Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Collecting Logs Remotely for Troubleshooting Server (High Debug)

App Control: Collecting Logs Remotely for Troubleshooting Server (High Debug)

Environment

  • App Control Server: All Versions

Objective

To remotely collect high debug logs for troubleshooting the App Control Server.

Resolution

  1. Gather the following information:
    • What is the OS version and build of the application server where the App Control Server is installed?
    • What is the total system memory of the application server?
    • What is the total free disk space on the drive App Control Server is installed on?
    • What version of the App Control Server is currently installed?
    • Is the SQL database located on the same server as the App Control Server?
    • What version of SQL Server is hosting the App Control database? Is it patched to the latest Cumulative Update?
    • What is the maximum memory set for SQL Server?
    • What error message or events are you receiving regarding this issue?
    • When did the error messages/events/issue start?
    • Were there any new changes on the server(s) or the network recently?
  2. Collect High Debug App Control Server logs:
    1. Log in to the App Control Console
    2. Navigate to > https://CBSERVER/Support.php  > go to the Diagnostics tab.
    3. Click the "Snapshot Server Logs" button
    4. Under "Server Logging"  > set logging duration to 30 minutes
    5. Set all debug levels to "High", and check the box for SQL Trace 
    6. Click Start logging
    7. Reproduce the issue
    8. Browse back to https://CBSERVER/support.php
    9. Click "Stop Logging Now"
    10. Click on ÔÇťAvailable log files" from the right menu > Related Views
    11. Save copies of all files having today's date:
      • PHPErrors-Date-Time.log
        ReporterLog-Date-Time.log
        ServerLog-Date-Time.bt9
        SQLTrace-date-time.csv
      • If using Syslog please restart the App Control Reporter Service due to a known issue causing it to stop sending events after debugging finishes
  3. Collect the Windows Application and Windows System logs.
  4. Collect the most recent IIS Logs.
  5. Upload the collected logs to the Vault and provide an update on the relevant Support Case.

Additional Notes

If the console version is 8.1.8 or 8.1.10 please set the logging duration to "Permanent" and manually stop it after reproducing the issue

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-24-2019
Views:
3900
Contributors