cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

HIPS Activity Log Not Updating

Jump to solution

Hello, everyone. I'm having an issue with the HIPS log not updating. I'm on Patch 11 and the issue is occuring on a Server 2012 R2 system.

 

I've tried uninstalling and reinstalling HIPS, reducing the log file size in the Client UI policy, and rebooting the systems.

 

Any suggestions? I have zero visibility into what HIPS and its firewall are doing.

1 Solution

Accepted Solutions
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: HIPS Activity Log Not Updating

Jump to solution

You might have an issue where the HIPS services aren't running  (McAfee Host Intrusion Prevention lpc Service and McAfee Host Intrusion Prevention Service; HIPS may not be active, so no logging is generated), or possibly the "C:\ProgramData\McAfee\Host Intrusion Prevention\Event.log" file is corrupt and can't be written to (this is the file represented as the Activity log).

You might try deleting that file (stop the HIPS services first), then restart the HIPS services.

 

If that doesn't work , please open a Service Request with our McAfee Support team for further investigation; please include a full debug MER file for review.

4 Replies
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: HIPS Activity Log Not Updating

Jump to solution

Do you have the logging options enabled in the Activity log?  Make sure they are all enabled.

 

screenshot.jpg

  • Traffic Logging:
    • Log all blocked
    • Log all Allowed
  • Filter Options:
    • Traffic
    • Intrusions

 

If you enable HIPS debug logging (via policy or registry), you should still see firewall traffic in the debug Firesvc.log file (although it will be more detailed than the Activity log).

Re: HIPS Activity Log Not Updating

Jump to solution

Yes, I have all boxes checked just like in your screenshot. Any ideas on how to get the Activity log to work again?

McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 4 of 5

Re: HIPS Activity Log Not Updating

Jump to solution

You might have an issue where the HIPS services aren't running  (McAfee Host Intrusion Prevention lpc Service and McAfee Host Intrusion Prevention Service; HIPS may not be active, so no logging is generated), or possibly the "C:\ProgramData\McAfee\Host Intrusion Prevention\Event.log" file is corrupt and can't be written to (this is the file represented as the Activity log).

You might try deleting that file (stop the HIPS services first), then restart the HIPS services.

 

If that doesn't work , please open a Service Request with our McAfee Support team for further investigation; please include a full debug MER file for review.

Re: HIPS Activity Log Not Updating

Jump to solution

Deleting the Event.log file and restarting the services fixed it. Thank you!

MPower Badge Now Available
Customers attending MPower can earn a community badge. Check into the MPower forum and say hi to have the badge awarded to your community profile.