Windows Preprocessor (WPP) logging provides developer level debugging information on the various engines and drivers used by Symantec Endpoint Protection (SEP) clients.

This logging is useful when troubleshooting driver or engine level conflicts or problems with the SEP client.

Enable WPP logging through SymDiag

1. Run the SymDiag tool. (Click Yes if User Account Control prompts.)
2. Review and accept the EULA.
3. Click Collect Data for Support.
4. Click the box for the Endpoint Protection Client product on the Select Products window.
5. Click Next.
6. Click the box Endpoint Protection Client under Debug Logging then Change the Timer to 0 Minutes
7. Click Advanced
8. Click ALS WPP Debug for the Configured presets.
9. Click OK then click Next.
10. Once the screen updates to state Debug logging is enabled, WPP logging is enabled. Reproduce the problem being troubleshooting, and click Continue scan once you've captured the behavior.
11. Once SymDiag completes its data gathering, enter the case number then click Save and send to Symantec Support if FTP is allowed or Save to just have a local copy.