Modify 
tmsplx.xml and rsyslog.conf to enable ServerProtect debug logging.Procedure
- Using a text editor such as 
vi, edit the following configuration files:
WARNING
Making incorrect changes to a configuration file can cause serious system errors. Back uptmsplx.xmlandrsyslog.confto restore your original settings. After modifying thersyslog.conffile, restart the rsyslog service immediately before you continue.- Edit 
tmsplx.xmlto define the debug level for each debug parameter (UserDebugLevelandKernelDebugLevel). - To assign the path and filename where ServerProtect will
                              write debug logs, edit 
/etc/rsyslog.conf. 
- 
To direct all ServerProtect user debug logs to
/path/splxUserDebug.log, include the following line inrsyslog.conf:local3.* /path/splxUserDebug.log - 
To direct ServerProtect kernel debug logs to
/path/splxKernDebug.log, do the following:- 
Open
/etc/rsyslog.conf. - 
For CentOS Linux and Red Hat Enterprise Linux, search for
#module(load="imklog")and delete the character#from the text. - 
Add the following lines to the file:
# this is for KHM debug log if $msg contains "SPLXMOD" and not($msg contains "systemd-journal") then { action(type="omfile" file="/path/splxKernDebug.log") } 
 - 
 
 - Edit 
 - Save and close the configuration file.
 - Restart rsyslog.
service rsyslog restart
Note
To prevent Linux file operation errors, restart rsyslog before you restart the ServerProtect service. - Restart ServerProtect
                        service:
/etc/init.d/splx restart 
		