Skip to content

Commit e2cdae7

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #264196 from btray900/patch-1
[operator nexus] Update howto-baremetal-run-data-extract.md for mde-support-diagnostics
2 parents 5fd9cc2 + 8522dfd commit e2cdae7

File tree

1 file changed

+184
-33
lines changed

1 file changed

+184
-33
lines changed

‎articles/operator-nexus/howto-baremetal-run-data-extract.md

Lines changed: 184 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -27,18 +27,22 @@ The run data extract command executes one or more predefined scripts to extract
2727

2828
The current list of supported commands are
2929

30-
- SupportAssist/TSR collection for Dell troubleshooting\
30+
- [SupportAssist/TSR collection for Dell troubleshooting](#hardware-support-data-collection)\
3131
Command Name: `hardware-support-data-collection`\
3232
Arguments: Type of logs requested
3333
- `SysInfo` - System Information
3434
- `TTYLog` - Storage TTYLog data
3535
- `Debug` - debug logs
3636

37-
- Collect Microsoft Defender for Endpoints (MDE) agent information\
37+
- [Collect Microsoft Defender for Endpoints (MDE) agent information](#collect-mde-agent-information)\
3838
Command Name: `mde-agent-information`\
3939
Arguments: None
4040

41-
- Collect Dell Hardware Rollup Status\
41+
- [Collect MDE diagnostic support logs](#collect-mde-support-diagnostics)\
42+
Command Name: `mde-support-diagnostics`\
43+
Arguments: None
44+
45+
- [Collect Dell Hardware Rollup Status](#hardware-rollup-status)\
4246
Command Name: `hardware-rollup-status`\
4347
Arguments: None
4448

@@ -56,41 +60,21 @@ Specify multiple commands using json format in `--commands` option. Each `comman
5660

5761
These commands can be long running so the recommendation is to set `--limit-time-seconds` to at least 600 seconds (10 minutes). The `Debug` option or running multiple extracts might take longer than 10 minutes.
5862

59-
This example executes the `hardware-support-data-collection` command and get `SysInfo` and `TTYLog` logs from the Dell Server.
63+
In the response, the operation performs asynchronously and returns an HTTP status code of 202. See the [Viewing the Output](#viewing-the-output) section for details on how to track command completion and view the output file.
6064

61-
```azurecli
62-
az networkcloud baremetalmachine run-data-extract --name "bareMetalMachineName" \
63-
--resource-group "resourceGroupName" \
64-
--subscription "subscription" \
65-
--commands '[{"arguments":["SysInfo", "TTYLog"],"command":"hardware-support-data-collection"}]' \
66-
--limit-time-seconds 600
67-
```
65+
### Hardware Support Data Collection
6866

69-
This example executes the `mde-agent-information` command without arguments.
67+
This example executes the `hardware-support-data-collection` command and get `SysInfo` and `TTYLog` logs from the Dell Server. The script executes a `racadm supportassist collect` command on the designated baremetal machine. The resulting tar.gz file contains the zipped extract command file outputs in `hardware-support-data-<timestamp>.zip`.
7068

7169
```azurecli
7270
az networkcloud baremetalmachine run-data-extract --name "bareMetalMachineName" \
7371
--resource-group "resourceGroupName" \
7472
--subscription "subscription" \
75-
--commands '[{"command":"mde-agent-information"}]' \
73+
--commands '[{"arguments":["SysInfo", "TTYLog"],"command":"hardware-support-data-collection"}]' \
7674
--limit-time-seconds 600
7775
```
7876

79-
This example executes the `hardware-rollup-status` command without arguments.
80-
81-
```azurecli
82-
az networkcloud baremetalmachine run-data-extract --name "bareMetalMachineName" \
83-
--resource-group "resourceGroupName" \
84-
--subscription "subscription" \
85-
--commands '[{"command":"hardware-rollup-status"}]' \
86-
--limit-time-seconds 600
87-
```
88-
89-
In the response, the operation performs asynchronously and returns an HTTP status code of 202. See the **Viewing the output** section for details on how to track command completion and view the output file.
90-
91-
## Viewing the output
92-
93-
Sample output looks something like this. Note the provided link to the tar.gz zipped file from the command execution. The tar.gz file name identifies the file in the Storage Account of the Cluster Manager resource group. You can also use the link to directly access the output zip file. The tar.gz file also contains the zipped extract command file outputs in `hardware-support-data-<timestamp>.zip`. Download the output file from the storage blob to a local directory by specifying the directory path in the optional argument `--output-directory`.
77+
__`hardware-support-data-collection` Output__
9478

9579
```azurecli
9680
====Action Command Output====
@@ -112,15 +96,53 @@ Percent Complete=[100]
11296
Deleting Job JID_814372800396
11397
Collection successfully exported to /hostfs/tmp/runcommand/hardware-support-data-2023-04-13T21:00:01.zip
11498
115-
11699
================================
117100
Script execution result can be found in storage account:
118101
https://cm2p9bctvhxnst.blob.core.windows.net/bmm-run-command-output/dd84df50-7b02-4d10-a2be-46782cbf4eef-action-bmmdataextcmd.tar.gz?se=2023-04-14T01%3A00%3A15Zandsig=ZJcsNoBzvOkUNL0IQ3XGtbJSaZxYqmtd%2BM6rmxDFqXE%3Dandsp=randspr=httpsandsr=bandst=2023-04-13T21%3A00%3A15Zandsv=2019-12-12
119102
```
120103

104+
__Example list of hardware support files collected__
105+
106+
```
107+
Archive: TSR20240227164024_FM56PK3.pl.zip
108+
creating: tsr/hardware/
109+
creating: tsr/hardware/spd/
110+
creating: tsr/hardware/sysinfo/
111+
creating: tsr/hardware/sysinfo/inventory/
112+
inflating: tsr/hardware/sysinfo/inventory/sysinfo_CIM_BIOSAttribute.xml
113+
inflating: tsr/hardware/sysinfo/inventory/sysinfo_CIM_Sensor.xml
114+
inflating: tsr/hardware/sysinfo/inventory/sysinfo_DCIM_View.xml
115+
inflating: tsr/hardware/sysinfo/inventory/sysinfo_DCIM_SoftwareIdentity.xml
116+
inflating: tsr/hardware/sysinfo/inventory/sysinfo_CIM_Capabilities.xml
117+
inflating: tsr/hardware/sysinfo/inventory/sysinfo_CIM_StatisticalData.xml
118+
creating: tsr/hardware/sysinfo/lcfiles/
119+
inflating: tsr/hardware/sysinfo/lcfiles/lclog_0.xml.gz
120+
inflating: tsr/hardware/sysinfo/lcfiles/curr_lclog.xml
121+
creating: tsr/hardware/psu/
122+
creating: tsr/hardware/idracstateinfo/
123+
inflating: tsr/hardware/idracstateinfo/avc.log
124+
extracting: tsr/hardware/idracstateinfo/avc.log.persistent.1
125+
[..snip..]
126+
```
127+
128+
### Collect MDE Agent Information
129+
121130
Data is collected with the `mde-agent-information` command and formatted as JSON
122131
to `/hostfs/tmp/runcommand/mde-agent-information.json`. The JSON file is found
123-
in the data extract zip file located in the storage account.
132+
in the data extract zip file located in the storage account. The script executes a
133+
sequence of `mdatp` commands on the designated baremetal machine.
134+
135+
This example executes the `mde-agent-information` command without arguments.
136+
137+
```azurecli
138+
az networkcloud baremetalmachine run-data-extract --name "bareMetalMachineName" \
139+
--resource-group "resourceGroupName" \
140+
--subscription "subscription" \
141+
--commands '[{"command":"mde-agent-information"}]' \
142+
--limit-time-seconds 600
143+
```
144+
145+
__`mde-agent-information` Output__
124146

125147
```azurecli
126148
====Action Command Output====
@@ -129,23 +151,152 @@ MDE agent is running, proceeding with data extract
129151
Getting MDE agent information for bareMetalMachine
130152
Writing to /hostfs/tmp/runcommand
131153
132-
133154
================================
134155
Script execution result can be found in storage account:
135156
https://cmzhnh6bdsfsdwpbst.blob.core.windows.net/bmm-run-command-output/f5962f18-2228-450b-8cf7-cb8344fdss63b0-action-bmmdataextcmd.tar.gz?se=2023-07-26T19%3A07%3A22Z&sig=X9K3VoNWRFP78OKqFjvYoxubp65BbNTq%2BGnlHclI9Og%3D&sp=r&spr=https&sr=b&st=2023-07-26T15%3A07%3A22Z&sv=2019-12-12
136157
```
137158

159+
__Example JSON object collected__
160+
161+
```
162+
{
163+
"diagnosticInformation": {
164+
"realTimeProtectionStats": $real_time_protection_stats,
165+
"eventProviderStats": $event_provider_stats
166+
},
167+
"mdeDefinitions": $mde_definitions,
168+
"generalHealth": $general_health,
169+
"mdeConfiguration": $mde_config,
170+
"scanList": $scan_list,
171+
"threatInformation": {
172+
"list": $threat_info_list,
173+
"quarantineList": $threat_info_quarantine_list
174+
}
175+
}
176+
```
177+
178+
### Collect MDE Support Diagnostics
179+
180+
Data collected from the `mde-support-diagnostics` command uses the MDE Client Analyzer tool to bundle information from `mdatp` commands and relevant log files. The storage account `tgz` file will contain a `zip` file named `mde-support-diagnostics-<hostname>.zip`. The `zip` should be sent along with any support requests to ensure the supporting teams can use the logs for troubleshooting and root cause analysis, if needed.
181+
182+
This example executes the `mde-support-diagnostics` command without arguments.
183+
184+
```azurecli
185+
az networkcloud baremetalmachine run-data-extract --name "bareMetalMachineName" \
186+
--resource-group "resourceGroupName" \
187+
--subscription "subscription" \
188+
--commands '[{"command":"mde-support-diagnostics"}]' \
189+
--limit-time-seconds 600
190+
```
191+
192+
__`mde-support-diagnostics` Output__
193+
194+
```azurecli
195+
====Action Command Output====
196+
Executing mde-support-diagnostics command
197+
[2024-01-23 16:07:37.588][INFO] XMDEClientAnalyzer Version: 1.3.2
198+
[2024-01-23 16:07:38.367][INFO] Top Command output: [/tmp/top_output_2024_01_23_16_07_37mel0nue0.txt]
199+
[2024-01-23 16:07:38.367][INFO] Top Command Summary: [/tmp/top_summary_2024_01_23_16_07_370zh7dkqn.txt]
200+
[2024-01-23 16:07:38.367][INFO] Top Command Outliers: [/tmp/top_outlier_2024_01_23_16_07_37aypcfidh.txt]
201+
[2024-01-23 16:07:38.368][INFO] [MDE Diagnostic]
202+
[2024-01-23 16:07:38.368][INFO] Collecting MDE Diagnostic
203+
[2024-01-23 16:07:38.613][WARNING] mde is not running
204+
[2024-01-23 16:07:41.343][INFO] [SLEEP] [3sec] waiting for agent to create diagnostic package
205+
[2024-01-23 16:07:44.347][INFO] diagnostic package path: /var/opt/microsoft/mdatp/wdavdiag/5b1edef9-3b2a-45c1-a45d-9e7e4b6b869e.zip
206+
[2024-01-23 16:07:44.347][INFO] Successfully created MDE diagnostic zip
207+
[2024-01-23 16:07:44.348][INFO] Adding mde_diagnostic.zip to report directory
208+
[2024-01-23 16:07:44.348][INFO] Collecting MDE Health
209+
[...snip...]
210+
================================
211+
Script execution result can be found in storage account:
212+
https://cmmj627vvrzkst.blob.core.windows.net/bmm-run-command-output/7c5557b9-b6b6-a4a4-97ea-752c38918ded-action-bmmdataextcmd.tar.gz?se=2024-01-23T20%3A11%3A32Z&sig=9h20XlZO87J7fCr0S1234xcyu%2Fl%2BVuaDh1BE0J6Yfl8%3D&sp=r&spr=https&sr=b&st=2024-01-23T16%3A11%3A32Z&sv=2019-12-12
213+
```
214+
215+
After downloading the execution result file, the support files can be unzipped for analysis.
216+
217+
__Example list of information collected by the MDE Client Analyzer__
218+
219+
```azurecli
220+
Archive: mde-support-diagnostics-rack1compute02.zip
221+
inflating: mde_diagnostic.zip
222+
inflating: process_information.txt
223+
inflating: auditd_info.txt
224+
inflating: auditd_log_analysis.txt
225+
inflating: auditd_logs.zip
226+
inflating: ebpf_kernel_config.txt
227+
inflating: ebpf_enabled_func.txt
228+
inflating: ebpf_syscalls.zip
229+
inflating: ebpf_raw_syscalls.zip
230+
inflating: messagess.zip
231+
inflating: conflicting_processes_information.txt
232+
[...snip...]
233+
```
234+
235+
### Hardware Rollup Status
236+
138237
Data is collected with the `hardware-rollup-status` command and formatted as JSON to `/hostfs/tmp/runcommand/rollupStatus.json`. The JSON file is found
139-
in the data extract zip file located in the storage account.
238+
in the data extract zip file located in the storage account. The data collected will show the health of the machine subsystems.
239+
240+
This example executes the `hardware-rollup-status` command without arguments.
241+
242+
```azurecli
243+
az networkcloud baremetalmachine run-data-extract --name "bareMetalMachineName" \
244+
--resource-group "resourceGroupName" \
245+
--subscription "subscription" \
246+
--commands '[{"command":"hardware-rollup-status"}]' \
247+
--limit-time-seconds 600
248+
```
249+
250+
__`hardware-rollup-status` Output__
140251

141252
```azurecli
142253
====Action Command Output====
143254
Executing hardware-rollup-status command
144255
Getting rollup status logs for b37dev03a1c002
145256
Writing to /hostfs/tmp/runcommand
146257
147-
148258
================================
149259
Script execution result can be found in storage account:
150260
https://cmkfjft8twwpst.blob.core.windows.net/bmm-run-command-output/20b217b5-ea38-4394-9db1-21a0d392eff0-action-bmmdataextcmd.tar.gz?se=2023-09-19T18%3A47%3A17Z&sig=ZJcsNoBzvOkUNL0IQ3XGtbJSaZxYqmtd%3D&sp=r&spr=https&sr=b&st=2023-09-19T14%3A47%3A17Z&sv=2019-12-12
151261
```
262+
263+
__Example JSON Collected__
264+
265+
```
266+
{
267+
"@odata.context" : "/redfish/v1/$metadata#DellRollupStatusCollection.DellRollupStatusCollection",
268+
"@odata.id" : "/redfish/v1/Systems/System.Embedded.1/Oem/Dell/DellRollupStatus",
269+
"@odata.type" : "#DellRollupStatusCollection.DellRollupStatusCollection",
270+
"Description" : "A collection of DellRollupStatus resource",
271+
"Members" :
272+
[
273+
{
274+
"@odata.context" : "/redfish/v1/$metadata#DellRollupStatus.DellRollupStatus",
275+
"@odata.id" : "/redfish/v1/Systems/System.Embedded.1/Oem/Dell/DellRollupStatus/iDRAC.Embedded.1_0x23_SubSystem.1_0x23_Current",
276+
"@odata.type" : "#DellRollupStatus.v1_0_0.DellRollupStatus",
277+
"CollectionName" : "CurrentRollupStatus",
278+
"Description" : "Represents the subcomponent roll-up statuses.",
279+
"Id" : "iDRAC.Embedded.1_0x23_SubSystem.1_0x23_Current",
280+
"InstanceID" : "iDRAC.Embedded.1#SubSystem.1#Current",
281+
"Name" : "DellRollupStatus",
282+
"RollupStatus" : "Ok",
283+
"SubSystem" : "Current"
284+
},
285+
{
286+
"@odata.context" : "/redfish/v1/$metadata#DellRollupStatus.DellRollupStatus",
287+
"@odata.id" : "/redfish/v1/Systems/System.Embedded.1/Oem/Dell/DellRollupStatus/iDRAC.Embedded.1_0x23_SubSystem.1_0x23_Voltage",
288+
"@odata.type" : "#DellRollupStatus.v1_0_0.DellRollupStatus",
289+
"CollectionName" : "VoltageRollupStatus",
290+
"Description" : "Represents the subcomponent roll-up statuses.",
291+
"Id" : "iDRAC.Embedded.1_0x23_SubSystem.1_0x23_Voltage",
292+
"InstanceID" : "iDRAC.Embedded.1#SubSystem.1#Voltage",
293+
"Name" : "DellRollupStatus",
294+
"RollupStatus" : "Ok",
295+
"SubSystem" : "Voltage"
296+
},
297+
[..snip..]
298+
```
299+
300+
## Viewing the Output
301+
302+
Note the provided link to the tar.gz zipped file from the command execution. The tar.gz file name identifies the file in the Storage Account of the Cluster Manager resource group. You can also use the link to directly access the output zip file. The tar.gz file also contains the zipped extract command file outputs. Download the output file from the storage blob to a local directory by specifying the directory path in the optional argument `--output-directory`.

0 commit comments

Comments
 (0)