The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

Configure the custom log destination on standalone endpoints

  • Published on Sep 13, 2026
  • 1 minute(s) read
Prev Next

You can configure a custom log destination using the command-line interface. This configuration applies automatically to Threat Prevention, Firewall, and platform services.

Important

Self-protection does not support a custom log path outside the Trellix ENS Linux installation directory. For more information on self-protection, see Enabling self protection support

Directory requirements

  • You must not run an On-Demand Scan or DAT update during this task.

  • You must specify an absolute path.

  • The directory must already exist and must be empty.

  • Ensure that the destination has a minimum of 10 MB of free disk space.

  • The root user must have read, write, and execute permissions for the directory.

  • You must provide only the base directory. Do not include component suffixes.

File system restrictions

The destination must reside on a local file system. The product does not support network-based file systems such as

nfs, nfs4, cifs, smbfs, fuse.sshfs, and fuse.gvfsd-fuse.

Path restrictions

The destination must not be a restricted system directory. Restricted path prefixes include

/tmp/, /var/tmp/, /proc/, /sys/, /dev/, and /run/.

Other restricted prefixes are /mnt/, /media/, /etc/, and /boot/. The product also restricts /lib/, /lib64/, /sbin/, /bin/, /usr/bin/, and /usr/lib/.

  1. Log on to the system as a user with administrator rights.

  2. Change directory to the bin directory of the product.

    • Threat Prevention: cd /opt/McAfee/ens/tp/bin

    • Firewall: cd /opt/McAfee/ens/fw/bin

  3. Run the command to configure the new log destination.

    Replace <custom_path> with your custom base directory.

    Note

    Verify that your custom log path meets all validation rules listed in prerequisites before you run this command.

    • Threat Prevention: ./mfetpcli --setcustomlogpath <custom_path>

    • Firewall: ./mfefwcli --setcustomlogpath <custom_path>

    Wait for the services to restart automatically.

  4. Run the command to verify the new log destination appears againt TP/FW Product Log Path.

    • Threat Prevention: ./mfetpcli --showlogsettings

    • Firewall: ./mfefwcli --showlogsettings