App Control: How To Collect Agent Performance Logs on macOS (Locally)

[#1]

Environment

• App Control Agent: All Supported Versions
• macOS: All Supported Versions

Objective

To collect diagnostics for cases involving performance impacts.

Resolution

Note: You will need the Global CLI Password to adjust the debug levels properly. Failure to authenticate with the Agent and set the proper debug levels will result in less data captured, which may prevent proper investigation into the issue.

1.   Open Terminal and issue the following commands:

   cd /Applications/Bit9/Tools
   ./b9cli --password 'GlobalCLIPassword'
   ./b9cli --resetcounters
   ./b9cli --flushlogs
   ./b9cli --debuglevel 4
   ./b9cli --kerneltrace 4
   ./b9cli --nettrace 1

2. Open the macOS Activity Monitor (Applications > Utilities > Activity Monitor).
3. Click View > Update Frequency > Often (2 sec)
4. Open the application experiencing the performance issues.
5. Return to Activity Monitor, and double click the process with the performance issue. Click Sample.
6. Once the Sample completes choose Save to export the results.
7. In Terminal, capture the Agent Logs and return logging to defaults:

   ./b9cli --capture ~/Desktop/`Hostname`-PerformanceLogs.zip
   ./b9cli --password 'GlobalCLIPassword'
   ./b9cli --debuglevel 0
   ./b9cli --kerneltrace 2
   ./b9cli --nettrace 0

8. Collect System Logs

   system_profiler -detailLevel full > ~/Desktop/sysinfo.txt
   tar -cvf ~/Desktop/`hostname`-DiagnosticReports.tar /Library/Logs/DiagnosticReports
   

9. Upload all captured logs to the Vault and update the existing Support Case.

Related Content

App Control: Anti-Virus Exclusions for Agent (macOS)
App Control: How to Collect Historical Agent Logs on macOS (Locally)