Collecting support data

Never send theseus.env, runtime/, backups or FIRST-LOGIN.txt: they hold your secrets. The support bundle below leaves them out.

If your stack is connected to the control plane

We can create the support bundle below on each of your servers from the control plane, without anyone logging in to the server. It reaches us over the Leitstand node's encrypted connection and we keep it for 14 days.

Create a support bundle on the server

On each server involved (on two servers, usually both):

cd /opt/theseus
sudo ./theseus support-bundle /tmp/schildmark-support.tgz

It writes one file (mode 0600) holding:

Part	Contents
manifest.json	When, which server role, organisation, version and release
status.json, doctor.json	The output of ./theseus status --json and ./theseus doctor --json
compose-ps.txt, docker.txt	Container states, Docker version and information
logs/<service>.log	The last 2,000 lines, with timestamps, of every service on this server
theseus.env.redacted	Your settings, with every password, secret, token and key replaced by <redacted>
config/	The rendered configuration files that hold no secret (service lists, gateway configuration, licence, release)

It never includes certificates or keys (runtime/pki), connector credentials or the install result.

Logs are included as the services wrote them, not redacted: they can contain host names, IP addresses and user names. Look through the file before sending it if that matters to you.

If the problem is the stack's connection to the control plane or an install, add the Leitstand node's log:

sudo journalctl -u theseus-node -n 500 --no-pager > /tmp/leitstand-node.log
sudo cp /var/lib/theseus-node/progress.log /tmp/ 2>/dev/null

From an endpoint

Platform	Files
Linux	/var/ossec/logs/ossec.log, journalctl -u theseus-agent -n 300
macOS	/Library/Ossec/logs/ossec.log, /var/log/theseus-agent.log
Windows	C:\Program Files (x86)\ossec-agent\ossec.log

Plus the exact installer output, if the problem is enrolment.

Tell us

• What you did, what you expected, what happened, and when (with time zone).
• Single server or two servers; self-hosted or hosted.
• The release (status shows it).