While conserve mode is in effect, users cannot log in to the unit, making it impossible to collect real-time reports on incidents with the unit (e.g., high process, high memory, performance statistics, etc.). To capture this information, the best practice is to set up an automation stitch that collects the logs and sends them via email to the administrator.  CLI:  config system automation-action
  edit "Report_Collection"
     set action-type cli-script
     set script "Â
diagnose sys top 2 30 5
get sys status
get sys performance status
diagnose debug crashlog read
diagnose sys process sock-mem
diagnose hardware sysinfo memory
diagnose hardware sysinfo interruptsÂ
diagnose sys top-mem 30
diagnose netlink interface packet-rate
diagnose sys mpstat 3 5
"Â
  next
  edit "Email Notification"
    set description "Send a custom email to the specified recipient(s)."
    set action-type email
    set email-to "email@example.com"
    set email-subject "%%report.collection.in.high.memory%%"
set message "%%results%%"
  next
end
Â
config system automation-trigger
  edit "high_memory_trigger"
   set event-type low-memory
  next
end
Â
config system automation-stitch
  edit "auto-stitch"
    set trigger "high_memory_trigger"
      config actions
        edit 1
          set action "Email Notification"
          set required enable
        next
        edit 2
          set action "Report_Collection"
          set delay 5
          set required enable
        next
      end
  next
end
 GUI:
To configure the automation action, set it up under Security Fabric -> Automation -> Action -> Edit or Create New.
The variable that needs to be configured for 'Body' is %%results%% to make sure the email message is the output of the script in 'Report_Collection' Action.
 Â 
To configure the automation trigger, set it from Security Fabric -> Automation -> Trigger -> Edit or Create New.
  Lastly, to create the stitch, go to Security Fabric -> Automation -> Stitch-> Edit or Create New.    Any necessary CLI scripts can be added in the script part under 'Report_Collection'. The 'email-to' option is to send the report through email to the configured recipient in 'Email Notification'. The conserve mode event 'high_memory_trigger' is being set, but other events can also be used. In the automation stitch, the trigger and actions are set. A 5-second delay has been added in the 'Report_Collection' action, which is adjustable.  Related articles: | 
