Contents

Introduction

Connecting to the Sensor CLI

Important Directories

Config.yml

PCAP Captures

Retrieving files from the IoX Sensor

Local Manager GUI

Copying Files through TFTP

Sensor Health

Status

Processing Status

Critical Information in the diag file

Introduction

This document describes the essentials needed to troubleshoot when working with the IoX Sensor on Cyber Vision solution.

Connecting to the Sensor CLI

Sensor applications can’t be accessed directly. First, need to connect to the switch through SSH. Then, use the show command to list the application running on it.

Show app-hosting list

Validate if the application is installed and document its name. Then, type (where 'ccv_sensor_iox_aarch64' is the app name in this example)

app-hosting connect appid ccv_sensor_iox_aarch64 session

Important Directories

Config.yml

It’s an important config file that documents flow, protocol, and port information configuration settings. The file can be found under:

/iox_data/etc/flow

PCAP Captures

The captures that are run and triggered from the GUI are under

/iox_data/var/flow/log/pcap

Retrieving files from the IoX Sensor

Local Manager GUI

From the Local manager GUI, navigate to the app, then the ‘App-DataDir’ tab will show the files present in the/iox_data/appdata directory

The ‘Logs’ tab under the app will show the files in /iox_data/logs.

Copying Files through TFTP

From the CLI of the sensor, files can be copied to a remote TFTP server using the command below:

tftp -p -l /iox_data/appdata/<local-filename> -r <remote-filename> <tftp-server-IP>

Sensor Health

From the Center GUI, navigate to Administration → Sensors → Management to look at the Sensor details. These are the connection and processing statuses that are available

Status

-New

-Request pending

-Authorized

-Disconnected

-Connected

-Unknown

-SSH

Processing Status

-Not enrolled

-Disconnected

-Waiting for data

-Pending data

-Normally processing

Critical Information in the diag file

Date – Reports the time when the diagnostics were run

Ip_addr – Reports the IP address & network information of all interfaces configured.

Ip_route – Report the configured gateway

Journal_errors – Reports the services which have failed to start

Journal_sensorsyncd – Reports the TLC connection info

Memory – Reports the amount of memory that’s in use

sbs-version – Reports the main version and the build date

sensor-enroll.conf – Reports the IP configured on the Enrollment package

top – Reports 4 “top” commands within 12 seconds sorted by CPU