How to analyze KATA collect script output [KATA/KEDRE]

November 12, 2023

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

Collect script output is a must for most KATA-related issues and questions.

Which information?

Which file?

How to find/interpret?

Example

КАТА version and role: CN/PCN/SCN/Sensor

/config/apt-va

File contains the version and role in human-readable form. Also, you can see if the node was upgraded from previous KATA versions in 'migrate' line

Primary CN

[product]

name=kata-cn

title=Kaspersky Anti Targeted Attack Platform

version=3.5.0-1269

release=release

master = yes

sensor = yes

timestamp = 1568700994

migrate =

cn_role = pcn

Standalone CN

[product]

name=kata-cn

title=Kaspersky Anti Targeted Attack Platform

version=3.6.1-713

release=release

master = yes

sensor = yes

timestamp =1572445307.01

migrate =

cn_role = cn

Sensor node

[product]

name=kata-cn

title=Kaspersky Anti Targeted Attack Platform

version=3.6.1-713

release=release

master = no

sensor = yes

timestamp =1583845362.98

migrate =

cn_role =

Virtual or hardware?

/environment/dmesg.txt

OR

/var/log/messages

OR

/var/log/boot.log

Search for "DMI" entries in the file.

Physical server

[ 0.000000] DMI: HPE ProLiant DL560 Gen10/ProLiant DL560 Gen10, BIOS U34 06/20/2018

Virtual server

[ 0.000000] DMI: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/05/2016

CPU

/environment/cpuinfo.txt

Scroll to the bottom of the file. Each "processor" listed is not a physical core, but virtual "thread", so, i.e. 8-physical core CPU with hyper-threading will have 16 CPUs in the file. Keep in mind that CPUs are counted from 0, so for 16-thread CPU last entry will have number 15.

processor : 15

vendor_id : GenuineIntel

cpu family : 6

model : 79

model name : Intel(R) Xeon(R) Platinum 8158 CPU @ 3.00GHz

stepping : 0

microcode : 0x2000050

cpu MHz : 2992.968

cache size : 25344 KB

physical id : 0

siblings : 16

core id : 15

cpu cores : 16

apicid : 15

initial apicid : 15

fpu : yes

fpu_exception : yes

cpuid level : 13

wp : yes

flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts nopl xtopology tsc_reliable nonstop_tsc eagerfpu pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch ibrs ibpb stibp fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 invpcid rtm rdseed adx smap xsaveopt arat spec_ctrl intel_stibp arch_capabilities

bogomips : 5985.93

clflush size : 64

cache_alignment : 64

address sizes : 43 bits physical, 48 bits virtual

power management:

RAM

/environment/memory.txt

File shows free command output. Values are in megabytes, pay attention to 'total' and 'available' columns. NB! Ignore 'free' column: despite of it's name, it doesn't actually show free RAM, 'available' column does it.

total used free shared buff/cache available

Mem: 197308 63869 3634 6738 129804 125558

Swap: 0 0 0

HDD

/environment/hdd.txt

Pay attention to partitions /dev/sda* and /dev/sdb*.

If /dev/sdb* partition is present, you are dealing with two-disk installation, otherwise, it's one-disk installation.

NB! Always check HDD partitions size and available free space! KATA needs a LOT of disk space to work correctly.

Most important partitions are:

/dev/sda4 1.2T 894G 224G 80% /data ← Used for processing queues and quarantine, main partition for KATA

/dev/sdb1 2.7T 1.4T 1.3T 52% /data/var/lib/kaspersky/storage ← Used for EDR data: (telemetry from Endpoint Sensors)

Filesystem Size Used Avail Use% Mounted on

/dev/sda3 367G 14G 335G 4% /

devtmpfs 126G 0 126G 0% /dev

tmpfs 126G 252K 126G 1% /dev/shm

tmpfs 126G 4.1G 122G 4% /run

tmpfs 126G 0 126G 0% /sys/fs/cgroup

/dev/sda2 232M 32M 189M 15% /boot

/dev/sda1 237M 5.5M 232M 3% /boot/efi

/dev/sda4 1.5T 435G 955G 32% /data

/dev/sdb1 2.7T 1.4T 1.3T 52% /data/var/lib/kaspersky/storage

tmpfs 26G 0 26G 0% /run/user/998

tmpfs 26G 0 26G 0% /run/user/1002

tmpfs 26G 0 26G 0% /run/user/1001

DNS name

/environment/hostname.txt

File contains exactly the hostname of the machine.

kata-cn

IP address

/environment/ipa.txt

/environment/ifconfig.txt

Both files contain info about network interfaces and assigned IP addresses.

ifconfig command is considered obsolete by community, but it can be useful: it helps to recognize SPAN interfaces. SPAN interfaces usually don't have IP address assigned, but have a lot of traffic. Also, SPAN interfaces always are in promiscuous mode: <UP,BROADCAST,RUNNING,PROMISC,MULTICAST>

ipa.txt

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

inet 127.0.0.1/8 scope host lo