A troubleshoot file contains a collection of log messages, configuration data, and command outputs. It is used in order to determine the status of a Sourcefire system. If a Cisco Support Engineer requests you to send a troubleshoot file from your BlueCoat X-Series Platform (also known as Crossbeam Sensor), follow the instructions on this document. This document also provides a list of the additional data that might be necessary to analyze an issue.
Generate Troubleshoot File
1. Log into your BlueCoat X-Series appliance as an admin user.
2. Find the VAP group for Sourcefire software.
show application vap-group
The following output is an example of the above command. In this example, the vap group is sf53.
VAP Group : sf53
App ID : SfSensor
Name : SF Sensor
Version : 220.127.116.11
Release : 55
Start on Boot : yes
App Monitor : on
App State (sf530_1) : Up
3. Next, we need to increase privilege so that we can remote-shell into the VAP group itself:
4. Then, open a remote-shell session:
5. Now, load the Sourcefire specific application:
6. Finally, generate a troubleshoot:
sf_troubleshoot.pl -t <case_number>
Additional Troubleshoot Data
1. Copies of all of the /var/log/messages* files on the Control Processor Module (CPM) are necessary for log analysis and troubleshooting purpose. A Sourcefire sensor logs all of the syslog messages on the /var/log/messages file of a CPM, rather than on an Application Processor Module (APM) where the Sourcefire software runs.
2. A running configuration of BlueCoat X-Series Platform allows us to understand how a sensor is installed and configured on XOS. The following command copies a running configuration into a text file:
copy running-config /tmp/running_config.txt
3. The following command outputs are important to determine the status of the module and chassis:
show module status
4. If an error or symptom is obvious on the web user interface, a screenshot of the web interface is also helpful to identify a problem.