Modifying the default log file rotation for Sophos Management Communication System (MCS)

  • Article ID: 119609
  • Updated: 10 Oct 2014

This article details how to increase the maximum size and number of Sophos Management Communication System (MCS) log files.  Sophos Support may ask you to change the default settings to troubleshoot issues, typically in combination with increasing the log level as detailed in article 119607.

Note: The default log file rotation values for each component are 4 log files with a maximum size of 1 MB each.

Applies to the following Sophos product(s) and version(s)
Sophos Cloud

What To Do

  1. Stop the following services:
    • 'Sophos MCS Agent'
    • 'Sophos MCS Client'
  2. Locate the 'Config' directory of MCS:
    • Windows XP/2003: 'C:\Documents and Settings\All Users\Application Data\Sophos\Management Communication System\Endpoint\Config\'.
    • Windows Vista+: C:\ProgramData\Sophos\Management Communication System\Endpoint\Config\'.
  3. Open 'Config.XML' in a text editor such as Notepad.

    Note: It is recommended you first take a backup of the file 'Config.XML' before committing any changes to the current file.

  4. To configure the logging changes for the 'Sophos MCS Client' service, within the 'McsClient' tags, create the following lines as appropriate:

    Note: The value for 'logSize' is the size in megabytes.

  5. To configure the same logging changes for the 'Sophos MCS Agent' service you may need to create, if it doesn't already exist, between the main 'Configuration' tags a new section called 'McsAgent' for example:
  6. Save 'Config.xml'.
  7. Start the following services:
    • Sophos MCS Agent'
    • 'Sophos MCS Client'
  8. To confirm changing the logging configuration has been successful, locate the log files of MCS to confirm the new rotation:​
    • Windows XP/2003: 'C:\Documents and Settings\All Users\Application Data\Sophos\Management Communication System\Endpoint\Logs\'.
    • Windows Vista+: C:\ProgramData\Sophos\Management Communication System\Endpoint\Logs\'.

If you need more information or guidance, then please contact technical support.

Rate this article

Very poor Excellent