What is a Customer Service Report (CSR) and how do I create one on Security Analytics?
search cancel

What is a Customer Service Report (CSR) and how do I create one on Security Analytics?

book

Article ID: 168347

calendar_today

Updated On:

Products

Security Analytics Security Analytics - VA

Issue/Introduction

CSRs are sometimes collected and sent to Security Analytics support to assist in diagnosing a problem  Knowing what it is, what is included, and how to create it is helpful in deciding if it should be sent for problem diagnosis.

Resolution

Please note that newer versions of the CSR will always include additional files and information.  The list below includes a basic list of files, but is subject to change in version updates.

A Customer Service Report (CSR) is collected from the menu under Settings > System > Customer Service Report (CSR).  Select the green "Download CSR" button.  The system will begin to collect configuration information and logs.  There will not be an hourglass or other notification that the CSR is being generated.  There will be a message in the bottom left of the browser saying "Waiting for hostname".  Depending on the size of the files, the CSR could take anywhere between 1 minute and several hours to download.

A CSR contains configuration files and log files.  Here is a sample of the configuration and log files:


root directory: 

df - Contains free disk space and lists mounted filesystems.
ps - Contains the processes which were running during the day in five-minute intervals.
top - Contains a list of the processes running, their cpu usage, and a load average for the day.
iostat - Statistical results showing the usage of each of the virtual disks.
dscapture - Shows the amount of data captured, which interfaces are capturing, and the recycle count
ethtool - Shows the status of the NICs
free - Shows memory usage
db_queries - Includes queries to the postgres database
megacli - Detailed disk status (info/lsi-show is a summary)
db_summary - Shows tables and database sizes
messages - The /var/log/messages file with application status output, including reports run
netapp_health - Contains the current health status of the netapp storage array.


config subdirectory:

issue - Version level of the appliance
issue.history - shows the version upgrade path since initial installation
capture-config - Devices used for packet capture
index-config - Devices used for index
ntp.conf - Network Time Protocol configuration
pam.d - Authentication configuration files
apps_config.json - Reindexer configuration as well as other customizations
dmidecode-out.txt - Hardware serial numbers, slot numbers, revisions, Asset Tag/Serial number
DSMODEL - System type, ie R620 or R720 or DS202
ifcfg-eth0 - Configuation of the eth0 NIC


info subdirectory:

dslicenseinfo.out - License entitlements
dsvpn.out - VPN configuration for central manager > sensor communication
fdisk.info - Virtual disks on the system and their sizes.
lsi-show.txt - Current status of the virtual disks.  Useful for diagnosing failed disks
powervault.txt - Contains the current health status of our most current storage arrays, the U144 and U840
admin.bash_history - list of all recent CLI commands run by the admin user
root.bash_history - list of all recent CLI commands run by the root user
psql_queries.out.gz - list of all database tables in postgres and values


log subdirectory: 

postgresql.log - Logs of postgres database transactions
firstboot.log - Details of the last installation
dsfsck.out - Details of the last capture filesystem/database check
secure - Login details for users

CSR's also include historical files.  These will be designated with a '-date.gz'  By default we keep the last 2 weeks of historical data for popular statistics such as db_querries, db_summary, df, df_i, diskspace_txt, dscapture, ethtool, extractord, filter, free, ifconfig, iostat, megacli, network_txt, oomstat, ps, ps_e, regen, slots_txt, top, tw_cli.  Each gzipped file includes a single day of statistics.  Some of these statistics run every hour and some every 5 minutes.  

For additional details on what the CSR script does and what the frequency of the CSR cron jobs are, check the following files in the /config directory of the extracted CSR file:

csr.sh
csr_cron  (also located in the /usr/share/solera/ directory on the appliance itself)