Diagnostic Tools

ArcSight Management Center provides several diagnostic tools that help you set up, manage, and troubleshoot your appliance. You can run these diagnostics on the local appliance only. To run a diagnostic tool on a remote container, refer to Running Diagnostics on a Container.

To access the diagnostic tools:

  1. Click Administration > Setup > System Admin from the top-level menu bar.

  2. Click Diagnostic Tools in the System section in the left panel to open the Diagnostic Tools page.

  3. From the Tool drop-down box, select the tool you want to use.  

  4. Enter the required parameters for the tool you selected and click Run (click Edit for the Edit text file tool).

Each tool, the parameters, and buttons available are described below.

Display I/O Statistics

Use the Display I/O Statistics tool to monitor input/output statistics for devices, partitions, and network file systems on the appliance. This tool is equivalent to the Linux command iostat.

This tool uses the parameters described below:

Parameter

Description

Match Expression

Type an expression to display only lines in the file that match that expression. Linux regular expressions are supported.

Note: The expression is case sensitive.

Exclude Expression

Type an expression to exclude lines that match that expression from the display. Linux regular expressions are supported.

Note: The expression is case sensitive.

Display file

Use Display file to display the contents of a file. This tool is equivalent to the Linux command cat.

This tool uses the parameters described below:

Parameter/Button

Description

Category

Select the type of file you want to display.

File

Displays a list of files for the type selected in the Category field (described above). Select the file you want to display from the list.

Note: Appliance models Cx400 do not have any boot log files; selecting Boot Log from the File list displays an empty pop-up window.

Match Expression

Type an expression to display only lines in the file that match that expression. Linux regular expressions are supported.

Note: The expression is case sensitive.

Exclude Expression

Type an expression to exclude lines that match that expression from the display. Linux regular expressions are supported.

Note: The expression is case sensitive.

Display

You can limit the number of lines you want to display.

  • Select Beginning of file to limit the display to the number of lines specified in the Number of Lines field (described below) starting from the top of the file.

  • Select End of file to limit the display to the number of lines specified in the Number of Lines field (described below) starting from the bottom of the file.

Note: If you select Beginning of file or End of file, you also need to specify a value in the Number of Lines field, described below.

To display all the lines in the file, leave both the Display and the Number of Lines field empty.

Number of Lines

Specify the number of lines you want to display from the beginning or end of the file.

If you enter an expression to match or exclude, the display contains or omits the first (if you select Beginning of file) or last (if you select End of file) number of occurrences of that expression. For example, if you enter TCP in the Exclude Expression field, then select Beginning of file from the Display drop-down, and enter 10 in the Number of Lines field, the display contains the first 10 occurrences of the expression TCP found starting from the beginning of the file.

Note: To display all the lines in the file, leave this field and the Display field (described above) empty.

Run

Click this button to display the contents of the selected file. The file contents display in a pop-up window.

Display network connections

Use Display network connections to review your network connections and transport protocol statistics. The status information can indicate areas where a protocol is having a problem.

This tool is equivalent to the Linux command netstat -pn [-t] [-u] [-w] [a] [-l] [-c].

This tool uses the parameters described below:

Parameter/Button

Description

Protocol

Leave this field empty to display statistics for all transport protocols or select from these options:

  • RAW only displays raw IP protocol statistics. This option is equivalent to the netstat Linux command option -w.

  • TCP only displays TCP protocol statistics. This option is equivalent to the netstat Linux command option -t.

  • UDP only displays UDP protocol statistics. This option is equivalent to the netstat Linux command option -u.

Connection

Leave this field empty to display information for all non-listening connections or select from these options:

  • All connections displays information for all current connections. This option is equivalent to the netstat Linux command option -a.

  • Listening connections displays information for listening connections only. This option is equivalent to the netstat Linux command option -l.

Mode

Select Run Continuously to poll the network status continuously every five minutes. This option is equivalent to the netstat Linux command option -c.

When Run Continuously is not selected, the network status is polled once.

Match Expression

Enter an expression to display only lines that match that expression in the output. Linux regular expressions are supported.

Exclude Expression

Enter an expression to exclude lines that match that expression from the output. Linux regular expressions are supported.

Run

Click this button to display the network connection information. The information displays in a pop-up window.

Display network interface details

Use Display network interface details to display the status of a currently active interface on the appliance. This tool is equivalent to the Linux command ifconfig.

This tool uses the parameters described below:

Parameter/Button

Description

Interface

Select the network interface on the appliance whose status you want to display.

Note: If you leave this field empty, the status of all active network interfaces display.

Run

Click this button to display the status of the selected network interface. The status displays in a pop-up window.

Display network traffic

Use Display network traffic to monitor packets that are transmitted and received on the network. This tool is equivalent to the Linux command tcpdump.

This tool uses the parameters described below:

Parameter/Button

Description

Host

Specify the IP address or hostname of the host you want to monitor.

Match Expression

Enter an expression to show only network traffic that matches that expression in the display; For example, if you specify the expression echo, only network traffic from the specified host that includes the expression echo is displayed.

Linux regular expressions are supported.

Exclude Expression

Enter an expression to exclude network traffic that matches that expression from the display; For example, if you specify the expression echo, all traffic except traffic that contains echo will be displayed.

Linux regular expressions are supported.

Run

Click this button to display network traffic between the appliance and the specified host. The information displays in a pop-up window.

Display process summary

Use Display process summary to show a list of the currently running processes and see how long they have been running. This tool is equivalent to the Linux command
top -b -n 1.

This tool uses the parameters described below:

Parameter/Button

Description

Match Expression

Enter an expression to display only processes that match that expression. Linux regular expressions are supported.

Exclude Expression

Enter an expression to exclude processes that match that expression from the display. Linux regular expressions are supported.

Run

Click this button to display the list of currently running processes. The list displays in a pop-up window.

Display routing table

Use Display routing table to see the routes through which traffic flows from the appliance. This tool is equivalent to the Linux command ip route.

This tool uses the parameters described below:

Parameter/Button

Description

Destination Host

  • Leave this field empty to see the entire IP routing table.

  • Specify the IP address or hostname of a host to see IP routing information from the appliance to that host.

Run

Click this button to obtain the routing table. The routing table displays in a pop-up window.

Edit text file

Use Edit text file to edit files on the appliance. This tool uses the parameters described below:

Parameter/Button

Description

Category

Select the type of file you want to edit.

File

Displays a list of files for the type selected in the Category field (described above). Select the file you want to edit.

Edit

Click this button to display the file for editing. After editing the file, click Save or Revert.

Save

Click this button to save the edits you make to the file.

Revert

Click this button to cancel the edits you make to the file. After clicking Revert, click Save to save the reverted text.

List directory

Use List directory to display the contents of a directory on the appliance. This tool is equivalent to the Linux command ls -alh.

This tool uses the parameters described below:

Parameter/Button

Description

Directory

Specify the directory whose contents you want to display. For example: /opt/arcsight/appliance

Run

Click this button to display the directory list. The list displays in a pop-up window.

List open files

Use List open files to display a list of files in use. This tool uses the parameters described below:

Parameter/Button

Description

Match Expression

Enter an expression to display only the top processes that match that expression. Linux regular expressions are supported.

Exclude Expression

Enter an expression to exclude processes that match that expression from the display. Linux regular expressions are supported.

Run

Click this button to display the list of the top processes. The list displays in a pop-up window.

List processes

Use List processes to display the top CPU processes that are currently running together with memory and resource information. This tool is equivalent to the Linux command
ps -ef.

This tool uses the parameters described below:

Parameter/Button

Description

Match Expression

Enter an expression to display only the top processes that match that expression. Linux regular expressions are supported.

Exclude Expression

Enter an expression to exclude processes that match that expression from the display. Linux regular expressions are supported.

Run

Click this button to display the list of the top processes. The list displays in a pop-up window.

Ping host

Use Ping host to test if a particular host is reachable across an IP network and to measure the round-trip time for packets sent from the appliance to the host. This tool is equivalent to the Linux command ping.

This tool uses the parameters described below:

Parameter/Button

Description

Host

Specify the IP address or hostname of the host you want to ping.

Run

Click this button to ping the specified host. The ping results display in a pop-up window.

Resolve hostname or IP Address

Use Resolve hostname to look up a hostname in the Domain Name Server and convert it to an IP address . This tool is equivalent to the Linux command host.

This tool uses the parameters described below:

Parameter/Button

Description

Hostname

Specify the hostname you want to resolve to an IP address .

Run

Click this button to look up the hostname in the Domain Name Server. The result displays in a pop-up window.

Scan network ports

Use Scan network ports to scan a specific host on the network for open ports. This tool is equivalent to the Linux command nmap [-p].

This tool uses the parameters described below:

Parameter/Button

Description

Host

Specify the IP address or hostname of the host whose ports you want to scan.

Port Range

Optional. Specify a range of ports you want to scan. Separate port numbers in a range by a dash (-) and individual port numbers by a comma. For example, 80-90, 8080.

If you do not provide a port range, all ports on the specified host are scanned.

This option is equivalent to the netstat Linux command option -p.

Run

Click this button to start scanning ports on the specified host. The result displays in a pop-up window.

Send signal to container

Use Send signal to container to send a terminate command to a container. This tool is equivalent to the Linux command kill -severity (where severity is either -15 or -9).

This tool uses the parameters described below:

Parameter/Button

Description

Severity

Select the severity of the terminate command you want to send to the container. You can select KILL (Linux kill command option -9) or TERM (Linux kill command option -15).

Container

Select the container to which you want to send the signal.

Run

Click this button to send the signal. The result displays in a pop-up window.

Tail file

Use Tail file to display the last ten lines of a system, application, or log file. This tool is equivalent to the Linux command tail -f.

This tool uses the parameters described below:

Parameter/Button

Description

Category

Select the type of file you want to edit.

File

Displays a list of files for the category selected in the Category field (described above). Select the file from which you want to display the last ten lines.

Match Expression

Enter an expression to display only lines that match that expression. Linux regular expressions are supported.

Exclude Expression

Enter an expression to exclude lines from the display that match that expression. Linux regular expressions are supported.

Run

Click this button to display the last ten lines of the file you selected. The lines display in a pop-up window.

Trace network route

Use Trace network route to display the specific network route between the appliance and a specified host. This tool is equivalent to the Linux command traceroute.

This tool uses the parameters described below:

Parameter/Button

Description

Host

Specify the IP address or hostname of the host whose route you want to trace.

Run

Click this button to display the network route. The information displays in a pop-up window.