Follow these steps:

1. Run the tool with root permission.

   

2. Below is the main menu. Select "1-Deep Security Agent" to use DSA support features.

   

   

3. You may also choose "3-About the Tool" to know tool version number.

   

Enable/Disable Debug Level Logs

After selecting tool console for Deep Security Agent, you may choose "Enable Debug Mode" / "Disable Debug Mode". Press 'Enter', the the tool will start to enable/disable debug log level.

• Send command to enable debug logs in backend.

  

• Send command to disable debug logs in backend.

  

Log Collection

From the main menu, you may choose Deep Security Agent > Collect logs. The tool will automatically collect log package and store it in local.

*ZIP password is trend.

Fast Logs Collection

From the main menu, choose Deep Security Agent > Fast Logs Collection (No DSA Diagnostic Logs). In the most cases, normal logs collection feature depends on DSA service to return diagnostic package. If the computer has low performance, the user will have to wait to get the log package.

Fast Logs Collection is a feature that allows to collect target path/files with "copy" command directly, which means it does not rely on DSA service. It can save time to collect necessary logs. The disadvantage is that the collected logs are less than in normal mode (but still enough for most of cases for troubleshooting).

After the collection, user can get a ZIP package for the logs with password "trend".

Top N List

From the main menu, you may choose Deep Security Agent > Top N list. There will be three options: Top Scanned Files, Top Busy Process, and Top Scanned Directories. Supported DSA version should be later than DSA 20.0.0.3445.

• Top Scanned Files

  

• Top Busy Process

  

• Top Scanned Directories

  

Network Packet Capture

Network Packet Capture is a feature running Linux "tcpdump" command in backend to help collect network packets. If the tool detects no "tcpdump" command has been installed in the environment, it will interrupt the collection and prompt "tcpdump" needs to be installed first. From the main menu, user can choose Deep Security Agent > Network Packet Capture.

In the next page, choose the correct NIC or "Any" (for all the NIC) for the capture collection, or "Exit" to go back to last page.

In the following example, when entering "1" for [ens32] and pressing 'Enter', the tool will start to collect network packets that go through [ens32].

After choosing the NIC, you may choose to either manually stop the capture or use a timer to stop automatically.

Press "Enter" to stop the collection, or you may just wait for the timer to stop. The tool will store the captured packets into a ZIP file in local.

Exit the tool, then find the ZIP file with password "trend".

Test Antimalware Through EICAR Test File

Support tool (Build-1.0.0.1015+) has a feature that verifies if the anti-malware realtime-scan has worked normally on agent side.

From the main menu, user can choose Deep Security Agent > Test Antimalware Through EICAR Test File.

When starting this feature, the tool will extract "EICAR.com" file to the local path and take action. The local path is "/tmp/", which is supposed to be monitored by DSA realtime-scan policy.

After waiting for a few seconds, tool will judge whether "EICAR.com" file still exists. If it does not, it means that the realtime-scan has taken effect and removed "EICAR.com" file. User can check the anti-malware events on console. Otherwise, realtime-scan may not work normally.

Scenario 1: No Detection

Scenario 2: Set detection on WRITE

Scenario 3: Set detection on READ

Like the Windows version, the Linux version tool also has a non-console mode to work. If you put a configuration file (DSALinuxTool.json) at the same path as the tool, you may just run the tool directly, and it will run based on parameters in "DSALinuxTool.json" without the console. The tool process may take some time. In the end you will get command echo and the log package.

DSALinuxTool.json example:

		{
		    "Top N List": {
		        "generateTopNList": 1
		    },
		    "Debug Setting": {
		        "enableDebugMode": 1,
		        "timerInSecondDebug": 60,
		        "disableDebugAfterTimer": 1
		    },
		    "Log Collection": {
		        "enableLogCollection": 1
		    }
		}
		

The Trend Micro Deep Security Agent Support Tool is integrated with the "log collection script" for Solaris and AIX platform. It will automatically detect which platform the environment belongs to then call the corresponding Solaris or AIX script to run.

The following is an example when running script on Solaris platform:

Send back following 2 files (diag#1, diag#2 and diag#3). Refer to the following example:

diag#1=/var/opt/ds_agent/diag/1653885553.zip
diag#2=/var/opt/ds_agent/diag_2022-05-30_04-39-13.tar.gz
diag#3=/var/opt/ds_agent/if.pcap