I see this get asked in forums A LOT, typically the poster has another problem they are trying to fix, someone has asked them to debug the problem and they cant see any debug output.
Solution
Firstly you need to understand what logging is, and how debugging fits within it. (Bear with me, this is good knowledge to have).
The firewall saves logs in syslog format, and there are 8 Levels of logs, the one with the MOST information is called ‘debugging’ (or severity 7 in Syslog world)
0=Emergencies
1=Alert
2=Critical
3=Errors
4=Warnings
5=Notifications
6=Informational
7=Debugging
So if you are debugging, then all you are doing is looking at syslog output thats severity 7. The ASA can send these logs to an internal memory buffer, and external Syslog server, or to the screen, either the console (via rollover cable) or the monitor (SSH/Telnet session, or what router types, call the virtual terminal lines).
Fine but I cant see anything doofus, that’s why I’m here!
OK, now you understand how it all works, you should understand when you see the commands, why it wasn’t working!
Issue a ‘show log’ command;
What does this tell us? Well mose importantly it tells us logging in ON.
[box]Syslog logging: enabled[/box]
If it were disabled then you turn it on with;
[box]logging on[/box]
The next piece of pertinent information is.
[box]Timestamp Logging: Disabled[/box]
While not critical, logs are much easier to interpret when they are stamped with the correct time! I’m in the UK so this is the command I would use (Note: I’m enabling NTP Time sync, this can take a while to synchronise);
[box]
clock timezone GMT 0
clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 2:00
!
ntp server 130.88.203.12 source outside
!
logging timestamp
[/box]
Sending Debug Output to the Screen
As mentioned above, you can send output to the console or the monitor;
Send Debug to SSH/Telnet Session
[box]logging monitor debugging
terminal monitor[/box]
Note: To disable, the command is ‘terminal no monitor‘ NOT ‘no terminal monitor’ (Thanks Cisco!)
Sending Debug Output to the Console (Serial Connection)
Send Debug to SSH/Telnet Session
[box]logging console debugging[/box]
Note: To stop it, set it back to ‘warnings’ (the default).
[box]logging console warnings[/box]
Sending Debug Output to the Internal Log (Buffer)
This is easier, as you can filter the results for particular IP addresses/ports/usernames etc, which is handy if there are pages and pages to look though, and they are not scrolling past you yes, faster than you can read them!
This tripped me up once before, and I didn’t document it! Normally if you have a console session open with your FirePOWER Module, (that you opened with a ‘session sfr‘ command), then you can just quit, and exit back to the firewall by typing ‘exit‘, like so;
[box]
ciscoasa# session sfr
Opening command session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
Cisco ASA5512 v6.1.0 (build 330)
firepower login: admin
Password:******
Last login: Tue Nov 22 15:49:51 UTC 2016 on pts/0
> exitRemote card closed command session. Press any key to continue.
Command session with module sfr terminated.
ciscoasa#
[/box]
But if you have a console session open with the module, (that you opened with a ‘session sfr console‘ command), then typing exit simply dumps you back at the login screen!
I did a VMware VI3 to vSphere (4.1 U1) upgrade today. While bringing all the guest machines across, suddenly I could no longer browse the datastore, I only had one more guest to “Add to the inventory”, and all the mission critical machines were already migrated. I tried rebooting the virtual center, I tried restarting the ESXi host machines, still it sat saying “Searching Datastore……”.
Solution
1. I found the solution by accident. I was adding virtual machines to the new VSphere inventory, so I went in search of a method of doing it from the console, I was just about to:
Command to add a VMware guest to the inventory
[box]vmware-cmd -s register {full path to virtual machine}MACHINE_NAME.vmx[/box]
But, while looking in the folder with the guest files, I saw thousands of log files, I guess the VI client is struggling to parse them all, and display them. A quick internet search and I found out I can safely delete the log files.
2. Log into the ESX/ESXi servers console, for ESXi servers (version 4.0 and below) see here, for newer versions you can simply enable SSH access from Troubleshooting Mode Options > Enable Remote Tech support (SSH).
3. Log on as root and issue the following command to find the symlink path to your shared storage:
[box]ls -l /vmfs/volumes/[/box]
4. Now you know your symlink, you can change to the folder that contains the affected guest OS.
[box]cd /vmfs/volumes/{your symlink}/{your vm folder}[/box]
5. To get rid of all the log files, simply issue the following command.
[box]rm -f vmware-*.log[/box]
6. Now retry and you should see the folder contents when you “Browse Datastore”.
Related Articles, References, Credits, or External Links
The ability to administer vCenter via a web browser is nothing new, vCenter has had a web console in previous versions.
vCenter vSphere 4 Web Client (Web Access)
The version with vSphere 5 is much more feature rich. Like the VMware vSphere client it talks directly to the vCenter vSphere API, but unlike previous web access, the component needs to be installed and configured before you can use it.
What the Web Client Can Do
1. Connect to a vSphere vCenter server.
2. Can be used on non Windows machines (VI Client is Windows only).
3. Deploy Virtual Machines (Including deployment from Templates).
Prerequisite: The vCenter server needs to have Adobe Flash installing on it to access the management console.
1. From the vCenter Installer media select “VMware vSphere Web Client (Server) > Install > Follow the on screen prompts.
2. Accept all the defaults, note the secure port number we will be using that later (TCP Port 9443).
3. Once installed > On the vCenter server itself open a browser window > navigate to > https://{servername}:9443/admin-app > Select “Register vCenter Server”.
vSphere Web Client Supported Browsers: Internet Explorer (7 or newer) and Firefox (3.5 or newer), I’ve tried Chrome, it works, but some functionality is lost. (anything that requires the plug in i.e. console connections).
4. Enter the details for the vCenter server > Take note of the URL for your client to access (https://{servername}:9443/vsphere-client) > Register.
5. You will probably be using self signed certificates to tick the box and select “Ignore”.
6. That’s the server configured and ready to go.
Step 2 – Access the vCenter from web client
1. Open a browser window and navigate to https://{servername}:9443/vsphere-client> You may receive a warning about the certificate (because it’s self signed) click to continue > Enter your credentials > Login.
2. The first time you connect it launches the welcome splash screen > tick “Do not show..” and close the window. (Note you can launch it again from the help menu).
Note: If you see this error:
Connection Error
Unable to connect to vCenter Inventory Service –
https://{servername}:10443
Check on the vCenter server to make sure this service is running.
3. You should then be connected, and be able to browse your virtual infrastructure.
4. You can “console” onto your VM’s (Note: will need a plug in installing your browser will prompt you to accept/install).
Related Articles, References, Credits, or External Links
Mostly my conversion to Windows 8 has been pretty painless, the only thing that wont work is the VMware VI client cant open a console session to the VMs on my ESX server.
Error
The VMRC console has disconencted…attempting to reconnect
This happens because the IE10 that comes with Windows 8 does NOT LIKE the requests the VI client is sending to the Internet Explorer plug-in.
Update 08/03/13 – This problem has now been fixed! Download the latest 5.1 version of the VI client. (see screenshot).
Solution
Work-Around 1 Use VMware workstation (Note: scroll down for a permanent fix)
Until either Microsoft or VMware change something then we are stuck! however there is a work around. if you have VMware Workstation (download the trial it will keep you ticking over till the problem is fixed!).
1. Launch VMware workstation > File > Connect to Server > Enter your ESX/vCenter server details > Connect.
Note: You may need to accept the certificate warning if you are using self signed certificates.
2. Now you can open a console session to your virtual machines.
Work-Around 2 Use VMware Guest Console
Download and run VMware Guest Console > Connect to to a host or vCenter, and you can access the guest machines consoles from there.
Permanent Fix
Sorry, the only way to fix this (at time of writing) is to upgrade to vSphere 5.1 AND install the 5.1 version of the vSphere client. (You can’t point the 5.1 client at a 5.0 host, it automatically launches the 5.0 version of the VI client).
Note: You will need to update vCenter to 5.1 as well for that to work!
Problem Resolved
Update to the latest VI client, and the problem will cease.
Related Articles, References, Credits, or External Links
Seen when connected to the VMware VI client software, and attempting to open a console session with a virtual machine.
Solution
This is a pretty generic error, for whatever reason the client software cannot connect to the KMS (Keyboard, Mouse, and Screen).
In NEARLY every case this is a communication issue, either the machine running the client software cannot resolve the name of the ESX host that is hosting the virtual machines, or TCP Port 902 is being blocked by a firewall.
1. If you can’t simply pop the correct name in your DNS, then add the name and IP to the machines, (the one running the VI client software) host file. You will locate this in;
[box] C:WindowsSystem32Driversetc [/box]
2. Open it with Notepad, and add the IP and name of your ESX host(s), Note: I’m also putting the name and IP of my Virtual Center server as well. Save the file and try again.
3. You should now be able to connect.
It’s NOT DNS!
If you can happily resolve the name and are sure that the port is not being blocked, then have you made any IP changes? Is the default gateway on the ESX Server set correctly? And finally restart the management agents on the host, either from the console, or by running ‘/sbin/services.sh restart’.
I’ve also fixed this error by shutting down the machine > removing it from the inventory > then browsing the storage, to locate the .vmx file > then simply import it back again.
Related Articles, References, Credits, or External Links
If like me you’ve spent a large part of your life hanging out of comms cabinets with serial cables programming routers, switches, and firewalls etc,then HyperTerminal will be an old friend. So I was a bit put out when I couldn’t find it in Vista, Windows 7, or Windows 8.
The Microsoft Web site says,
HyperTerminal is no longer part of Windows. However, you can use Telnet. It’s a simple, text-based program that you can use to connect to another computer over the Internet. If you previously used HyperTerminal to troubleshoot modem problems, use Phone and Modem Options instead:
Open Phone and Modem Options by clicking the Start button , clicking Control Panel, clicking Hardware and Sound, and then clicking Phone and Modem Options.
Note: You might need to provide information, such as your country or region and any special phone dialing rules, in the Location Information dialog box before you can access the Phone and Modem Options dialog box.
Well that’s all well and good, but I use it for Terminal Emulation – and I don’t want to fork out for expensive products like Prism or Host Suite.
Now I’ve seen some posts that claim you just need to copy hypertrm.dll and hypertrm.exe from an XP machine to the vista machines system32 directory then Start > Run > hypertrm {enter}
However – You can still download HyperTerminal as an application from the people who made it (Hilgraeve )
Solution
This one runs quite happily on Vista (Tested on Vista Ultimate V6.0 (Build 6000)), Windows 7 (Tested on Windows 7 x64 Ultimate (Build 7601)), Windows 8 (Tested on Windows 8 Pro (Build 9600)).
Note: Linux Users for a terminal console click here
Related Articles, References, Credits, or External Links
