You can ease the collection of logs with the Webex Serviceability service. The service automates the tasks of finding, retrieving, and storing diagnostic logs and information.

This capability uses the Serviceability Connector deployed on your premises. Serviceability Connector runs on a dedicated host in your network ('connector host'). You can install the connector on either of these components:

• Enterprise Compute Platform (ECP)—Recommended

  ECP uses Docker containers to isolate, secure, and manage its services. The host and the Serviceability Connector application install from the cloud. You don’t need to manually upgrade them to stay current and secure.

  Important

  We recommend use of ECP. Our future development will focus on this platform. Some new features won't be available if you install the Serviceability Connector on an Expressway.

• Cisco Expressway

You can use the Servicability Connector for these purposes:

• Automated log and system information retrieval for service requests

• Log collection of your Unified CM clusters in a Cloud-Connected UC deployment

You can use the same Serviceability Connector for both use cases.

You can use the Webex Serviceability service to aid Cisco technical assistance staff in diagnosing issues with your infrastructure. The service automates the tasks of finding, retrieving, and storing diagnostic logs and information into an SR case. The service also triggers analysis against diagnostic signatures so that TAC can identify problems and resolve cases faster.

When you open a case with TAC, TAC engineers can retrieve relevant logs as they perform the diagnosis of the problem. We can collect the needed logs without coming back to you each time. The engineer sends requests to the Serviceability Connector. The connector collects the information and securely transfers it to the Customer eXperience Drive (CXD). The sytem then appends the information to your SR.

When we have the information, we can use the Collaboration Solution Analyzer and its database of diagnostic signatures. The system automatically analyses logs, identifies known issues, and recommends known fixes or workarounds.

You deploy and manage Serviceability Connectors through Control Hub like other Hybrid Services, such as Hybrid Calendar Service and Hybrid Call Service. You can use it along with other Hybrid Services, but they aren't required.

If you already have your organization configured in Control Hub, you can enable the service through your existing organization administrator account.

In this deployment, the Serviceability Connector is always available, so that TAC can collect data when necessary. But, it doesn’t have a steady load over time. The TAC engineers manually initiate data collection. They negotiate an appropriate time for the collection to minimize the impact on other services provided by the same infrastructure.

You can use the Serviceability service through Control Hub to monitor your Unified CM clusters in a Cloud-Connected UC deployment.

For a current list of limitations, see the Known Issues with Serviceability Service article.

The diagram shows the required accounts to deliver Serviceability Service. Many of these accounts aren’t for users. The Serviceability Connector needs permission to retrieve data from several devices.

The following tables lists people and accounts, and their roles in deploying and using the service:

When a command is entered, Webex sends the request to the Serviceability Connector, which acts on it to collect the required data.

Note

This request has no directly identifiable data about the managed device. It has a device ID or cluster ID, so it knows from which devices to get the data. The Serviceability Connector translates this device/cluster ID. The ID can't by itself identify your infrastructure. Also, the connection between the cloud and the connector uses HTTPS transport.

The Serviceability Connector translates the request as follows:

• It finds the devices for the device/cluster ID in its list of managed devices and clusters and obtains the addresses.

• It recreates the request and parameters as API or SSH calls to the addresses, using the appropriate API or command for the devices.

• To authorize the commands, the connector uses the pre-configured device credentials for the target devices.

The connector temporarily stores the resulting data files on the connector host (Expressway or ECP).

The connector chunks the temporary file, encrypts the chunks, and transmits them over HTTPS to the Customer eXperience Drive. If the request came from TAC, the TAC case file store reassembles the log data and stores it against your Service Request.

Serviceability Connector writes the following data about the transaction to the command history on the Connector host:

• Unique identifiers for the command issued and the issuer of the command. You can trace the ID of the issuer back to the person who issued the command, but not on the connector host.

• The issued command and parameters (not the resulting data).

• The connector-generated alias of the devices to which the command was issued (not the address or hostname).

• The status of the requested command (success/failure).

Managed devices:

• You keep the data at rest on your managed devices secure by using the measures available on those devices and your own policies.

• You create and maintain the API or SSH access accounts on those devices. You enter the credentials on the connector host; Cisco personnel and third parties don't need to and can't access those credentials.

• The accounts might not need full administrative privileges, but do need authorization for typical logging APIs (See People and Roles). The Serviceability Service uses the minimum permissions required to retrieve log information.

Connector host:

• Management Connector creates a TLS connection with Webex when you first register the Connector host (ECP or Expressway). To do this, the Management Connector needs to trust the certificates that Webex presents. You can opt to manage the host trust list yourself, or allow the host to download and install the required root CA list from Cisco.

• The Management Connector maintains a connection to Webex, for reporting and alarms. The Serviceability Connector uses a similar persistent connection for receiving serviceability requests.

• Only your administrators need to access the host to configure the Serviceability Connector. Cisco personnel don't need to access the host.

Serviceability Connector (on connector host):

• Makes HTTPS or SSH connections to your managed devices, to execute API commands.

• You can configure the Serviceability Connector to request and verify server certificates from the managed devices.

• Makes outbound HTTPS connections to the Cisco TAC case management system storage.

• Doesn't log any of your personally identifiable information (PII).

  Note	The connector itself doesn't log any PII. However, the connector doesn't inspect or clean the data that it transfers from the managed devices.

• Doesn't permanently store any of your diagnostic data.

• Keeps a record of the transactions that it makes in the connector’s command history (Applications > Hybrid Services > Serviceability > Command History). The records don't directly identify any of your devices.

• Only stores the addresses of devices and the credentials to their API accounts in the Connector configuration store.

• Encrypts data for transfer to the Customer eXprerience Drive using a dynamically generated 128-bit AES key.

Proxy:

• If you use a proxy to go out to the internet, the Serviceability Connector needs credentials to use the proxy. The Connector host supports basic authentication.

• If you deploy a TLS inspecting device, then it must present a certificate that the Connector host trusts. You may need to add a CA certificate to the host trust list.

Firewalls:

• Open TCP port 443 outbound from the connector host to a number of Cisco service URLs. See External Connections Made by the Serviceability Connector (https://help.webex.com/article/xbcr37/).

• Open the required ports into protected networks that contain the managed devices. See Serviceability Connector Ports which lists ports required by the managed devices. For example, open TCP 443 into your DMZ to collect logs through an Expressway-E's inward facing address.

• Don't open any additional ports inbound to the connector host.

Webex:

• Doesn't make unsolicited inbound calls to your on-premises equipment. The Management Connector on the connector host persists the TLS connection.

• All traffic between your connector host and Webex is HTTPS or secure web sockets.

Technical Assistance Center:

When you enable the Serviceability Service for the TAC use case:

• Has developed comprehensive and secure data storage tools and protocols to safeguard customer device data.

• Employees are bound by Code of Business Conduct not to share customer data unnecessarily.

• Stores diagnostic data in encrypted form in the TAC case management system.

• Only the personnel who are working on the resolution of your case may access that data.

• You can access your own cases and see what data was collected.