Generate Secure Malware Analytics Support Snapshot and Enable Live Support Session

Introduction

This document describes the information on the steps to collect Support Snapshot and enable live support session from the Cisco Secure Malware Analytics appliance for further investigation

Support Snapshots

Generate Support Snapshot from Admin UI

In order to create a Support Snapshot, follow these steps:

Step 1: Login into the Secure Malware Analytics Admin UI

Step 2: click or select Support

Step 3: click or select Support Snapshots and then click or select Create Snapshot to generate a support snapshot on this appliance

Step 4: Once the snapshot is complete, you would see a Success message as shown in the image:

Step 5: Under Actions click or select Download Snapshot and this must download the snapshot on your machine from where you have logged into the UI

Generate Support Snapshot from TGSH CLI

In order to create a Support Snapshot from TGSH CLI, follow these steps:

Step 1: Login into the TGSH CLI from SSH. Please refer to the User Guide for instructions on how to configure this access

Step 2: Once you are logged in, select the Snapshots option

Step 3: Select the Create option and this generates the Snapshot. Now, you would be able to download the Snapshot from the Admin UI as per the process documented for Admin UI

Live Support Session

Enable Live Support Session from Admin UI

In most cases, TAC might request you to enable Live Support Session to the Secure Malware Analytics appliance for further investigation 

NOTE: Please provide the Serial Number you enable the Live Support Session to TAC to enable them to access the device remotely

To enable this access on the appliance, follow these steps:

Step 1: On the Admin UI, click or select the Live Support Session under the Support Tab

Step 2: click or select the Start Support Session option

Step 3: Once connected, you must see the message as shown in the image:

Note: You need to allow Outbound Connectivity from the Dirty interface to rash.threatgrid.com for this access to work correctly. Please refer to Network Interface Setup Diagram for more information

Enable Live Support Session from TGSH CLI

To enable this access on the appliance from TGSH CLI from SSH, follow these steps:

Step 1: Log into the TGSH SSH CLI

Step 2: Select the option Support Mode

Step 3: Select Start to enable the Live session

Step 4: You must see it showing the Status as active

Note: In situations where the Admin UI or TGSH CLI access is not available, Live Support Session can also be enabled from the Appliance Recovery mode.