Collect Historical (Non-Debug) Logs for CBX Agent

Products

• CBX Complete
• CBX Essentials

Issue/Introduction

Steps to collect standard historical (non-debug) logs for the CBX Agent for general troubleshooting or when requested by Support. This covers both local and remote collection.

Environment

• CBX Agent
• Microsoft Windows: All Supported Versions

Resolution

Method 1: Locally via SymDiag

1. Download SymDiag v3 and open SymDiagwin.exe
2. The application will automatically check for and install any available updates when it opens.
3. Click I accept the EULA to proceed.
4. Select Task (Step 1): Leave the default option selected (Collect Product Data with Optional Product Logging) and click Next.
5. Select Products (Step 3): Unless your technical support engineer specifically instructed you otherwise, leave the default setting (Logging Disabled) and click Next.
6. Scan Options (Step 4): Unless directed otherwise, Keep the default settings and click Next.
   • As mentioned in the download article, the number of active commands defaults to 50% of your system's virtual CPUs.
7. Customer Information (Step 6): Fill out the Name, Company, Case, Contact, and Issue fields. Type or browse to the folder where you want to save the final .sdz3 diagnostic file, then click Next.

Method 2: Remotely via the Console

1. Log into the CBX Console and navigate to Agent Management > Devices > Managed Devices
2. Click the vertical ellipsis (⋮ icon) next to the agent in question > Device Management > Collect Remote Diagnostics
3. Unless directed otherwise by support, leave Enable debug logging for X minutes as the default (0).
4. (Optional): click Show notification message on the user device, to notifier the end user that log collection is occuring.
5. Check I agree to the terms to continue with log collection
6. Click Continue
7. Click Command Status (⧖ icon) in the top right hand corner > Remote Diagnostic Log
8. Click the vertical ellipsis (⋮ icon) next to the agent in question > Download Log

Method 3: Remotely via Live Response

1. Log into the CBX Console and navigate to Agent Management > Devices > Managed Devices
2. Click the vertical ellipsis (⋮ icon) next to the agent in question > Detection and Response > Live Response
3. Within Live Response, change directory to where you want SymDiag to be downloaded. Ex:

   mkdir c:\temp\SymDiag
   cd c:\temp\SymDiag

4. Send SymDiag from your local machine to the remote machine path. Ex:

   put c:\temp\SymDiag

5. Run SymDiag:

   execfg SymDiagWin sd-s sd-base C:\temp\SymDiag sd-dest --dir "C:\temp\SymDiag" sd-log log

6. Once complete a file named <DeviceName>__<Year-Month-Day__Hour-Minute-Second>>.sdz3 will be created.
7. Retrieve and download the logs to your local machine

   get <filename>.sdz3

8. The file will download to whichever directory you have specified to download to (usually 'Downloads').
9. To open with SymDiag Viewer v3 the file it would need to be renamed again to have the .sdz3 extension.