Viewing FortiDLP Agent debug bundles

If Fortinet Support requests a FortiDLP Agent debug bundle when assisting you with an issue, follow the steps below.

How to collect a FortiDLP Agent debug bundle remotely

1. In the FortiDLP Console, on the left-hand sidebar, click .
   
2. Filter for the relevant node. For guidance on this, see Nodes in the FortiDLP Console User Guide.
3. In the Table tab, select the row of the node.
4. On the Node profile page, click Perform action.
5. In the Actions dialog box, do the following:
   1. Click Request debug bundle.
   2. Do one of the following:
      • To collect a standard debug bundle:
        1. Optionally, alter the request timeout period.
        2. Click Request debug bundle.
           
      • To collect a verbose debug bundle:
        1. Select the Request verbose debug bundle checkbox. A verbose debug bundle contains more information and takes longer to compile.
        2. Optionally, alter the request timeout period.
        3. Click Request debug bundle.
      The debug bundle is generated.
6. To view the bundle, do the following:
   1. Click Close to exit the dialog box.
   2. In the Bundles and reports widget, for the relevant bundle, click .
      
      A ZIP file is downloaded to your device.

      Pending action requests for debug bundles will display with a "Requested" badge. You can check for pending actions by sending a GET request to the FortiDLP API's /api/v1/actions/{agent_uuid}/in-flight endpoint.

   3. Extract the ZIP file.

You can also download the bundle from the Action details panel, accessible from the Action (New) or Action (Legacy) event stream (depending on the Agent version). In the Investigate module, just enter the action = debug_bundle search query and then open the panel for the relevant action event. For detailed information about our search functionality, see Searches in the FortiDLP Console User Guide.

How to collect a FortiDLP Agent debug bundle locally

1. On the device you want to collect a debug bundle for, open a command-line interface.

Administrator or root privileges are required.

2. Do one of the following:
   • On Windows, run "C:\Program Files\Jazz Networks\Agent\agent.exe" debug bundle.
   • On macOS, run sudo /Library/Application\ Support/Ava/Reveal/agent/agent debug bundle.
   • On Linux, run jazz-agent debug bundle.
     The debug bundle is saved to the current directory as a ZIP file and its filename is shown in the output message.
3. To view the bundle, extract the ZIP file.