Netskope Client Debug Mode - Netskope Knowledge Portal

The Netskope Client debug mode offers an easy and efficient way to consolidate all necessary information required for troubleshooting. In the event of any issues, activate debug mode and reproduce the issue. Once the issue occurs, stop the debug mode and share the generated archive file with Netskope.

When the Netskope Client debug mode is activated, it performs the following:

Inner packet capture with multiple file rotations.
Outer packet capture with multiple file rotations.
The Netskope Client service debug logs rotate across multiple files.
Start debug mode with administrative privileges to collect the following information:

Run the nsdiag command as an administrator on Windows and sudo on MacOS
- On Mac, collect the sysdiagnose log (this process can take a few minutes).
- On Windows,
  - Generate memory dumps for the Netskope Client service (stAgentSvc.exe) and the current tenant user UI (stAgentUI.exe).
    
    If Protect Client configuration and resources is enabled, debug Mode does not collect memory dumps.
  - Collect Windows Application and System Event logs.
Disables Save Logs option on the Client UI.
Disables Advanced Debugging Client UI features such as Set Log Level, Save Driver Logs, Inner Packet Capture, and Outer Packet Capture.
Disables nsdiag command from setting log levels, initiating inner and outer packet captures from the Netskope Client UI, and increasing the log file size.

Debug Mode Command

Windows

nsdiag -b [start | stop | status | cleanup] -l [ dump | debug | info | error | critical] -s <snap length> -m <max debug log files> -i [disable | maxInnerPcapTotalSize in MB] -e [disable | maxOuterPcapTotalSize in MB] -c [disable | CPU sample interval in second] -r [enable | disable driver log] -t [duration of time in minutes] -o <output archive path>

macOS

nsdiag -b [start | stop | status | cleanup] -l [ dump | debug | info | error | critical] -s <snap length> -m <max debug log files> -i [disable | maxInnerPcapTotalSize in MB] -e [disable | maxOuterPcapTotalSize in MB] -c [disable | CPU sample interval in second] -d [enable | disable sysdiagnose log] -t [duration of time in minutes] -o <output archive path>

Linux

nsdiag -b [start | stop | status | cleanup] -l [ dump | debug | info | warning | error | critical] -s <snap length> -m <max debug log files> -i [disable | maxInnerPcapTotalSize in MB] -e [disable | maxOuterPcapTotalSize in MB]-t [duration of time in minutes] -o <output archive path>

Parameter	Description
-b [start \| stop \| status \| cleanup]	start/stop/get status/cleanup debug mode
-l [ dump \| debug \| info \| error \| critical]	Set debug mode log level. Default value is debug.
-s <snap length>	Set the inner and outer packet capture snap length in debug mode. Default value is 0.
-m <max debug log files>	Set the maximum debug log file number in debug mode. Default value is 10.
-i [disable \| maxInnerPcapTotalSize in MB]	Set inner packet capture total size in debug mode. Default value is 600MB.
-e [disable \| maxOuterPcapTotalSize in MB]	Set outer packet capture total size in debug mode. Default value is 800MB.
-c [disable \| CPU sample interval in second]	– Windows and Mac only. – Snapshot all processes CPU usage in every (interval) seconds. The result will be in new nsDMCpuUsage.log in Netskope Client log folder.
-r [enable \| disable driver log]	– Windows only. – Enable/disable driver log in debug mode.
-d [enable \| disable]	– macOS only. – Enable/disable collecting sysdiagnose log. Note: It takes a few minutes to collect sysdiagnose log details.
-t [duration of time in minutes]	Optional: Default is 2160 minutes or 36 hours – Minimum value is 1 (minute). – Maximum value is 86,400 minutes or 60 days – Netskope Client automatically stops the debug mode and collects the required information after the duration.
-o <output archive full path>	Required: set output archive file (.zip) full path. – Netskope Client automatically adds .zip extension if the specified file does not have it. – If it is configured in -b start command, it is not required in -b stop command.

Stop Debug Command

The Netskope Client continues to collect information until the user executes the command nsdiag -b stop to terminate debug Mode.

A device reboot would not stop debug Mode.

Debug Command Examples

Example 1

Users frequently encounter issues with Netskope Client. To troubleshoot this, initiate debug mode using the default parameters and then attempt to reproduce the issue as follows:

nsdiag -b start -o ~/debug/NSClientLogs.zip

When the issue occurs, stop the debug mode immediately. A file named NSClientLogs_timestamp.zip (for example, NSClientLogs_2025.04.03_16-16-35-0800.zip) is generated in the ~/debug folder. Share this file with Netskope Support.

nsdiag -b stop

Example 2

Users occasionally encounter issues that are not easily reproducible on demand; it might take several hours or even days for the problem to manifest. To troubleshoot, they can initiate debug mode as follows:

Before proceeding, ensure that there is sufficient disk space available and adjust the parameters as necessary.

nsdiag -b start -s 200 -i 1000 -e 1200 -m 50 -o ~/debug/NSClientLogs.zip

Set inner pcap total size to 1000M bytes.
Set outer pcap total size to 1200M bytes.
Set total 50 debug log files.

When the issue occurs after several hours or days, users can promptly disable the debug mode.

nsdiag -b stop

Example 3

Netskope Client experiences instability which may manifest as process hangs or crashes. As an admin run the following:

nsdiag -b start -o “c:\debug\NSClientLogs.zip“

When the issue occurs, stop the debug mode immediately. To stop the debug mode, run the following in the command prompt:

nsdiag -b stop

Example 4

If there is a performance issue due to tunnel loading, run the following in the command prompt:

nsdiag -b start -l info -s 200 -i 1200 -e disable -r disable -c 3 -o "c:\debug\loadtest.zip"

In the preceding command, set the following parameters:

Set log level to “info”
Set snaplen to 200
Set inner pcap total size to 1200M bytes
Disable outer pcap
Disable driver log

You can evaluate CPU usage every three seconds. Disable the debug mode after validation is complete.

Example 5

If the administrator wants to initiate the debug mode in a macOS device and gather all relevant information including sysdiagnose log, perform the following:

sudo nsdiag -b start -o ~/debug/1.zip

nsdiag -b stop

Example 6

If the administrator wants to initiate the debug mode on a macOS device without collecting the sysdiagnose log, perform one of the following:

nsdiag -b start -o ~/debug/1.zip

nsdiag -b stop

sudo nsdiag -b start -o ~/debug/1.zip

nsdiag -b stop -d disable

Example 7

To clean up all debug mode files after stopping the debug mode:

nsdiag.exe -b cleanup

Example 8

The administrator wants to specify running the Debug Mode for only 60 minutes with the default parameters.

-b start -t 60 -o outputFile(.zip)

After 60 minutes, the Debug mode stops automatically, and collects the required information to the output file in the format outputFile_YYYY.MM.DD_HH-MM-SS-UTC.zip file.

Restarting Netskope Client in between 60 minutes does not stop the debug mode.

Verify Debug Status

To verify the status of debug mode, you can use one of two methods:

Using command line: nsdiag -b status
Using Netskope Client UI:
1. When debug mode is enabled, the Save Logs… menu appears greyed out.
2. Click Advanced Debugging.
  
  The options for Set Log Level, Save Driver Logs, Inner Packet Capture, and Outer Packet Capture are also greyed out, and shows the current status (Start or Stop).

When the Netskope Client debug mode is activated, it performs the following:

Inner packet capture with multiple file rotations.
Outer packet capture with multiple file rotations.
The Netskope Client service debug logs rotate across multiple files.
Start debug mode with administrative privileges to collect the following information:

Run the nsdiag command as an administrator on Windows and sudo on MacOS
- On Mac, collect the sysdiagnose log (this process can take a few minutes).
- On Windows,
  - Generate memory dumps for the Netskope Client service (stAgentSvc.exe) and the current tenant user UI (stAgentUI.exe).
    
    If Protect Client configuration and resources is enabled, debug Mode does not collect memory dumps.
  - Collect Windows Application and System Event logs.
Disables Save Logs option on the Client UI.
Disables Advanced Debugging Client UI features such as Set Log Level, Save Driver Logs, Inner Packet Capture, and Outer Packet Capture.
Disables nsdiag command from setting log levels, initiating inner and outer packet captures from the Netskope Client UI, and increasing the log file size.

Debug Mode Command

Windows

nsdiag -b [start | stop | status | cleanup] -l [ dump | debug | info | error | critical] -s <snap length> -m <max debug log files> -i [disable | maxInnerPcapTotalSize in MB] -e [disable | maxOuterPcapTotalSize in MB] -c [disable | CPU sample interval in second] -r [enable | disable driver log] -t [duration of time in minutes] -o <output archive path>

macOS

nsdiag -b [start | stop | status | cleanup] -l [ dump | debug | info | error | critical] -s <snap length> -m <max debug log files> -i [disable | maxInnerPcapTotalSize in MB] -e [disable | maxOuterPcapTotalSize in MB] -c [disable | CPU sample interval in second] -d [enable | disable sysdiagnose log] -t [duration of time in minutes] -o <output archive path>

Linux

nsdiag -b [start | stop | status | cleanup] -l [ dump | debug | info | warning | error | critical] -s <snap length> -m <max debug log files> -i [disable | maxInnerPcapTotalSize in MB] -e [disable | maxOuterPcapTotalSize in MB]-t [duration of time in minutes] -o <output archive path>

Parameter	Description
-b [start \| stop \| status \| cleanup]	start/stop/get status/cleanup debug mode
-l [ dump \| debug \| info \| error \| critical]	Set debug mode log level. Default value is debug.
-s <snap length>	Set the inner and outer packet capture snap length in debug mode. Default value is 0.
-m <max debug log files>	Set the maximum debug log file number in debug mode. Default value is 10.
-i [disable \| maxInnerPcapTotalSize in MB]	Set inner packet capture total size in debug mode. Default value is 600MB.
-e [disable \| maxOuterPcapTotalSize in MB]	Set outer packet capture total size in debug mode. Default value is 800MB.
-c [disable \| CPU sample interval in second]	– Windows and Mac only. – Snapshot all processes CPU usage in every (interval) seconds. The result will be in new nsDMCpuUsage.log in Netskope Client log folder.
-r [enable \| disable driver log]	– Windows only. – Enable/disable driver log in debug mode.
-d [enable \| disable]	– macOS only. – Enable/disable collecting sysdiagnose log. Note: It takes a few minutes to collect sysdiagnose log details.
-t [duration of time in minutes]	Optional: Default is 2160 minutes or 36 hours – Minimum value is 1 (minute). – Maximum value is 86,400 minutes or 60 days – Netskope Client automatically stops the debug mode and collects the required information after the duration.
-o <output archive full path>	Required: set output archive file (.zip) full path. – Netskope Client automatically adds .zip extension if the specified file does not have it. – If it is configured in -b start command, it is not required in -b stop command.

Stop Debug Command

The Netskope Client continues to collect information until the user executes the command nsdiag -b stop to terminate debug Mode.

A device reboot would not stop debug Mode.

Debug Command Examples

Example 1

Users frequently encounter issues with Netskope Client. To troubleshoot this, initiate debug mode using the default parameters and then attempt to reproduce the issue as follows:

nsdiag -b start -o ~/debug/NSClientLogs.zip

nsdiag -b stop

Example 2

Before proceeding, ensure that there is sufficient disk space available and adjust the parameters as necessary.

nsdiag -b start -s 200 -i 1000 -e 1200 -m 50 -o ~/debug/NSClientLogs.zip

Set inner pcap total size to 1000M bytes.
Set outer pcap total size to 1200M bytes.
Set total 50 debug log files.

When the issue occurs after several hours or days, users can promptly disable the debug mode.

nsdiag -b stop

Example 3

Netskope Client experiences instability which may manifest as process hangs or crashes. As an admin run the following:

nsdiag -b start -o “c:\debug\NSClientLogs.zip“

When the issue occurs, stop the debug mode immediately. To stop the debug mode, run the following in the command prompt:

nsdiag -b stop

Example 4

If there is a performance issue due to tunnel loading, run the following in the command prompt:

nsdiag -b start -l info -s 200 -i 1200 -e disable -r disable -c 3 -o "c:\debug\loadtest.zip"

In the preceding command, set the following parameters:

Set log level to “info”
Set snaplen to 200
Set inner pcap total size to 1200M bytes
Disable outer pcap
Disable driver log

You can evaluate CPU usage every three seconds. Disable the debug mode after validation is complete.

Example 5

If the administrator wants to initiate the debug mode in a macOS device and gather all relevant information including sysdiagnose log, perform the following:

sudo nsdiag -b start -o ~/debug/1.zip

nsdiag -b stop

Example 6

If the administrator wants to initiate the debug mode on a macOS device without collecting the sysdiagnose log, perform one of the following:

nsdiag -b start -o ~/debug/1.zip

nsdiag -b stop

sudo nsdiag -b start -o ~/debug/1.zip

nsdiag -b stop -d disable

Example 7

To clean up all debug mode files after stopping the debug mode:

nsdiag.exe -b cleanup

Example 8

The administrator wants to specify running the Debug Mode for only 60 minutes with the default parameters.

-b start -t 60 -o outputFile(.zip)

After 60 minutes, the Debug mode stops automatically, and collects the required information to the output file in the format outputFile_YYYY.MM.DD_HH-MM-SS-UTC.zip file.

Restarting Netskope Client in between 60 minutes does not stop the debug mode.

Verify Debug Status

To verify the status of debug mode, you can use one of two methods:

Using command line: nsdiag -b status
Using Netskope Client UI:
1. When debug mode is enabled, the Save Logs… menu appears greyed out.
2. Click Advanced Debugging.
  
  The options for Set Log Level, Save Driver Logs, Inner Packet Capture, and Outer Packet Capture are also greyed out, and shows the current status (Start or Stop).