Support & Diagnostics

Overview

The Support tab in Settings → Support (superusers only) gathers everything DFIRe support needs to troubleshoot your installation into a single downloadable file, and shows a live view of the application logs so you can watch what the system is doing in real time. For problems the application cannot see itself, such as a container that will not start, a companion script collects diagnostics directly on the host.

Support Package

The support package is a plain zip file containing diagnostic information about your installation:

• Application logs of the backend, task worker, and Slack socket processes
• System information: versions, platform, database and Redis health, uptime
• Migration state and installed package versions
• Your system configuration with all secrets masked or omitted
• License state and the time of the last license server contact
• An audit log excerpt, optional (you choose the window, 7 to 90 days, or exclude it entirely)
• Background task state: failed tasks, schedules, queue depth
• Backup inventory and database size statistics

The package contains no passwords, API keys, or encryption keys, and no attachment data. Configuration secrets are masked at the source, and the archive is a plain zip so you can inspect exactly what you are sending before you send it. Every file in the archive is listed in its manifest.json.

One part of the package can carry case-related text: the audit log excerpt records who changed what, including the old and new values of edited fields. If audit data must not leave your installation, set the audit log window to Do not include — the package is generated without it, and the manifest records that it was excluded by choice rather than lost to an error.

Generating from the web interface

1. Open Settings → Support

   The Support tab is visible to superusers.

2. Choose the audit log window

   Seven days is the default and usually enough; extend it when the problem started earlier, or choose Do not include to leave audit data out of the package.

3. Click Generate support package

   The package builds on the server and downloads through your browser. Nothing is stored on the server, and each generation is recorded in the audit log.

Generating from the command line

When the web interface is unreachable, generate the same package on the host:

docker compose exec -T backend python manage.py support_package
docker compose cp backend:<printed path> .

The command prints the path of the finished zip inside the container.

Live Log Viewer

The Application logs card on the Support tab tails the logs of the three application processes: Backend, Task worker, and Slack socket. New lines appear within a couple of seconds of being written.

• Errors are shown in red and warnings in amber, so problems stand out while scrolling.
• Filter the view by minimum level (for example errors only) or by any text.
• Pause freezes the view while you read; Resume catches up. The view follows the newest lines unless you scroll up.
• Download log saves the current log file as it is on disk. Downloads are recorded in the audit log.

The viewer covers the application processes.

Version Information

DFIRe ships as two containers, and both report their version: the backend and frontend versions are shown side by side in My Profile → About and on Settings → License & Updates. If the two containers are running different releases, for example because an update pulled one image but not the other, a warning appears in both places telling you to update both containers to the same release. Version mismatches are a common cause of missing features or a broken interface after an upgrade, so check here first when something looks wrong right after updating. See Updating DFIRe for the upgrade procedure.