Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Working with Host Intrusion Prevention Clients
Overview of the Windows client
Troubleshooting the Windows client
Host Intrusion Prevention includes a Troubleshooting option on the Help menu, which is
available when the interface is unlocked. Options include enabling IPS and firewall logging and
disabling system engines.
Figure 37: Troubleshooting Options
NOTE:
McAfee provides a utility (ClientControl.exe) to help automate upgrades and other maintenance
tasks when third-party software is used for deploying Host Intrusion Prevention on client
computers. This command-line utility, which can be included in installation and maintenance
scripts to temporarily disable IPS protection and activate logging functions, is available from
the McAfee.com product download site. Refer to the documentation that accompanies the utility
for directions on usage, including details on parameters and security
Setting options for IPS logging
As part of troubleshooting you can create IPS activity logs that can be analyzed on the system
or sent to McAfee support to help resolve problems. Use this task to enable IPS logging.
Task
1 Select the IPS Enable Logging checkbox.
2 Select the message type (All or a combination of Information, Warning, Debug, Error,
Security Violations). At a minimum, you must select Error and Security Violations.
3 Click OK. The information is written to C:\Documents and Settings\All Users\Application
Data\McAfee\Host Intrusion Prevention\HipShield.log; on Windows Vista: C:\Program
Data\McAfee\Host Intrusion Prevention\HipShield.log. After the file reaches 100 MB, a new
file is created.
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
89