Guide
Generate a support file
Download one zip with the state, configuration and logs someone helping you troubleshoot needs, and know what's left out.
When something doesn’t look right, a support file gives whoever helps you everything they need to see in one download: no screen sharing, no shell access.
Generate it
Section titled “Generate it”- Sign in as an admin and open System.
- Click Generate support file.
- Choose the options. Both are on by default:
- Include the last 5 minutes of flow records (up to 20,000, with IP addresses). Turn it off if you’d rather not share addresses from your traffic.
- Capture the routers’ flow export packets for 10 seconds (up to 500 per exporter). This shows exactly what a router puts in its records. The download starts after the capture.
- Save the zip and send it to info@heimnull.com, with a short description of what you see and since when.
Every download is recorded in the audit log.
What’s in it
Section titled “What’s in it”- The System page’s state, component health and the license state.
- Every exporter, with its sampling, the templates Heimnull learned and its fields.
- Your configuration, exported without secrets, and the settings.
- BGP sessions and notification channels.
- The last week’s events, attacks, mitigations and audit log.
- Heimnull’s internal metrics, and the recent output of every process in the container (about the last 2 MB each).
- ClickHouse’s recent errors, failed queries and table sizes.
- For wrong rates on an interface: the last hour per interface as the flows saw it (with and without the sampling multiplier) and as SNMP saw it, and each SNMP interface’s flows-versus-SNMP series over 6 hours.
- If you chose them: the recent flow records, and the capture of flow export packets (
exporters/datagrams.pcap, which opens in Wireshark).
index.json inside lists every part, and anything that couldn’t be collected.
What’s left out
Section titled “What’s left out”- Stored passwords, SNMP communities, tokens and keys are never in it. The API never returns them, and fields that look like secrets are blanked.
- URLs in the logs keep only their host name, since a webhook URL can carry a token.
- It still names your networks, your devices and the users who changed settings, and the flow records and capture (if you leave them on) hold addresses from your traffic. Look through the zip before you send it if that matters.
From a script
Section titled “From a script”With an admin API token:
curl -H "Authorization: Bearer $HN_TOKEN" -o support.zip \ "http://heimnull.example.net/api/support/bundle?flow_minutes=5&capture_seconds=10"flow_minutes (0 to 60, default 5) and capture_seconds (0 to 30, default 10) set the two options; 0 leaves that part out.