Troubleshooting data collectors

Troubleshooting of data collectors is done using Admiral, a text-based console application available via the Sophos XDR data collector's console or via the serial port. The Admiral console lets you access information about a deployed Sophos XDR data collector locally.

The tools provided in Admiral assist with device setup and troubleshooting common problems, such as network connectivity issues. Administrators can use Admiral to issue commands to the data collector to obtain device information, such as hostname, network details, NTP configuration, and more. You can also issue diagnostic commands to determine whether any health or connectivity issues are affecting the device and obtain verbose results that may help resolve problems.

Access Admiral

Access the Admiral console via the console or the serial port of the Sophos XDR data collector, according to the platforms listed below.

VMware

In VMware, access Admiral from the data collector’s console. There are multiple ways to access the virtual machine console from within VMware, depending on your setup. For steps to access the console, refer to the official VMware documentation.

HyperV

In HyperV, access Admiral from the virtual machine console. Follow these steps:

1. Find the data collector's virtual machine from System Center Virtual Machine Manager, also referred to as SCVMM or VMM.
2. Right-click the virtual machine and click Connect or View. A sub-menu displays.
3. Click Connect via Console. A new window opens with the console. If the screen is initially blank, press Enter to see the console.

Nutanix

For steps to access the console, refer to the official Nutanix documentation for your version of Prism. For details, see Managing a VM through Prism Central (AHV).

AWS

In AWS, access Admiral from the EC2 serial console as follows:

1. Find the data collector instance in EC2 and open the instance summary.
2. Click Actions and choose Monitor and troubleshoot. A sub-menu displays.
3. Choose EC2 serial console from the sub-menu. The EC2 serial console screen displays.
4. Click Connect to connect to the instance's serial console. A new window opens, allowing you to interact with the console. If the screen is initially blank, press Enter to see the console.

Azure

In Azure, access Admiral from the VM serial console as follows:

1. Find the data collector virtual machine in Azure and bring up the overview.
2. From the left menu in the virtual machine context, click Serial console from the Help header. Azure connects to the serial console and displays it in the right portion of the screen. If the screen is initially blank, press Enter to see the console.

GCP

In GCP, access Admiral from the serial console as follows:

1. Find the data collector virtual machine and open the instance details.
2. At the top of the Details tab, click Connect to serial console to connect to serial port 1. A new window opens, and the serial console appears. If the screen is initially blank, press Enter to see the console.

Using Admiral

The following sections provide guidance on using Admiral in basic and more advanced scenarios.

Basic usage

Admiral is a text-based command-line application. While using Admiral, the application provides suggestions based on what you type and supports auto-completion with the Tab key.

The Admiral prompt displays when you access Admiral for the first time. This contains the hostname of the data collector followed by a > symbol. Begin typing commands into Admiral for it to execute. To see what commands Admiral supports, use the help command, which outputs a list of currently supported commands with a brief description of each. See Command types for more information.

Suggestions and auto-complete

As you type, Admiral provides a list of suggestions based on your input. These suggestions contain the same brief descriptions of each available command seen when using help. To use a suggestion, press the Tab key to have Admiral auto-complete it. Once you've pressed Tab, scroll through the list of all suggested commands using the up and down arrows, and use Enter to execute the command that you've chosen.

To get a new blank line without executing what you've already typed, press Ctrl-C. Admiral brings you to a new clean line without attempting to process any command you've already entered.

When typing a command, the suggestions list only shows you the top suggestions, requiring you to press Tab and then scroll to see the complete list. However, press the ? key at any time, and Admiral displays every suggested command without needing to tab into the list to scroll.

Command types

Admiral commands are divided into two types: show commands that provide information about the status of the data collector and run commands that cause actions to occur. As a rule, show commands never change the status of the data collector or generate any network traffic, whereas run commands are allowed to perform actions that may cause the data collector to update its status or create network connections.

Check commands and verbosity

One special type of run command is the check command. Checks are routines that provide feedback on various collector systems necessary for it to collect data. In their normal form, they provide very simple output indicating whether a system is functioning correctly. However, if more in-depth information is desired, use the verbose form of the check to obtain more detailed output that can be useful for troubleshooting.

For example, the run dns check command displays a simple output showing if DNS resolution of the Sophos XDR API FQDN is successful. If you need more detailed information about the DNS resolution process, use run dns check with verbose output.

Commands and command menus

Admiral commands are organized into menus. The directory command displays a list of available menus. To enter a menu, use the enter command followed by the name of the menu you wish to enter. To exit a menu, use the exit command.

Currently, there are two menus: default and maintenance. The default menu contains the basic run and show commands. The maintenance menu contains commands useful for troubleshooting specific scenarios when working with Sophos support. When entering a different menu, the prompt changes to indicate which menu you're in to help you keep track of where you are.

Default menu available commands

The following table lists each command available in Admiral's default menu. This menu is used when Admiral starts. Exiting this menu exits Admiral.

Maintenance menu available commands

The following table lists each command available in Admiral's maintenance menu. Exiting this menu will return you to the default menu.