There are several different logs you can capture to use while troubleshooting Endpoint Protection. What to read next ESX EPP Module (MUX) LogsIf virtual machines on an ESXi host are not working with Endpoint Protection, or if there are alarms on a host regarding communication to the SVA, then it could be a problem with the ESX EPP Module on the ESXi host. GI Thin Agent LogsThe thin agent is installed on the VM Guest OS and detects user logon details. EPP EPSecLib and SVM Logs The EPSecLib receives events from the ESXi host ESX EPP Module (MUX). Parent topic: Manage Endpoint Protection