Collecting support data

There is no support-bundle command yet coming soon. Collect the following and send it to us. Never send theseus.env, runtime/, backups or FIRST-LOGIN.txt: they hold your secrets.

On the server

cd /opt/theseus
mkdir -p /tmp/theseus-support
sudo ./theseus status > /tmp/theseus-support/status.txt 2>&1
sudo ./theseus status --json > /tmp/theseus-support/status.json 2>&1
sudo ./theseus doctor > /tmp/theseus-support/doctor.txt 2>&1
sudo ./theseus config show > /tmp/theseus-support/config-masked.txt     # secrets are masked
for s in web wazuh.manager wazuh.indexer wazuh.dashboard keycloak ageleia-backend enroll; do
  sudo ./theseus logs-tail "$s" 500 > "/tmp/theseus-support/$s.log" 2>&1
done
sudo journalctl -u theseus-node -n 500 --no-pager > /tmp/theseus-support/theseus-node.log
sudo cp /var/lib/theseus-node/progress.log /tmp/theseus-support/ 2>/dev/null
uname -a > /tmp/theseus-support/host.txt; free -h >> /tmp/theseus-support/host.txt; df -h >> /tmp/theseus-support/host.txt
tar -czf /tmp/theseus-support.tar.gz -C /tmp theseus-support

Add the logs of the services involved in your problem (for example patch-service, vuln-verify, pallas, connector-defender): sudo ./theseus logs-tail <service> 500.

Review the files before sending: logs can contain host names, IP addresses and user names.

From an endpoint

Platform	Files
Linux	/var/ossec/logs/ossec.log, journalctl -u theseus-agent -n 300
macOS	/Library/Ossec/logs/ossec.log, /var/log/theseus-agent.log
Windows	C:\Program Files (x86)\ossec-agent\ossec.log

Plus the exact installer output, if the problem is enrolment.

Tell us

• What you did, what you expected, what happened, and when (with time zone).
• Single server or two servers; self-hosted or hosted.
• The release (status shows it).