What logs do I need to gather in order to troubleshoot a failed SEP 12.1 client installation?

Article:TECH164067  |  Created: 2011-07-06  |  Updated: 2013-06-25  |  Article URL http://www.symantec.com/docs/TECH164067
Article Type
Technical Solution


What logs do I need to gather in order to troubleshoot a failed Symantec Endpoint Protection (SEP) 12.1 client installation?


The SEP install first runs the Microsoft Installer (MSI) install, and then runs the Symantec Installer Server (SIS).

Files to obtain when troubleshooting a failed client install:

Look in the following file system locations: %temp% or %systemroot%\temp

  • Contains SEP_INST.log (MSI log) 
  • Contains ROLLBACK.log (if rolled back during migration)

%AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\%currentversion%.105\Data\Install\logs

  • Contains SIS_INST.log (Symantec Installer Log)
  • Contains RORU.log (uninstall log of previous product)

For rollbacks during a fresh install check SEP_INST.log and SIS_INST.log

  • For failures in SEP_INST.log search for Value 3
  • For failures in SIS_INST.log search for "failed to execute" "returning non-success" and "ACTION_FAILED."

Other files to obtain when troubleshooting failed client install

%Program Files%\Symantec\Symantec Endpoint Protection\<latest-version>\Scripts

  • All files (e.g., install script, rollback script, etc.)

%AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\<latest-version>\Data\Scripts\

  • All files (e.g., install script, rollback script, etc.)

Further logs:

    • Important: This log used to be located in C:\Windows\ but it is now located here: C:\Windows\INF

Setupapi.log files contain information about teefer, and will reveal problems if teefer fails to load.  Teefer is considered a hardware driver.


Note: Many of these logs are collected automatically when the tool SymHelp is run.


Article URL http://www.symantec.com/docs/TECH164067

Terms of use for this information are found in Legal Notices