How to re-process archived / bad syslogs to re-generate reports in Virtual Appliance
03/26/2020 1,141 People found this article helpful 397,994 Views
Description
In some circumstances user may need to reprocess syslogs to generate reports. Below instructions how to re-process archived logs to generate reports in Virtual Appliance.
Resolution
1. Obtain root password from tech support:
Please log a Support request with SonicWall tech support team with GMS/Analyzer serial number. Support team will provide the root password.
2. Connect to VA using secure client like ‘Putty’:
- Go to https://GMS/Analyzer_IP/appliance page
- Go to license > refresh license (This will activate the root password provided by tech support)
- Open Putty
- Username: root
- Password: (provided by tech support)
3. Steps to re-process logs:
Step 1:
- Go to archived logs directory (cd /opt/GMSVP/syslogs/ archivedSyslogs)
Step2:
- Create a folder to reprocess syslogs:
- mkdir reprocessedLog (reprocessedLog is the name of the folder created)
Step 3:
Determine the logs you like to re-process. For an example logs will similar to this RawSyslogs_X_20160505__1.zip. In this instance we will re-process logs for the month of May only.
- Each zip file has year month and day format
Step 4:
Move the logs for the month of May to the newly created folder:
- cp RawSyslogs_1_201605* /reprocessedLog
- Use the wildcard (*) to confirm everything from the month of May 2016
- You can use days or weeks by specifying the dates correctly
Step 5:
Move to reprocessedLog folder and unzip all the files
- cd reprocessedLog
- unzip '*.zip'
- above will unzip all the zip files to .prd format
Step 6:
Remove the duplicate zip files
- rm *zip
Step 7:
Rename .prd file extension to .src format
- for x in *.prd; do mv"$x" "$(basename "$x" .prd).src";done
- above will rename all the .prd files to .src files
Step 8:
Move all the .src file to the syslog folder to re-process the syslogs:
- cp *src /opt/GMSVP/syslogs
4. Restart all the services:
- Go to https://GMS/Analyzer_IP/appliance
- Deployment > Services > select all services > restart
- This will start processing all the .src files for reports
Related Articles
Categories
Was This Article Helpful?
YESNO