STUNT Script (VA Support Script)

[roddy_toomim]

	Description	Script to assist with troubleshooting SailPoint virtual appliances
	Legal Agreement	By using this CoLab item, you are agreeing to SailPoint’s Terms of Service for our developer community and open-source CoLab.
	Repository Link	GitHub - sailpoint-oss/colab-stunt-script · GitHub
	Supported by	Community Support

Overview

STUNT is an acronym for Support Team Unified Network Test. The script itself has grown beyond just network testing at this point, as it now collects a snapshot of information from a SailPoint virtual appliance (commonly referred to as a “VA”) to assist in troubleshooting.

Requirements

• A SailPoint VA with SSH access

Guide

If your VA has Internet access, try pulling the stunt script and executing it with this single-line command:

wget -O ~sailpoint/stunt_2.sh https://raw.githubusercontent.com/sailpoint-oss/colab-stunt-script/main/stunt.sh; bash ~sailpoint/stunt_2.sh

If your VA does not have access to the Internet, use the following process:

1. Download the zip file from the support ticket to your local machine
2. Upload the zip file to your VA via some secure method. This can be the “scp” binary on Windows Powershell, the “scp” binary on a Mac/Linux terminal, or another utility like WinSCP
3. SSH into the VA
4. Unzip the file with this command:
   unzip stunt_##.zip(replace “##” with the real filename)
5. Make the shell script executable with this command:
   chmod +x stunt_##.sh(again, replace “##”)
6. Run the script with this command, or as directed by your Support contact:
   ./stunt_##.sh

You can modify the command in the final step to use any of the flags (or options) available to the script. Here is a list and those flags and what they do:

Table of options
-h	Show the help text
-t	Add a traceroute test to SQS
-p	Add a ping test
-f	Add automatic fixes; STUNT can detect some problems and attempt to fix them, but no changes are made without being opted-in by using this flag
-o	Add openSSL config file into the stuntlog
-j	Add collection of the last day of the systemd journal
-s	Prompts the user for information to pull a server-based certificate from a IQService (or any other server) and installs it in /home/sailpoint/certificates/
-u	Only perform forced update steps (this makes system changes, and requires at least one reboot when successful). If used, no other tests or data gathering will be performed.
-c	Only perform a series of curl tests - this alternates between SQS and S3, and outputs to a new stuntlog. If used, no other tests or data gathering will be performed.
-n	Overrides the default of creating a zip file with all logs. This will only generate the “stuntlog” file with diagnostic tests.

The most commonly used option is the -j flag which collects logs, like this: ./stunt_##.sh -j

NOTE: Once the operation is complete, the final line of output contains a ready-to-use scp command you can copy and paste to your local machine in order to retrieve the .zip or .log file the script creates for you. Provide this entire file to the SailPoint support team member via your case.

[awyss (Adam Wyss)]

Hi @roddy_toomim thank you for sharing this. Can I suggest an update to the script to account for demo tenants? Our ambassador labs and partner tenants have a different domain of identitynow-demo.com and this script isn’t able to handle that when it does the connectivity tests.

[adamian (Andrei Damian Fekete)]

When is the stunt script that comes along with the VA be updated? It seems that there is still version 1.4 used.

[adamian (Andrei Damian Fekete)]

Feel free to fix this bug: VA: stunt script performs the keyPassphrase check incorrectly

[roddy_toomim]

The issue of having an older version onboard the VA image by default was corrected a few months ago. Thanks for pointing it out!

[roddy_toomim]

Thanks for pointing it out. I’ll see what I can do to account for this.

[roddy_toomim]

Forgot to reply here when it was completed, but the work to support demo tenants is included in STUNT.