IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

Guardium Windows Must Gather V3.0 - Part 3 - How to run Must Gather V3.0?

By SATOSHI KAWASE posted Sun October 02, 2022 07:00 AM

  

About Windows Agent Must Gather V3.0

Guardium Windows Agent Must Gather V3.0 (a.k.a. Windows S-TAP Must Gather) is the latest must gather script, which is released in Guardium V11.5.

It's included in all Guardium Windows agents (GIM, S-TAP, GAM, CAS, FAM monitor, FAM crawler, FDEC for NAS/SP, FAM for NAS/SP) in V11.5, and will be back-ported to all supported versions.

Index

  1. What's new in V3.0?
  2. S-TAP mode and STANDALONE mode
  3. How to run Must Gather V3.0?
  4. Must Gather V3.0 command options
  5. Where is the output of Must Gather?
  6. What files are collected?
  7. What if Must Gather doesn't generate output?

      NOTE: This blog article covers the section 3. Click links to read other sections.

      3. How to run Must Gather V3.0?

      There are a couple of ways to run Must Gather V3.0.

      Method 1) Run Must Gather from GUI

      NOTE: This method is applicable only in S-TAP mode. Windows S-TAP needs to be installed.

      1. Logon to Guardium GUI > S-TAP Control.
      2. Click on "Send Command" icon on the target S-TAP Host.
      3. Choose "STAP Logging". Make sure that "Run Diagnostics" checkbox is checked, and then press Apply button.

      It may take several minutes or more, and the diagnostic files will be archived to a zip file and uploaded to the collector. You can grab it at Guardium GUI > Manage > Maintenance > Support Information Results.



      Method 2) Run Must Gather from Windows Start menu

      NOTE: This method is applicable only in S-TAP mode. Windows S-TAP needs to be installed.

      1. Logon to the DB server where Windows S-TAP is installed.
      2. From Windows Start menu, navigate to Windows S-TAP > Run Diagnostics.

      Then, elevated Windows Command Prompt will be opened and Must Gather script will start. The diagnostic files will be archived and stored to %WINSTAP_DIR%\Bin\zipTmp\*.zip. It's also sent to the collector if upload feature is enabled in Windows S-TAP.



      Method 3) Run Must Gather from Windows Explorer

      NOTE: This method is applicable to any Windows environment where diag.bat and diag.ps1 exist. It runs in STANDALONE mode.

      1. Logon to the DB server.
      2. Right click on diag.bat and choose "Run as administrator".

      The diagnostic files will be archived and stored to %current_dir%\zip\*.zip.

      Method 4) Run Must Gather from Windows Command Prompt as Administrator

      You can also run Must Gather from Windows Command Prompt as Administrator. 

      1. Open Windows Command Prompt as Administrator
      2. Change directory to the location where diag.bat and diag.ps1 are located.
      3. Run diag.bat.


      [NOTE 1]  As written in former section, you can put diag.bat and diag.ps1 in any directory (e.g. C:\tmp) and run it. In these cases, diag.bat (diag.ps1) will run as STANDALONE mode. This is useful if you want to run Must Gather before installing any of Guardium Windows agent, or if you want to use the latest Must Gather script where older Guardium Windows agents are installed.



      Method 5) Run Must Gather PowerShell script (diap.ps1) directly

      Must Gather V3.0 is written in PowerShell. You can also run diag.ps1 directly, without using diag.bat.

      Example 1) Open Windows Command Prompt as Administrator and run "powershell ./diag.ps1" on the directory where diag.ps1 is located.
      Example 2) Open PowerShell as Administrator and run "./diag.ps1" on the directory where diag.ps1 is located.


      What's next?

      The next blog will explain 4. Must Gather V3.0 command options.

      Questions?

      If you have any questions, please feel free to comment on this article. You can also ask questions to IBM Security Guardium discussion in IBM Security Community or open a technical support ticket.

      Reference

      0 comments
      7 views

      Permalink