This KB describes what data to collect for JTAC review

Gather the output from running the commands: (Before and after any process restart)

sudo systemctl status "netrounds-*"

sudo systemctl status apache2

sudo systemctl status kafka

sudo systemctl status zookeeper

ncc status

sudo ncc services  status

Log collection to file:

sudo journalctl --since "1 days ago" > /tmp/$(date +"%Y%m%d_%H%M")_$(hostname)_Journal.txt

Note: These sections of the suggested filename will automatically be updated with the 

date: $(date +"%Y%m%d_%H%M")

hostname: $(hostname)_

Important: Getting full journal for any os related messages, make sure this timeframe covers when the problem behavior started. Change the "1 days ago" to the number of days since the system was working normally.

sudo apt list --installed > /tmp/$(date +"%Y%m%d_%H%M")_$(hostname)_packageList.txt

sudo ps -aux > /tmp/$(date +"%Y%m%d_%H%M")_$(hostname)_ps.txt

sudo sudo ss -par > /tmp/$(date +"%Y%m%d_%H%M")_$(hostname)_ss.txt

sudo free > /tmp/$(date +"%Y%m%d_%H%M")_$(hostname)_free.txt

Bundle all the outputs from above

 sudo tar czf /tmp/$(date +"%Y%m%d_%H%M")_$(hostname)_netroundslogs.tgz /var/log/apache2 /etc/apache2 /etc/netrounds /etc/hosts /tmp/$(date +"%Y%m%d")*.txt

Please also capture:

- Approximate time of last package update by your OS/security team (if applicable)

- any relevant screenshot(s)