Trace files of SVMs and Network Agent on SVMs

During SVM operation, the following trace files may be created on an SVM:

• Protection Server trace file (ScanServer.log).

  The name of the file contains the file creation date and time. In addition to general data, this file can store the following information:

  • Paths to files on protected virtual machines (may include personal data, including last name and first name, if this information is part of the path).
  • The name of the account used to log in to the operating system if the user account name is part of a file name.
  • Email address or web address containing the name of the user account and the password if this information is contained in the name of the detected object.
  • Settings for connecting SVMs to the Integration Server:
    • Password of the user account used for the connection (whether the password is recorded in trace files is controlled by the settings in the ScanServer.conf configuration file).
    • Certificate and certificate fingerprint for establishing the connection.
  • Headers and bodies of HTTP requests that are sent and received by the SVM.
  • Information about the connection of Light Agents to the SVM:
    • Unique ID of the SVM
    • Unique ID and information about the operating system of the virtual machine on which the Light Agent is installed
    • Periods when the Light Agent was connected to the SVM
    • List and status of Light Agent components
    • Information about the localization of the Light Agent
  • IP addresses of protected virtual machines
  • Contact information of the owner of the license key and other license information (may contain personal data if the contact information belongs to a specific individual).
  • Information about the anti-virus databases being used.

  You can create a ScanServer.log trace file:

  • Using the ScanServer.conf configuration file in the /etc/opt/kaspersky/la/ directory on the SVM
  • In the Protection Server policy

  To create the ScanServer.log trace file in the Protection Server policy:

  1. Enable the display of additional settings in the Protection Server policy. By default, additional settings are not displayed.
  2. Configure the trace level in the Advanced settings section of the policy and apply the change.

     We recommend clarifying the required trace level with Technical Support staff.

  The created trace file is located in the /var/log/kaspersky/la/ directory.

• boot_config.log trace file

  This file records the results of commands of the SVM first startup script.

  The boot_config.log trace file is generated automatically.

  The created trace file is located in the /var/log/kaspersky/la/ directory.

• wdserver.log trace file

  This file records information about events that occur during operation of the watchdog service (wdserver). This file contains general data.

  The wdserver.log trace file is generated automatically.

  The created trace file is located in the /var/log/kaspersky/la/ directory.

• SnmpTool.log trace file

  This file records information about events that occur during operation of the SNMP service (SnmpTool). This file contains general data.

  You can create the SnmpTool.log trace file using the SnmpTool.conf configuration file in the /etc/opt/kaspersky/la/ folder on the SVM.

  The created trace file is located in the /var/log/kaspersky/la/ directory.

• Trace file of the Kaspersky Security Center Network Agent installed on an SVM

  This file records information about events occurring during operation of the Kaspersky Security Center connectivity module. The following information can be saved in the file:

  • Protection settings of the connection between Light Agents and the Protection Server:
    • Encrypted certificate for estblishing a connection.
    • Encrypted private key.
  • Encrypted password of the account being used.
  • Settings of policies and tasks.
  • License information (may contain personal data).
  • Paths to Network Agent files.

  A special script is used to create a Network Agent trace file. Contact Technical Support representatives for details.

  The created trace file is located in the /var/log/kaspersky/la/ directory.

• SVM configuration trace files

  SVM configuration trace files: config.log, results-*.log, configure-*.log, klnagchk-*.log, klnagchk-*.trace.log.

  The config.log and results-*.log files may contain the following information about SVM configuration commands:

  • Time when the command was run
  • The command
  • Execution result
  • Command output

  The configure-*.log file may contain the results of tracing SVM configuration commands (including SVM names, the name and address of the device on which the Kaspersky Security Center Administration Server is installed).

  The klnagchk-*.log file may contain information about the execution of klnagchk commands (including SVM names, the name and address of the device on which the Kaspersky Security Center Administration Server is installed).

  The klnagchk-*.trace.log file may contain the results of tracing klnagchk commands (including SVM names, the name and address of the device on which the Kaspersky Security Center Administration Server is installed).

  Created SVM configuration trace files are located in the /var/opt/kaspersky/klconfig/ directory.

• SVM module update trace files

  SVM configuration trace files: autopatch.log, *-install.log.

  These files record information about the manual or automatic installation of module updates.

  The created trace files are located in the /var/log/kaspersky/la/ directory.

Access to trace file directories on SVMs is restricted:

• Administrator rights are required for access to the /var/log/kaspersky/la/ directory.
• Access to the /var/opt/kaspersky/klconfig directory requires administrator rights; user accounts have read-only access.

If you change the default directory for storing trace files, Kaspersky Security does not control access to trace files. We recommend protecting the information from unauthorized access.

For detailed information on how to create and configure trace files, please contact our Technical Support experts.

Page top