- Site Collector Overview
- Get Started with Site Collectors
- Install Site Collector
- Set Up Collectors
- Manage Site Collectors
- Site Collector Monitoring
- Troubleshoot the Site Collector
- Pre-checks failed during Site Collector installation and upgrade
- Site Collector UI shows the status INSTALLATION_ERROR
- Download Support Packages for Troubleshooting
- How to reboot the Virtual Machine (VM) successfully to apply security updates?
- What information must be added while creating a support ticket to resolve an issue?
- Site Collector UI is not displaying the heartbeats
- Splunk Collector can't be set up
- Splunk Collector is set up however, logs are not reaching DL/AA
- Only a few of the installed Splunk Collectors are processing logs or EPS has dropped by 50% as compared to last hour
- The Windows Active Directory Collector (formerly known as LDAP Collector) is set up, however, the context data is not reaching DL/AA
- The Windows Active Directory Collector (formerly known as LDAP Collector) is stuck in the ‘Update’ mode after deployment
- Installation is initiated; however, the collector shows the status as ‘Setting Up’ for some time
- Data Lake and Advanced Analytics Does Not Show Context Data
- Context Data from Windows Active Directory Collector is Segmented
- Minifi Permission Denied - Logback.xml File Missing and Config File Update - Failed Error Occurred while Installing the Windows Event Log Collector
- Where should I upload proxy certificates if I am running proxy with TLS interception?
- How to upgrade Linux collector instance?
Run Prechecks to Validate VM Configuration
To prevent disruption of installation or upgrade process of Site Collectors, the precheck binary file validates the VM configuration. Refer to the following sections that describe the procedure to download and run the precheck binary file and the components it verifies.
Download and Run the Precheck Binary File
To download and run the precheck binary file ngsccli, perform the following steps.
Run the following command on your VM Command Line Interface (CLI) to download the ngscclibinary file located at:
curl -o ngsccli https://storage.googleapis.com/ngsc_update/exa-cloud-prod/exa-ngsc/ngsccli
Run the following command on VM Command Line Interface (CLI) to make the ngsccli binary file executable.
chmod +x ngsccli
Use the following command if you are installing Site Collector for the first time.
# Install precheck sudo ./ngsccli precheck install
# Help ./ngsccli precheck install -h Usage: ngsccli precheck install [flags] Flags: --enterprise precheck with enterprise specs --extract-path string path to extraction directory (default "/tmp") -h, --help help for install --install-path string path to installation directory (default "/opt") --proxy string proxy host:port (example - myproxy:3128or,
Use the following command to run the ngsccli binary precheck file if you already have installed a Site Collector instance.
# Install precheck sudo ./ngsccli precheck install # Upgrade precheck sudo ./ngsccli precheck upgrade # Help ./ngsccli precheck install -h Usage: ngsccli precheck install [flags] Flags: --enterprise precheck with enterprise specs --extract-path string path to extraction directory (default "/tmp") -h, --help help for install --install-path string path to installation directory (default "/opt") --proxy string proxy host:port (example - myproxy:3128Note
If you are installing a Site Collector instance for the first time, run the install precheck only:
sudo ./ngsccli precheck install.The following prechecks are not conducted during the Site Collector upgrade process.
Existing Site Collector Installation
Tmux Version
Available Disk Space
Ports
Components Verified by the Precheck File
The following table describes the components that the precheck binary file verifies.
Component | Verification | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
CPU Cores | The precheck binary file checks the minimum number of CPU cores available on the host system.
| |||||||||||||||||||||
Memory | The precheck binary file checks the minimum amount of RAM available on the host system.
| |||||||||||||||||||||
HTTP Endpoint Reachability | The precheck binary file checks if the following required HTTP services are reachable.
| |||||||||||||||||||||
Ports | The precheck binary file checks if the following required ports are available on the VM.
| |||||||||||||||||||||
Disk Capacity | The precheck binary file checks if the disk size requirements are fulfilled as follows.
| |||||||||||||||||||||
Available Disk Space | The precheck binary file checks if the available disk space at the SXB extractions path /tmp (or custom extract path) is 8 GB. If the disk space is less than 8 GB, a warning message is displayed without preventing installation of Site Collectors. | |||||||||||||||||||||
Physical Disk Partitions | The precheck binary file checks is disks have physical partitions, and not logical (LVM) .
| |||||||||||||||||||||
Disk No Exec Option | The precheck binary file checks that disk is mounted without noexec option on /tmp (or custom extract path). | |||||||||||||||||||||
OS Version | The precheck binary file checks that the VM has the correct version of the operating system.
| |||||||||||||||||||||
Tmux Version | The precheck binary file checks if minimum tmux version 1.9 is available. | |||||||||||||||||||||
Jq Installation | The precheck binary file checks if the jq command is installed. The command-line JSON processing tool jq is a library that is required for processing JSON data for Site Collectors. | |||||||||||||||||||||
Docker Version | The precheck binary file checks if the minimum docker version 20.10.10 is available on the VM. | |||||||||||||||||||||
Docker Compose v2 | The precheck binary file checks if the docker compose v2 is installed on the VM. | |||||||||||||||||||||
Docker-In-Docker | The precheck binary file checks if /.dockerenv file exists to ensure that docker is not being run from inside docker. | |||||||||||||||||||||
Existing Site Collector Installation | The precheck binary file checks if any of the following files exist to verify previously installed Site Collector instance.
The precheck binary file skips certain checks if there is an existing installation found. | |||||||||||||||||||||
User Access | The precheck binary file checks if the Exabeam user has sudo access which is required for installation. | |||||||||||||||||||||
Hostname | The precheck binary file checks if the hostname is not resolvable to loopback IP. The hostname must not be bound to 127.0.0.1 or 127.0.1.1 also called as loopback IP. The hostname must resolve to a private external IP. | |||||||||||||||||||||
Time Tracking | The precheck binary file checks either |