Using agent debug command

Learn how to use the debug command functionality which allows you to collect debug information from given agents utilising the C2 protocol.

You must have administrator privileges to request or download the debug logs.

  1. Execute the following command to initiate the operation to the agent:
    <efmHost:port>/efm/api/operations/debug/<agentId>
    • This operation command initiates the debug request within the next heartbeat to the given agent.
    • When the agent receives it in the next heartbeat, it starts to upload the files to the EFM server.
    • In the response, you receive an URI, which you can use for retrieving the bundles. Example response:
      {
        "uri": "https://localhost/efm/api/transfer/472a0346-4b6b-11ec-9a48-0242ac11000c",
        "operation": {
          "identifier": "1e261f63-6141-4792-bac7-0739cecde805",
          "operation": "TRANSFER",
          "operand": "debug",
          "args": {
            "target": "/efm/api/transfer/472a0346-4b6b-11ec-9a48-0242ac11000c"
          },
          "targetAgentId": "472a0346-4b6b-11ec-9a48-0242ac11000c",
          "state": "QUEUED",
          "created": 1637579394449,
          "updated": 1637579394449
        }
      }
    • You need to wait at least for the same amount of time as the heartbeat interval plus a little buffer for upload time, before you try the URI.
    After the command is deployed, the agent starts uploading the collected logs to the C2 server.
  2. You can try the URL received from the previous step to download the logs.
    You can also follow the progress in the Monitor > Events tab of the CEM UI. When the operation state is DONE, it means that you can try the download URI to get the log file.


  3. Optional. You can control the maximum uploadable file size by changing the efm.data.transfer.maxFileSize parameter.
    The default value of the parameter is 16 MB which is the maximum value supported by the current storage implementation.