Cloud ConnectorsCloud Connectors Troubleshooting

SSH into the Linux machine that hosts the Exabeam Cloud Connectors app with an account that has root-level permissions.

Run the command for your deployment:

Without a proxy

sudo bash -c "$(curl -L https://reportlogs.skyformation.net/v1/logs/collect.sh)"

With a proxy

sudo bash -c "$(curl -x https://proxyserver:8080 -L https://reportlogs.skyformation.net/v1/logs/collect.sh)"

When prompted for a report code, enter the code provided by Exabeam Support (usually the ticket number, i.e. 12345).

Note the password created for the encryption of the logs archive.

Notify Exabeam Support that a diagnostic file was uploaded and provide the password for the logs archive.

Support will analyze your logs and help diagnose any issues.

Have the relevant tenant ID on hand. For a single tenant that would be default-tenant-id.

On the system where Exabeam Cloud Connectors is installed, open the terminal and execute the following command:

docker container exec -it sk4zookeeper bash

Change to the bin folder and run the zkCli.sh script.

cd bin
./zkCli.sh

Create the health reports settings.

/sk4/tenants/<your tenant>/settings/health-report-settings ‘{ "whitelisted-fqdns": [] }’

Verify that you can get to the health report settings by tying to get to /sk4/tenants/<your tenant>/settings/health-report-setting.

Quit the zkCli and exit.

Save the below script into a local file, e.g. setup.sh.

#!/usr/bin/env bash

# setup rsyslog rule to split to both local file and to forward to another TCP destination

while getopts "p:s:h" opt; do case $opt in h) HELPONLY=true ;; p) FWDPORT="$OPTARG" ;; s) FWDIP="$OPTARG" ;; \?) echo "Invalid option -$OPTARG" >&2 ;; esac done

LOCAL_TARGET_FILE=/var/log/sk4.log

print_help(){ echo "usage: sudo ./setup.sh -s [IP to forward messages to. mandatory] -p [port to forward messages to]" echo "locally messages will be logged to $LOCAL_TARGET_FILE" }

if [[ ${HELPONLY} == true ]]; then print_help exit 0; fi

if [[ -z "$FWDIP" ]]; then echo "Target IP was not provided via -s flag. Aborting, here's the help:" print_help exit 1; fi

if [[ -z "$FWDPORT" ]]; then echo "Target port was not provided via -p flag. Aborting, here's the help:" print_help exit 1; fi

cat <<EOT > /etc/rsyslog.d/20-sk4-local-and-fwd.conf # Load Modules module(load="imtcp") module(load="omfwd")

ruleset(name="sk4localandsplit"){ # log locally action(type="omfile" File="/var/log/sk4.log") # forward to somewhere else action(type="omfwd" Target="$FWDIP" Port="$FWDPORT" Protocol="tcp") # stop propagating this message stop }

input(type="imtcp" port="5514" ruleset="sk4localandsplit") EOT

# ensure proper permissions to local file touch $LOCAL_TARGET_FILE chmod 666 $LOCAL_TARGET_FILE

# apply by restarting rsyslog systemctl restart rsyslog

Change the permissions of the script to make it executable.

chmod +x setup.sh

Run the script as sudo and provide the target IP address and port of the syslog receiver to which you want to forward the messages. For example:

sudo ./setup.sh -s 1.2.3.4 -p 1514

Run the ifconfig command and inspect the output to locate the private IP address of the host.

Note the IP address and then refer to Add a SIEM to the Exabeam Cloud Connectors Platform. You will use the IP address to set up SIEM Integration to send logs to this local IP address and port 5514.Add a SIEM to the Exabeam Cloud Connectors Platform

Deactivate all accounts in the Exabeam Cloud Connectors web interface.

After a two-minute wait, stop the Exabeam Cloud Connectors server.

systemctl stop sk4compose

Delete content in the sk4_kafka_data volume.

Delete Kafka's offset tracking information in ZooKeeper.

docker-compose -f <SK4_ROOT_DIR>/docker-compose.yml up -d zookeeper
docker container exec -it sk4zookeeper zkCli.sh
deleteall /sk4kafka
quit
docker-compose -f <SK4_ROOT_DIR>/docker-compose.yml down

Delete server.properties in the sk4_kafka_conf volume.

Change Kafka's data retention period by updating the KAFKA_LOG_RETENTION_MS environment variable at the <SK4_ROOT_DIR>/docker-compose.yml file (.services.kafka.environment[KAFKA_LOG_RETENTION_MS]).

Start the Exabeam Cloud Connectors server.

systemctl start sk4compose