How to Gather Support Incident Information – Capsule8

To enable you provide us with the requested technical information, Capsule8 recommends that you follow this guide in retrieving the information from your infrastructure.

Capsule8 Sensor and Content Version

Run the below commands to obtain the sensor and content version

# on Debian based distros:
$ apt list --installed | grep capsule8-sensor

# on Debian based distros:
$ apt list --installed | grep capsule8-content

# on Redhat based distros:
$ rpm -qa | grep capsule8-sensor

# on Redhat based distros:
$ rpm -qa | grep capsule8-content

# On Containerized sensor node using Kubernetes:
$ kubectl get ds -o yaml capsule8-sensor

Capsule8 Console Version

Run the below commands to obtain the console version

# on Debian based distros:
$ apt list --installed | grep capsule8-console

# on Redhat based distros:
$ rpm -qa | grep capsule8-console

# On Containerized console node using Kubernetes:
$ kubectl -nconsole get deploy -o yaml capsule8-console

Note: You do not need to run the above Kubernetes command to obtain the Console Version for the SaaS Console.

Sensor YAML Configuration File/Environment Variables Set

# To obtain the above information for installations done via PackageCloud run:
$ cat /etc/capsule8/capsule8-sensor.yaml

# On Containerized sensor node using Kubernetes:
$ kubectl exec -it <container-name> cat /etc/capsule8/capsule8-sensor.yaml

$ kubectl -n <namespace> exec -it <container-name> cat /etc/capsule8/capsule8-sensor.yaml

# On Containerized sensor node using Docker: 
$ docker exec -it <container-name> cat /etc/capsule8/capsule8-sensor.yaml

$ docker -n <namespace> exec -it <container-name> cat /etc/capsule8/capsule8-sensor.yaml

Console YAML Configuration File/Environment Variables Set

# To obtain the above information for installation done via PackageCloud run the below on the console node:
$ cat /etc/capsule8/capsule8-console.yaml

# On Containerized environment using Kubernetes:
$ kubectl get cm -o yaml <configmapname>

Analytics YAML Configuration File/Environment Variables Set

# To obtain the above information for installations done via PackageCloud run:
$ cat /etc/capsule8/capsule8-analytics.yaml

# On Containerized sensor node using Kubernetes:
$ kubectl exec -it <container-name> cat /etc/capsule8/capsule8-analytics.yaml

$ kubectl -n <namespace> exec -it <container-name> cat /etc/capsule8/capsule8-analytics.yaml

# On Containerized sensor node using Docker: 
$ docker exec -it <container-name> cat /etc/capsule8/capsule8-analytics.yaml

$ docker -n <namespace> exec -it <container-name> cat /etc/capsule8/capsule8-analytics.yaml

Operation System and Version

# To obtain the OS and version run any of the below commands:

$ uname -a

$ cat /etc/os-release

$ cat /etc/redhat-release

$ lsb_release -a

$ hostnamectl

Container Technologies and Version

Please contact your organization’s team for that information.

Linux Kernel Version

# To obtain the kernel version run any of the below commands:

$ uname -r

$ cat /proc/version

$ hostnamectl | grep kernel

Sensor Logs

# To obtain the sensor logs run any of the below commands:

$ journalctl -u capsule8-sensor

$ journalctl -efu capsule8-sensor

$ tail -f /var/log/capsule8/sensor.log

# On containerized environment you can obtain the log using any of the below commands:

$ kubectl logs <sensor-container-name>

$ docker logs <sensor-container-name>

$ journalctl -M rkt-<rkt-container-id>

$ kubectl logs po/<console-pod> -c capsule8-sensor

Console Logs

# To obtain the console logs run any of the below commands:

$ journalctl -u capsule8-console     #u-specifies unit log, in this case is capsule8-console

$ journalctl -efu capsule8-console   #e-specifies to go to the end of the log output, f-specifies follow the logs)

$ tail -f /var/log/capsule8/console.log

# On containerized environment you can obtain the logs using any of the below commands:

$ kubectl logs <console-container-name>

$ docker logs <console-container-name>

$ journalctl -M rkt-<rkt-container-id>

$ kubectl logs po/<console-pod> -c capsule8-console

Capsule8 Sensor CPU and Memory Profiling

The Capsule8 Sensor is equipped with runtime profiling features that can be used to generate CPU profiles and memory allocation snapshots via Google’s pprof library.

Enable Debug Mode

To enable profiling either run the sensor with the environment variable CAPSULE8_DEBUG=true set or add debug: true to the /etc/capsule8/capsule8-sensor.yaml config file.

# Then Restart the sensor 
$ systemctl restart capsule8-sensor

Once the sensor is restarted it will start to collect profiling data as it runs.

Generate a Profile

Performance profiles can be captured at anytime by making requests to a local HTTP endpoint:

# Sample memory allocations of live objects on the heap
$ curl -s http://localhost:9010/debug/pprof/heap > heap.out

# Sample CPU usage for 60 seconds and generate a profile
$ curl -s 'http://localhost:9010/debug/pprof/profile?seconds=60' > profile.out

These profiles should be generated by a sensor that is experiencing the memory or CPU issues that you wish to troubleshoot for the profile to be useful.

Capsule8 Metrics Output

To generate the metric output, please note that you do NOT need to Enable Debug Mode. Simple run the below command on the sensor:

# Sample command to retrieve the Metrics Output
$ curl -s http://localhost:9010/metrics > metrics.out