This article lists the logs required for troubleshooting failed Symantec Endpoint Protection (SEP) 14.x client installations.

The SEP install first runs the Microsoft Installer (MSI) install, and then runs the Symantec Installer Server (SIS).

Primary files to obtain

Look in the file system locations %temp% or %systemroot%\temp, which contain the following:

• SEP_INST.log (MSI log)
• ROLLBACK.log (if rolled back during migration)

Look in C:\ProgramData\Symantec\Symantec Endpoint Protection\14.X.XXX.XXXX\Data\Install\Logs, which contains the following:

• SIS_INST.log (Symantec Installer Log)
• RORU.log (uninstall log of previous product)

For rollbacks during a fresh install check SEP_INST.log and SIS_INST.log:

• For failures in SEP_INST.log search for Value 3
• For failures in SIS_INST.log search for "failed to execute" "returning non-success" and "ACTION_FAILED."

Other files to obtain

Look in %Program Files%\Symantec\Symantec Endpoint Protection\<latest-version>\Scripts for the following:

• All files (e.g., install script, rollback script, etc.)

Look in %AllUsersProfile%\Application Data\Symantec\Symantec Endpoint Protection\<latest-version>\Data\Scripts\ for the following:

• All files (e.g., install script, rollback script, etc.)

Additional logs

• SETUPAPI.LOG
  
  Note: This log used to be located in C:\Windows but it is now located at C:\Windows\INF.

Setupapi.log files contain information about teefer, and will reveal problems if teefer fails to load. Teefer is considered a hardware driver.

You can also run SymDiag, which automatically collects most of these files.