How to Collect a HAR File and HTTP Error Logs Using Safari
book
Article ID: 286831
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Capture diagnostic logs from a web browser for UI troubleshooting using Safari
Environment
Apple Safari: All Supported Versions
Resolution
Open Safari
Browse to the URL in question
Confirm that the "Develop" menu is visible at the top of the window
If the "Develop" menu is not visible then go to Safari > Preferences > Advanced > check the box, "Show Develop Menu in menu bar"
Navigate to Develop > Show Web Inspector
Refresh the page to start capturing traffic
Reproduce the issue
Control + click on the resource in question and click "Export HAR"
Check for and save HTTP Error details
For any errors observed above, note the Request URL and HTTP error number (4## or 5##)
Select the Console tab
Locate the error number tied to the Request URL
Right-click matching error and click "Save As..."
Set name of file, including at least HTTP error number, and save file to your computer
Example
Original filename: defense-prod05.conferdeploy.net-1646930859819.log
Updated filename: 400_defense-prod05.conferdeploy.net-1646930859819.log
Attach the HAR file and HTTP Error file to the case, or use CB Vault if the file is larger than 25 MB
Additional Information
The "Show Web Inspector" option will not be available until the user browses beyond Safari's home page.
All credentials and session cookies within a HAR file should be removed before sharing with Carbon Black
The HAR file is a text file, it can be opened in a text editor and searched for the SESSION cookie value and replaced with <REDACTED>
This can also be done for passwords and API tokens if they were part of the recording
It's also recommended to logout from the Carbon Black session after recording a HAR session. This is a precaution that should invalidate session IDs if any were missed.
HAR Files under 25 MB can be attached directly to a Carbon Black Technical Support case.
Files larger than 25 MB should be uploaded to CB Vault.