Consolidated troubleshooting report (CTR)

To enable the support team to troubleshoot system issues, you can generate a consolidated troubleshooting report (CTR). The encrypted file includes a file with the system's current status and log files with details, such as the active processes and resource usage.

To download the CTR, go to Diagnostics > Tools. See Download log files.

The CTR can contain the system snapshot and all the log files. You can generate a CTR and send it to Sophos Support to diagnose and troubleshoot an issue.

CTR name format

The firewall generates the file with the name: CTR_<APPKEY>_<MM_DD_YY>_<HH_MM_SS>

APPKEY is the device key of the device for which the report is generated.
MM_DD_YY is the date (month, date, year) on which the report is generated.
HH_MM_SS is the time (hour, minute, second) at which the report is generated.

Log lines in CTR

By default, the CTR only includes 1,000 log lines for the service subsystem logs. You can increase this limit to 10,000 lines on the CLI. The log files and the number of lines they show in the CTR are as follows:

Default subsystems: These log files always include all the log lines.
Service subsystems: These log files are limited to the configured number of log lines.

You can increase the number of log lines in the CTR for some files. You can also turn on debug mode to get debug-level logs for some files.

To increase the CTR limit, sign in to the CLI, enter 4 for Device console, and enter the following command:

system diagnostics ctr-log-lines <number>

Note

The line limit in log files only applies to the CTR. You can get the complete log file from the CLI. See Log files for modules.

Debug-level logs

Turn on debug mode for each subsystem for which you want to generate debug-level logs.

Note

To save disk space, we recommend that you turn off debug mode after you get the log files. See Check troubleshooting logs.

You can only turn on debug mode for the following subsystems.

Default logs	Service logs
`syslog.log`	`awarrenhttp_access.log`
`postgres.log`	`httplogd.log`
`reportdb.log`	`bwm.log`
`applog.log`	`awarrensmtp.log`
`access_server.log`	`pktcapd.log`
`awarrenhttp.log`	`warren.log`
`awed.log`
`charon.log`
`csc.log`
`garner.log`
`heartbeatd.log`
`ips.log`
`iview.log`
`msync.log`
`nSXLd.log`
`networkd.log`
`red.log`
`reverseproxy.log`
`smtpd_main.log`
`sslvpn.log`
`tomcat.log`
`u2d.log`
`up2date_av.log`
`npu-startup.log.prev`
`npu_syslog.log`
`syslog-ng.log`
`xgs-healthmond.log`
`xgs-host.log`
`xgs-npu-fw.log`
`xgs-pport-wait.log`

More resources

Diagnostics