Data to gather when troubleshooting the SyncAPI or Splunk App in Cloud SWG (formerly known as WSS)

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

You experience an issue with the SyncAPI or the Splunk App in Cloud SWG (formerly known as WSS).

You need to collect data for the Splunk App and Transfer Agent (TA).

Resolution

Supplying the information below provides insight into where the possible issue originates and helps to identify the cause.

Gather the following before creating your case with Symantec Support:

• Make sure you are running the latest version of the Symantec Web Security Service App for Splunk
• Provide us with the Credential API Username for Symantec Web Security Service
• Gather the timestamp in UTC when the issue was observed.
• Gather the WSS Splunk logs which are written in $SPLUNK_HOME/etc/var/log/scwss/scwss-poll.log
• Check in folder /opt/splunk/etc/apps/TA-SymantecWebSecurityService/bin for corrupted files and provide us with the last 3 cloud_archive_XXXXXXXX_stash_ta_scwss_logs.zip file.

NOTE: You may be asked to gather further data and information for troubleshooting purposes.

Additional Information

• Test log export from Cloud SWG for use in a SIEM
• Understand Cloud SWG Sync API Response Codes