Read Me. Using the Enhanced Customer Support Tool

Size: px

Start display at page:

Download "Read Me. Using the Enhanced Customer Support Tool"

Clyde Hawkins
6 years ago
Views:

1 Read Me Using the Enhanced Customer Support Tool The Enhanced Customer Support Tool (ECST) allows you to capture your current IPSO configuration, log files, core dumps and other information in a single file that can be sent to Nokia customer support for analysis. Typically, you would run ECST if you have opened a case with Nokia support and you have been asked to provide an ECST file. When you run ECST, you can include any or all of the following information in the output file: Offline Network Voyager pages captured Network Voyager pages that show your current configuration and that can be viewed offline by Nokia customer support. You must supply your user name and password for ECST to capture the Network Voyager pages. To ensure that all the configuration information is captured, you should have at least read-only access to all IPSO features. When you include offline Network Voyager pages, ECST saves your current configuration before it captures the pages. Firewall information firewall status, objects, tables, and diagnostics, as captured from utilities such as cpinfo, cpstat, and fw tab. IPSO information captured output from the utilities listed below. date arp -a uname -a ifconfig -v -a vmstat -mis dbget -rv dynamic ps -auxw ipsctl -a df -k ntpdc -pn pstat -ks ls -l netstat IPSO log files copies of the syslog log files, httpd access logs, httpd error logs, cron logs, and other logs. IPSRD/Core dumps copies of the configuration files in /config, user directories in /var/ emhome, IPSRD and core dumps, and firewall logs. ECST 1.0 Part No. N Rev 001 March 2009

2 All ECST output files are stored in /opt/ecst_output on the appliance. Because the ECST output files can be quite large, Nokia recommends that you do not keep more than three output files on your appliance at a time. Obtaining the ECST Package The latest ECST package is available on the Nokia Support Web site. In preparation for installation, it can be downloaded to a local or network drive on your workstation or placed on an FTP server that is reachable from your Nokia appliance. Installing and Upgrading the ECST Package You install or upgrade the ECST package the same way you install or upgrade any IPSO package. You can use the newpkg command, the CLI add package command, or the Install Package page in Network Voyager. For information on how to install or upgrade an IPSO package, consult the Getting Started Guide and Release Notes or the Nokia Network Voyager Reference Guide for the version of IPSO you are using. The ECST package must be enabled before you can run ECST. You can verify that it is enabled from the Manage Packages page in Network Voyager. Note The ECST package description shown in Network Voyager contains the version of the ECST package (for example, 1.0-2) and some IPSO build information. The IPSO build information does not mean that you are restricting to running ECST only on that IPSO version. The build information is used for internal tracking purposes and does not indicate version compatibility. Running the Enhanced Customer Support Tool You can run ECST from Network Voyager or the IPSO shell, as described in the next two sections. Keep the following points in mind while running ECST: Try to run ECST when no traffic is flowing through the appliance. Although this condition is not mandatory, ECST runs more slowly when traffic is present. Make sure that no IPSO images or firewall packages are present in /var/etc or in /var/ emhome/admin. The presence of these packages increases the size of the ECST output file. The size of the ECST output file depends on the presence and size of various files, such as IPSO log files, firewall log files, and core/crash files, and on the configuration of the firewall. ECST calculates the space required for the output file before it runs and will not execute if there is not enough space. For more information on your options if this happens, see Disk Space Required by ECST. 2

3 The time to complete the ECST execution depends on the device capacity, traffic and the configuration present on the appliance. Running ECST Using Network Voyager The following two procedures describe how to use Network Voyager to run ECST. To collect all information 1. Select Firewall and Other Packages from the Network Voyager navigation tree and click the ECST Diagnostics link. 2. Check the Select All box. 3. Enter your user name and password. 4. Check the Generate Configuration Summary box. 3

4 5. Click Apply. The ECST tool begins to run, collecting the required information. To monitor the collection process, return to the Firewall and Other Packages page and click the ECST Diagnostics link again. This causes the page to automatically refresh every few seconds, allowing ECST to post updated status information. When ECST finishes, it updates the Notice message with: ECST execution completed successfully Output file is CST-host-date-time.tgz 6. Download the ECST output file by clicking on the link in the Download table. To collect selected information 1. Select Firewall and Other Packages from the Network Voyager navigation tree and click the ECST Diagnostics link. 2. If the Select All box is already checked, uncheck it and click Apply. 3. Click the check boxes for the information you want to collect. 4. If you selected Offline Voyager, enter your user name and password. 5. Check the Generate Configuration Summary box. 4

5 6. Click Apply. The ECST tool will begin to run, collecting the required information. To monitor the collection process, return to the Firewall and Other Packages page and click the ECST Diagnostics link again. When ECST finishes, it updates the Notice message with: ECST execution completed successfully Output file is CST-host-date-time.tgz 7. Download the ECST output file by clicking on the link in the Download table. 5

6 Running ECST from the IPSO Shell You can also run ECST from the IPSO shell, using the command: # ecst [ -cfhilv ] If you include no options with the command, ECST collects information based on the configuration in its current configuration file. The contents of its configuration file are determined by the Service Summary selections in Network Voyager. If no configuration file exists, ECST collects all information. If you specify options, ECST ignores the content of its configuration file and collects just the information specified by the options. The options are described in Table 1. Table 1 ECST Options Option Description -c Specifies that the core dump files, configuration files, and user home directories should be collected. -f Specifies that firewall information should be collected. -h Displays help for the ecst command. -i Specifies that the output of various utilities should be captured (same content as the legacy ipsoinfo utility) -l Specifies that the log files should be collected. -v Specifies that Network Voyager pages should be captured for offline viewing. The files produced by ECST are in the /opt/ecst_output directory. Disk Space Required by ECST Depending on the appliance configuration and the data you have selected to be collected with ECST, the output file can be very large. In addition, ECST needs disk space over and beyond the output file size in order to run. ECST calculates the disk space it requires before it begins execution. If there is not enough disk space, it stops execution and displays an notice stating how much disk space it requires and how much disk space is available. If ECST tells you that there is not enough disk space, you can: Free up disk space. For example, IPSO images or firewall packages in /var/etc or in /var/ emhome/admin can greatly increase the amount of disk space ECST requires. Choose to run with fewer ECST data collection options selected. 6

7 Table 2 shows how much disk space each ECST data collection option required in a system tested by Nokia. These numbers can vary on any individual target system according to system and firewall configuration, the number of log files, the number of core and crash files, and so on. In particular, firewall configuration and number of core/crash files can make a large difference in the ECST disk space requirements. Table 2 Disk Space Required for ECST Options Offline Voyager Firewall Information IPSO Information IPSO Log Files IPSRD/Core Dumps All Options System without firewall or core/crash files Minimal Configuration With Routing (OSPF/BGP) and High Availability With 1000 Static Routes With 2000 Static Routes With 3000 Static Routes With 1000 VLANs and no static routes 3 MB 0.5 MB 1 MB 2 MB 1 MB 7.5 MB 4.5 MB 0.5 MB 2 MB 40 MB 2.5 MB 49.5 MB 11 MB 0.5 MB 2 MB 40 MB 2.5 MB 56 MB 17 MB 0.5 MB 2 MB 40 MB 2.5 MB 62 MB 23 MB 0.5 MB 2 MB 40 MB 2.5 MB 68 MB 23.5 MB 0.5 MB 11.5 MB 40 MB 2.5 MB 78 MB System with firewall and core/crash files With Routing (OSPF/BGP) and High Availability 4.5 MB 46 MB 2 MB 40 MB 40 MB MB Notes Size varies with configuration in Network Voyager Size varies based on firewall configuration, policies, VPN, NAT configuration Size varies with number of log files. Size can be minimal (2 MB) in flash-based appliances. Size varies with number of core and crash files. Could be much larger. 7

8 Table 3 shows the disk space required by ECST running on an IP690 with Accelerated Data Path (ADP) modules. Table 3 ECST Disk Space Requirements on an IP690 with ADP Modules Number of Static Routes Number of VLANs Resulting.tgz size Extracted folder size Offline Voyager size Limitations The following limitations exist in ECST 1.0 running on IPSO 4.1 or 4.2. On a system with 1000 VLANs configured on an interface, ECST can take up to three hours to complete. This is not an issue when up to 250 VLANs are configured on a interface. (PR84128). When you install the ECST package, you might see the following message on the console: [LOG_ERR] xpand[440]: pkg_class: unknown token 'ecst' This message is harmless and you can ignore it. (PR83510) When you enable the ECST package on a flash-based appliance, you might see the following message on the console: [LOG_ERR] xpand[1007]: Failed to create symlink /opt/cgi-bin/ecst-1-0 to /opt/ecst-1-0/voyager-cgi-bin This message is harmless and you can ignore it. (PR83637) 8

9 We Welcome Your Comments Nokia Business Security Products is interested in improving our documentation to better serve you. Please feel free to send comments and suggestions to If you are using Adobe Acrobat Reader 6.0 or later, we invite you to provide feedback to us by using the following form. How satisfied are you with the help you received from this document? Feel free to elaborate on your answer: Where did you find this document? If you chose other, where did you get the document? Was the document easy to find? Feel free to enter suggestions for improving this document: May we contact you at your address if we have questions about your feedback? Note: This form is returned to us through your . We respect your privacy and will not use your address for any other purpose than communication about this form.

Nokia Intrusion Prevention with Sourcefire Appliance Quick Setup Guide. Sourcefire Sensor on Nokia v4.8

Nokia Intrusion Prevention with Sourcefire Appliance Quick Setup Guide Sourcefire Sensor on Nokia v4.8 Part No. N450000774 Rev 001 Published September 2008 COPYRIGHT 2008 Nokia. All rights reserved. Rights