Running must gather from the CLI

You can run must_gather commands from the command line interface of an IBM® Guardium® collector, aggregator, or central manager.

Procedure

  1. Open a PuTTY session (or similar) to the appropriate collector, aggregator, or central manager.
  2. Log in as user cli.
  3. Depending on the type of issue, enter the relevant must_gather commands into the CLI prompt in the format support must_gather <issue>. You might need more than one of the following must_gather commands to diagnose the problem.
    • agg_issues - Aggregation process issues.
    • alert_issues - Alerting issues.
    • app_issues - Application issues.
    • audit_issues - Audit process issues.
    • auth_issues - Authentication issues (including LDAP and multifactor authentication).
    • auto_create_ie - Auto create inspection engines issues.
    • backup_issues - Backup process issues.
    • big_data_issues - Big data issues.
    • cm_issues - Central manager issues.
    • compliance_mon_issues - Compliance monitoring issues.
    • datamining_issues - Data mining issues.
    • datastreams_issues - Data streaming issues.
    • deploy_agents_issues - Deployment agents issues.
    • deployment_issues - Deployment issues.
    • eagle_eye_issues - Advanced threat scanning issues.
    • ecosystem_issues - Ecosystem issues.
    • enterprise_load_balancer_issues - Enterprise load balancer issues.
    • entitlement_issues - Entitlement optimization issues.
    • go_stream - Go stream issues.
    • jproxy_issues - Jproxy issues.
    • miss_dbuser_prog_issues - System database user issues.
    • native_auditing_issues - Native auditing issues.
    • network_issues - Network architecture issues.
    • patch_install_issues - Patch installation and upgrade issues.
    • purge_issues - Purge process issues.
    • risk_spotter - Risk spotter issues.
    • scanner_agent_issue
    • scheduler_issues - Scheduler issues.
    • slon_looper - Slon looper output.
    • sniffer_issues - Sniffer issues.
    • system_db_info - Guardium system database or operating space performance issues.
    • universal_connector_issues - Universal connector issues.
  4. Generate and send the resulting output to IBM Support:
    • Running the must_gather can take several minutes. When complete, you can retrieve the file with the fileserver command. For more information, see fileserver. On the fileserver, the must gather files are stored in the ../Access logs > opt-ibm-guardium-log/ ** > must_gather/ directory. Within the directory, Guardium generates the logs as .tgz files.
    • Upload any must_gather files to ECUREP by using standard data upload. Specify the PMR number and the file to upload.