[INTERNAL] Procedure to collect logs on a Production Unit

06/10/2021 0 People found this article helpful 185,574 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

This article is written with the purpose of having a standard procedure on how to collect logs from a production unit.

WARNING: Consent from the customer must be granted first and Support needs to have Management approval before the data collection request.

Resolution

1. Request the customer a Read-Only Admin user account and a time-slot outside customer's business hours when low traffic is expected.

2. Access the production Active Unit , preferably via MGMT GUI interface from the RMK.

3. Verify the following stats to ensure minimum impact during the collection of the logs:

a) CPU usage: CORE 0 should have low utilisation during the previous minutes. Anything older than that is irrelevant, or can be ignored. – check that under Diagnostics>Core 0 Monitor. 

b) Admin users logged: To ensure that no configuration changes are being done at the same moment, we should verify that no other admin user is logged in.

After these checks are verified, we can start collecting the following logs:

1. Tech Support Report

2. ChassisOS logs

3. Event Logs in CSV and TXT formats

Related Articles

• Bandwidth usage and tracking in SonicWall
• How to force an update of the Security Services Signatures from the Firewall GUI
• Configure Guest VLAN in the TZ firewall, for guest users to access Internet only.

Categories

• Firewalls > NSsp Series > Firewall Management