This article applies to:

• WebMarshal 6.X and 7.X

Question:

• What information is required when logging a complex WebMarshal related call with Trustwave Technical Support?

Information:

To assist with investigation of cases that are complex or difficult to reproduce, please follow these procedures to gather needed information.

Note: The procedure below requires WebMarshal services to be restarted. Restarting causes a brief interruption in web access for users each time the services are restarted. You may wish to provide advance notice to users.

• If you have more than one processing node server in your WebMarshal array, you only need to restart services on a single node where you will run your test.
• In some cases it may be necessary to run a test during business hours (for instance, if the issue appears to be influenced by server load).

1. Enabling full logging:
   • Open the WebMarshal Console.
   • Navigate to Tools > Server and Array Properties > Advanced Settings. (In WebMarshal 6.8 and above, Tools > Global Settings > Advanced Settings > General)
     
     • Select full logging for all services.
     • If your WebMarshal installation includes more than one server, and you have created "Server Groups", you can enable debug logging for each Server Group.
     • You can also enable debug level logging for the individual servers by editing the individual service.config.xml files found in the installation folder on each server. (for instance, WMEngine.config.xml). Set the value of debug fullTrace to "true" and then restart the service. Setting this value "true" in the file overrides the global setting in the Options window.
   • Navigate to Tools > Server and Array Properties > Traffic Logging. (In WebMarshal 6.8 and above, Tools > Global Settings > System Settings > Traffic Logging)
     • Enable logging.
2. Restart all WebMarshal services (if you have more than one node, do this on the node). You can use the WebMarshal Server Tool from the Start Menu, or the Windows Services control panel.
3. Run a test to replicate the issue. If you have more than one node, ensure that the test session uses that node.
   
   • Make a note of all details such as time, date, website visited, computer or IP address browsed from, and user credential.
4. Run the WebMarshal Support Tool. For more information about this tool, see Knowledge Base article Q11886.
   • On the Array Manager (or Stand Alone install):
     • Open the WebMarshal Console.
     • Navigate to Tools > Open Support Tool.
   • On a processing node server (if installed on a separate server):
     • Open Windows Explorer.
     • Navigate to the WebMarshal installation directory.
     • Run (double click on) WMSupportTool.exe or MarshalSupport Tool.exe
   • Leave all default items checked unless instructed otherwise by Support.
   • Specify an easy to access Output directory, such as your desktop.
   • Please make sure that the checkbox for "upload file to M86 Security support" option (if present) is NOT selected.
   • Allow the tool to gather and compress files.
     • Note: If you have trouble running the support tool, please un-tick the checkbox for "install directory listings" and then try running the support tool again.
5. IMPORTANT: Disable full logging. Disable traffic logging if you do not normally use it. These features consume significant disk space and can reduce performance.
6. Restart services on the server or node, as before.

Upload the zip file to your case in the Trustwave Portal (if your support is not directly through Trustwave, send the file as directed by the reseller).

Be sure to include the details of your test such as time, date, website visited, computer or IP address browsed from, and user credential.