How do I download the encrypted diagnostic bundle for the support team (Encrypted Support Bundle)?

Short answer

On the vService screen, the Status Logs tab in the right panel is opened; the file is downloaded with Download next to the Encrypted Support Bundle row with the lock icon and sent to the TR7 support team. The bundle is not produced manually: at the moment the vService's status changes to Error, TR7 collects the vService configuration at that moment, the latest vService logs and the warnings, and encrypts them with the public key of the TR7 support team; the bundle cannot be opened on the device. If the row is not visible, the vService did not change to Error in that range, or the date range must be widened. If a bundle is needed for the whole device, sys-cmd support collect is used in WEB-CLI.

Problem: The Support Team Wants the State at the Moment of the Error

The vService fell into the Error status, and the support team wants to see the configuration and the logs at that moment. Even if the error has passed, the diagnostic data of that moment needs to be delivered securely.

Definitive rules:

• The bundle is produced automatically at the moment the vService's combined status changes to Error from a status other than Error; it is not produced on Warning transitions.
• At most one bundle is produced in 60 seconds for the same vService.
• The bundle is encrypted with the public key of the TR7 support team; it cannot be opened on the device or on the user side. If no support key is defined on the device, no bundle is produced.
• In a cluster, the records come from both devices; the row shows the name of the device the record came from.

Solution: Two Methods

The two methods are alternatives to each other: the vService data of the Error moment is taken from Status Logs, and the data of the whole device is taken from WEB-CLI.

Your situation	Suitable method
The diagnostic data of a vService at the Error moment	Method 1: Status Logs → Encrypted Support Bundle
A device-wide support bundle, or no transition to Error	Method 2: WEB-CLI sys-cmd support collect

Method 1: Status Logs → Encrypted Support Bundle Recommended

• How it works The bundle is produced automatically when the vService changes to the Error status, and it is listed in the Status Logs tab as a row with a lock icon next to the status transition.
• Where it is opened Left Monitor Panel → Load Balancer vServices → vService → right panel → Status Logs
• Requirement The vService must have changed to Error in the examined date range
• vService type HTTP · L7 TCP · Network

Step-by-Step Configuration

1

Adım 1 Open the vService screen

In the Left Monitor Panel, Load Balancer vServices is selected from the category selector and the vService is clicked (accessing the screen).

2

Adım 2 Open the Status Logs tab

The Status Logs tab in the right panel is clicked. On first opening, the list shows the last 7 days and at most 50 records.

3

Adım 3 Widen the range

If the Error transition is not in the list, the date range is widened, Log Limit is increased and the refresh button is clicked. The range and the limit are remembered per user.

4

Adım 4 Download the bundle

The Download button is clicked in the Encrypted Support Bundle row with the lock icon next to the Error transition; the tr7-diag-…-….json file is downloaded. The file is attached to the support ticket; since it is encrypted, no attempt is made to open it.

Verification

1FileClient side

The name of the downloaded file is checked.

Expectedtr7-diag-…-….json

Since the content of the file is encrypted, it cannot be read; this is the expected behavior.

Method 2: WEB-CLI sys-cmd support collect

• How it workssys-cmd support collect produces a support bundle for the whole device or for a single vService; in the default anon profile, the addresses and names are converted into pseudonyms, and the section that belongs to the TR7 support team is encrypted.
• Where it is opened TR7 WEB-CLI
• Requirement A user whose User type is Admin
• Scope Device-wide; can be narrowed to a single vService with --pool.

Step-by-Step Configuration

1

Adım 1 Find the ID for a single vService

If the bundle will be narrowed to a single vService, its ID is taken from the list:

lb service list

2

Adım 2 Produce the bundle

The first command is run for the whole device, and the second for a single vService:

sys-cmd support collect
sys-cmd support collect --pool <vService>

The default profile is anon, and the scope is the last 7 days (at most --since 30d). Only one bundle is produced at a time.

3

Adım 3 Download the bundle

The link written at the end of the command is clicked, or the bundles are listed and the address in the Link column is used:

sys-cmd support list

The summary.txt in the downloaded support-….zip is read before it is sent; the files in the bundle are listed in the Content of the Bundle section of the docs.

Verification

1BundleTR7 side

The sys-cmd support list output is checked.

Expectedsupport-….zip row and Link

Common Mistakes

• Looking for the bundle on Warning transitions. The bundle is produced only on a transition to Error.
• Expecting a separate bundle for each consecutive Error. At most one bundle is produced in 60 seconds for the same vService.
• Assuming that the bundle is broken if there is no row. The transition may have fallen outside the date range; the range is widened or the WEB-CLI method is used.
• Trying to open the bundle. The bundle can be opened only by the TR7 support team.
• Looking for the bundle in the SIEM. Status Logs transitions can be sent to the log server; the encrypted bundles are not sent.

How it is done in the documentation

• Dashboard · Panel Tabs
• Support · Support Collect
• Support · The Content of the Bundle

Related questions

• Which information should I collect before contacting TR7 support?
• What does the configuration error(s) warning in the vService preview (DNS Resolution Error, Port binding error) mean; where does Port Collision appear?
• What does the Data Flow Panel on the right of the vService screen show?