topic TDERROR_ALL_ALL=5 in Firewall and Security Management

TDERROR_ALL_ALL=5

Sabi_Halevi — Wed, 24 Mar 2021 12:43:18 GMT

Hi All,

There is a way to know if TDERROR is active besides looking into the .elg files?

Many Thanks

S_E_ — Wed, 24 Mar 2021 13:26:06 GMT

Hi,

If I remember correctly the healthscript.sh shows active debugs/tcpdump and provides warnings

Regards

Sabi_Halevi — Wed, 24 Mar 2021 13:38:20 GMT

Its doesn't work, This is the procedure that the health check script does to check:

"env | grep TDERROR | awk -F= '{print $1}'"

If you Turn on TDERROR and you run the line above its shows nothing.

Best Regards,

Tal_Paz-Fridman — Wed, 24 Mar 2021 21:39:28 GMT

If you have all the .elg files you can search for the following lines when the debug was started:

Starting debug output
Setting TDERROR

Sabi_Halevi — Thu, 25 Mar 2021 07:48:43 GMT

It can determine when it was started, but not if it is active in real-time..

Tal_Paz-Fridman — Thu, 25 Mar 2021 08:31:43 GMT

No it cannot, but combine it with the string Stopping debug output, you can conclude if it was started and if it was stopped.

Bob_Zimmerman — Thu, 25 Mar 2021 12:34:08 GMT

Pretty sure rebooting disables debugging without a "Stopping debug output" line, so it's probably also worth checking the uptime.

Not sure if a process crash or cprestart stops debugging.