Configuring the logging level of Sophos Management Communication System

  • Article ID: 119607
  • Rating:
  • 2 customers rated this article 5.5 out of 6
  • Updated: 01 Jun 2015

This article details how to configure the level of logging for Sophos Management Communication System (MCS).  Enabling a custom level of logging may be request by Sophos Support to troubleshoot issues. 

Applies to the following Sophos product(s) and version(s)
UTM Managed Endpoint (Windows 2000+)
Sophos Cloud

What To Do

  1. Stop the following services:
    • 'Sophos MCS Agent'
    • 'Sophos MCS Client'
  2. Locate the 'Config' directory of MCS:
    • Windows XP/2003: 'C:\Documents and Settings\All Users\Application Data\Sophos\Management Communication System\Endpoint\Config\'.
    • Windows Vista+: C:\ProgramData\Sophos\Management Communication System\Endpoint\Config\'.
  3. Open 'Config.XML' in a text editor such as Notepad.

    Note: It is recommended you first take a backup of the file 'Config.XML' before committing any changes to the current file.

  4. To configure logging for the 'Sophos MCS Client' service, within the 'McsClient' tags, create a new line:

    Note: The possible values for 'logLevel' are as follows:
    0 = trace
    1 = debug
    2 = information
    3 = warning
    4 = error
    5 = fatal

    Minimum: 0
    Maximum: 5
    Default: 2 (information)

  5. To configure logging for the 'Sophos MCS Agent' service you may need to create, if it doesn't already exist, between the main 'Configuration' tags a new section called 'McsAgent' for example:
  6. Save 'Config.xml'.
  7. Start the following services:
    • Sophos MCS Agent'
    • 'Sophos MCS Client'
  8. To confirm changing the log level has been successful, locate the log files of MCS:​
    • Windows XP/2003: 'C:\Documents and Settings\All Users\Application Data\Sophos\Management Communication System\Endpoint\Logs\'.
    • Windows Vista+: C:\ProgramData\Sophos\Management Communication System\Endpoint\Logs\'.
  9. Open either "McsAgent.log' and/or McsClient.log' in a text editor depending on which component logging was enabled for. 
  10. The level of logging can be identified in the third column before the message as either 'TRACE', 'WARN', 'DEBUG', 'INFO', etc..
Important: It is strongly recommended that the log level is returned back to the original value once troubleshooting is completed.

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent