I have set up SEPM 14 to save behavior, packet and traffic logs to a dump file. The logs are being created, but are being deleted and new logs created per client instead of cumulative. This means only the last machine to send logs at the end of the day is registered and all other logs are not. The data can be accessed in the SEPM console, but the dump files are archived off for audit purposes and need to be acurate.
Example: agt_behavior.tmp fills to 209Kb all one client then a few seconds later drops to 8Kb with only data from another client.
We have this working perfectly on SEP 12 with all client logs showing in the dump file, the issue is with the SEP 14 server and needs to be fixed before we can migrate all clients.
Any help would be appreciated.