Nexthink Support Training May 2015 Introduction Carlos Snchez

Nexthink Support Training May 2015

Introduction › Carlos Sánchez | Technical Support Manager › 28 years old › Spanish nationality › Living in Lausanne, Switzerland › Joined Nexthink in April 2012

Objectives › › › › Learn about the Nexthink Support Team organization and processes Learn to investigate an issue in any of the Nexthink components Learn to gather the important information for further analysis Acquire the necessary knowledge to solve an issue by yourself Learn to open and document support cases Explore the Frequently Asked Questions (FAQ) section To answer your questions This training is not about: › › Installing, configuring and maintaining the Nexthink solution Using Nexthink to troubleshoot the IT infrastructure

Target audience › Certified Nexthink Partners (having passed the Foundation exam) › Nexthink Staff

Requirements › Laptop (with at least 8 GB of physical RAM) › Windows installed (either as the main Operating System or on a Virtual Machine) › VMware Workstation or WMware Player installed › An SSH and FTP client of your choice › The Nexthink Demo is the same used for the Nexthink Foundation Training › Make sure the connection between your main host to the VM hosting the Appliance is working (Finder, SSH, FTP)

Organization of the day › › › 9: 00 10: 30 10: 45 Training begins 15 minutes break Training continues › 12: 30 1 hour for lunch break › › › 13: 30 15: 00 17: 00 Training restarts 15 minutes break Training ends

Product Support Tools › Ticketing Portal support. nexthink. com › SFTP Server sftp. nexthink. com › Documentation Portal doc. nexthink. com › WEBDAV Server transfer. nexthink. com › Frequently Asked Questions faq. nexthink. com › Remote Access Team. Viewer & Web. Ex › Email support@nexthink. com › Phone +41 21 566 74 83

Product Support Process › Nexthink is relying on the Partners to provide level 1 and level 2 support › Nexthink is relying on the Pre-Sales to provide level 1 and level 2 support during a Proof Of Concept (POC)

Support Service Organization NXT Customers NXT Partners NXT Consultants NXT Product Support NXT Research & Development NXT Product Management

Standard Support Channels Phone (emergency only) Email Ticket › The Support Team centralizes everything using the ticketing system › Phone calls are manually transformed into tickets › Emails are automatically redirected into tickets

Priority Support Channels Ticket Email Phone (emergency only) Step 1: Ticket creation as soon as possible Step 2: Calling support if needed and possible 10 minutes after step 1 › Technical Criticality Automatically escalated by the Support Team › Business Criticality Nexthink Account Manager/VP Sales validation is required prior escalation by the Support Team

What is critical Technical Business › › › › BSOD on Device System freezes on Device Engine is not booting Several users can’t log in to Finder Several users can’t log in to the Portal License can’t be activated This is dynamically defined on a case-by-case basis by the Nexthink Account Manager/VP Sales. The Support Team will not try to understand the reasons behind the scene. Once it’s validated by the Nexthink Account Manager/VP Sales it’s automatically handled as a technical criticality.

Implications of the priority mode › The support agent stops what he is doing and focuses his work on the issue › The impacted developers stop what there are doing to focus on the issue › The VP Engineering closely follows the evolution of the issue, validates strategic decisions and assesses roadmap delays › The Head of Product Management is put in the loop if the roadmap is impacted and will participate in the strategic decisions

The Nexthink Components The Nexthink solution is built around 7 major components, which are: › › › › Collector Updater Finder Engine Portal Console Licensing module

The Collector is an ultra-light driver-based technology to capture activity information, network connections and web requests. The next slides will give you an overview of what scenarios can the Collector be involved in.

Device hang or freeze › The Collector log must be set to debug and the Device rebooted › The hung or freeze must be reproduced if possible › The Collector Reporter must be run in the Device after it has been recovered from the hung or the freeze › Open a support ticket directly

Connectivity issue › Make sure the Collector is running and sending packets trough the Control Panel Extension › Ping the Engine from the Device where the Collector is installed › Check the traffic from the Device to the Engine with: sudo tcpdump -i any "src Device. IPAddress and udp port 999" › In case of a new Device, make sure your license has not reached its limit › The Collector log must be set to debug and the Device rebooted › The Collector Reporter must be run in the Device › Analyze the output of the Collector Reporter

Installation issue › The Collector log must be set to debug and the Device rebooted › Try to install the Collector with the help of the installer (exe) › Try to install the Collector with the help of the MSI › Try to install the Collector with the command-line interface (CLI) › The installation must be logged: msiexec /i Collector. msi /l*v log. txt › The Collector Reporter must be run in the Device › Analyze the output of the Collector Reporter and the installation log at the time the event took place

Information mismatch › Verify the last seen field of the Device to make sure the data is arriving to the Engine › The Collector log must be set to debug and the Device rebooted › Take a full screenshot of the information displayed on the Device and on the Finder › Capture the traffic from this Device to the Engine by entering screen and then: sudo tcpdump -i any "src Device. IPAddress and udp port 999" -w engine. pcap -s 0 › Use screen -list to list all the active sessions and screen -r Screen. ID to recover it › Reboot the Device and capture the traffic for at least 30 minutes › Press CTRL+C to stop the capture. › The file engine. pcap will be located in the home directory of the Nexthink user › The Collector Reporter must be run in the Device

Printing module issue › Verify you are not facing a technical limitation › Unzip the nxtreporter-[version]. zip file to a folder: C: /Temp › Run the following command (with Admin privileges) from the same path: nxtreporter. cmd -p › Reproduce the scenario, the tool will capture the printing events › Press any key on the command prompt for the tool to continue › «Do you wish to generate a full system report? <y/n>» › The output will be generated on the desktop

Blue Screen Of Death (BSOD) › Make sure a kernel memory dump is saved by the system after the BSOD has taken place › The Collector log must be set to debug and the Device rebooted › The Crash. Guard must be reset (4 days by default) › The BSOD must be reproduced if possible › The Collector Reporter must be run in the Device after it has been recovered from the BSOD re › Make sure the MEMORY. DMP is among the files gathered by the Collector Reporter. Otherwise, take it from: C: WindowsMEMORY. DMP › Open a support ticket directly

The Updater is a tool that will communicate with the Engine and will install or update the Collector on the Device. The next slides will give you an overview of what scenarios can the Updater be involved in.

The Updater cannot install the Collector › Make sure the requirements of the Updater are met › Make sure the communication between the Device and the Engine is possible › The Updater log must be enabled in the Device by executing this registry key: Enable_Updater_Log. reg › The Updater log must be enabled in the Engine with the following command: nxinfo log -d Updater › Reproduce the scenario by killing the process and stopping the service or restarting the Device › Disable the log in the Device by executing this registry key: Disable_Updater_Log. reg › Disable the log in the Engine with the following command: nxinfo log -i Updater › The output on the Device is to be found here: C: Windowsnxtupdater. log › The output on the Engine is to be found here: /var/log/nexthink/engine. log › Analyze the output at the time when the event took place

The Finder is a search and user interface to render visibility into your IT infrastructure. The next slides will give you an overview of what scenarios can the Finder be involved in.

Finder crash › Make sure the application diagnostics and the crash report are sent › Make sure your email is provided › The Quality Assurance Team will receive the crash report and will get back to the Support Team with more information on the issue › Additionally join the Nexthink customer experience improvement program › Open a support ticket directly

Connectivity issue › Make sure the Engine is up and running › Check if the Engine port is open with: telnet Engine. IP 999 › The Finder logs must be enabled in the Engine with the following command: nxinfo log -d Finder › Reproduce the scenario › Disable the log in the Engine with the following command: nxinfo log -i Finder › The output on the Engine is to be found here: /var/log/nexthink/engine. log › Analyze the output at the time when the event took place

Performance issue › Make sure you install the right version of the Finder depending on the Operating System architecture › You can verify the version installed by clicking on the About button › The 32 -bit version is recommended for 32 -bit versions of Windows or for computers with less than 4 GB of RAM › The 64 -bit version is suitable for 64 -bit versions of Windows with at least 4 GB of RAM; while providing a better performance and letting you display more information, it may use more memory.

The Engine is a high-performance analytics software capable of storing and processing millions of endpoint activities in seconds. The next slides will give you an overview of what scenarios can the Engine be involved in.

Engine crash › › › › Check the health of the Engine with nxinfo Explore the Engine log: sudo less /var/log/nexthink/engine. log Look for the following pattern: «starting nxengine» Analyse the previous line to find the latest event before the Engine started Look for the following pattern: «minidump detected» If detected in the logs, make sure the latest minidump is among the files provided by the customer. Take it from: /var/nexthink/engine/[instance. Number]/debug/ The support script must be run in the Engine Appliance and its output sent by the customer Make sure the Engine is running after the crash. The output of nxinfo will show you the current status

Performance issue › › Make sure the requirements of the Engine are met Record the performance counters for 24 hours if asked to do so by the Support Team by entering screen and then: nxinfo perf -s 5 -o > perf. csv › › › Use screen -list to list all the active sessions and screen -r Screen. ID to recover it The file perf. csv will be located in the home directory of the Nexthink user The support script must be run in the Engine Appliance and its output sent by the customer

The Portal is the reporting tool, collaboration platform and centralized management platform of the Nexthink End-User IT analytics platform. The next slides will give you an overview of what scenarios can the Portal be involved in.

Portal crash › › › › Make sure the requirements of the Portal are met Explore the Portal log: less /var/nexthink/portal/log/portal. log Look for the following pattern: «Portal version» Analyse the previous line to find the latest event before the Portal started Look for the following pattern: «Out. Of. Memory. Error» Explore the tomcat log: less /usr/local/tomcat/logs/catalina. out Look for the following pattern: «Out. Of. Memory. Error» The support script must be run in the Portal Appliance and its output sent by the customer

Widget computation error › › › › › Make sure the requirements of the Portal are met Go to Administration > Widgets > Computations Management Analyse the latest information regarding the status of the computation Filter by «Unsuccessful» and check their errors Look for «Unknown Category» or «Unknown Service» errors Look for «Request Timeout» errors when the Engine is not responding (3 minutes maximum by default) Delete unused Widgets if any Make sure the customer provides screenshots of the issue being reproduced as well as the results obtained The support script must be run in the Portal Appliance and its output sent by the customer

Real-time Service Widget issue › Make sure the requirements of the Portal are met › Make sure the requirements of the Engine are met › Make sure the user waits 10 minutes for the data to be refreshed › Make sure the communication layer is up and running by the logs with the following command: ps -aux | grep java | grep comm /var/nexthink/portal/log/comm-layer. log › Explore the realtime log: less /var/nexthink/portal/log/portal-realtime. log › Look for the following pattern: «Received data from unexpected engine» › If recently worked with hierachies, some old references might remain in memory. Restart the Portal from the web Console › Make sure the customer provides screenshots of the issue being reproduced as well as the results obtained › The support script must be run in the Portal and Engine Appliances and its output sent by the customer

The Console is the web interface from which we can configure and upgrade the Nexthink Appliance hosting the Engine or the Portal. The next slides will give you an overview of what scenarios can the Console be involved in.

Update not successful when using a proxy › Proxy requiring NTLM authentication is not supported although the connection to the Library will still work › We are going to make sure Yum is saving the right information in the cache. Edit the Console configuration file: vi /etc/yum. conf › Add the following line: http_caching=packages › Disable the yum module fastestmirror by editing the following file: vi /etc/yum/pluginconf. d/fastestmirror. conf › Modify the parameter under «main» to: enabled=0 › Remove the update metadata: sudo yum clean all › Restart the update: sudo yum update › Make sure nothing is alterning the traffic between the Appliance and updates-v 5. nexthink. com

Licensing The Local License Manager (LLM) is a Nexthink component installed on the Nexthink Appliance hosting the Portal. It connects to the Nexthink Central License Manager (CLM) hosted in the cloud to retrieve the license information. The next slides will give you an overview of what scenarios can the Licensing module be involved in.

License operation issues › › › › › Run nxinfo license -w from the Engine command-line interface to check the current license status. It might take a couple of minutes Check the connectivity between the LLM and the CLM: curl k http: //localhost: 8100/llm/1/ping. Clm Check the connectivity between the Portal Appliance and the CLM: curl k https: //license. nexthink. com/clm/external/1/ping. Ss If the first command failed, explore the LLM log: less /var/nexthink/llm/logs/llm. log If the second command failed, make sure the port 443 is open between the Portal Appliance and the CLM Make sure the proxy is correctly configured in the web Console in case you are using one Make sure nothing is blocking or altering the traffic between the Appliance hosting the Portal and license. nexthink. com (178. 32. 252. 200) in your firewall or proxy settings (such as the SSL inspection) The Portal address must be configured in the web Console on the Engine Appliance The status of the Engine must show a green dot under the «Engine Management» menu in the Portal The Appliance is appearing as «Connected» Under the «Appliance Management» menu and the Engine is shown on its section

Creating a support ticket › Submit a request › Complete the fields accuratelly and add the reproduction steps when possible

Creating a support ticket › Attach the information gathered from the Device/s › Record an screencast to illustrate the problem if needed. You can use the software of your choice (Jing, Snag. It, etc. ) There’s a tool included in Windows called “Problem steps recorder”

Questions?