1. Open Kaspersky Endpoint Security for Windows.
2. In the main application window, click Support.
3. Click System tracing.
4. In a drop-down list, select one of the options:
   • Is enabled, to enable tracing.
   • With rotation, to enable tracing and limit the number and size of trace files. Enter the maximum number of trace files and maximum size for each file.
5. Select the trace level:
   • Critical (100), logs critical errors only.
   • High (200), logs all errors including the critical ones.
   • Troubleshooting (300), logs all errors and warnings.
   • Important (400), logs all errors and warnings as well as additional information messages.
   • Normal (500), logs all errors and warnings, as well as additional information messages and normal operational data. This level is used by default.
   • Low (600), logs all available messages.

Ask a support engineer which tracing level to set. If the support engineer did not give you specific instructions about the trace level, select Normal (500).

6. Click ОК.

7. Restart Kaspersky Endpoint Security for Windows and reproduce the problem.
8. Disable tracing: In the Information for Technical Support window, select is disabled in the drop-down list. Click ОК.

Trace files will be created in the encrypted form in the %ProgramData%\Kaspersky Lab folder for versions 11.0.0–11.4.0.

To access the folder, turn on display of hidden files and folders.

1. Open Kaspersky Endpoint Security for Windows.
2. In the main application window, click Support.
3. Click Support Tools.
4. Click the Enable application traces switch.
5. In the drop-down list, select one of the options:  
   • Write to a single file, to enable tracing.
   • With rotation, to enable tracing and limit the number and size of trace files. Enter the maximum number of trace files and maximum size for each file.
6. Select the trace level:
   • Critical (100), logs critical errors only.
   • High (200), logs all errors including the critical ones.
   • Troubleshooting (300), logs all errors and warnings.
   • Important (400), logs all errors and warnings as well as additional information messages.
   • Normal (500), logs all errors and warnings, as well as additional information messages and normal operational data. This level is used by default.
   • Low (600), logs all available messages.

Ask a support engineer which tracing level to set. If the support engineer did not give you specific instructions about the trace level, select Normal (500).

7. Click Save.

8. Restart Kaspersky Endpoint Security for Windows and reproduce the problem.
9. Disable tracing: Open the Support Tools window and click the Enable application traces to switch it off. Click Save.

Trace files will be created in the encrypted form in the folder: 

• %ProgramData%\Kaspersky Lab\KES\Traces for versions 11.5.0–11.9.0;
• %ProgramData%\Kaspersky Lab\KES.<The product line number>\Traces for versions 11.10.0 and above.  

Trace files have the following format: KES.<The product line number>_<Creation date>_<Creation time>_<PID>.<Trace file type>.log.