Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

How to Collect a HAR File and HTTP Error Logs Using Chrome

How to Collect a HAR File and HTTP Error Logs Using Chrome

Environment

  • Chrome Web Browser: All Supported Versions

Objective

Capture diagnostic logs from a web browser for UI troubleshooting using Chrome

Resolution

  1. Set up logging

    1. Open Google Chrome
    2. From the Chrome Click F12 or right-click > Inspect
    3. Select the Console tab in the Chrome Developer Tools Console (Bottom Window)
    4. Click the Clear button to clear out any existing logs from the console.
  2. Generate a HAR file
    1. Select the Network tab
    2. Look for a round Record button in the upper left corner of the Network tab, and make sure it is red. If it is grey, click it once to start recording.
    3. Check the box next to Preserve log
    4. Click the Clear button to clear out any existing logs from the Network tab.
    5. Reproduce the issue
    6. When finished, right click inside the table of network events, select Save as HAR with Content , and save the file to your computer
  3. Check for and save HTTP Error details
    1. For any errors observed above, note the Request URL and HTTP error number (4## or 5##)
    2. Select the Console tab
    3. Locate the error number tied to the Request URL
    4. Right-click matching error and click "Save As..."
    5. Set name of file, including at least HTTP error number, and save file to your computer
      Example
      Original filename: defense-prod05.conferdeploy.net-1646930859819.log
      
      Updated filename: 400_defense-prod05.conferdeploy.net-1646930859819.log
  4. Upload logs
    1. Attach the HAR file and console file to your case or https://community.carbonblack.com/docs/DOC-4211 for analysis

Additional Notes

  • All credentials and session cookies within a HAR file should be removed before sharing with Carbon Black
    • The HAR file is a text file, it can be opened in a text editor and searched for the SESSION cookie value and replaced with <REDACTED>
    • This can also be done for passwords and API tokens if they were part of the recording
    • It's also recommended to logout from the Carbon Black session after recording a HAR session. This is a precaution that should invalidate session IDs if any were missed.
  • HAR Files under 5 MB can be attached directly to a Carbon Black Technical Support case. 
  • Files larger than 5 MB should be uploaded to CB Vault.
  • For EDR issues, debug logging can be enabled in the console: EDR: How to enable debug logging in Chrome browser

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-27-2018
Views:
26420
Contributors