Event Logging Troubleshooting Log Files

The Secure Event Connector troubleshooting command collects logs, configurations, and limited system information, compressing them into a single archive to simplify the diagnosis of issues. If you already have a TAC case open, the compressed archive can also be sent directly to your TAC representative.

SSH to your host using the admin account, typically cdo.
Switch to the SDC user using the command sudo su - sdc
If you do not have a TAC case open: Run the command to gather and compress the troubleshooting bundle:

sdc eventing troubleshoot
If you already have a TAC case open: Request an upload token from your TAC representative and use the command to gather, compress, and upload the troubleshooting bundle directly to your case:

sdc eventing troubleshoot --case-number [your-tac-case-number] --token [the-token-tac-provided]
If you prefer to retrieve the troubleshooting bundle manually, use SCP or SFTP. Locate the absolute path to the bundle provided in the last log entry after running the troubleshoot command. Then, use the following SCP command to download the bundle to your local machine:
```
scp -P [22 or whichever port you SSH on]
        cdo@your-vm-ip:/opt/cdo/.cdo/troubleshooting/cdo_[tenant-name-here]
        -troubleshooting-[timestamp-here].tar.gz ./sec-troubleshooting-bundle.tar.gz
```
Note

Replace /opt/cdo/.cdo/troubleshooting/cdo_\[tenant-name-here\]-troubleshooting-\[timestamp-here\].tar.gz with the actual path displayed in the log output.

If you want to decompress the archive to review the logs and system configurations, use the command: tar xvf ./[sec-troubleshooting-bundle-filename].tar.gz