In a distributed environment where you have a JSA console and many managed hosts (Flow processor or Event Processors), it is helpful to be able to run one command to put files to the managed hosts or request information back from the managed hosts.
Using the 'all_servers.sh' is a versatile tool that allows a user to execute a command on the console and avoids the need to either SSH to each managed host or SCP a file to each managed host. The 'all_servers.sh' is located here:
[root@jsa ~]# find / -name all_servers.sh /opt/qradar/support/all_servers.sh
To copy a file from the console to all of the managed hosts at one time, use the following command:
Console:
[root@jsa ~]# /opt/qradar/support/all_servers.sh -p /tmp/test1.txt INFO: Copying /tmp/test1.txt to each server in /storetmp
SCP of large files can take a considerable amount of time before you receive feedback. Please be patient.
10.85.221.95 -> EP22195.juniper.net Appliance Type: 1699 Product Version: 7.3.1.20180507202600 08:00:06 up 58 min, 1 user, load average: 0.13, 2.17, 2.02 ------------------------------------------------------------------------ INFO: The scp put of "/tmp/test1.txt" is complete. [root@jsa ~]#
In 7.3, it puts the test1.txt file into /storetmp of the managed host and in 2014.x, it puts the test1.txt file into /tmp
SSH from Console to Managed Host to confirm:
[root@jsa ~]# ssh [email protected] Last login: Tue Apr 16 07:03:25 2019 This server has Secure Analytics 7.3.1.20180507202600 installed on Tue Jul 24 17:46:51 EDT 2018. [root@EP22195 ~]# cd /storetmp [root@EP22195 storetmp]# ll test1.txt -rw-r--r-- 1 root root 43 Apr 16 08:00 test1.txt [root@EP22195 storetmp]#
Not sure you have disk space on all your managed hosts to copy the file "test1.txt" from console to managed hosts? Check available disk space on all devices with this command:
[root@jsa ~]# /opt/qradar/support/all_servers.sh -C "df -h" 10.85.221.94 -> jsa.juniper.net Appliance Type: 3199 Product Version: 7.3.1.20180507202600 08:04:30 up 37 min, 2 users, load average: 3.22, 5.52, 6.24 ------------------------------------------------------------------------ Filesystem Size Used Avail Use% Mounted on /dev/mapper/rootrhel-root 13G 3.0G 9.6G 24% / devtmpfs 16G 0 16G 0% /dev tmpfs 16G 20K 16G 1% /dev/shm tmpfs 16G 18M 16G 1% /run tmpfs 16G 0 16G 0% /sys/fs/cgroup /dev/sda3 32G 4.6G 28G 15% /recovery /dev/sda2 1014M 207M 808M 21% /boot /dev/mapper/rootrhel-storetmp 15G 44M 15G 1% /storetmp /dev/mapper/rootrhel-opt 13G 8.4G 4.2G 67% /opt /dev/mapper/rootrhel-home 1014M 33M 982M 4% /home /dev/mapper/storerhel-store 306G 31G 276G 10% /store /dev/mapper/storerhel-transient 77G 36M 77G 1% /transient /dev/mapper/rootrhel-var 5.0G 261M 4.8G 6% /var /dev/mapper/rootrhel-tmp 3.0G 130M 2.9G 5% /tmp /dev/mapper/rootrhel-varlog 15G 415M 15G 3% /var/log /dev/mapper/rootrhel-varlogaudit 3.0G 108M 2.9G 4% /var/log/audit tmpfs 3.2G 0 3.2G 0% /run/user/0 10.85.221.95 -> EP22195.juniper.net Appliance Type: 1699 Product Version: 7.3.1.20180507202600 08:04:30 up 1:02, 1 user, load average: 0.12, 1.02, 1.58 ------------------------------------------------------------------------ Filesystem Size Used Avail Use% Mounted on /dev/mapper/rootrhel-root 13G 2.3G 11G 19% / devtmpfs 12G 0 12G 0% /dev tmpfs 12G 12K 12G 1% /dev/shm tmpfs 12G 8.8M 12G 1% /run tmpfs 12G 0 12G 0% /sys/fs/cgroup /dev/mapper/rootrhel-tmp 3.0G 33M 3.0G 2% /tmp /dev/mapper/rootrhel-var 5.0G 132M 4.9G 3% /var /dev/mapper/rootrhel-opt 13G 4.3G 8.3G 35% /opt /dev/mapper/rootrhel-home 1014M 33M 982M 4% /home /dev/sda2 1014M 207M 808M 21% /boot /dev/sda3 32G 4.6G 28G 15% /recovery /dev/mapper/rootrhel-storetmp 15G 33M 15G 1% /storetmp /dev/mapper/rootrhel-varlog 15G 104M 15G 1% /var/log /dev/mapper/rootrhel-varlogaudit 3.0G 35M 3.0G 2% /var/log/audit tmpfs 2.4G 0 2.4G 0% /run/user/0 /dev/mapper/storerhel-store 334G 12G 323G 4% /store /dev/mapper/storerhel-transient 39G 33M 39G 1% /transient [root@jsa ~]#
Above is just a few examples of how to run the 'all_servers.sh'. Use the --help for more:
--help
[root@jsa ~]# /opt/qradar/support/all_servers.sh --help all_servers.sh v2.0 Usage: all_servers.sh [FILTERS] "COMMAND" all_servers.sh [FILTERS] [MODE] "FILE"
FILTERS
-a <APPLIANCE> :: Matches host appliance_name in a SQL LIKE statement. eg: -a '16%' matches all 16XX appliances -a '%05' matches any XX05 appliance. -C :: Include the Console -i <IP> :: Matches host IP address in a SQL LIKE statement. eg: -i '10%' matches all 10X.X.X.X hosts -i '%215' matches any X.X.X.215 host. -I <IPs> :: Pass a comma separated list of IPs. -k :: Include HA Standby Boxes. Does not include HA standy systems behind NATs -n <NAME> :: Matches hostname in a SQL LIKE statement. eg: -n '%col%' matches all hosts with 'col' in the name
Note: Multiple filters can be passed.
MODES
-p <FILE> :: Copy to mode. The <FILE> passed should include the full path. It will be pushed to /storetmp on the remote host. NOTE: Will not SCP file to remote system if the destination partition will be more than 90% full after transfer. -g <FILE> :: Copy from mode. The <FILE> passed should include the full path. -r <DIR>
:: Change remote directory. Used in conjuction with -p option, to specify remote directory to copy file. Default is /storetmp -s PATCH :: Patch Staging Mode. This PATCH should include the full path. This option will push the patch to the hosts and mount it. -P PATCH :: Patch mode. This option will intall the patch on all the hosts in parallel. Include the name of the patch file. -R :: Patch Report and Monitoring mode. This option will open a screen session and display the patch status of all hosts. -l :: List IP mode. The IPs that would be operated on are returned as a separated list.
OTHER OPTIONS
-m <THREADS> :: Set Maximum Parallel Threads. Default: 2 Max: 4 -L <RATE> :: Set the scp transfer rate limit in kilobits -v :: Display revision information -V :: Verbose output -h,--help :: Displays this dialog
You have new mail in /var/spool/mail/root
[root@jsa ~]#