Accessing agent log files

Datto EDR log files are UTF-8 encoded text files created by Datto EDR and its components that record detailed events from the Datto EDR Agent. These files are used for agent troubleshooting and diagnosis.

Separate log files are generated for each service managed by the agent (EDR, AV, RWD, RWRB). The location and behavior of the log files vary per operating system.

For information about agent requirements, refer to Hardware and operating system requirements.

Location of the log files

Operating System	EDR	Datto AV (DAV)	Ransomware Detection (RW)	Ransomware Rollback (RWRB)
Windows	%Program Files \infocyte\agent\logs\agent-YYYY-MM-dd.log Notes Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd A maximum of 7 log files are archived, typically before log rotation begins. Logs are in UTC time zone	%Program Files \infocyte\agent\logs\datto-av-YYYY-MM-dd.log Notes Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd A maximum of 7 log files are archived, typically before log rotation begins. Logs are in UTC time zone Engine Logs %Program Data%\DattoAV\Endpoint Protection SDK\logs\ Logs are in device time zone	Folder location %ProgramData%\Datto\Datto Rollback Driver\Logs\ Engine.txt Wrapper.txt Notes   Logs are in device time zone	Install logs %Program Files \infocyte\agent\rwd\install_*.txt Operational logs: Folder location %ProgramData%\Datto\Datto Rollback Driver\Logs\ Rollbackservice.txt Rbupdater.txt rollbackAutoRepairCheck.txt RollbackHealthCheck.txt Notes Logs are in device time zone
macOS	/usr/local/infocyte/agent/logs/agent-YYYY-MM-dd.log Notes Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd A maximum of 7 log files are archived, typically before log rotation begins Logs are in UTC time zone	/usr/local/infocyte/agent/logs/datto-av-YYYY-MM-dd.log Notes Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd A maximum of 7 log files are archived, typically before log rotation begins Logs are in UTC time zone	N/A	N/A
Linux	/opt/infocyte/agent/logs/agent-YYYY-MM-dd.log Notes Daily at midnight UTC, the current log file closes, and a new log file is created for continued logging The archive log files have the following naming convention agent-YYYY-mm-dd.log (that is, agent-2025-09-20.log) with a date stamp in in the format of yyyy-mm-dd A maximum of 7 log files are archived, typically before log rotation begins. Logs are in UTC time zone	N/A	N/A	N/A

Fetching the log files

You can initiate an agent action to upload log files to the Reports tab in the platform. To do this, select Organizations > Devices. For the applicable device, click the ellipses menu () and select Fetch Logs. This will pull all current device logs into the Reports section.

Copying the log files

Once you have located the log files, you can copy them for troubleshooting purposes. The methods outlined below will explain how to copy a log file by using a command line on Windows, macOS, or Linux devices.

Windows

1. Change directory to the location of the log file you would like to copy. For example, if you would like to copy the Datto EDR Agent log file, use the following command:
   cd "C:/Program Files/Infocyte/agent/logs"

2. Press Enter.

3. When you are in the directory, type the following:
   copy agent-YYYY-MM-dd.log <give new filename here>.log
   
   EXAMPLE  
   copy agent-2025-09-15.log Copy.log

4. Press Enter.

macOS

1. Open terminal. If you would like to copy the Datto RMM Agent Service log file, type the following:
   cd /usr/local/infocyte/agent/logs

2. Press Enter.

3. Then type the following:
   cp agent-YYYY-MM-dd.log <give new filename here>.log
   
   EXAMPLE  
   cp agent-2025-09-15.log Copy.log

4. Press Enter.

Linux

1. Open terminal. If you would like to copy the Datto RMM Agent Service log file, type the following:
   cd /opt/infocyte/agent/logs

2. Press Enter.

3. Then type the following without brackets:
   cp agent-YYYY-MM-dd.log <give new filename here>.log
   
   EXAMPLE  
   cp agent-2025-09-15.log Copy.log

4. Press Enter.

 

Revision	Date
Initial release	9/18/25