Description

This article explains how to change the output location of the get_logs.sh script.

 

Symptoms

The get_logs.sh script gathers all the logs and data needed for review, and saves a log file in this location:

/store/LOGS/logs_<hostname>_<YYYMMDD>.tgz

If this location is full, users may need to save the output to another location.

 

Solution

Complete the following steps:

  1. Navigate to the support directory using the following command:

cd /opt/qradar/support/

  1. Edit get_logs.sh .

vi get_logs.sh

  1. Change the location of SAVE_DIR="/place you want to store output/" .

  2. Save and exit by using :wq! .

  3. Run sh /opt/qradar/support/get_logs.sh .

The logs should now get saved in the desired location.

 

Modification History

2020-12-28:Article modified to apply to JSA; article checked for accuracy
9/1/24 - Updated for current code save location

 

Related Information