Skip to main content

Collect Endpoint Agent diagnostic logs

If a managed endpoint encounters issues with the Malwarebytes Endpoint Agent, you may need to collect diagnostic logs for investigation, or to submit them to our Support team for troubleshooting the issue.  This article explains how to generate diagnostic logs via the Nebula console, and how to manually collect them from an endpoint.

Generate endpoint agent diagnostic logs using one of the following methods:

Generate Diagnostic Logs from the Nebula console

Logs can be collected from the console for Windows, Mac, Linux, iOS, Android, and ChromeOS devices.

  1. On the left navigation menu, go to Manage > Endpoints.
  2. Check the box for one or more endpoints.
  3. Click Actions > Generate Diagnostic Logs. This task may take a few minutes to complete. You can check the task status on the Tasks page.
  4. When the task is successful, click the name of the endpoint(s) to view the Endpoint Details page.
  5. At the top-right corner of the Endpoint Details page, click the Diagnostic Logs Available icon 2021-01-04_11-36-33.png to download the Diagnostic Logs zip folder to your local machine.
    Note: Logs are available to download from the console for 72 hours.

Watch the video below to see how to generate diagnostic logs from the Nebula console.

If you cannot generate diagnostic logs within Nebula, follow one of the manual collection steps below.

Manually collect Windows endpoint logs

Logs for Windows operating systems can be generated either from the task bar icon or from Windows command line.

Generate logs from task bar icon

  1. Reproduce the issue so the Malwarebytes Endpoint Agent can run and generate new data.
  2. Locate the Malwarebytes icon in the task bar tray.
  3. Hover over the icon, hold CTRL and right-click. Select Generate Diagnostic Logs.
    DOC-1818-1.png
  4. A log collection start message displays. Click Ok.
  5. The log collection process takes a few minutes to run. When it completes, the file MBDiagnostics.zip saves to the desktop. Send the file to Malwarebytes Support.
    DOC-1818-2.png

Generate logs from command line

  1. Reproduce the issue so the Malwarebytes Endpoint Agent can run and generate new data.
  2. Open Command Prompt as an administrator.
  3. Run the following command: 
    • "C:\Program Files\Malwarebytes Endpoint Agent\Useragent\EACmd.exe" -diag
      mceclip0.png
  4. The log collection process takes a few minutes to run. When it completes, the file MachineName_Diag_YYYY_MM_DD_HH_MM_SS.zip saves to the desktop. Send the file to Malwarebytes Support.
    • To specify the output folder, use the following command:
      • "C:\Program Files\Malwarebytes Endpoint Agent\Useragent\EACmd.exe" -diag --output=VALUE

Unresponsive log collection

If Malwarebytes is unresponsive to generating logs using Windows command line, then follow the steps below:  

    1. Reboot the endpoint. 
    2. If the Malwarebytes Agent starts, repeat the process to generate logs from task bar icon or using Windows command line.
      • Check the Malwarebytes Agent service by running the following Windows command:
        • SC query MBEndpointAgent
    3. Copy the contents of the folders below:
      • %PROGRAMDATA%\Malwarebytes Endpoint Agent\logs\*.*
      • %PROGRAMDATA%\Malwarebytes\MBAMService\logs\*.*
      • %PROGRAMDATA%\Malwarebytes\MBAMService\config\*.*
      • %APPDATA%\Local\Temp\MSIxx.log
      • Include this folder if running Endpoint Detection and Response
        • %PROGRAMDATA%\Malwarebytes Endpoint Agent\Plugins\EDRPlugin\Database\*.*
    4. Zip the collected information and submit to Malwarebytes support. 

Manually collect Mac endpoint logs

Mac Endpoint Agents do not support command line log generation. Follow the steps below to generate logs from the Malwarebytes menu bar icon. You can also manually locate the log files.

Generate logs from the Malwarebytes menu bar icon

  1. Reproduce the issue so the Malwarebytes Endpoint Agent can run and generate new data.
  2. Locate the Malwarebytes icon in the menu bar.
  3. Right-click on the Malwarebytes icon (or hold the Control key and left-click) and select Generate Diagnostic Logs.
    DOC-1818-5.JPG
  4. After the above commands execute, the file Diagnostic_info-?.zip is created and saved to:
    • /Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/Diagnostics
  5. Attach this folder to your email reply to Malwarebytes Support.

Manually locate log files

  1. Press Shift-Command-G and enter these file paths:
    • /var/log/com.malwarebytes.EndpointAgent.log
    • /var/log/install.log
  2. Save both files to your desktop.
  3. If this computer has Malwarebytes Endpoint Agent v1.1 or older installed, enter this path:
    • '/Library/Application Support/Malwarebytes/NebulaAgent'
  4. Double-click the Data folder.
  5. Save the settings.dat file to your desktop.
  6. Press Return.
  7. Send the logs you saved to your desktop to Malwarebytes Support as an email attachment.

Manually collect Linux logs

Logs for Linux operating systems can be generated through Command Line Interface. 

Generate logs from command line

  1. Reproduce the issue so the Malwarebytes Endpoint Agent can run and generate new data.
  2. Enter the command in your Linux Command Line Interface
    • mblinux diag
  3. The log collection process takes a few minutes to run. When it completes, the file MBDiagnostics.tar.gz will be located in your same directory.
  4. Send the file to Malwarebytes Support.

Collect log files manually from the following locations: 

  • /var/log/mbdaemon.log
  • /var/log/mblinux.log
  • /var/log/com.malwarebytes.edr.log
  • /var/lib/dkms/mbedr_drv/1.x.xx/build/make.log

Manually collect iOS, Android, and ChromeOS logs

Logs for mobile endpoints can be collected from the help screen. 

  1. Launch the Mobile Security for Business app on the mobile device.
  2. In the top-right, tap the Help icon.
  3. Tap Export diagnostic data.
  4. Select a location to export the logs and provide it to support. 

Enable debug logging

You can enable debug logging on the Malwarebytes Endpoint Agent to collect diagnostic logs. Windows,  Mac, and Linux endpoints support debug logging, which is enabled either from the Windows tray icon, Mac menu bar icon, or the command line.

For more information, see Enable debug logging on the Malwarebytes Endpoint Agent.

Related articles