Showing results for 
Search instead for 
Did you mean: 

Reading ELM files outside the ELM

Hi all,

We know we can use sftp to export the raw logs, however, sftp has proven to be slow and unstable, frequently crashing in the middle of bulk transfer and "ls -lR" attempts.

I was wondering: Has anyone ever managed to read the ELM files saved by the ELM outside the ELM?

2 Replies
Reliable Contributor sssyyy
Reliable Contributor
Report Inappropriate Content
Message 2 of 3

Re: Reading ELM files outside the ELM

I was told once you can download the files from the ELM and read offline. Because ELM store the raw logs as flat files.


Re: Reading ELM files outside the ELM

I'm not sure this is the case. From what I gather the .ELM files are certainly not raw files.

Yes, you can use SFTP to get the raw files but the SFTP is not a traditional SFTP server where you access files laying in a filesystem. Instead the edsftp server queries the ELM backend components to create a dynamic file list.

Sadly, the edsftp process is complete very unstable and tends to crash in the middle of large file transfers. So as long you want one of two hours of logs you are fine, but if you try to get 2 days worth of logs... good luck.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community