Diagnostic Tools
ArcSight Management Center provides several diagnostic tools that help you set up, manage, and troubleshoot your appliance. You can run these diagnostics on the local appliance only. To run a diagnostic tool on a remote container, refer to Running Diagnostics on a Container.
To access the diagnostic tools:
-
Click Administration > Setup > System Admin from the top-level menu bar.
-
Click Diagnostic Tools in the System section in the left panel to open the Diagnostic Tools page.
-
From the Tool drop-down box, select the tool you want to use.
-
Enter the required parameters for the tool you selected and click Run (click Edit for the Edit text file tool).
Each tool, the parameters, and buttons available are described below.
Display I/O Statistics
Use the Display I/O Statistics tool to monitor input/output statistics for devices, partitions, and network file systems on the appliance. This tool is equivalent to the Linux command iostat.
This tool uses the parameters described below:
Parameter |
Description |
---|---|
Match Expression |
Type an expression to display only lines in the file that match that expression. Linux regular expressions are supported. Note: The expression is case sensitive. |
Exclude Expression |
Type an expression to exclude lines that match that expression from the display. Linux regular expressions are supported. Note: The expression is case sensitive. |
Display file
Use Display file to display the contents of a file. This tool is equivalent to the Linux command cat
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Category |
Select the type of file you want to display. |
File |
Displays a list of files for the type selected in the Category field (described above). Select the file you want to display from the list. Note: Appliance models Cx400 do not have any boot log files; selecting Boot Log from the File list displays an empty pop-up window. |
Match Expression |
Type an expression to display only lines in the file that match that expression. Linux regular expressions are supported. Note: The expression is case sensitive. |
Exclude Expression |
Type an expression to exclude lines that match that expression from the display. Linux regular expressions are supported. Note: The expression is case sensitive. |
Display |
You can limit the number of lines you want to display.
Note: If you select Beginning of file or End of file, you also need to specify a value in the Number of Lines field, described below. To display all the lines in the file, leave both the Display and the Number of Lines field empty. |
Number of Lines |
Specify the number of lines you want to display from the beginning or end of the file. If you enter an expression to match or exclude, the display contains or omits the first (if you select Beginning of file) or last (if you select End of file) number of occurrences of that expression. For example, if you enter Note: To display all the lines in the file, leave this field and the Display field (described above) empty. |
Run |
Click this button to display the contents of the selected file. The file contents display in a pop-up window. |
Display network connections
Use Display network connections to review your network connections and transport protocol statistics. The status information can indicate areas where a protocol is having a problem.
This tool is equivalent to the Linux command netstat -pn [-t] [-u] [-w] [a] [-l] [-c]
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Protocol |
Leave this field empty to display statistics for all transport protocols or select from these options:
|
Connection |
Leave this field empty to display information for all non-listening connections or select from these options:
|
Mode |
Select Run Continuously to poll the network status continuously every five minutes. This option is equivalent to the When Run Continuously is not selected, the network status is polled once. |
Match Expression |
Enter an expression to display only lines that match that expression in the output. Linux regular expressions are supported. |
Exclude Expression |
Enter an expression to exclude lines that match that expression from the output. Linux regular expressions are supported. |
Run |
Click this button to display the network connection information. The information displays in a pop-up window. |
Display network interface details
Use Display network interface details to display the status of a currently active interface on the appliance. This tool is equivalent to the Linux command ifconfig
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Interface |
Select the network interface on the appliance whose status you want to display. Note: If you leave this field empty, the status of all active network interfaces display. |
Run |
Click this button to display the status of the selected network interface. The status displays in a pop-up window. |
Display network traffic
Use Display network traffic to monitor packets that are transmitted and received on the network. This tool is equivalent to the Linux command tcpdump
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Host |
Specify the IP address or hostname of the host you want to monitor. |
Match Expression |
Enter an expression to show only network traffic that matches that expression in the display; For example, if you specify the expression Linux regular expressions are supported. |
Exclude Expression |
Enter an expression to exclude network traffic that matches that expression from the display; For example, if you specify the expression Linux regular expressions are supported. |
Run |
Click this button to display network traffic between the appliance and the specified host. The information displays in a pop-up window. |
Display process summary
Use Display process summary to show a list of the currently running processes and see how long they have been running. This tool is equivalent to the Linux command top -b -n 1
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Match Expression |
Enter an expression to display only processes that match that expression. Linux regular expressions are supported. |
Exclude Expression |
Enter an expression to exclude processes that match that expression from the display. Linux regular expressions are supported. |
Run |
Click this button to display the list of currently running processes. The list displays in a pop-up window. |
Display routing table
Use Display routing table to see the routes through which traffic flows from the appliance. This tool is equivalent to the Linux command ip route
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Destination Host |
|
Run |
Click this button to obtain the routing table. The routing table displays in a pop-up window. |
Edit text file
Use Edit text file to edit files on the appliance. This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Category |
Select the type of file you want to edit. |
File |
Displays a list of files for the type selected in the Category field (described above). Select the file you want to edit. |
Edit |
Click this button to display the file for editing. After editing the file, click Save or Revert. |
Save |
Click this button to save the edits you make to the file. |
Revert |
Click this button to cancel the edits you make to the file. After clicking Revert, click Save to save the reverted text. |
List directory
Use List directory to display the contents of a directory on the appliance. This tool is equivalent to the Linux command ls -alh
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Directory |
Specify the directory whose contents you want to display. For example: |
Run |
Click this button to display the directory list. The list displays in a pop-up window. |
List open files
Use List open files to display a list of files in use. This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Match Expression |
Enter an expression to display only the top processes that match that expression. Linux regular expressions are supported. |
Exclude Expression |
Enter an expression to exclude processes that match that expression from the display. Linux regular expressions are supported. |
Run |
Click this button to display the list of the top processes. The list displays in a pop-up window. |
List processes
Use List processes to display the top CPU processes that are currently running together with memory and resource information. This tool is equivalent to the Linux command ps -ef
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Match Expression |
Enter an expression to display only the top processes that match that expression. Linux regular expressions are supported. |
Exclude Expression |
Enter an expression to exclude processes that match that expression from the display. Linux regular expressions are supported. |
Run |
Click this button to display the list of the top processes. The list displays in a pop-up window. |
Ping host
Use Ping host to test if a particular host is reachable across an IP network and to measure the round-trip time for packets sent from the appliance to the host. This tool is equivalent to the Linux command ping
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Host |
Specify the IP address or hostname of the host you want to ping. |
Run |
Click this button to ping the specified host. The ping results display in a pop-up window. |
Resolve hostname or IP Address
Use Resolve hostname to look up a hostname in the Domain Name Server and convert it to an IP address . This tool is equivalent to the Linux command host
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Hostname |
Specify the hostname you want to resolve to an IP address . |
Run |
Click this button to look up the hostname in the Domain Name Server. The result displays in a pop-up window. |
Scan network ports
Use Scan network ports to scan a specific host on the network for open ports. This tool is equivalent to the Linux command nmap [-p]
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Host |
Specify the IP address or hostname of the host whose ports you want to scan. |
Port Range |
Optional. Specify a range of ports you want to scan. Separate port numbers in a range by a dash (-) and individual port numbers by a comma. For example, 80-90, 8080. If you do not provide a port range, all ports on the specified host are scanned. This option is equivalent to the |
Run |
Click this button to start scanning ports on the specified host. The result displays in a pop-up window. |
Send signal to container
Use Send signal to container to send a terminate command to a container. This tool is equivalent to the Linux command kill -
severity
(where severity
is either -15
or -9
).
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Severity |
Select the severity of the terminate command you want to send to the container. You can select KILL (Linux |
Container |
Select the container to which you want to send the signal. |
Run |
Click this button to send the signal. The result displays in a pop-up window. |
Tail file
Use Tail file to display the last ten lines of a system, application, or log file. This tool is equivalent to the Linux command tail -f
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Category |
Select the type of file you want to edit. |
File |
Displays a list of files for the category selected in the Category field (described above). Select the file from which you want to display the last ten lines. |
Match Expression |
Enter an expression to display only lines that match that expression. Linux regular expressions are supported. |
Exclude Expression |
Enter an expression to exclude lines from the display that match that expression. Linux regular expressions are supported. |
Run |
Click this button to display the last ten lines of the file you selected. The lines display in a pop-up window. |
Trace network route
Use Trace network route to display the specific network route between the appliance and a specified host. This tool is equivalent to the Linux command traceroute
.
This tool uses the parameters described below:
Parameter/Button |
Description |
---|---|
Host |
Specify the IP address or hostname of the host whose route you want to trace. |
Run |
Click this button to display the network route. The information displays in a pop-up window. |