What's Windows S-TAP Must Gather?

Windows S-TAP Must Gather is a Windows batch script that gathers troubleshooting information as well as Windows environment information. The file name is diag.bat, and it's installed as a part of Windows S-TAP.

In Guardium V11.2, the Must Gather script (diag.bat V2) was significantly improved. See the following articles in IBM Security Community site for details.

• Overview of Windows S-TAP Must Gather V2

• Files Collected by Windows S-TAP Must Gather V2

• Reading Basic Environment Information from Windows S-TAP Must Gather
  
  

The biggest improvement of the script in Guardium V11.3(diag.bat V2.1) is STANDALONE feature. The script can run separately from Windows S-TAP, and the script is installed in all Guardium Windows agents such as GIM, FAM, CAS, etc.

How to run the script?

It's simple. Open Windows Command Prompt as Administrator, and run
%WINSTAP_DIR%\Bin\diag.bat. The output files are zipped at
%WINSTAP_DIR%\Bin\zipTmp\xxx.zip.

The new Must Gather script (diag.bat V2.1) can run in any place in Windows Server. For example, if you put the script under C:\tmp directory, it'll generate a zip file at C:\tmp\zip\xxx.zip. This is how STANDALONE mode works. It's supported since Guardium V11.3 (diag.bat V2.1).

What's S-TAP mode and STANDALONE mode?

Until Guardium V11.2, Windows S-TAP Must Gather (diag.bat) is supposed to be a part of Windows S-TAP. It should be in Windows S-TAP installed directory, and it works with some other Windows S-TAP components. It can be executed from Guardium GUI, and generates a zip file as an output, and it'll be sent to the collector when UPLOAD_FEATURE is set to 1. This is how Must Gather works in S-TAP mode.

Starting Guardium V11.3, Must Gather (diag.bat) can work without any other Windows S-TAP components. You can copy diag.bat to any place in Windows server and run it standalone. It's called STANDALONE mode.

[NOTES]

(*1) The diag.bat V2.1 script runs as S-TAP mode when it's in Windows S-TAP directory, and run as STANDALONE mode when it's in other directory.

(*2) Windows FAM Crawler is supported in diag.bat V2.1.16 and newer.

(*3) The script generates some files and copies config/log files from Guardium agents (S-TAP, GIM, FAM, etc) to the ZIP source directory, and create a zip file at the ZIP target directory

(*4) The ExternalZip.exe is a part of Windows S-TAP. The compress-archive is a PowerShell command. It's support in Windows Server 2016 and newer, and Windows Server 2012 plus Windows Management Framework (WMF) 5.1. If you run diag.bat script in STANDARD mode on Windows Server 2012 without WMF 5.1, compress-archive doesn't exist and the script will keep all files under ZIP source directory, instead of generating a ZIP file. You can manually create a ZIP file from Windows Explorer.

Which mode should we use?

It depends. Let me show some examples.

• If you're using Windows S-TAP and you want to run Must Gather from Guardium GUI, you'll use S-TAP mode.
• If you get a problem in installing Windows S-TAP. If it's somehow installed, you can run Must Gather in S-TAP mode. If it's not installed yet, just copy diag.bat V2.1 to somewhere (e.g. C:\tmp) and run it in STANDALONE mode.
• If you install GIM, FAM, etc but not S-TAP, and want to run Must Gather. You can run Must Gather in any of the installed directory. It'll run in STANDALONE mode.

Questions?

If you have questions, please feel free to comment on this article. You can also ask questions to IBM Security Guardium discussion in IBM Security Community or open a technical support ticket.