Description

This article explains the all_servers.sh command and how to use it. This is useful if you have a distributed deployment. This can help in issuing commands to all JSA appliances within your deployment.

In case you need to check disk usage on all managed hosts, instead of checking on each host, you can use all_servers.sh command on console server which will collect information from all the managed hosts. 

Solution

Warning:  Using  all_servers.sh  as a file manipulation tool can be destructive and could have consequential results. Use extra caution when using this tool for file manipulation. When in doubt, contact Juniper support for guidance.

The  all_servers.sh  command is a powerful tool that can issue commands to all JSA appliances within your deployment. 

  • To obtain the full list of options for the  all_servers.sh  script, run the following command: 

    /opt/qradar/support/all_servers.sh -h ​

  • To move a file to all Appliances in the deployment you would use this command:

    /opt/qradar/support/all_servers.sh -p   <file>  

    This option will copy files to  /tmp  in JSA 2014 [juniper.net].8. In JSA 7.3 Versions,  all_servers.sh  copies the file to  /storetmp . In JSA 7.3 the  -p  option also provides a file check for disk space. If the available space is over 85% on a Console or 95% on a Managed Host an error is returned. The Copy function is then aborted.

  • When used with the  -p  option for JSA 7.3 versions the  -r  allows you to choose an alternative remote directory.

    Example:  /opt/qradar/support/all_servers.sh -p   <file>  -r  <remote_directory>

    Note : This feature is only in JSA 7.3 Versions.

  • The command /opt/qradar/support/all_servers.sh -g will copy a remote file from all appliances. This option can be used for getting copies of files or logs from all appliances.

  • To check disk space and have the output that is redirected to a file, use the following command:

    /opt/qradar/support/all_servers.sh -C "df -h" > DiskSpace.txt

Example: 

1.1.1.1 -> jsa.juniper.net
Appliance Type: 3199Product Version: 7.2.8.20160920132350
11:52:16 up 12 days, 19:30,2 users,load average: 0.38, 0.34, 0.24
------------------------------------------------------------------------
FilesystemSizeUsed Avail Use% Mounted on
/dev/sda720G6.6G12G36% /
tmpfs16G016G0% /dev/shm
/dev/sda193M41M48M46% /boot
/dev/sda36.0G3.5G2.2G62% /recovery
/dev/sda8140G13G128G9% /store
/dev/sda69.7G24M9.2G1% /store/tmp
/dev/sda937G33M37G1% /store/transient
/dev/sda59.8G294M9.0G4% /var/log

  • To locate a specific string within the  /var/log/qradar.log  file on all JSA appliances, a command like the following can be used. In this example, we are searching for the word  deploy :

    /opt/qradar/support/all_servers.sh -C 'grep -i  "deploy"  /var/log/qradar.log | tail -n 10'  

    The command above will provide the last 10 entries in the  /var/log/qradar.log  file, on all appliances, displaying logged deployed changes.