Skip to main content

Troubleshooting

When something doesn't work correctly, it can be difficult to diagnose if you don't know where to look. In this module, we'll explore a few different troubleshooting methods.

Inspecting Task Failures​

important

If necessary, Navigate back to the REST Collector Source page. From the top nav of your Cribl Stream Sandbox, select Manage > Data > Sources, then select Collectors > REST from the Data Sources page's tiles or left nav. Click Add Collector to open the REST > Add Collector modal, which provides the following options and fields.

  1. In the Collector ID field, enter its_broken.
  2. Copy the following URL to the Collect URL field. 
    'http://rest-server/404'
  3. At the bottom left, click ► Save & Run. In the Run configuration modal, click Run again.

You should see a Not found result in the preview window. This particular REST API service is nice because it returns a human-readable error message. But not all collection jobs will show a message – some will fail with a numeric error.

important
  1. Close the Preview window.
  2. In the Manage Rest Collectors table, locate the its_broken row. In the Latest Ad Hoc Run column, click the corresponding blue link for the collector.
  3. In the modal, click on the Task Errors upper tab.
  4. Expand the + button to the left of each error: {# items...} message, and explore the task error that was returned.

You can also see the same error under the Logs tab.

important
  1. Click the Logs tab at the top of the modal.
  2. In the search filter, copy and paste the following query: 
    message == "task execution failure"

Expand the error row and view the details in the reason field. This will be similar to the Task Errors tab.

Viewing the Calculated URLs​

important

If you haven't completed the Pagination module's [RFC 5988 - Web Linking](../3-Advanced Collector Configuration/1_pagination#rfc-5988---web-linking) section, do so before completing the next steps.

  1. Close the modal for the most recent run.
  2. Click the ► Run button on the collect_web_linking collector job's row.
  3. In the Run Collector dialog, expand the Advanced Settings accordion.
  4. In the Log Level, select debug.
  5. Click the Run button at the bottom right.
  6. Close the Preview window when the collection job completes.
  7. In the Manage Rest Collectors table, locate the collect_web_linking row. In the Latest Ad Hoc Run column, click the corresponding blue link for the collector.
  8. Click the Logs tab at the top of the modal.
  9. In the search filter, copy and paste the following query: 
    message == "sending http request"
  10. Click the Search button.

Expand each row, and observe the value in the url field. These are the URLs used to collect each page of the paginated collection job. Examining these URLs is useful if query strings are not evaluating correctly when running a collection job.

View Logs for Previously Run Jobs​

For scheduled Collectors, or other previously run adhoc jobs, you can view logs in the Monitoring tab.

note
  1. Click the Monitoring tab in the top navigation menu.
  2. In the sub-menu, select System > Job Inspector.
  3. Click the Scheduled button in the filter.
  4. Click on the ID field of any row to open the Job results and logs.

Conclusion​

Congratulations, you now know how to start troubleshooting problematic collections! Proceed to the next module for the course conclusion.