Skip to main content
Anthony_E
Staff
Staff
October 28, 2024

Technical Tip: How to collect a debug bundle remotely

  • October 28, 2024
  • 0 replies
  • 191 views
Description This article describes how to collect a debug bundle remotely.
Scope FortiDLP.
Solution

Traditionally, debug bundles were collected and stored on target machines by executing local commands. This is sometimes a time-consuming process.

 

To streamline this process, from Agent v7.11.2 or later, operators can collect and access debug bundles from target machines by carrying out actions from the Reveal web UI. This functionality is present on Windows, macOS, and Linux.

 

Note:

This requires the target machine's Reveal Agent to be running and able to communicate with the Reveal infrastructure.

 

Directions:

  1. Go to 'Nodes", then navigate to the target machine's page through the active nodes or another filter.

 

Anthony_E_0-1730118275000.png

 

  1. Select the 'Perform action' button:

 

Anthony_E_1-1730118275008.png

 

  1. If a verbose debug bundle is required, please ensure the box is ticked for 'Collect a verbose debug bundle including profiling data'. Otherwise, proceed to step 5.
  2. Select the "Request debug bundle" button. A request for a debug bundle will now be sent to the agent on the target machine.

 

 

Anthony_E_2-1730118275011.png

 

  1. Navigate to 'Action log' (circled in red in the screenshot below), to view the status of the bundle collection and download the debug bundle.



Anthony_E_3-1730118275024.jpeg

 

  1. Select the relevant request bundle event.
  2. The debug bundle can be downloaded by expanding 'Content', and selecting 'Action result' (circled in red in the screenshot below).


Anthony_E_4-1730118275037.jpeg

 

Note:

The time it takes for the debug bundle to become downloadable from the web UI can vary depending on the size of the bundle file and the speed of the network connection.

 

Requesting bundles exceeding 200MB will result in the timeout error shown below:

 

Anthony_E_5-1730118275040.jpeg
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.