Gathering logs requested by Trustwave NAC TAC (NAC 5.X)

This article applies to:

• NAC 4.x
• NAC 5.x

Question:

• Gathering logs requested by Trustwave NAC TAC

Procedure:

If Trustwave Technical Support needs your logs for troubleshooting, you can follow the procedures below.

All current versions of NAC allow you to gather logs using the command line interface (CLI). Version 5.1.2 and above allows you to gather logs from the Web interface.

Gathering logs from the CLI:

• For the commands below replace Case.CaseNumber with the full case number
• The commands attempt to automatically insert the server name and date. However, if you have any issues you can try to replace the following by hand:
  • $(uname -n) with the server name
  • $(date '+%F') with the date in this format: YYYY-MM-DD
• Example command with all information manually entered:
  snapshot.sh -a -d /root/1234567_2015-09-20_myserver_TSLogs.tgz 

1. SSH to the server as user root
2. On a Server, Server/Sensor or Standalone system type:
   • snapshot.sh -a -d /root/Case.CaseNumber_$(date '+%F')_$(uname -n)_TSLogs.tgz 
     
3. On a Sensor type:
   • snapshot.sh -a -d /root/Case.CaseNumber_$(date '+%F')_$(uname -n)_TSLogs.tgz
   • scp the file to the server
     • scp *_TSLogs.tgz root@server:
   • remove it once it is copied to the server
     • rm -i *_TSLogs.tgz
4. Using a SCP client from your desktop, connect to the server via WinSCP and collect the file above. 
5. Upload that file to your case in the portal. If the file is over 600Mb please contact support before uploading.

If you have any issues please contact Support.

Gathering logs from the Web Interface:

For the Sensor:

1. Open the web interface of the NAC and navigate to the Maintenance tab
2. Select the Sensor
3. Click the link "load fresh technical support logs"
   
    
4. The system reports the progress of log gathering:
   
   
   
   Then:
   
   
5. When log gathering is complete a new line provides a link to download the logs
   
   
6. Click the link "Download data retrieved xxxx-yy-zz  xx:yy:zz +xxxx" link to open a save file dialog. The file is already in archived format, ready to be uploaded to the ticket.

For the Central Manager:

The procedure for the CM is quite similar.

1. Open the web interface of the NAC and navigate to the Maintenance tab
2. Select the Central Manager
3. Click the link "Download technical support logs"
4. Save the file and attach to the ticket

Notes:

• If you do not have a SCP client, one free option is available at www.winscp.net
• The option "Download technical support overview" does not provide access to Logs. This option provides a plain text file with a general overview of the NAC configuration.