable it.
3. Stop the Trend Micro Deep Security Agent service.
4. In the C:\Windows directory, create a plain text file named ds_agent.ini.

5. In the ds_agent.ini file, add this line:

   trace=*

6. Launch DebugView.exe.
7. Go to Menu > Capture.
8. Enable these settings:
   • Capture Win32
   • Capture Kernel
   • Capture Events
9. Start the Trend Micro Deep Security Agent service.
10. Export the information in DebugView to a CSV file.
11. Re-enable self-protection if you disabled it at the beginning of this procedure.