How to collect troubleshooting data for a suspected policy problem

Products

ProxySG Software - SGOS ISG Proxy

Issue/Introduction

Policy issues will usually require a policy trace along with configuration information from the Proxy. Following are instructions on how to gather a policy trace using 2 different methods.

This document assumes your proxy is at IP X.X.X.50 and is reachable with HTTPS port 8082.

Resolution

Unfiltered Policy Trace

Use this template when an unfiltered policy trace is required. An unfiltered policy trace has a maximum size of 1 Megabyte. This can be used in cases where you are using a lab proxy or your production proxy does not have a high traffic load. Obtaining this on a busy proxy will most likely result in not catching the error.

In the web management console click Configuration -> Policy -> Policy Options then click "Trace all Policy execution"
Reproduce the issue
Go back and uncheck trace all policy execution
Collect the trace file, sysinfo, and event log
Browse to https://X.X.X.50:8082/policy/trace/ and download the default_trace.html file
Browse to https://X.X.X.50:8082/sysinfo, ensure the page has completely loaded, and safe it as a .txt file (not MHT nor HTM/HTML)
Browse to https://X.X.X.50:8082/Eventlog/Statistics and click the link to download the log. It can be saved as the default format of .log.
Browse to https://X.X.X.50:8082/Diagnostics/Snapshot. Save each snapshot by clicking the "download all". There are two by default but may be many more, please download each one.
Store all requested files in an archive (please use .zip) and upload them to the Service Request opened with support by browsing to Broadcom Support and completing the form.
Please provide the IP of the client you were browsing from, the URL producing the issue, and if you are using proxy authentication the user name of the user running the test to technical support.

Policy Trace Filtered by IP

This can be used to take filtered policy trace and capture policy based on client IP. Use this when you have a production proxy that is handling a high traffic load.

To enable policy trace for a single IP address using the Visual Policy Manager (VPM):

Open VPM, select Policy and create a new Web Access layer. This new Web Access layer will have just one rule in it.
On source right click and select Set and then New. Select Client IP address/Subnet.
Enter the IP address of the client you are running the testing from. There is no need to enter a subnet.
Select Add and then close. On the Set source object window select this client IP and then OK.
On Track right click and select Set, New, and then Trace
Select the Trace Level selection and then Rule and Request tracing. Select OK and then OK.
Install policy. Now all activity for the configured client IP address will be dumped to the policy trace file. Reproduce the issue and when you are done getting policy trace information delete or disable this rule.
Collect the trace file, sysinfo, and event log
Browse to https://X.X.X.50:8082/policy/trace/ and download the default_trace.html file
Browse to https://X.X.X.50:8082/sysinfo, ensure the page has completely loaded, and safe it as a .txt file (not MHT nor HTM/HTML)
Browse to https://X.X.X.50:8082/Eventlog/Statistics and click the link to download the log. It can be saved as the default format of .log.
Browse to https://X.X.X.50:8082/Diagnostics/Snapshot. Save each snapshot by clicking the "download all". There are two by default but may be many more, please download each one.
Store all requested files in an archive (please use .zip) and upload them to the Service Request opened with support by browsing to Broadcom Support
Please provide the IP of the client you were browsing from, the URL producing the issue, and if you are using proxy authentication the user name of the user running the test to technical support.

Why this data is needed
The policy trace shows every rule in your policy that is hit. The unfiltered policy trace shows misses as well, though those are not generally as useful (any rule which is not hit can be considered a miss).
The sysinfo contains the full configuration, detailed statistics, and the entire compiled policy on your Edge SWG(ProxySG).
The eventlog can point out policy conflicts or other error messages which can help lead to the root cause of the problem.
The snapshots are sysinfo files taken at regular intervals (1 day and 1 hour by default). This can help uncover a policy or configuration change that may have contributed to the problem.