Where Them
Logs AppWTLA-01

Microsoft Defender

4 log locations · Windows, macOS, Linux

Microsoft Corporation · Vendor documentation

Where Microsoft Defender keeps its logs

Microsoft Defender logs to Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational on Windows. 1 other Windows log location is recorded below.

Microsoft Defender logs to /Library/Logs/Microsoft/mdatp/ on macOS. These paths were verified for pkg installs - a different installer, or a portable copy, can put them somewhere else.

Microsoft Defender logs to /var/log/microsoft/mdatp/ on Linux. These paths were verified for deb and rpm installs - a different installer, or a portable copy, can put them somewhere else.

Paths are printed exactly as Microsoft Defender writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.

Finding your way around Windows, macOS and Linux.

WIN

Microsoft Defender

Microsoft Corporation
antivirusEvent Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational
support logs (MPLog, MpSupportFiles.cab)C:\ProgramData\Microsoft\Windows Defender\Support\- MpCmdRun.exe -GetFiles writes MpSupportFiles.cab here; the MPLog-<date>.log protection logs also live in this folder
systemper-machine
Wrong path? Add a variant
MAC

Microsoft Defender

Microsoft Corporation
install log (install.log)/Library/Logs/Microsoft/mdatp/- Diagnostic bundles from sudo mdatp diagnostic create go to /Library/Application Support/Microsoft/Defender/wdavdiag/
pkgper-machine
Wrong path? Add a variant

How to turn on debug logging for Microsoft Defender

  1. macOS and Linux: run mdatp log level set --level debug.
  2. macOS and Linux: reproduce the issue and collect the logs.
  3. macOS and Linux: switch back with mdatp log level set --level info.
  4. Linux: change the log size limits with mdatp config log-rotation-parameters [max-current-size/max-rotated-size] --size [value in MB].

How to collect Microsoft Defender logs

  1. Windows: open an elevated command prompt in the newest %ProgramData%\Microsoft\Windows Defender\Platform\<version> folder, or in %ProgramFiles%\Windows Defender.
  2. Windows: run MpCmdRun.exe -GetFiles.
  3. Windows: collect C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab.
  4. Windows: to copy it to a share instead, run MpCmdRun.exe -GetFiles -SupportLogLocation <RootPath>. It writes <RootPath>\<MMDD>\MpSupport-<Hostname>-<HHMM>.cab.
  5. macOS and Linux: run sudo mdatp diagnostic create, optionally with --path [directory].
  6. macOS and Linux: collect the zip file at the path it prints.
  7. From the Defender portal, you can also run Collect investigation package on the device.