Troubleshooting

Overview

When setting up basic functionality in Paragon Insights, it can be challenging to diagnose problems. From installation, to device configuration, to adding devices and applying playbooks, when an issue occurs there are many possible areas to investigate.

Starting with HealthBot Release 2.1.0, the self-test tool validates the core functionality of Paragon Insights. To perform the self test, the tool performs a typical set of tasks:

• Adds a simulated device to Paragon Insights

• Creates a device group, and adds the device

• Creates a rule

• Creates and deploys a playbook

• Streams data from the simulated device

• Displays ongoing status in the dashboard

The self-test instance essentially acts as a fully working setup, running entirely within the Paragon Insights system. When testing is complete, the tool provides a report.

Other Uses for the Self Test Tool

In addition to validating the Paragon Insights installation, the self-test feature also provides:

• An easy way to do a quick demo - the self test instance provides a simulated device connected to Paragon Insights, so you can demo Paragon Insights with no need to add a real device or apply playbooks.

• A good way for new users to get started - the self test auto-configures a simulated device connected to Paragon Insights, thereby eliminating the complexity of adding devices, applying playbooks, and so on.

• A ‘running reference’ - if there is an issue with real devices, you can use a self-test instance to help determine where the issue is; if the self-test instance is OK then the problem is not with the Paragon Insights system.

Usage Notes

• Currently this feature supports simulating devices to stream data for OpenConfig telemetry and iAgent (NETCONF).

• You can retain the self-test instance to act as a ‘running reference’, as noted above.

• The color coding for the test results is as follows:

  • Green = pass

  • Yellow = error (unable to test)

  • Red = fail

  • Any items with yellow or red status will include a message with more detail about the issue.

• Do not use the self-test tool when there are undeployed changes, as the self-test tool issues its own deploy during execution.

• Do not use rules, playbooks, devices, device-groups or other elements created by the self-test tool with real network devices.

How to Use the Self Test Tool

1. Navigate to the Administration > Debug page from the left-nav panel, and select the APPLICATION tab.

2. Select the desired sensor type(s) from drop-down menu.

3. Click the Test button.

4. After a few moments, the test results appear.

   

   The example above shows that both sensors are working as expected.

Overview

In early versions of Paragon Insights, there was no way to easily determine whether the devices you added were up and reachable; you would need to get through the entire setup procedure - add the device, setup a device group, apply playbooks, monitor devices - at which point the health pages would indicate “no data” indicating that the setup did not work correctly. Furthermore, “no data” does not indicate whether the problem is a reachability issue or data streaming issue.

Starting with HealthBot Release 2.1.0, the device reachability tool can verify connectivity to a device. The tool performs tests using ping and SSH. Paragon Insights uses the device’s IP address or host name, based on what was configured when adding the device.

Usage Notes

• While this feature is generally intended to help troubleshoot device onboarding, you can use it any time to check device reachability.

• The color coding for the test results is as follows:

  • Green = pass

  • Yellow = error (unable to test)

  • Red = fail

  • Any items with yellow or red status will include a message with more detail about the issue.

How to Use the Device Reachability Tool

1. To access the tool:

   • Navigate to the Administration > Debug page from the left-nav panel, and select the REACHABILITY tab.

     

   • Or, on the Dashboard page click the desired device in the device list widget, and in the pop-up window click the REACHABILITY TEST button.

   Note:

   The REACHABILITY TEST button does not appear when first adding the device.

2. In the Device Reachability tool, select the desired device from drop-down menu.

3. Click the Test button.

4. After a few moments, the test results appear.

   

   The example above shows that the ping test was successful, but the SSH test failed.

Overview

In early versions of Paragon Insights, there was no way to easily determine which ingest methods were supported for a given device; you also had no way to know whether the configured ingest method successfully established a connection with the network device.

Starting with HealthBot Release 2.1.0, the ingest connectivity tool can verify ingest methods where Paragon Insights initiates the connection, such as OpenConfig, iAgent, and SNMP. Paragon Insights does not test UDP-based ingest methods, such as syslog and Native GPB, as the UDP parameters are common to a device group and not specific to a device.

Paragon Insights validates each supported ingest method in its own way:

• OpenConfig: Establishes a gRPC connection with the device using its IP/host name, gRPC port, and credentials

• iAgent: Establishes a NETCONF session with the device using its IP/host name, NETCONF port, and credentials

• SNMP: Executes a simple SNMP GET command; expects to get a reply from the device

This tool provides multiple benefits:

• It helps to identify when there might be missing configuration on the network device side.

• It helps you choose appropriate playbooks and rules that use sensors compatible with the supported ingest methods.

• It helps to identify ingest connectivity issues early on, rather than troubleshoot the “no-data” issue described in the previous section.

Usage Notes

• While this feature is generally intended to help troubleshoot device onboarding, you can use it any time to check ingest connectivity.

• The color coding for the test results is as follows:

  • Green = pass

  • Yellow = error (unable to test)

  • Red = fail

  • Any items with yellow or red status will include a message with more detail about the issue.

How to Use the Ingest Connectivity Tool

1. To access the tool:

   • Navigate to the Administration > Debug page from the left-nav panel, and click the INGEST tab.

   • Or, on the Dashboard page click the desired device in the device list widget, and in the pop-up window click the INGEST TEST button.

     
   Note:

   The Ingest Test button does not appear when first adding the device.

2. In the Ingest Connectivity tool, select the desired device from drop-down menu

3. Click the Test button.

4. After a few moments, the test results appear.

   

   The example above shows that iAgent is supported, OpenConfig is not supported, and SNMP encountered an error.

Overview

One of the most common problems that a Paragon Insights users face is “How to debug no-data?”. Determining the root cause is challenging as the issue can occur for a variety of reasons, including:

• Device not reachable

• Device not sending data

• Firewall blocking connections

• Ingest connectivity settings mismatch

• Rule frequency/trigger interval is configured less than the router response time

• Paragon Insights services not running

In early versions of Paragon Insights, you needed to manually look for the problem, checking add-device parameters, reviewing logs, checking the device configuration, and so on.

Starting with HealthBot Release 2.1.0, the debug no-data tool helps to determine why a device or rule is showing a status of “no-data”. The tool takes a sequential, step-by-step approach to determine at which stage incoming data is getting dropped or blocked, as follows:

• Paragon Insights Services​

  • Verify that all common and device group-related services are up and running​

• Device Reachability​

  • Test connectivity to device using ping and SSH

• Ingest Connectivity​

  • Verify that the configured ingest session is established

• Raw Data Streaming​

  • Verify whether the ingest is receiving any raw data from the devices

  • Likely to be OK if device connectivity is OK

• Field Processing​

  • Within rules, verify that the fields working properly, and that the field information is populated in the database

• Trigger Processing​

  • Within rules, verify that the trigger settings working as intended, and status information is populated in the database

• API Verification

  • Check for API timeouts that might be affecting the GUI

Usage Notes

• The tool runs through the entire sequence of checks, regardless of any issues along the way.

• The test results provide root cause information and advise where to focus your troubleshooting efforts.

• While this feature is generally intended to debug a device when it is marked as no-data, you can use it any time to verify that deployed rules are receiving data.

• This tool does not support rules using a syslog sensor, as the sensor data is event driven and not periodic.

• The color coding for the test results is as follows:

  • Green = pass

  • Yellow = error (unable to test)

  • Red = fail

  • Any items with yellow or red status will include a message with more detail about the issue.

How to Use the Debug No-Data Tool

1. To access the tool:

   • On any device health page, click a “no data” tile.

     

   • Or, navigate to the Administration > Debug page from the left-nav panel, and select the NO DATA tab.

2. In the Debug No-Data tool, select the desired device group, device, and one or more rules from the drop-down menu

3. Click the Debug button.

4. After a few moments, the test results appear.

   

   The example above shows that one common services is not working properly.