#!/bin/bash
# NetWitness Tech Support Data Gathering Script

shopt -sq extglob

scriptver="2014.02.10"
WEBPROTO='https'
CMSRESOURCE='nwtech.zip'
PUBKEYID='EF0344E9'
NWPUBKEY='-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2.0.19 (Darwin)

[payload removed: 1648 characters in 26 lines]
=YeoP
-----END PGP PUBLIC KEY BLOCK-----'

function main {
	echo -e "RSA NetWitness Tech Support Script\nVersion: $scriptver\n"
	if [ $# -eq 1 ]; then
		if [[ $1 != "-p" && $1 != "-d" && $1 != "-i" && $1 != "-detect" && $1 != "-u" ]]; then
			usage
		fi
	elif [[ $# -ge 1 && $# -le 6 ]] ; then
		echo -n
	else
		usage
	fi

	DATE=`date +%Y.%m.%d-%H.%M.%S`
	TMP=/tmp/nwtech-$DATE
	mkdir $TMP

	OLDIFS=$IFS
	USER=$1
	PASSWORD=$2
	num=0
	PARAMETERS=""

	for arg in "$@"; do
		if [[ $arg == "-p" || $arg == "-d" || $arg == "-i" || $arg == "-e" || $arg == "-ea" || $arg == "-u" ]]; then
			echo -n
			DONTSKIP=1;
		elif [ -z $DONTSKIP ]; then
			#Skip over first two command line arguments as they're the credentials
			num=$(expr $num + 1)
			if [ $num -le 2 ]; then
					continue
			fi
		fi
		case $arg in

		-s)
				SSL=':ssl'
				PARAMETERS="${PARAMETERS} s-"
				;;
		-ss)
				SSLOPT=1;
				PARAMETERS="${PARAMETERS} ss-"
				;;
		-i)
				IGNORE=1
				PARAMETERS="${PARAMETERS} i-"
				;;
		-assl)
				SSLAPP=1;
				SSLFROMCOMMANDLINE=1;
				PARAMETERS="${PARAMETERS} lssa-"
				;;
		-dssl)
				SSLDEC=1;
				SSLFROMCOMMANDLINE=1;
				PARAMETERS="${PARAMETERS} lssd-"
				;;
		-lssl)
				SSLLOGDEC=1;
				SSLFROMCOMMANDLINE=1;
				PARAMETERS="${PARAMETERS} lssl-"
				;;
		-cssl)
				SSLCON=1;
				SSLFROMCOMMANDLINE=1;
				PARAMETERS="${PARAMETERS} lssc-"
				;;
		-bssl)
				SSLBRO=1;
				SSLFROMCOMMANDLINE=1;
				PARAMETERS="${PARAMETERS} lssb-"
				;;
		-p)
				PASSOPT=1
				PARAMETERS="${PARAMETERS} p-"
				;;
		-e)
				ENCRYPT=1
				TRUST=0;
				PARAMETERS="${PARAMETERS} e-"
				;;
		-ea)
				ENCRYPT=1
				TRUST=1;
				PARAMETERS="${PARAMETERS} ae-"
				;;
		-a)
				GRABALLMESSAGES=1
				PARAMETERS="${PARAMETERS} a-"
				;;
		-m)
				MINIMAL=1
				LOGTYPES="logTypes=warning,failure"
				PARAMETERS="${PARAMETERS} m-"
				;;
		-l)
				LOGTYPES="logTypes=warning,failure"
				PARAMETERS="${PARAMETERS} l-"
				;;
		-d)
				RUNDISKONLY=1
				PARAMETERS="${PARAMETERS} d-"
				;;
		-u)
				PARAMETERS="${PARAMETERS} u-"
				updatescript
				;;
		-detect)
				RUNDETECT=1
				#PARAMETERS="${PARAMETERS} d-"
				;;
		-k)
				KEEP=1
				PARAMETERS="${PARAMETERS} k-"
				;;
		-b)
				BZ2=1
				PARAMETERS="${PARAMETERS} b-"
				;;
		*)
				usage
				;;
		esac
	done

	if [ ! -z $RUNEDETECT ]; then
		rundetect
	fi

	if [ ! -z $RUNDISKONLY ]; then
		diskonly
	fi

	echo -e "Gathering tech support data.  This may take a few minutes.\n"
	df -i | grep -q '100%'
	if [ $? == 0 ]; then
		echo "WARNING:  inodes exhausted on at least one partition!  Run 'df -i' for more info."
	fi

	#In this next section, we break up the NextGen version number into its consituent parts to make comparison easier
	NwConsole -h 2>/dev/null | head -1 | grep "RSA Security Analytics Console" &>/dev/null
	if [[ $? == "0" ]]; then
		NWVER=`NwConsole -h 2>/dev/null | head -1 | awk '{print $5}'`
	else
		NWVER=`NwConsole -h 2>/dev/null | head -1 | awk '{print $3}'`
	fi

	OIFS=$IFS
	IFS='.'
	NWVERARRAY=($NWVER)
	IFS=$OIFS
	NWMAJOR=${NWVERARRAY[0]}
	NWMINOR=${NWVERARRAY[1]}
	BUILDTYPE=${NWVERARRAY[2]}
	RELEASENUM=${NWVERARRAY[3]}

	identifyServices

	#if [[ -f /var/lib/jetty7/webapps/root.war && -d /var/lib/netwitness/uax ]]; then
	#	SERVICE="SA Reporting Engine"
	#	SERVICES="${SERVICES}R"
	#	UAX=1
	#	uaxpull
	#fi

	if [ -f /usr/sbin/NwAppliance ]; then
		nextgenpull 50006 "Appliance" "appliance"
	fi

	if [[ $SERVICES =~ "D" ]]; then
		nextgenpull 50004 "Decoder" "decoder"
	fi

	if [[ $SERVICES =~ "L" ]]; then
		nextgenpull 50002 "LogDecoder" "logdecoder"
	fi

        if [[ $SERVICES =~ "O" ]]; then
                nextgenpull 50001 "LogCollector" "logcollector"
        fi

	if [[ $SERVICES =~ "C" ]]; then
		nextgenpull 50005 "Concentrator" "concentrator"
	fi

	if [[ $SERVICES =~ "B" ]]; then
		nextgenpull 50003 "Broker" "broker"
	fi

	if [[ $SERVICES =~ "S" ]]; then
		SPECTRUM=1
		spectrumpull "Spectrum"
	fi

	if [[ $SERVICES =~ "W" ]]; then
		UAX=1
		uaxpull "SA Web"
	fi

	IFS='
'

	if [ -z $MINIMAL ]; then #run this section when NOT in minimal mode
		profilesystem
		checkraidutil

		mkdir $TMP/raid
		profileblockdevs

		for file in ${COPYTHESE[@]}; do
				if [ -f $file ]; then
						cp -pL --parents $file $TMP
				elif [ -d $file ]; then
						cp -pL --parents -r $file $TMP
				fi
		done

		if [ -z "$GRABALLMESSAGES" ]; then
			cp -pL --parents /var/log/messages $TMP
		else
			cp -pL --parents /var/log/messages* $TMP
		fi

		#Run commands
		commands

		#If fneserver exists, run fneserver
		if [ -f /opt/fneserver/bin/fneserver ]; then
			fneserver
		fi

		#Run RAID commands if utility present
		if [ -n "$raidutil" ]; then
			doraid
		fi
		doSAN

		#Remove excluded items from temp dir
		for delfile in ${EXCLUDE[@]}; do
				rm -rf $TMP$delfile
		done
	else	#run this section if in minimal mode
		profilesystem
		checkraidutil
		mkdir $TMP/raid

		for file in ${COPYTHESEMINIMAL[@]}; do
				if [ -f $file ]; then
						cp -pL --parents $file $TMP
				elif [ -d $file ]; then
						cp -pL --parents -r $file $TMP
				fi
		done

		#Run commands
		commandsminimal

		#Run RAID commands if utility present
		if [ -n "$raidutil" ]; then
			doraid
		fi
		doSAN

		#Remove excluded items from temp dir
		for delfile in ${EXCLUDEMINIMAL[@]}; do
				rm -rf $TMP$delfile
		done
	fi


	OLDPWD1=`pwd`
	SERVICES=`echo $SERVICES | rev`
	echo $SERVICES > $TMP/services.out
	TMPA=nwtech-$SERVICES-$HOSTNAME-$DATE
	mv $TMP /tmp/$TMPA
	if [ -z $KEEP ]; then
		echo -e "\tCompressing data\t\nThe compressed file will be located in the directory you're currently in."
		cd /tmp
		which 7za &>/dev/null
		if [[ $? == 0  && -z $BZ2 ]]; then
			OUTFILE="$TMPA.tar.7z"
			tar cf - $TMPA/* | 7za a -bd -si $OLDPWD1/$OUTFILE >/dev/null
		else
			OUTFILE="$TMPA.tar.bz2"
			tar cjf $OLDPWD1/$OUTFILE $TMPA/*
		fi
		echo "Wrote $OUTFILE of size" `stat -c%s $OLDPWD1/$OUTFILE`
	else
		mv /tmp/$TMPA $OLDPWD1
		echo "Wrote directory $TMPA"
	fi
	cd $OLDPWD1

	if [ ! -z $ENCRYPT ]; then #encrypt payload
		gpgencrypt
	fi

	#let's return everything back to normal
	cleanup
}

function cleanup {
	if [ ! -z "$1" ]; then
		CODE="$1"
	else
		CODE=0
	fi
	stty echo
	IFS=$OLDIFS
	if [ -d "$TMP" ]; then
		rm -rf $TMP
	elif [ -d "/tmp/$TMPA" ]; then
		rm -rf /tmp/$TMPA
	fi
	exit $CODE
}
trap cleanup SIGHUP SIGINT SIGTERM

function usage {
        echo "Usage: $0 [-p] [-d] [-u] username password [-s] [-ss] [-m] [-l] [-i] [-e] [-a] [-k] [-b]"
		echo -e "\nNOTE:  Passwords containing certain special characters like @ must be placed within 'single quotes'.  If your password doesn't work, please single quote it.  It may also be necessary to upgrade to at least NextGen 9.6.5.10/9.7.5.9 due to a passwords with special characters bug"
        echo -e "\n  -p	Prompt for service account names/passwords separately.  This MUST be specified as the first parameter.  Do not enter a username and password on the command line."
        echo "  -b	Use bz2 compression if 'z7a' command is present (7zip compression is default if '7za' is installed)."
        echo "  -d	Only run disk commands.  Does nothing else.  This MUST be specified as the first parameter.  Do not enter a username and password on the command line."
		echo "  -s	Login to services using SSL.  You must use this option if your appliance has SSL enabled."
		echo "  -ss	Prompt for SSL separately for each service.  You must use this if not all services have SSL enabled."
		echo "  -k	Keep script output beneath current directory and do not compress."
		echo "  -m	Grab minimal data (runs fewer commands).  In the case of service logs, pulls only warning & failure messages.  Mainly used for status checks."
		echo "  -l	Grab minimal service logs.  Only pulls warning & failure logs."
        echo "  -i	Ignore failed login attempts and continue.  If selected and service logins fail, the output file will contain neither service logfiles nor configuration data."
		echo "  -e	Encrypt payload using RSA NetWitness Support PGP public key (nwsupport@rsa.com).  You may be prompted to add the key to your GPG keyring.  The unencrypted output file will not be deleted."
		echo "  -a	Grab all /var/log/messages* files, not just active logfile."
        echo "  -u	Update this script via CMS.  Stores CMS configuration in ~/.nwtech.conf."
        echo -e "\n\n   CONFIGURING A PROXY SERVER FOR UPDATE FUNCTIONALITY:\n"
        echo "   This script uses 'curl' for its autoupdate functionaity.  If the use of a proxy server is required to reach the Internet, you should create a file called ~/.curlrc."
        echo -e "   In this file, configure either a socks or http proxy by adding one of the following lines:\n"
        echo -e "     --socks4 [host]:[port]   - a SOCKS4 proxy"
		echo "     --socks5 [host]:[port]   - a SOCKS5 proxy that does not resolve hostnames through the proxy"
		echo "     --socks5-hostname [host]:[port]   - a SOCKS5 proxy that resolves hostnames through the proxy"
		echo -e "     --proxy [host]:[port]   - an HTTP proxy\n"
		echo -e "   See 'man curl' for more information on configuring proxies with curl.\n";

        exit 1
}

function identifyServices {
	SERVICES=""
	if [[ -f /var/lib/jetty7/webapps/root.war && -d /var/lib/netwitness/uax ]]; then
		SERVICES="${SERVICES}W"
	fi
	if [[ -f /var/lib/jetty7/webapps/root.war && -d /var/lib/netwitness/spectrum ]]; then
		SERVICES="${SERVICES}S"
	fi
	if [[ -f /var/lib/jetty7/webapps/root.war && -d /var/lib/netwitness/rsamalware/spectrum ]]; then
		SERVICES="${SERVICES}S"
	fi
	if [ -f /usr/sbin/NwDecoder ]; then
		SERVICES="${SERVICES}D"
	fi
	if [ -f /usr/sbin/NwLogDecoder ]; then
		SERVICES="${SERVICES}L"
	fi
	if [ -f /usr/sbin/NwConcentrator ]; then
		SERVICES="${SERVICES}C"
	fi
	if [ -f /usr/sbin/NwBroker ]; then
		SERVICES="${SERVICES}B"
	fi
}

function gpgencrypt {
	gpg --list-keys | grep -q $PUBKEYID
	FOUNDKEY=$?
	ADDKEY=0
	if [ $FOUNDKEY == 1 ]; then
		echo -e "\n\nWARNING:  Public key for nwsupport@rsa.com not found in GPG keyring."
		until [ -n $ADDKEY ] && [ $ADDKEY == 1 ] || [ $ADDKEY == 2 ] || [ $ADDKEY == 3 ] && [ $IMPORTED == 1 ]; do
			echo -e -n "Your options are: \n1)  Add the key automatically (easiest).\n2)  Attempt to pull the key from keyserver hkp://keys.gnupg.net. (requires internet access)\n3)  Attempt to pull the key from keyservers configured in ~/.gnupg/gpg.conf. (this may fail depending on GPG configuration)\n4)  Abort encryption and add key manually.  See RSA SecurCare Online (SCOL) KB article a58761 [NetWitness Support PGP/GPG Public Key] to download the key.  You can import it using 'gpg --import <filename>\nEnter Selection: "
			read ADDKEY
			case $ADDKEY in
				1)  #Don't add whitespace to the beginning of import lines
					echo -e -n "\nWARNING: Importing the key may not make the key trusted, depending on whether you have generated your own GPG keypair.  You may be warned that the authenticity of the key cannot be verified.  You can choose to use the key anyway, or if you already have your own GPG keypair (you can generate your own keypair with 'gpg --gen-key'), you can trust the key by exiting the program, and running 'gpg --sign-key nwsupport@rsa.com'.\nHit any key to continue."
					read
					gpg --import << EOF
$NWPUBKEY
EOF
					gpg --list-keys | grep -q $PUBKEYID
					FOUNDKEY=$?
					if [ $FOUNDKEY == 0 ]; then
						IMPORTED=1
					else
						echo "ERROR: Key import failed!"
						IMPORTED=0
					fi
					;;
				2)
					echo -e -n "\nWARNING: Importing the key may not make the key trusted, depending on whether you have generated your own GPG keypair.  You may be warned that the authenticity of the key cannot be verified.  You can choose to use the key anyway, or if you already have your own GPG keypair (you can generate your own keypair with 'gpg --gen-key'), you can trust the key by exiting the program, and running 'gpg --sign-key nwsupport@rsa.com'.\nHit any key to continue."
					read
					gpg --keyserver hkp://keys.gnupg.net --search-keys 'nwsupport@rsa.com'
					gpg --list-keys | grep -q $PUBKEYID
					FOUNDKEY=$?
					if [ $FOUNDKEY == 0 ]; then
						IMPORTED=1
					else
						echo "ERROR: Key import failed!"
						IMPORTED=0
					fi
					;;
				3)
					echo -e -n "\nWARNING: Importing the key may not make the key trusted, depending on whether you have generated your own GPG keypair.  You may be warned that the authenticity of the key cannot be verified.  You can choose to use the key anyway, or if you already have your own GPG keypair (you can generate your own keypair with 'gpg --gen-key'), you can trust the key by exiting the program, and running 'gpg --sign-key nwsupport@rsa.com'.\nHit any key to continue."
					read
					gpg --search-keys 'nwsupport@rsa.com'
					gpg --list-keys | grep -q $PUBKEYID
					FOUNDKEY=$?
					if [ $FOUNDKEY == 0 ]; then
						IMPORTED=1
					else
						echo "ERROR: Key import failed!"
						IMPORTED=0
					fi
					;;
				4)
					return 0
					;;
				*)
					ADDKEY=0
					echo -e "\nInvalid Selection!\n"
					;;
			esac
		done
		echo -e "\nEncrypting payload\n"
		if [ $TRUST == 0 ]; then
			gpg --encrypt --recipient nwsupport@rsa.com $OUTFILE
		elif [ $TRUST == 1 ]; then
			gpg --trust-model always --encrypt --recipient nwsupport@rsa.com $OUTFILE
		fi
		if [ -f "$OUTFILE.gpg" ]; then
			echo -e "\nWrote $OUTFILE.gpg of size" `stat -c%s $OUTFILE.gpg`
		else
			echo -e "\nWARNING: $OUTFILE.gpg not written"
		fi
	else
		echo -e "\nEncrypting payload\n"
		if [ $TRUST == 0 ]; then
			gpg --encrypt --recipient nwsupport@rsa.com $OUTFILE
		elif [ $TRUST == 1 ]; then
			gpg --trust-model always --encrypt --recipient nwsupport@rsa.com $OUTFILE
		fi
		if [ -f "$OUTFILE.gpg" ]; then
			echo -e "\nWrote $OUTFILE.gpg of size" `stat -c%s $OUTFILE.gpg`
		else
			echo -e "\nWARNING: $OUTFILE.gpg not written"
		fi
	fi
}

function nwversionge {
	perl -e '
		sub nwversionify { #this subroutine is for making NW version numbers comparable by switching the third and fourth octets due to the weird way we write our version #s
			(my $major,my $minor,my $buildtype,my $release)=split(/\./,$_[0]); #this statement leaves an alternate way of comparing version numbers by breaking it down to its constituent parts
			return($major,$minor,$buildtype,$release);
		}
		sub nwversionge { #checks one netwitness version against another.  Ignores buildtype as buildtypes make it impossible to compare versions of different buildtypes.
		#takes two strings as arguments, i.e. nwversionge("9.6.5.3","9.5.5.10")
		#returns 1 if first arguments version is greater than or equal to second arguments, else it returns 0
			my $leftside=shift;
			my $rightside=shift;
			my ($leftmajor,$leftminor,$leftbuildtype,$leftrelease) = nwversionify($leftside);
			my ($rightmajor,$rightminor,$rightbuildtype,$rightrelease) = nwversionify($rightside);
			if (($leftmajor > $rightmajor) || ($leftmajor == $rightmajor && $leftminor > $rightminor) || ($leftmajor == $rightmajor && $leftminor == $rightminor && $leftrelease >= $rightrelease)) {
				exit 1;
			}
			exit 0;
		}
		nwversionge($ARGV[0],$ARGV[1]);
	' $1 $2
	return $?
}

function checkraidutil {
	if [ -f /opt/MegaRAID/MegaCli/MegaCli64 ]; then
		raidutil='/opt/MegaRAID/MegaCli/MegaCli64'
	elif [ -f /opt/MegaRAID/CmdTool2/CmdTool2 ]; then
		raidutil='/opt/MegaRAID/CmdTool2/CmdTool2'
	elif [ -f /opt/MegaRAID/MegaCli/MegaCli ]; then
		raidutil='/opt/MegaRAID/MegaCli/MegaCli'
	else
		echo "No RAID controller utility found." | tee $TMP/noraid.out
	fi
}

function profilesystem {
	if [ -f '/sys/class/dmi/id/board_name' ]; then
		my_board=$(</sys/class/dmi/id/board_name)
	else
		dmidecode  | grep -q -m1 "Product Name"
		if [ $? -eq 0 ]; then
			my_board=$(dmidecode  | grep -m1 "Product Name" | awk '{print $3}')
			my_board2=$(dmidecode  | grep -m2 "Product Name" | tail -1 | awk '{print $3}')
			vmwarestate=$(dmidecode -s system-serial-number | grep -qi vmware; echo -n $?)
		fi
	fi
	if [ ! -z $my_board ]; then
		if [[ "$my_board" == "S5000PSL" || "$my_board2" == "S5000PSL" ]]; then
			boardname="McKay Creek 1200"
		elif [[ "$my_board" == "0DPRKF" || "$my_board2" == "0DPRKF" ]]; then
			if [[ -f /usr/sbin/NwConcentrator && -f /usr/sbin/NwDecoder ]]; then
				boardname="Dell NWA200 Hybrid"
			elif [ -f /usr/sbin/NwConcentrator ]; then
				boardname="Dell NWA2400-ND Concentrator"
			elif [ -f /usr/sbin/NwDecoder ]; then
				boardname="Dell NWA2400-ND Decoder"
			fi
		elif [[ "$my_board" == "X7DWN+" || "$my_board2" == "X7DWN+" ]]; then
			PROCS=`grep processor /proc/cpuinfo | wc -l`
			if [ $PROCS -eq 4 ]; then
				boardname="SuperMicro 1200 or 2400"
			else
				boardname="SuperMicro NWA2400 Concentrator"
			fi
		elif [[ "$my_board" == "X7SBi" || "$my_board2" == "X7SBi" ]]; then
			boardname="SuperMicro 100 Decoder"
		elif [[ "$my_board" == "X7DBU" || "$my_board2" == "X7DBU" ]]; then
			boardname="SuperMicro 100 Concentrator"
		elif [[ "$my_board" == "Bridgeport" || "$my_board2" == "Bridgeport" ]]; then
			my_vendor=$(</sys/class/dmi/id/board_vendor)
			if [ "$my_vendor" == "NextComputing" ]; then
				boardname="Next Computing Eagle"
			fi
		elif [[ "$my_board" == "X7SB4/E" || "$my_board2" == "X7SB4/E" ]]; then
			boardname="SuperMicro NWP55-8D Eagle"
		elif [[ "$my_board" == "0P229K" || "$my_board2" == "0P229K" ]]; then
			boardname="Dell NWA200-ND-8B Broker"
		elif [[ "$my_board" == "X8DTN+-F" || "$my_board2" == "X8DTN+-F" ]]; then
			if echo $SERVICES | grep -q S; then
				if echo $SERVICES | grep -q D; then
					boardname="SuperMicro NWA2400-NS-64M Standalone Spectrum/Decoder"
				elif echo $SERVICES | grep -q B; then
					boardname="SuperMicro NWA2400-NS-64M Enterprise Spectrum/Broker"
				fi
			else
				boardname="SuperMicro 2400n Nehalem"
			fi
		elif [[ "$my_board" == "X8SIU" || "$my_board2" == "X8SIU" ]]; then
			if echo $SERVICES | grep -q S; then
				boardname="SuperMicro NWA200 Broker/Spectrum"
			else
				boardname="SuperMicro NWA200 Broker"
			fi
		elif [[ "$my_board" == "X8DTU-6+" || "$my_board2" == "X8DTU-6+" ]]; then
			if echo $SERVICES | grep -q S; then
				if echo $SERVICES | grep -q D; then
					boardname="SuperMicro NWA200-NS-32M Standalone Spectrum/Decoder"
				elif echo $SERVICES | grep -q B; then
					boardname="SuperMicro NWA200-NS-32M Enterprise Spectrum/Broker"
				fi
			else
				boardname="SuperMicro NWA200 Hybrid NWA200-NS-32H"
			fi
		elif [[ "$my_board" == "0N83VF" || "$my_board2" == "0N83VF" ]]; then
			if echo $SERVICES | grep -q D; then
				boardname="Dell NWA200 Standalone Spectrum/Decoder"
			elif echo $SERVICES | grep -q B; then
				boardname="Dell NWA200 Enterprise Spectrum/Broker"
			fi
		elif [[ "$my_board" == "05XKKK" || "$my_board2" == "05XKKK" ]]; then
			boardname="Dell NWA200-ND-8B Broker"
		elif [[ "$my_board" == "00HDP0" || "$my_board2" == "00HDP0" ]]; then
			boardname="Series 3 Dell 2400-ND"
		elif [[ "$my_board" == "EB1012" || "$my_board2" == "EB1012" ]]; then
			boardname="Asus Baby Decoder"
		elif [ "$vmwarestate" == "0" ]; then
			boardname="VMware Virtual Machine"
		elif [[ "$my_board2" == "08GXHX" || "$my_board" == "08GXHX" ]]; then
			if [ -f "/usr/sbin/NwDecoder" ]; then
				boardname="Series 4 Dell SMC-S4H-DEC Decoder"
			elif [ -f "/usr/sbin/NwConcentrator" ]; then
				boardname="Series 4 Dell SMC-S4H-CON Concentrator"
			elif [ -f "/usr/sbin/NwBroker" ]; then
				boardname="Series 4 Dell SMC-S4H-BRO Broker"
			elif [ -f "/usr/sbin/NwLogDecoder" ]; then
				boardname="Series 4 Dell SMC-S4H-DEC-SYS LogDecoder"
			fi
		elif [[ "$my_board" == "0KFFK8" ]]; then
			if [[ -f "/usr/sbin/NwBroker" && -f "/var/lib/jetty7/webapps/root.war" && -f "/var/lib/jetty7/webapps/root-classes.jar" ]]; then
				boardname="Series 4S Dell SA-S4H-AS SA Server"
			elif [[ -f "/usr/sbin/NwDecoder" && -f "/usr/sbin/NwConcentrator" ]]; then
				boardname="Series 4S Dell SA-HYBRID-P Hybrid"
			elif [[ -f "/usr/sbin/NwLogDecoder" && -f "/usr/sbin/NwConcentrator" ]]; then
				boardname="Series 4S Dell SA-HYBRID-L Log Hybrid"
			elif [ -f "/usr/sbin/NwDecoder" ]; then
				boardname="Series 4S Dell SA-S4H-P-DEC Decoder"
			elif [ -f "/usr/sbin/NwLogDecoder" ]; then
				boardname="Series 4S Dell SA-S4H-L-DEC LogDecoder"
			elif [ -f "/usr/sbin/NwConcentrator" ]; then
				boardname="Series 4S Dell SA-S4H-CON Concentrator"
			elif [ -f "/usr/sbin/NwBroker" ]; then
				boardname="Series 4S Dell SA-S4H-BRO Broker"
			fi
		else
			boardname="Appliance type not identified/Possibly software-only"
		fi
		echo "Appliance Type: $boardname" >> $TMP/sysinfo.out
	fi
}

function doraid {
	echo $raidutil > $TMP/raid/raidutil.out
	$raidutil -pdlist -aall > $TMP/raid/pdlist.out
	$raidutil -adpallinfo -aall > $TMP/raid/adaplist.out
	$raidutil -ldpdinfo -aall > $TMP/raid/ldpdinfo.out
	$raidutil -AdpEventLog -GetEvents -f $TMP/raid/adapevents.out aall > /dev/null
	/sbin/dmsetup ls > $TMP/raid/dmsetup-ls.out

# Removing nwraidutil output support since old versions of it will cause this script to run forever.
# The support for a script which is not written by the same author.

#        if [[ -f /opt/MegaRAID/MegaCli/MegaCli64 || -f /opt/MegaRAID/CmdTool2/CmdTool2 || -f /opt/MegaRAID/MegaCli/MegaCli ]]; then
#		if [[ -f /usr/sbin/nwraidutil.pl ]]; then
#			nwraidutil.pl 1> $TMP/raid/nwraidutil.out 2> $TMP/raid/nwraidutil-error.log
#			if [ -s $TMP/raid/nwraidutil-error.log ]; then
#				echo "You seem to have an older version of the Nw Raid Utility Installed. An error file nwraidutil-error.log will be generated if you receive any errors from the output. Please see RSA SecurCare Online (SCOL) KB article a59744 NetWitness RAID Utility for the latest script"
#			fi
#		fi
#	fi

	egrep -i 'Product Name|FW Version' $TMP/raid/adaplist.out | perl -e '
	$TMP=$ARGV[0];
	sub raidfirmwareversionify {
		(my $ver)=@_;
		my @ver=split(/\./,$ver);
		my $lastver=pop @ver;
		my @last=split(/-/,$lastver);
		foreach (@last) {
			push(@ver,$_);
		}
		return(@ver);
	}
	while(<STDIN>){
			chomp;
			if ($_ =~ /Product Name\s+\:\s(.*)$/) {$card = $1;}
			if ($_ =~ /FW Version\s+\:\s(.*)$/) {
					$fwversion = $1;
					if ($card =~ /MegaRAID SAS 8888ELP/) {
							my $curfwversion="1.40.342-1650";
							(my $curfwmajor, my $curfwminor, my $curfwrev, my $curfwbuild)=raidfirmwareversionify($curfwversion);
							(my $fwmajor, my $fwminor, my $fwrev, my $fwbuild)=raidfirmwareversionify($fwversion);
							if ( ($fwmajor < $curfwmajor) || ($fwmajor == $curfwmajor && $fwminor < $curfwminor) || ($fwmajor == $curfwmajor && $fwminor == $curfwminor && $fwrev < $curfwrev) || ($fwmajor == $curfwmajor && $fwminor == $curfwminor && $fwrev == $curfwrev && $fwbuild < $curfwbuild)) {
									`echo -e "Product Name\t: $card\nFW Version\t: $fwversion" >> $TMP/raid/upgradefirmware.out`;
									`echo "Supported version for MegaRAID SAS 8888ELP adapter is $curfwversion.  See RSA SecurCare Online (SCOL) KB article a59723 [SAS 8888ELP RAID Controller Firmware Update]" >> $TMP/raid/upgradefirmware.out`;
									`echo "8888ELP RAID firmware is out of date.  Please see raid/upgradefirmware.out for more info." >> $TMP/sysinfo.out`;
							}
							else {
								`echo "8888ELP RAID firmware is current." >> $TMP/sysinfo.out`;
							}
					}
					elsif ($card =~ /SRCSAS144E/) {
							my $curfwversion="1.12.280-0826";
							(my $curfwmajor, my $curfwminor, my $curfwrev, my $curfwbuild)=raidfirmwareversionify($curfwversion);
							(my $fwmajor, my $fwminor, my $fwrev, my $fwbuild)=raidfirmwareversionify($fwversion);
							if ( ($fwmajor < $curfwmajor) || ($fwmajor == $curfwmajor && $fwminor < $curfwminor) || ($fwmajor == $curfwmajor && $fwminor == $curfwminor && $fwrev < $curfwrev) || ($fwmajor == $curfwmajor && $fwminor == $curfwminor && $fwrev == $curfwrev && $fwbuild < $curfwbuild)) {
									`echo -e "Product Name\t: $card\nFW Version\t: $fwversion" >> $TMP/raid/upgradefirmware.out`;
									`echo "Supported version for SRCSAS144E adapter is $curfwversion.  See RSA SecurCare Online (SCOL) KB article a59722 [SRCSAS144E RAID Controller Updates]" >> $TMP/raid/upgradefirmware.out`;
									`echo "SRCSAS144E RAID firmware is out of date.  Please see raid/upgradefirmware.out for more info." >> $TMP/sysinfo.out`;
							}
							else {
								`echo "SRCSAS144E RAID firmware is current." >> $TMP/sysinfo.out`;
							}
					}
			}
	}' $TMP
}

function doSAN {
	if [[ -f /sbin/multipath && -f /sbin/dmsetup ]]; then
		mkdir $TMP/san
		/sbin/multipath -l > $TMP/san/multipath-l.out
		/sbin/multipath -ll > $TMP/san/multipath-ll.out
		/sbin/dmsetup ls > $TMP/san/dmsetup-ls.out
	fi
}

COPYTHESEDISKONLY=( /etc/fstab
/etc/lvm
/etc/mdadm.conf
/etc/multipath.conf
/etc/redhat-release
/proc/mdstat
/proc/partitions
/proc/scsi/scsi )

function commandsdiskonly {
	df -m > $TMP/df-m.out
	df -h > $TMP/df-h.out
	df -i > $TMP/df-i.out
	vgdisplay -C > $TMP/vgdisplay.out
	vgscan -v &> $TMP/vgscan.out
	pvdisplay -C > $TMP/pvdisplay.out
	pvscan -v &> $TMP/pvscan.out
	lvdisplay -C > $TMP/lvdisplay.out
	lvscan -v &> $TMP/lvscan.out
	fdisk -l &> $TMP/fdisk-l.out
	parted -l &> $TMP/parted-l.out
	date > $TMP/date.out
	mount > $TMP/mount.out
	ls -laR /dev > $TMP/ls-dev.out
	identifyServices
	echo $SERVICES | rev > $TMP/services.out #we still want to know which services are on the box for hw detection
	profilesystem
	echo -n 'Product Name: ' >> $TMP/sysinfo.out;dmidecode -s baseboard-product-name >> $TMP/sysinfo.out
	echo -n 'Board Vendor: ' >> $TMP/sysinfo.out;dmidecode -s baseboard-manufacturer >> $TMP/sysinfo.out
	echo -n 'Serial Number: ' >> $TMP/sysinfo.out;dmidecode -s system-serial-number >> $TMP/sysinfo.out
	mdadm --detail /dev/md* > $TMP/raid/mddetail.out 2>&1
	echo $scriptver > $TMP/scriptversion.out
}

function profileblockdevs {
	cd /sys/block
	grep -q Fedora /etc/redhat-release
	if [ $? -eq 0 ]; then
		for dir in `eval ls -l | egrep 'sd|hd' | awk '{print $8}'`; do
			smartctl -a /dev/$dir 2>/dev/null >> $TMP/raid/$dir.info
		done
	fi
	grep -q CentOS /etc/redhat-release
	if [ $? -eq 0 ]; then
		for dir in `eval ls -l | egrep 'sd|hd' | awk '{print $9}'`; do
			smartctl -a /dev/$dir 2>/dev/null >> $TMP/raid/$dir.info
		done
	fi
	cd - > /dev/null
}

function diskonly {
	echo -e "Gathering tech support data.  This may take a few minutes.\n"
	checkraidutil
	df -i | grep -q '100%'
	if [ $? == 0 ]; then
		echo "WARNING:  inodes exhausted on at least one partition!  Run 'df -i' for more info."
		df -i | grep -B1 '100%'
	fi
	mkdir $TMP/raid
	profileblockdevs
	commandsdiskonly
	#Run RAID commands if utility present
	IFS='
'
	if [ -n "$raidutil" ]; then
		doraid
	fi
	doSAN

	for file in ${COPYTHESEDISKONLY[@]}; do
			if [ -f $file ]; then
					cp -pL --parents $file $TMP
			elif [ -d $file ]; then
					cp -pL --parents -r $file $TMP
			fi
	done
	OLDPWD1=`pwd`
	SERVICES='DISKONLY'
	TMPA=nwtech-$SERVICES-$HOSTNAME-$DATE
	mv $TMP /tmp/$TMPA
	if [ -z $KEEP ]; then
		echo -e "\tCompressing data\t\nThe compressed file will be located in the directory you're currently in."
		cd /tmp
		which 7za &>/dev/null
		if [[ $? == 0  && -z $BZ2 ]]; then
			OUTFILE="$TMPA.tar.7z"
			tar cf - $TMPA/* | 7za a -bd -si $OLDPWD1/$OUTFILE >/dev/null
		else
			OUTFILE="$TMPA.tar.bz2"
			tar cjf $OLDPWD1/$OUTFILE $TMPA/*
		fi
		echo "Wrote $OUTFILE of size" `stat -c%s $OLDPWD1/$OUTFILE`
	else
		mv /tmp/$TMPA $OLDPWD1
		echo "Wrote directory $TMPA"
	fi
	cd $OLDPWD1
	if [ ! -z $ENCRYPT ]; then #encrypt payload
		gpgencrypt
	fi
	cleanup
}

function livecreds {
	echo -e "\n\nEnter your credentials for NetWitness CMS.  These are the same credentials used by Live Manager"
	echo "This will overwrite any existing ~/.nwtech.conf"
	echo -e "WARNING:  These credentials are NOT stored securely\n"
	CONFIRM=''
	until [[ "$CONFIRM" == "y" || "$CONFIRM" == "Y" ]]; do
		echo
		read -p "Enter CMS hostname <cms.netwitness.com>: " WEBHOST
		read -p "Enter NetWitness CMS Username: " CMSUSER
		read -s -p "Enter NetWitness CMS Password: " CMSPASSWORD
		if [ "$WEBHOST" == '' ]; then
			WEBHOST='cms.netwitness.com'
		fi
		echo
		read -p "Are these credentials correct? <Y/n> " CONFIRM

		if [[ -z "$CMSUSER" || -z "$CMSPASSWORD" ]]; then
			echo "Invalid credentials.  Please re-enter them"
			CONFIRM=''
			continue
		fi
		if [ "$CONFIRM" == "n" ]; then
			echo "Not saving CMS credentials.  Exiting"
			exit 0
		elif [ "$CONFIRM" == "" ]; then
			CONFIRM=y
		fi
		echo "WEBHOST=\"$WEBHOST\"" > ~/.nwtech.conf
		echo "CMSUSER=\"$CMSUSER\"" >> ~/.nwtech.conf
		echo "CMSPASSWORD=\"$CMSPASSWORD\"" >> ~/.nwtech.conf
		echo "Wrote CMS config file ~/.nwtech.conf"
	done
}

function testcmsconnection {
	echo -e "\nTesting CMS connection"
	TESTRESPONSE=`curl -s -f -k "$WEBPROTO://$CMSUSER:$CMSPASSWORD@$WEBHOST/alfresco/service/resource?uri=/admin/tree.xml"`
	if [ "$TESTRESPONSE" == '' ]; then
		echo "CMS Login Failed.  Please re-enter your credentials"
		livecreds
	else
		echo -e "CMS login successful\n"
	fi

}

function updatescript {
	which perl &>/dev/null
	if [ $? != 0 ]; then
		echo "'perl' not found in path.  Cannot continue."
		cleanup 1
	fi
	which curl &>/dev/null
	if [ $? != 0 ]; then
		echo "'curl' not found in path.  Cannot continue."
		cleanup 1
	fi
	which sha1sum &>/dev/null
	if [ $? != 0 ]; then
		echo "'sha1sum' not found in path.  Cannot continue."
		cleanup 1
	fi
	which unzip &>/dev/null
	if [ $? != 0 ]; then
		echo "'unzip' not found in path.  Cannot continue."
		cleanup 1
	fi
	if [ ! -f ~/.nwtech.conf ]; then
		echo -e -n "~/.nwtech.conf does not yet exist.  Would you like to configure it now? (y/N) "
		CONFIGURE=0
		until [[ $CONFIGURE == "y" || $CONFIGURE == "n" ]]; do
			read CONFIGURE
			if [ "$CONFIGURE" == '' ]; then
				CONFIGURE=n
			fi
		done
		if [ $CONFIGURE == "y" ]; then
			livecreds
			testcmsconnection
		elif [ $CONFIGURE == "n" ]; then
			echo "Cannot continue update without valid CMS credentials."
			cleanup 1
		fi
	else
		source ~/.nwtech.conf
		testcmsconnection
	fi
	echo -e "Checking for updates\n"
	SCRIPTLOC=`curl -s -f -k "$WEBPROTO://$CMSUSER:$CMSPASSWORD@$WEBHOST/alfresco/service/SDK_1_1/content?name=$CMSRESOURCE"`
	if [ "$SCRIPTLOC" == '' ]; then
		echo "$CMSRESOURCE could not be located in CMS.  Exiting"
		cleanup 1
	fi
	SCRIPTURI=`perl -ne '
		chomp;
		$_ =~ m|<link rel="alternate" title="currentVersion" href=".*(/alfresco/service/api/node/content/workspace/SpacesStore/.*)" />|;
		$uri = $1;
		if (defined($uri)) {
			print "$uri";
			exit 0;
		}' <<< "$SCRIPTLOC"`
	echo "Downloading $CMSRESOURCE"
	curl -s -f -k "$WEBPROTO://$CMSUSER:$CMSPASSWORD@$WEBHOST$SCRIPTURI" > $TMP/$CMSRESOURCE
	if [ ! -e $TMP/$CMSRESOURCE ]; then
		echo "Download Failed.  Exiting"
		cleanup 1
	else
		echo "Download successful"
	fi

	echo "Extracting $CMSRESOURCE"
	cd $TMP
	unzip $CMSRESOURCE &>/dev/null
	cd - &>/dev/null

	if [ ! -f $TMP/nwtech.sh ]; then
		echo "nwtech.sh not found.  Cannot continue"
		cleanup 1
	fi
	if [ ! -f $TMP/shasum ]; then
		echo "shasum file not found.  Cannot continue"
		cleanup 1
	fi
	WEBVER=`grep ^scriptver $TMP/nwtech.sh | sed 's/[^0-9\.-]*//g'`
	if [ "$WEBVER" == '' ]; then
		echo "Cannot identify version number from CMS script.  Exiting"
		cleanup 1
	else
		perl -e '
			sub nwversionify {
				(my $firstpart,my $release)=split(/-/,$_[0]);
				(my $year,my $month,my $day)=split(/\./,$firstpart); #this statement leaves an alternate way of comparing version numbers by breaking it down to its constituent parts
				return($year,$month,$day,$release);
			}
			my ($leftyear,$leftmonth,$leftday,$leftrelease) = nwversionify(shift);
			my ($rightyear,$rightmonth,$rightday,$rightrelease) = nwversionify(shift);
			if (($leftyear > $rightyear) || ($leftyear == $rightyear && $leftmonth > $rightmonth) || ($leftyear == $rightyear && $leftmonth == $rightmonth && $leftday > $rightday) || ($leftyear == $rightyear && $leftmonth == $rightmonth && $leftday == $rightday && $leftrelease > $rightrelease)) {
					exit 1;
			}
			exit 0;' $WEBVER $scriptver
		if [ $? == 0 ]; then
			echo "You have the the same or a more recent version of nwtech.sh than exists on CMS"
			echo "CMS Version: $WEBVER"
			echo "This script version: $scriptver"
			cleanup
		else
			echo -e "nwtech.sh is out of date.\n\nAvailable version: $WEBVER\nThis version: $scriptver\n"
			echo "Checking sha hash of new script"
			WEBSHA=`cat $TMP/shasum`
			SHA=`sha1sum $TMP/nwtech.sh | awk '{print $1}'`
			if [ "$WEBSHA" == "$SHA" ]; then
				echo "sha hashes match"
			else
				echo "sha hashes do not match.  Cannot continue."
				cleanup 1 #restore when done
			fi
			echo "Backing up this script to ~/nwtech-$scriptver.sh"
			cp -f $0 ~/nwtech-$scriptver.sh
			echo "Moving new file over to /usr/sbin/nwtech.sh"
			echo "Update complete"
			MOVER='mv -f $TMP/nwtech.sh /usr/sbin/nwtech.sh;cleanup;'
			eval $MOVER #the move is done through an eval so that any changes in line numbering with the new script don't cause errors when the old script is overwritten.  the script will exit here
		fi
	fi
}

function rundetect {
	if [ -f /usr/sbin/NwAppliance ]; then echo "appliance";fi
	if [ -f /usr/sbin/NwDecoder ]; then echo "decoder";fi
	if [ -f /usr/sbin/NwLogDecoder ]; then echo "logdecoder";fi
	if [ -f /usr/sbin/NwConcentrator ]; then echo "concentrator";fi
	if [ -f /usr/sbin/NwBroker ]; then echo "broker";fi
	if [[ -f /var/lib/jetty7/webapps/root.war && -d /var/lib/netwitness/spectrum ]]; then echo "spectrum";fi
	if [[ -f /var/lib/jetty7/webapps/root.war && -d /var/lib/netwitness/uax ]]; then echo "saweb";fi
	exit 0;
}

function logpull9055 {
	LOGFIRST=`eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs/stats ls -c logout | grep "first.id" | awk '{print $4}'`
	LOGLAST=`eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs/stats ls -c logout | grep "last.id" | awk '{print $4}'`
	LOGTOTAL=`expr $LOGLAST - $LOGFIRST`
	if [ $LOGTOTAL -gt 2000 ]; then
		until [ $LOGTOTAL -le 2000 ]; do
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs download op=start id1=$LOGFIRST id2=$LOGLAST $LOGTYPES -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 >> $TMP/$LOGFILENAME.log
			LOGTOTAL=`expr $LOGTOTAL - 2000`
			LOGFIRST=`expr $LOGFIRST + 2000`
		done
	fi
	eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs download op=start id1=$LOGFIRST id2=$LOGLAST $LOGTYPES -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 >> $TMP/$LOGFILENAME.log
}

function logpull9556 {
	LOGFIRST=`eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs/stats ls -c logout | grep "first.id" | awk '{print $6}'`
	LOGLAST=`eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs/stats ls -c logout | grep "last.id" | awk '{print $6}'`
	LOGTOTAL=`expr $LOGLAST - $LOGFIRST`
	if [ $LOGTOTAL -gt 2000 ]; then
		until [ $LOGTOTAL -le 2000 ]; do
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs download op=start id1=$LOGFIRST id2=$LOGLAST $LOGTYPES -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 >> $TMP/$LOGFILENAME.log
			LOGTOTAL=`expr $LOGTOTAL - 2000`
			LOGFIRST=`expr $LOGFIRST + 2000`
		done
	fi
	eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs download op=start id1=$LOGFIRST id2=$LOGLAST $LOGTYPES -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 >> $TMP/$LOGFILENAME.log
}

function logpull9557 {
	LOGFIRST=`eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs/stats ls -c logout | grep "first.id" | awk '{print $6}'`
	LOGLAST=`eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /logs/stats ls -c logout | grep "last.id" | awk '{print $6}'`
	eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c cd /logs -c dlogs id1=$LOGFIRST id2=$LOGLAST $LOGTYPES pathname=$TMP/$LOGFILENAME.log delimiter='\\\\t' append=0 -c logout > /dev/null
}

function parserstats {
	if [[ $NWMAJOR -eq 9 && $NWMINOR -eq 5 ]]; then
		eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /parsers memory -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 > $TMP/parsermem.out
	elif [[ ( $NWMAJOR -eq 9 && $NWMINOR -ge 6 ) || ( $NWMAJOR -ge 10 ) ]]; then
		eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /decoder/parsers schema -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 > $TMP/parserschema.out
		DETAILEDSTATS=`eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /decoder/parsers/config ls -c logout | grep detailed.stats | sed -e 's/^.* = //'`
		if [[ $DETAILEDSTATS == "no" ]]; then
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c set /decoder/parsers/config/detailed.stats yes -c logout &> /dev/null
			sleep 2
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /decoder/parsers/definitions ls depth=10 -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 2>&1 > $TMP/parserdefinitions.out
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c set /decoder/parsers/config/detailed.stats no -c logout &> /dev/null
		elif [[ $DETAILEDSTATS == "yes" ]]; then
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /decoder/parsers/definitions ls depth=10 -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 2>&1 > $TMP/parserdefinitions.out
		fi
	else
		echo -n #don't do anything
	fi
}

function nextgenpull {
	PORT=$1
	SERVICE="$2"
	LOGFILENAME="$3"
	echo -e "Found $SERVICE Service"
	if [ -n "$PASSOPT" ]; then
		echo -n "$SERVICE Service Username: "
		read USER
		echo -n "$SERVICE Service Password: "
		stty -echo
		read -s PASSWORD
		stty echo
		echo
	fi
	if [ -n "$SSLFROMCOMMANDLINE" ]; then
		unset SSL
	fi

	if [[ -n "$SSLAPP" && $SERVICE == "Appliance" ]]; then
		SSL=':ssl'
	fi
	if [[ -n "$SSLDEC" && $SERVICE == "Decoder" ]]; then
		SSL=':ssl'
	fi
	if [[ -n "$SSLLOGDEC" && $SERVICE == "LogDecoder" ]]; then
		SSL=':ssl'
	fi
        if [[ -n "$SSLLOGDEC" && $SERVICE == "LogCollector" ]]; then
                SSL=':ssl'
        fi
	if [[ -n "$SSLCON" && $SERVICE == "Concentrator" ]]; then
		SSL=':ssl'
	fi
	if [[ -n "$SSLBRO" && $SERVICE == "Broker" ]]; then
		SSL=':ssl'
	fi
	if [ -n "$SSLOPT" ]; then
		unset SSL
		unset SSLENABLED
		until [[ $SSLENABLED == "y" || $SSLENABLED == "Y" || $SSLENABLED == "n" || $SSLENABLED == "N" ]]; do
			echo -n "$SERVICE Service SSL Enabled? (y/n): "
			read SSLENABLED
			echo
		done
		if [[ $SSLENABLED == "y" || $SSLENABLED == "Y" ]]; then
			SSL=':ssl'
		fi
	fi
	eval NwConsole -c login localhost:$PORT$SSL $USER \'$PASSWORD\' -c logout 2>/dev/null | grep -q Successfully
	if [ $? -eq 1 ]; then
		echo "Login failed.  Please provide valid login credentials to $SERVICE Service."
		FAIL=1
		if [ -z "$IGNORE" ]; then
			cleanup 1
		fi
	fi
	if [ -z "$FAIL" ]; then #pull logs
		#pull logs the old way for 9.0 <=.5.5
		if [[ $NWMAJOR -eq 9 && $NWMINOR -eq 0 && $BUILDTYPE -eq 5 && $RELEASENUM -le 5 ]]; then
			logpull9055
		#pull logs the old way for 9.5 <=.5.6
		elif [[ $NWMAJOR -eq 9 && $NWMINOR -eq 5 && $BUILDTYPE -eq 5 && $RELEASENUM -le 6 ]]; then
			logpull9556
		#pull logs the new way for 9.5 >=.5.7
		elif [[ $NWMAJOR -eq 9 && $NWMINOR -eq 5 && $BUILDTYPE -eq 5 && $RELEASENUM -ge 7 ]]; then
			logpull9557
		#pull logs the new way for >= 9.6
		elif [[ $NWMAJOR -eq 9 && $NWMINOR -ge 6 ]]; then
			logpull9557
		elif [[ $NWMAJOR -ge 10 ]]; then
			logpull9557
		fi

		eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /sys save force=1 -c logout &>/dev/null
		#pull parser memory stats on 9.5.5.6 and newer decoders
		if [[ $SERVICE == "Decoder" && $NWMAJOR -eq 9 && $NWMINOR -eq 5 && $BUILDTYPE -eq 5 && $RELEASENUM -ge 6 ]]; then
			parserstats
		#pull parser memory stats on 9.6 and newer decoders
		elif [[ $SERVICE == "Decoder" && ( $NWMAJOR -eq 9 && $NWMINOR -ge 6 ) || ( $NWMAJOR -ge 10 ) ]]; then
			parserstats
		fi

		if [[ ( $SERVICE == "Concentrator" || $SERVICE == "Decoder" ) && ( $NWMAJOR -eq 9 && $NWMINOR -ge 6 ) || ( $NWMAJOR -ge 10 ) ]]; then
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /index profile -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 > $TMP/$LOGFILENAME-index-profile.out
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c /index inspect -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 > $TMP/$LOGFILENAME-index-inspect.out
		fi

		if [[ $NWMAJOR -ge 10 && $SERVICE != "Appliance" ]]; then
			eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c \'/sys/license licInfo\' -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 > $TMP/licInfo-$LOGFILENAME.out
		fi

		#next command executes 'ls depth=10' on the current service and writes to ls<service>.out
		eval NwConsole -c login 127.0.0.1:$PORT$SSL $USER \'$PASSWORD\' -c / ls depth=10 -c logout | tail -n+7 | egrep -v "^\(F\).*\[PipeManager::messageHandler\]  Socket Error: End of file$" | head -n-2 > $TMP/ls$LOGFILENAME.out
	fi
	if [ $SERVICE == "Decoder" ]; then
		if [[ -d "/etc/netwitness/9.0/feeds" && -f "/usr/bin/file" ]]; then
			file /etc/netwitness/9.0/feeds/*.feed | tee -a $TMP/feedfile90.out | awk '{print $2}' | sort | uniq > $TMP/feedfilesummary90.out
		fi
		if [[ -d "/etc/netwitness/ng/feeds" && -f "/usr/bin/file" ]]; then
			file /etc/netwitness/ng/feeds/*.feed | tee -a $TMP/feedfileng.out | awk '{print $2}' | sort | uniq > $TMP/feedfilesummaryng.out
		fi
	fi
}

function spectrumpull {
	SERVICE=$1
	echo -e "Found $SERVICE Service"
	ls -latrR /var/lib/jetty7 > $TMP/ls-varlibjetty7.out
	ls -latrR /var/lib/netwitness > $TMP/ls-varlibnetwitness.out
	which unzip &> /dev/null
	if [[ $? == 0 ]]; then
		unzip -p /var/lib/jetty7/webapps/root.war WEB-INF/classes/build-info.properties > $TMP/spectrum-build-info.properties
		SPECTRUMMAJ=`grep version= $TMP/spectrum-build-info.properties | sed -r 's/.*=//'`
		SPECTRUMSTABILITYID=`grep stabilityId= $TMP/spectrum-build-info.properties | sed -r 's/.*=//'`
		SPECTRUMREVISION=`grep count= $TMP/spectrum-build-info.properties | sed -r 's/.*=//'`
		SPECTRUMBUILD=`grep build= $TMP/spectrum-build-info.properties | sed -r 's/=/ /'`
		echo "$SPECTRUMMAJ.$SPECTRUMSTABILITYID.$SPECTRUMREVISION $SPECTRUMBUILD" > $TMP/spectrumver.out
	elif [ -f "/tmp/jetty-0.0.0.0-443-root.war-_-any-/webapp/WEB-INF/classes/build-info.properties" ]; then
		cp /tmp/jetty-0.0.0.0-443-root.war-_-any-/webapp/WEB-INF/classes/build-info.properties $TMP/spectrum-build-info.properties
		SPECTRUMMAJ=`grep version= $TMP/spectrum-build-info.properties | sed -r 's/.*=//'`
		SPECTRUMSTABILITYID=`grep stabilityId= $TMP/spectrum-build-info.properties | sed -r 's/.*=//'`
		SPECTRUMREVISION=`grep count= $TMP/spectrum-build-info.properties | sed -r 's/.*=//'`
		SPECTRUMBUILD=`grep build= $TMP/spectrum-build-info.properties | sed -r 's/=/ /'`
		echo "$SPECTRUMMAJ.$SPECTRUMSTABILITYID.$SPECTRUMREVISION $SPECTRUMBUILD" > $TMP/spectrumver.out
	else
		ROOTWARMD5=`md5sum /var/lib/jetty7/webapps/root.war | cut -d ' ' -f1`
		if [ $ROOTWARMD5 == 'fbf9367b23d8bce05dc05f0f19767be0' ]; then
			echo "1.0.5.0" > $TMP/spectrumver.out
		elif [ $ROOTWARMD5 == 'd3c93f6e22beac7c6671ba11788e49ad' ]; then
			echo "1.0.5.2" > $TMP/spectrumver.out
		elif [ $ROOTWARMD5 == '7902d13c7d8aed2b2390f15b2d6f43a8' ]; then
			echo "1.0.4.2" > $TMP/spectrumver.out
		elif [ $ROOTWARMD5 == 'e8ca6ec7424c40e2e23f95aa403d08d9' ]; then
			echo "1.1.5.1" > $TMP/spectrumver.out
		elif [ $ROOTWARMD5 == '2973a5251fad291652ce77de462024ff' ]; then
			echo "1.1.5.2" > $TMP/spectrumver.out
		elif [ $ROOTWARMD5 == 'fefb932d171418abb4e3794a4ca04812' ]; then
			echo "1.1.5.5" > $TMP/spectrumver.out
		elif [ $ROOTWARMD5 == 'dc1704094348797e30b6ba5e55a29c4a' ]; then
			echo "1.1.5.6" > $TMP/spectrumver.out
                else
                        echo "Could not determine spectrum version - build.info was not found and could not match md5sum of root.war: md5sum is $ROOTWARMD5" > $TMP/spectrumver.out
                fi
        fi
}

function uaxpull {
	SERVICE="$1"
	echo -e "Found $SERVICE Service"
	ls -latrR /var/lib/jetty7 > $TMP/ls-varlibjetty7.out
	ls -latrR /var/lib/netwitness > $TMP/ls-varlibnetwitness.out
	if [ -e /home/rsasoc ]; then
		ls -latrR /home/rsasoc > $TMP/ls-homersasoc.out
	fi
	which unzip &> /dev/null
	if [[ $? == 0 ]]; then
		unzip -p /var/lib/jetty7/webapps/root.war WEB-INF/classes/build-info.properties > $TMP/uax-build-info.properties
		UAXMAJ=`grep version= $TMP/uax-build-info.properties | sed -r 's/.*=//'`
		UAXSTABILITYID=`grep stabilityId= $TMP/uax-build-info.properties | sed -r 's/.*=//'`
		UAXREVISION=`grep count= $TMP/uax-build-info.properties | sed -r 's/.*=//'`
		UAXBUILD=`grep build= $TMP/uax-build-info.properties | sed -r 's/=/ /'`
		echo "$UAXMAJ.$UAXSTABILITYID.$UAXREVISION $UAXBUILD" > $TMP/uaxver.out
	elif [ -f "/tmp/jetty-0.0.0.0-443-root.war-_-any-/webapp/WEB-INF/classes/build-info.properties" ]; then
		cp /tmp/jetty-0.0.0.0-443-root.war-_-any-/webapp/WEB-INF/classes/build-info.properties $TMP/uax-build-info.properties
		UAXMAJ=`grep version= $TMP/uax-build-info.properties | sed -r 's/.*=//'`
		UAXSTABILITYID=`grep stabilityId= $TMP/uax-build-info.properties | sed -r 's/.*=//'`
		UAXREVISION=`grep count= $TMP/uax-build-info.properties | sed -r 's/.*=//'`
		UAXBUILD=`grep build= $TMP/uax-build-info.properties | sed -r 's/=/ /'`
		echo "$UAXMAJ.$UAXSTABILITYID.$UAXREVISION $UAXBUILD" > $TMP/uaxver.out
	else
		ROOTWARMD5=`md5sum /var/lib/jetty7/webapps/root.war | cut -d ' ' -f1`
		if [ $ROOTWARMD5 == '0ee952dd72d98ea78dc1d3e1374a6392' ]; then
			echo "9.8.5.0" > $TMP/uaxver.out
		elif [ $ROOTWARMD5 == '2a1e289b88ee5c3461e5de109c30241b' ]; then
			echo "10.0.5.0" > $TMP/uaxver.out
		elif [ $ROOTWARMD5 == '98b01649d8a912496a17854aaa8d2c2f' ]; then
			echo "10.0.5.1" > $TMP/uaxver.out
		elif [ $ROOTWARMD5 == 'e9879f5e8018767ca0303603c159079a' ]; then
			echo "10.1.5.2" > $TMP/uaxver.out
		elif [ $ROOTWARMD5 == '2aac753651c6553f0b781b07f3d31857' ]; then
			echo "10.2.0.1716-5" > $TMP/uaxver.out
		elif [ $ROOTWARMD5 == '96934782c4a28bd7fa65530bff1f83a5' ]; then
			echo "10.2.1.1893-5" > $TMP/uaxver.out
		elif [ $ROOTWARMD5 == 'cdcca6a5d433bb6ac3f1a8f6ad4e6341' ]; then
			echo "10.2.2.3743-5" > $TMP/uaxver.out
		elif [ $ROOTWARMD5 == '3c27aee29444d53d90f0f439f8021a13' ]; then
			echo "10.2.2.4265-5" > $TMP/uaxver.out
		else
			echo "Could not determine SA Web version - build.info was not found and could not match md5sum of root.war: md5sum is $ROOTWARMD5" > $TMP/uaxver.out
		fi
	fi

# Old fneserver output that does not work
#	UAXVER=`cat $TMP/uaxver.out`
#	if [[ ! $UAXVER =~ "^9\." ]]; then
#		which curl &>/dev/null
#		if [ $? == 0 ]; then
#			curl -sS http://localhost:3333/fne/xml/properties &> $TMP/fneproperties.out
#			curl -sS http://localhost:3333/fne/xml/devices &> $TMP/fnedevices.out
#			curl -sS http://localhost:3333/fne/xml/reservations &> $TMP/fnereservations.out
#			UAXHOSTID=`sed 's/.*hostid="\(\w\+\)".*/\1/' $TMP/fneproperties.out`
#			if [[ "$UAXHOSTID" != "" ]]; then
#				echo "UAX Host ID: $UAXHOSTID" >> $TMP/sysinfo.out
#			else
#				echo "Could Not Determine UAX Host ID"
#			fi
#		fi
#	fi
}

COPYTHESE=( /etc/event.d
/etc/hosts
/etc/fstab
/etc/inittab
/etc/krb5.conf
/etc/ldap.conf
/etc/lvm
/etc/mdadm.conf
/etc/modprobe.conf
/etc/monit.conf
/etc/monit.d
/etc/multipath.conf
/etc/netwitness/ng
/etc/netwitness/9.0
/etc/ntp.conf
/etc/pam.d/netwitness
/etc/rc.sysinit
/etc/redhat-release
/etc/resolv.conf
/etc/rsa
/etc/sysconfig
/home/rsasoc/rsa/soc/reporting-engine/conf
/home/rsasoc/rsa/soc/reporting-engine/logs
/proc/cpuinfo
/proc/interrupts
/proc/mdstat
/proc/meminfo
/proc/partitions
/proc/scsi/scsi
/boot/grub/grub.conf
/etc/cron*
/var/spool/cron
/var/lib/netwitness/spectrum/conf
/var/lib/netwitness/spectrum/logs
/var/lib/rsamalware/spectrum/logs/spectrum.log
/var/lib/netwitness/rsamalware/spectrum/logs/spectrum.log
/var/lib/netwitness/uax/conf
/var/lib/netwitness/uax/logs
/var/lib/fneserver
/var/log/fneserver
/var/log/audit/audit.log
/var/lib/jetty7/contexts/root.xml
/etc/default/jetty
/var/spool/postfix/maildrop
/etc/sysctl.conf
/etc/odbc.ini
/etc/odbcinst.ini
/var/netwitness/logcollector/rabbitmq/logs/
/var/netwitness/logcollector/rabbitmq/tmp/
/var/netwitness/logcollector/runtime/
/etc/vsftpd/
/var/netwitness/logcollector/rabbitmq/mnesia/cluster_nodes.config
/var/netwitness/logcollector/rabbitmq/mnesia/nodes_running_at_shutdown
/var/netwitness/logcollector/rabbitmq/mnesia/rabbit_serial
/var/netwitness/logcollector/rabbitmq/mnesia/scheme_version
/etc/init/nwlogcollector.conf
/etc/init/rabbitmq.conf
/etc/rabbitmq/enabled_plugins
/etc/rsyslog.conf
/etc/ssh/sshd_config )

COPYTHESEMINIMAL=( /etc/netwitness/ng
/etc/netwitness/9.0 )

EXCLUDE=( /etc/netwitness/9.0/Geo*
/etc/netwitness/9.0/feeds
/etc/netwitness/9.0/parsers
/etc/netwitness/9.0/envision
/etc/netwitness/ng/Geo*
/etc/netwitness/ng/feeds
/etc/netwitness/ng/parsers
/etc/netwitness/ng/envision )

EXCLUDEMINIMAL=( /etc/netwitness/9.0/Geo*
/etc/netwitness/9.0/feeds
/etc/netwitness/9.0/parsers
/etc/netwitness/9.0/envision
/etc/netwitness/ng/Geo*
/etc/netwitness/ng/feeds
/etc/netwitness/ng/parsers
/etc/netwitness/ng/envision )

function fneserver {
	mkdir $TMP/fneserver
	curl -sS http://localhost:3333/fne/xml/features?detailed=true | xmllint --format - &> $TMP/fneserver/entitlements.out
	curl -sS http://localhost:3333/fne/xml/devices | xmllint --format - &> $TMP/fneserver/devices.out
	curl -sS http://localhost:3333/fne/xml/reservations | xmllint --format - &> $TMP/fneserver/reservations.out
	curl -sS http://localhost:3333/fne/xml/properties | xmllint --format - &> $TMP/fneserver/properties.out
	service fneserver status > $TMP/fneserver/fneserver_status.out
}

function commands {
	mkdir $TMP/network
	arp -na > $TMP/arp.out
	df -m > $TMP/df-m.out
	df -h > $TMP/df-h.out
	df -i > $TMP/df-i.out
	ifconfig -a > $TMP/ifconfig.out
	netstat -nr > $TMP/routes.out
	netstat -nap > $TMP/netstat.out
	vgdisplay -C > $TMP/vgdisplay.out
	vgscan -v &> $TMP/vgscan.out
	pvdisplay -C > $TMP/pvdisplay.out
	pvscan -v &> $TMP/pvscan.out
	lvdisplay -C > $TMP/lvdisplay.out
	lvscan -v &> $TMP/lvscan.out
	fdisk -l &> $TMP/fdisk-l.out
	parted -l &> $TMP/parted-l.out
	date > $TMP/date.out
	dmidecode > $TMP/dmidecode.out
	rpm -qa > $TMP/rpms.out
	lsmod > $TMP/lsmod.out
	modinfo ixgbe | egrep '(ver|desc)' > $TMP/network/ixgbe.out
	modinfo tg3 | egrep '(ver|desc)' > $TMP/network/tg3.out
	modinfo e1000 | egrep '(ver|desc)' > $TMP/network/e1000.out
	top -b -n1 > $TMP/top.out
	ps -ef | grep -v $0 > $TMP/ps-ef.out
	mount > $TMP/mount.out
	dmesg > $TMP/dmesg.out
	sysctl -a > $TMP/sysctl-a.out
	ls -latrR /var/netwitness > $TMP/ls-varnetwitness.out
	ls -latrR /etc/netwitness > $TMP/ls-etcnetwitness.out
	ls -latrR /etc > $TMP/ls-etc.out
	ls -latrR /var/!(netwitness) > $TMP/ls-var.out
	ls -laR /dev > $TMP/ls-dev.out
	ls -laRH /etc/init.d > $TMP/ls-etcinit.d.out
	echo -n 'Product Name: ' >> $TMP/sysinfo.out;dmidecode -s baseboard-product-name >> $TMP/sysinfo.out
	echo -n 'Board Vendor: ' >> $TMP/sysinfo.out;dmidecode -s baseboard-manufacturer >> $TMP/sysinfo.out
	echo -n 'Serial Number: ' >> $TMP/sysinfo.out;dmidecode -s system-serial-number >> $TMP/sysinfo.out
	nwversionge "$NWMAJOR.$NWMINOR" "9.6"
	result=$?
	if [[ $result == 1 ]]; then
		NwConsole -c license | grep "Computer ID" >> $TMP/sysinfo.out
	elif [[ -f "$TMP/lsappliance.out" ]]; then
		echo Computer ID: `grep -ri '/sys/stats/compid' $TMP/lsappliance.out | awk '{print $6}'` >> $TMP/sysinfo.out
	fi

	uname -a > $TMP/uname.out
	mdadm --detail /dev/md* > $TMP/raid/mddetail.out 2>&1
	runlevel > $TMP/runlevel.out
	echo $scriptver > $TMP/scriptversion.out
	if [ -d /var/netwitness/decoder ]; then if [ `find /var/netwitness/decoder | wc -l` -gt 1 ]; then du -sh /var/netwitness/decoder/* > $TMP/du-sh-varnetwitnessdecoder.out; fi; fi
	if [ -d /var/netwitness/decoder ]; then if [ `find /var/netwitness/decoder | wc -l` -gt 1 ]; then du -sk /var/netwitness/decoder/* > $TMP/du-sk-varnetwitnessdecoder.out; fi; fi
	if [ -d /var/netwitness/concentrator ]; then if [ `find /var/netwitness/concentrator | wc -l` -gt 1 ]; then du -sh /var/netwitness/concentrator/* > $TMP/du-sh-varnetwitnessconcentrator.out; fi; fi
	if [ -d /var/netwitness/concentrator ]; then if [ `find /var/netwitness/concentrator | wc -l` -gt 1 ]; then du -sk /var/netwitness/concentrator/* > $TMP/du-sk-varnetwitnessconcentrator.out; fi; fi
	if [ -d /var/netwitness/broker ]; then if [ `find /var/netwitness/broker | wc -l` -gt 1 ]; then du -sh /var/netwitness/broker/* > $TMP/du-sh-varnetwitnessbroker.out; fi; fi
	if [ -d /var/netwitness/broker ]; then if [ `find /var/netwitness/broker | wc -l` -gt 1 ]; then du -sk /var/netwitness/broker/* > $TMP/du-sk-varnetwitnessbroker.out; fi; fi
	du -k /var/netwitness | sort -n > $TMP/du-k-varnetwitness.out
	du -sk --exclude "/var/netwitness" /var/*  2>/dev/null | sort -n > $TMP/du-sk-var.out
	du -sh --exclude "/var/netwitness" /var/*  2>/dev/null > $TMP/du-sh-var.out
	du -k --exclude "/var/netwitness" /var  2>/dev/null | sort -n > $TMP/du-k-var.out
	du -h --exclude "/var/netwitness" /var  2>/dev/null > $TMP/du-h-var.out
	echo $PARAMETERS | rev >> $TMP/parameters.out
	INTERFACES=($(ifconfig -a | egrep '^eth[0-9]+|^em[0-9]+|p[0-9]' | awk '{print $1}'))
	for INTERFACE in "${INTERFACES[@]}"; do
		ethtool $INTERFACE >> $TMP/ethtool-$INTERFACE.out 2>&1
		ethtool -S $INTERFACE >> $TMP/ethtool-S-$INTERFACE.out 2>&1
		ethtool -k $INTERFACE >> $TMP/ethtool-k-$INTERFACE.out 2>&1
		ethtool -c $INTERFACE >> $TMP/ethtool-c-$INTERFACE.out 2>&1
		ethtool -i $INTERFACE >> $TMP/ethtool-i-$INTERFACE.out 2>&1
		ethtool -g $INTERFACE >> $TMP/ethtool-g-$INTERFACE.out 2>&1
	done
	NwConsole -h 2>/dev/null | head -1 | grep "RSA Security Analytics Console" &>/dev/null
	if [[ $? == "0" ]]; then
		NwConsole -h 2>/dev/null | head -1 | awk '{print $5}' > $TMP/nwversion.out
	else
		NwConsole -h 2>/dev/null | head -1 | awk '{print $3}' > $TMP/nwversion.out
	fi
	if [ -f /sbin/lspci ]; then
		lspci -v -v > $TMP/lspci.out
	fi
	chkconfig --list > $TMP/chkconfig.out
	
# Removing because it causes errors in virtual machines & logdecoders
	# service --status-all > $TMP/service--status-all.out
	if [ -f /sbin/initctl ]; then
                initctl list > $TMP/initctl-list.out
        fi
	if [ -f /etc/init.d/pycarlos ]; then
                /etc/init.d/pycarlos status > $TMP/pycarlos-status.out
        fi
	free -m > $TMP/free-m.out
	if [ -d /var/lib/jetty7/logs ]; then mkdir -p $TMP/var/lib/jetty7/logs; ls -ltr /var/lib/jetty7/logs/*.log 2>/dev/null | tail -3 | awk '{print $9}' | xargs -I {} cp {} $TMP/var/lib/jetty7/logs; fi
	ntpstat 2>&1 > $TMP/ntpstat.out
	if [[ ! -z $SPECTRUM && $SPECTRUMMAJ == '1.0' && $SPECTRUMSTABILITYID -eq '5' && $SPECTRUMREVISION -le 2 ]]; then
		WEBPROXYPWDHASH=`grep '<proxyPassword>' $TMP/var/lib/netwitness/spectrum/conf/webProxyConfig.xml | sed -r 's/<proxyPassword>(\S+)<\/proxyPassword>$/\1/' | openssl md5`
		sed -ri "s/<proxyPassword>\S+<\/proxyPassword>/<proxyPassword>$WEBPROXYPWDHASH<\/proxyPassword>/" $TMP/var/lib/netwitness/spectrum/conf/webProxyConfig.xml
	fi
	iptables -L > $TMP/iptables-L.out
	X=0
	iostat -mN 1 5 2>/dev/null > $TMP/iostat-mN.out
	iostat -m 1 5 2>/dev/null > $TMP/iostat-m.out
	mpstat -P ALL 1 5 2>/dev/null > $TMP/mpstat.out
	vmstat 1 5 2>&1 > $TMP/vmstat.out
	if [ -f /usr/bin/monit ]; then
		monit summary > $TMP/monit-summary.out;
		monit status >  $TMP/monit-status.out;
	fi
	if [[ -f /etc/init/nwlogcollector.conf ]]; then
		ls -ltR /opt/netwitness > $TMP/optnwrecursvlist.out;
	fi
}

function commandsminimal {
	df -m > $TMP/df-m.out
	df -h > $TMP/df-h.out
	df -i > $TMP/df-i.out
	ifconfig -a > $TMP/ifconfig.out
	vgdisplay -C > $TMP/vgdisplay.out
	vgscan -v &> $TMP/vgscan.out
	pvdisplay -C > $TMP/pvdisplay.out
	pvscan -v &> $TMP/pvscan.out
	lvdisplay -C > $TMP/lvdisplay.out
	lvscan -v &> $TMP/lvscan.out
	fdisk -l &> $TMP/fdisk-l.out
	parted -l &> $TMP/parted-l.out
	date > $TMP/date.out
	rpm -qa > $TMP/rpms.out
	lsmod > $TMP/lsmod.out
	top -b -n1 > $TMP/top.out
	ps -ef | grep -v $0 > $TMP/ps-ef.out
	echo -n 'Product Name: ' >> $TMP/sysinfo.out;dmidecode -s baseboard-product-name >> $TMP/sysinfo.out
	echo -n 'Board Vendor: ' >> $TMP/sysinfo.out;dmidecode -s baseboard-manufacturer >> $TMP/sysinfo.out
	echo -n 'Serial Number: ' >> $TMP/sysinfo.out;dmidecode -s system-serial-number >> $TMP/sysinfo.out
	if [[ -f "$TMP/lsappliance.out" && $NWMAJOR -eq 9 && $NWMINOR -le 5 ]]; then
		echo Computer ID: `grep -ri '/sys/stats/compid' $TMP/lsappliance.out | awk '{print $6}'` >> $TMP/sysinfo.out
	elif [[ -f "$TMP/lsappliance.out" && ( $NWMAJOR -eq 9 && $NWMINOR -ge 6 ) || ( $NWMAJOR -ge 10 ) ]]; then
		echo Computer ID: `grep -ri '/sys/stats/computer.id' $TMP/lsappliance.out | awk '{print $6}'` >> $TMP/sysinfo.out
	fi
	uname -a > $TMP/uname.out
	echo $scriptver > $TMP/scriptversion.out
	if [ -d /var/netwitness/decoder ]; then if [ `find /var/netwitness/decoder | wc -l` -gt 1 ]; then du -sh /var/netwitness/decoder/* > $TMP/du-sh-varnetwitnessdecoder.out; fi; fi
	if [ -d /var/netwitness/decoder ]; then if [ `find /var/netwitness/decoder | wc -l` -gt 1 ]; then du -sk /var/netwitness/decoder/* > $TMP/du-sk-varnetwitnessdecoder.out; fi; fi
	if [ -d /var/netwitness/concentrator ]; then if [ `find /var/netwitness/concentrator | wc -l` -gt 1 ]; then du -sh /var/netwitness/concentrator/* > $TMP/du-sh-varnetwitnessconcentrator.out; fi; fi
	if [ -d /var/netwitness/concentrator ]; then if [ `find /var/netwitness/concentrator | wc -l` -gt 1 ]; then du -sk /var/netwitness/concentrator/* > $TMP/du-sk-varnetwitnessconcentrator.out; fi; fi
	if [ -d /var/netwitness/broker ]; then if [ `find /var/netwitness/broker | wc -l` -gt 1 ]; then du -sh /var/netwitness/broker/* > $TMP/du-sh-varnetwitnessbroker.out; fi; fi
	if [ -d /var/netwitness/broker ]; then if [ `find /var/netwitness/broker | wc -l` -gt 1 ]; then du -sk /var/netwitness/broker/* > $TMP/du-sk-varnetwitnessbroker.out; fi; fi
	echo $PARAMETERS | rev >> $TMP/parameters.out
	INTERFACES=($(ifconfig -a | egrep '^eth[0-9]+|^em[0-9]+|p[0-9]' | awk '{print $1}'))
	for INTERFACE in "${INTERFACES[@]}"; do
		ethtool $INTERFACE >> $TMP/ethtool-$INTERFACE.out 2>&1
		ethtool -S $INTERFACE >> $TMP/ethtool-S-$INTERFACE.out 2>&1
		ethtool -k $INTERFACE >> $TMP/ethtool-k-$INTERFACE.out 2>&1
		ethtool -c $INTERFACE >> $TMP/ethtool-c-$INTERFACE.out 2>&1
		ethtool -i $INTERFACE >> $TMP/ethtool-i-$INTERFACE.out 2>&1
		ethtool -g $INTERFACE >> $TMP/ethtool-g-$INTERFACE.out 2>&1
	done
	NwConsole -h 2>/dev/null | head -1 | grep "RSA Security Analytics Console" &>/dev/null
	if [[ $? == "0" ]]; then
		NwConsole -h 2>/dev/null | head -1 | awk '{print $5}' > $TMP/nwversion.out
	else
		NwConsole -h 2>/dev/null | head -1 | awk '{print $3}' > $TMP/nwversion.out
	fi
}

if [ -f /usr/sbin/dmidecode ]; then
    if [ `dmidecode -s chassis-serial-number` == "None" ]; then
        echo -e "\n\t*********** WARNING ***********\n\n\tThis is a Virtual Machine, the\n\tscript will still run, however\n\tthere may be errors thrown.\n\n"
        echo "Running Script. Please Wait"
        sleep 5
    fi

    main "$@"

else
    echo -e "\n\tPlease install the dmidecode command before running this script.\n\n\tIf you have your yum repository setup properly, you may install dmidecode with the following command:\n\n\t\tyum install dmidecode\n\n"
fi
