Required logs for troubleshooting failed Endpoint Protection 12.1 client installations

Article:TECH164067  |  Created: 2011-07-06  |  Updated: 2015-01-20  |  Article URL
Article Type
Technical Solution


This article lists the logs required for troubleshooting failed Symantec Endpoint Protection (SEP) 12.1 client installations.


The SEP install first runs the Microsoft Installer (MSI) install, and then runs the Symantec Installer Server (SIS).

Primary files to obtain

Look in the file system locations %temp% or %systemroot%\temp, which contain the following:

  • SEP_INST.log (MSI log)
  • ROLLBACK.log (if rolled back during migration)

Look in %AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\%currentversion%.105\Data\Install\logs, which contains the following:

  • SIS_INST.log (Symantec Installer Log)
  • RORU.log (uninstall log of previous product)

For rollbacks during a fresh install check SEP_INST.log and SIS_INST.log:

  • For failures in SEP_INST.log search for Value 3
  • For failures in SIS_INST.log search for "failed to execute" "returning non-success" and "ACTION_FAILED."

Other files to obtain

Look in %Program Files%\Symantec\Symantec Endpoint Protection\<latest-version>\Scripts for the following:

  • All files (e.g., install script, rollback script, etc.)

Look in %AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\<latest-version>\Data\Scripts\ for the following:

  • All files (e.g., install script, rollback script, etc.)

Additional logs


    Note: This log used to be located in C:\Windows but it is now located at C:\Windows\INF.

Setupapi.log files contain information about teefer, and will reveal problems if teefer fails to load. Teefer is considered a hardware driver.

You can also run SymHelp, which automatically collects most of these files.


Article URL

Terms of use for this information are found in Legal Notices