Accessing agent log files

Datto EDR log files are UTF-8 encoded text files created by Datto EDR and its components that record detailed events from the Datto EDR Agent. These files are used for agent troubleshooting and diagnosis.

Separate log files are generated for each service managed by the agent (EDR, AV, RWD, RWRB). The location and behavior of the log files vary per operating system.

For information about agent requirements, refer to Hardware and operating system requirements.

Location of the log files

Operating System

EDR

Datto AV (DAV)

Ransomware Detection (RW)

Ransomware Rollback (RWRB)
Windows %Program Files \infocyte\agent\logs\agent-YYYY-MM-dd.log

Notes

  • Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging

  • The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd

  • A maximum of 7 log files are archived, typically before log rotation begins.

  • Logs are in UTC time zone

 %Program Files \infocyte\agent\logs\datto-av-YYYY-MM-dd.log

Notes

  • Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging

  • The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd

  • A maximum of 7 log files are archived, typically before log rotation begins.

  • Logs are in UTC time zone

Engine Logs

  • %Program Data%\DattoAV\Endpoint Protection SDK\logs\

  • Logs are in device time zone

 Folder location
%ProgramData%\Datto\Datto Rollback Driver\Logs\

  • Engine.txt

  • Wrapper.txt

Notes

 

  • Logs are in device time zone

 Install logs

  • %Program Files \infocyte\agent\rwd\install_*.txt

Operational logs: Folder location
%ProgramData%\Datto\Datto Rollback Driver\Logs\

  • Rollbackservice.txt

  • Rbupdater.txt

  • rollbackAutoRepairCheck.txt

  • RollbackHealthCheck.txt

Notes

  • Logs are in device time zone
macOS /usr/local/infocyte/agent/logs/agent-YYYY-MM-dd.log

Notes

  • Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging

  • The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd

  • A maximum of 7 log files are archived, typically before log rotation begins

  • Logs are in UTC time zone

 /usr/local/infocyte/agent/logs/datto-av-YYYY-MM-dd.log

Notes

  • Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging

  • The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd

  • A maximum of 7 log files are archived, typically before log rotation begins

  • Logs are in UTC time zone

 N/A N/A
Linux /opt/infocyte/agent/logs/agent-YYYY-MM-dd.log

Notes

  • Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging

  • The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd

  • A maximum of 7 log files are archived, typically before log rotation begins.

  • Logs are in UTC time zone

 N/A

 

 N/A N/A

Fetching the log files

You can initiate an agent action to upload log files to the Reports tab in the platform. To do this, select Organizations > Devices. For the applicable device, click the ellipses menu () and select Fetch Logs. This will pull all current device logs into the Reports section.

What files does Fetch Logs collect?

When you run Fetch Logs on a device, the Datto EDR agent collects its logs and logs from related Datto components into a single compressed file. The file is uploaded for Datto Support to troubleshoot the issue. Only Datto product log and configuration files are collected. Personal files and documents are not included.

Windows

Component Location on device Information collected

Datto EDR agent

 C:\Program Files\infocyte\agent\logs\ Agent activity logs: startup, server check-ins, jobs, response actions and errors

 

 C:\Program Files\infocyte\agent\ Agent configuration (config.toml), plus update, upgrade, service, crash and debug logs

Datto AV

 C:\Program Files\infocyte\agent\dattoav\ Real-time protection setup log and the list of installed files

 

 ...\dattoav\Endpoint Protection SDK\logs\ and C:\ProgramData\DattoAV\Endpoint Protection SDK\logs\ Antivirus engine logs: scans, detections and definition updates

 

 ...\Endpoint Protection SDK\Settings\ Current antivirus settings (AppSettings.json)

 

 Generated during collection A snapshot of the antivirus engine’s current configuration

 

 C:\Windows\Temp\ Datto AV install, uninstall and deployment logs

Datto Rollback Driver

 C:\Program Files\infocyte\agent\rwd\ Rollback Driver configuration and installation logs

 

 C:\ProgramData\Datto\Datto Rollback Driver\Logs\ Rollback engine, rollback operation and service logs

Windows

 C:\Windows\System32\LogFiles\ and C:\Windows\Logs\ Only Windows log files that relate to Datto, the agent or rollback

 

 C:\Windows\Temp\ Windows Security Center registration logs for Datto AV

macOS and Linux

Component Location on device Information collected

Datto EDR agent

 macOS:
/usr/local/infocyte/agent/logs/

Linux:
/opt/infocyte/agent/logs/		 Agent activity logs

Copying the log files

Once you have located the log files, you can copy them for troubleshooting purposes. The methods outlined below will explain how to copy a log file by using a command line on Windows, macOS, or Linux devices.

Windows

  1. Change directory to the location of the log file you would like to copy. For example, if you would like to copy the Datto EDR Agent log file, use the following command:
    cd "C:/Program Files/Infocyte/agent/logs"
  1. Press Enter.
  1. When you are in the directory, type the following:
    copy agent-YYYY-MM-dd.log <give new filename here>.log

    EXAMPLE  
    copy agent-2025-09-15.log Copy.log
  1. Press Enter.

macOS

  1. Open terminal. If you would like to copy the Datto EDR Agent log file, type the following:
    cd /usr/local/infocyte/agent/logs
  1. Press Enter.
  1. Then type the following:
    cp agent-YYYY-MM-dd.log <give new filename here>.log

    EXAMPLE  
    cp agent-2025-09-15.log Copy.log
  1. Press Enter.

Linux

  1. Open terminal. If you would like to copy the Datto EDR Agent log file, type the following:
    cd /opt/infocyte/agent/logs
  1. Press Enter.
  1. Then type the following without brackets:
    cp agent-YYYY-MM-dd.log <give new filename here>.log

    EXAMPLE  
    cp agent-2025-09-15.log Copy.log

  1. Press Enter.

 

Revision Date
Initial release. 9/18/25
Edited macOS, Linux PRs step 1: Datto EDR Agent log file. 2/27/26
Added section: What files does Fetch Logs collect? 10/15/26