How to collect troubleshooting data for unexpected restart of the Edge SWG (ProxySG)

Products

• ProxySG Software - SGOS

Issue/Introduction

When experiencing unexpected restarts/reboots/crashes perform the following to obtain the data required to troubleshoot this issue.

Device down after unexpected restart.

Resolution

To use the automated features of the Management Console to collect the data perform the following:

Within the SG Management GUI, the Maintenance > Core Images may have “Software only, context” core selected.  This default setting generates a context core automatically upon restart, which can be used to identify the cause of the restart. In many cases a full core is needed and would need to be enabled prior to the restart. For more information see How to enable a full core dump on the Edge SWG (ProxySG) appliance.

To troubleshoot these types of issues we need to gather specific data from the Proxy which includes memory or context information.  This information is critical in determining the root cause of the issue.  Follow these steps after the proxy has experienced a restart.

In the management console click Maintenance -> Service Information -> Send information -> Send Service Information tab.

Enter the service request number (case number) and select the following items:

• Sysinfo
• Event Log
• Core Image (if available)
• Snapshots -> Select snapshots to send -> on the snapshot selection screen, add each snapshot from the lower portion to the upper portion and click ok
• Context -> Select contexts to send -> add the context that corresponds to the restart in question and click ok
• Click Send

To manually collect this data perform the following:

You can also manually pull the Core Image and Sysinfo.  You can access these directly by using the URLs below.

1. Sysinfo from the Proxy
https://192.0.2.50:8082/sysinfo

2. Context and full Core File from the Proxy
https://192.0.2.50:8082/CM/Core_Image

3. Snapshots from the Proxy
https://192.0.2.50:8082/Diagnostics/Snapshot
Save each snapshot using the "Download All" link for each section.  There are generally at least two but there may be more, so please gather all listed.

Download the context and full core (if available) which corresponds to the restart in question
Save these files, then upload to case via the Broadcom Support Portal.

Why this data needs to be collected:

As soon as the Edge SWG reboots unexpectedly, a core image is written which contains data relating to the restart: what was happening in memory at the time, pointer information, stack traces, and process(es) running at the time of the restart.  The core image can be the best piece of data to collect. In addition to that, the sysinfo contains full system configuration and policy as well as a lot of system statistics.  The event log can show system-level errors or problems. Snapshots are sysinfo files taken at regular intervals over a period of time (daily for the full sysinfo and hourly for a subset of statistics for the other snapshot).  This helps discover trend information at a very granular level.  All of these can help find the cause of an unexpected system restart.