You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
22
+
-[Microsoft Defender XDR](/defender-xdr)
23
+
24
+
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-pullalerts-abovefoldlink)
25
+
26
+
When contacting support, you might be asked to provide the output package of the Microsoft Defender for Endpoint Client Analyzer tool.
27
+
18
28
The XMDEClientAnalyzer is used for diagnosing Microsoft Defender for Endpoint health or reliability issues on onboarded devices running Linux.
19
29
20
-
There are two ways to run the client analyzer tool:
30
+
There are two different ways to run the client analyzer tool using live response or locally:
21
31
22
32
1. Using a binary version (no external Python dependency)
23
-
2. Using a Python-based solution
33
+
1. Using a Python-based solution
34
+
35
+
## Collect support logs in Microsoft Defender for Endpoint using live response
36
+
37
+
This section provides instructions on how to run the tool via Live Response on Linux machines.
38
+
39
+
## Linux
40
+
41
+
The XMDE Client Analyzer tool can be downloaded as a [binary](https://aka.ms/XMDEClientAnalyzerBinary) or [Python](https://aka.ms/XMDEClientAnalyzer) package that can be extracted and executed on Linux machines. Both versions of the XMDE Client Analyzer can be executed during a Live Response session.
42
+
43
+
### Prerequisites
44
+
45
+
- For installation the `unzip` package is required.
46
+
47
+
- For execution the `acl` package is required.
48
+
49
+
> [!IMPORTANT]
50
+
> Window uses the Carriage Return and Line Feed invisible characters to represent the end of one line and beginning of a new line in a file, but Linux systems uses only the Line Feed invisible character at the end of its file lines. When using the following scripts, if done on Windows, this difference can result in errors and failures of the scripts to run. A potential solution to this is to utilize the Windows Subsystem for Linux and the `dos2unix` package to reformat the script so it aligns with the Unix and Linux format standard.
51
+
52
+
### Installing the XMDE Client Analyzer
53
+
54
+
Both versions of XMDE Client Analyzer, binary and Python, a self-contained package that must be downloaded and extracted before executing, and the complete set of steps for this process can be found:
55
+
56
+
-[Running the Binary version of the Client Analyzer](/defender-endpoint/run-analyzer-macos-linux)
57
+
58
+
-[Running the Python version of the Client Analyzer](/defender-endpoint/run-analyzer-macos-linux)
59
+
60
+
Due to the limited commands available in Live Response the steps detailed must be executed in a bash script, and by splitting the installation and execution portion of these commands it's possible to run the install script once, while running the execution script multiple times.
61
+
62
+
> [!IMPORTANT]
63
+
> The example scripts assume the machine has direct internet access and can retrieve the XMDE Client Analyzer from Microsoft. If the machine does not have direct internet access then the installation scripts will need to be updated to fetch the XMDE Client Analyzer from a location the machines can access successfully.
64
+
65
+
#### Binary Client Analyzer Install Script
66
+
67
+
The following script performs the first six steps of the [Running the Binary version of the Client Analyzer](/defender-endpoint/run-analyzer-macos-linux). When complete, the XMDE Client Analyzer binary is available from the `/tmp/XMDEClientAnalyzerBinary/ClientAnalyzer` directory.
68
+
69
+
1. Create a bash file `InstallXMDEClientAnalyzer.sh` and paste the following content into it.
echo"MDESupportTool installed at /tmp/XMDEClientAnalyzerBinary/ClientAnalyzer"
88
+
89
+
```
90
+
91
+
#### Python Client Analyzer Install Script
92
+
93
+
The following script performs the first six steps of the [Running the Python version of the Client Analyzer](/defender-endpoint/run-analyzer-macos-linux). When complete, the XMDE Client Analyzer Python scripts are available from the `/tmp/XMDEClientAnalyzer` directory.
94
+
95
+
1. Create a bash file `InstallXMDEClientAnalyzer.sh` and paste the following content into it.
echo"Setting execute permissions on mde_support_tool.sh script"
111
+
cd /tmp/XMDEClientAnalyzer
112
+
chmod a+x mde_support_tool.sh
113
+
114
+
echo"Performing final support tool setup"
115
+
./mde_support_tool.sh
116
+
117
+
```
118
+
119
+
#### Running the Client Analyzer Install Scripts
120
+
121
+
1. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) on the machine you need to investigate.
122
+
123
+
2. Select **Upload file to library**.
124
+
125
+
3. Select **Choose file**.
126
+
127
+
4. Select the downloaded file named `InstallXMDEClientAnalyzer.sh`, and then select **Confirm**.
128
+
129
+
5. While still in the LiveResponse session, use the following commands to install the analyzer:
130
+
131
+
```console
132
+
run InstallXMDEClientAnalyzer.sh
133
+
```
134
+
135
+
### Running the XMDE Client Analyzer
136
+
137
+
Live Response doesn't support running the XMDE Client Analyzer or Python directly, so an execution script is necessary.
138
+
139
+
> [!IMPORTANT]
140
+
> The following scripts assume the XMDE Client Analyzer was installed using the same locations from the scripts mentioned earlier. If your organization has chosen to install the scripts into a different location, then the following scripts need to be updated to align with your organization's chosen installation location.
141
+
142
+
#### Binary Client Analyzer Run Script
143
+
144
+
The Binary Client Analyzer accepts command line parameters to perform different analysis tests. To provide similar capabilities during Live Response the execution script takes advantage of the `$@` bash variable to pass all input parameters provided to the script to the XMDE Client Analyzer.
145
+
146
+
1. Create a bash file `MDESupportTool.sh` and paste the following content into it.
The Python Client Analyzer accepts command line parameters to perform different analysis tests. To provide similar capabilities during Live Response the execution script takes advantage of the `$@` bash variable to pass all input parameters provided to the script to the XMDE Client Analyzer.
162
+
163
+
1. Create a bash file `MDESupportTool.sh` and paste the following content into it.
164
+
165
+
```bash
166
+
#! /usr/bin/bash
167
+
168
+
echo"cd /tmp/XMDEClientAnalyzer"
169
+
cd /tmp/XMDEClientAnalyzer
170
+
171
+
echo"Running mde_support_tool"
172
+
./mde_support_tool.sh $@
173
+
174
+
```
175
+
176
+
#### Running the Client Analyzer Script
177
+
178
+
> [!NOTE]
179
+
> If you have an active Live Response session you can skip Step 1.
180
+
181
+
1. Initiate a [Live Response session](live-response.md#initiate-a-live-response-session-on-a-device) on the machine you need to investigate.
182
+
183
+
2. Select **Upload file to library**.
184
+
185
+
3. Select **Choose file**.
186
+
187
+
4. Select the downloaded file named `MDESupportTool.sh`, and then select **Confirm**.
188
+
189
+
1. While still in the Live Response session, use the following commands to run the analyzer and collect the resulting file.
190
+
191
+
```
192
+
run MDESupportTool.sh -parameters "--bypass-disclaimer -d"
193
+
GetFile "/tmp/your_archive_file_name_here.zip"
194
+
```
195
+
196
+
## Collect Microsoft Defender for Endpoint support logs locally
197
+
198
+
This section provides instructions on how to run the tool locally on the Linux machines.
24
199
25
200
## Running the binary version of the client analyzer
26
201
27
202
1. Download the [XMDE Client Analyzer Binary](https://aka.ms/XMDEClientAnalyzerBinary) tool to the Linux machine you need to investigate.
28
203
If you're using a terminal, download the tool by entering the following command:
Use OS tracing facilities to record Defender for Endpoint performance traces.
192
-
193
-
> [!NOTE]
194
-
> This functionality exists in the Python solution only.
195
-
196
-
```console
197
-
-h, --help show this help message and exit
198
-
--length LENGTH Length of time to record the trace (in seconds).
199
-
--mask MASK Mask to select with event to trace. Defaults to all
200
-
```
201
-
202
-
On running this command for the first time, it installs a Profile configuration.
203
-
204
-
Follow this to approve profile installation: [Apple Support Guide](https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac#:~:text=Install%20a%20configuration%20profile%20you%E2%80%99ve%20received).
205
-
206
-
Usage example `./mde_support_tool.sh trace --length 5`
> This functionality will be skipping the faulty rules. The faulty rule then needs to be further identified and fixed.
270
420
271
-
## Result package contents on macOS and Linux
421
+
## Result package contents on Linux
272
422
273
423
- report.html
274
424
275
425
Description: The main HTML output file that contains the findings and guidance from running the client analyzer tool on the device. This file is only generated when running the Python-based version of the client analyzer tool.
276
426
277
427
- mde_diagnostic.zip
278
428
279
-
Description: Same diagnostic output that gets generated when running *mdatp diagnostic create* on either [macOS](mac-resources.md#collecting-diagnostic-information) or [Linux](linux-resources.md#collect-diagnostic-information).
429
+
Description: Same diagnostic output that gets generated when running *mdatp diagnostic create* on [Linux](linux-resources.md#collect-diagnostic-information).
0 commit comments