Report a bug or get support

What to gather before you write, how to redact what should not leave your network, and where to send it.

Support is by email at support@sxaccess.com. Most client-side problems are settled by three things: the output of sxaccess info -d, which includes the agent and CLI versions, a diagnostics bundle covering the moment it went wrong, and a precise description. Gathering them first turns a multi-day exchange into one reply. On a device that runs the app rather than the CLI agent, the app's status report or logs take the place of the first two; see From the apps.

Before you write

1
Work through the troubleshooting page
Troubleshooting the client covers the common symptoms and the command that tells them apart. It resolves most of what people report.
2
Collect the basics
The detail view, anonymized, and the affected device's name as it appears in the dashboard. Its Agent and CLI rows show the versions.
shell
```
sxaccess info -d -A
```
3
Capture a bundle over the failure
For something reproducible, collect a bundle now with sxaccess diagnose collect -A. For something intermittent, capture a window with the command below: capture switches the agent to trace logging, reconnects the device, waits the time you give and bundles that period. Because it reconnects, SSH and other sessions running over SXAccess drop.

Both print Bundle saved to: and the path of the archive. Only root can read it, so copy it with sudo before attaching it.
shell
```
sxaccess diagnose capture 5m -A
```

What is in a bundle

A bundle is a zip archive. Its about.txt describes every file and the anonymizing rules. The rest:

log/ - the agent log, the agent service's output and error streams, older rotated logs (-C sets how many, one by default) and, on Linux, the service journal.
state/ - summary.txt, the detail view at the moment of collection; settings.txt, the agent's settings, which never include private keys; saved.json, the system changes the agent recorded so it can undo them.
net/ - netmap.json, the network map this device last received: itself, the devices it may connect with, routes, DNS settings and access rules. Text files hold the state of the tunnel and the addresses routed domains resolved to. When system information is included, they also hold the routing table, the network interfaces and the routing rules.
firewall/ - on Linux, the iptables or nftables rules with their counters, when system information is included.
prof/ - performance profiles of the agent process.

System information is included unless you add -S=false.

What -A hides and what it keeps

-A (--anonymize) applies to every text file in the archive and to the output of info.

Replaced: public IP addresses, by stand-ins that count up from 198.51.100.0 for IPv4 and from 100:: for IPv6, and the domain part of every name outside SXAccess's own domains, by a random name ending in .domain.
Kept: private ranges (10.x, 172.16.x to 172.31.x, 192.168.x), the overlay addresses in 100.64.0.0/10, well-known public DNS resolvers, names without a dot, and the labels in front of a replaced domain: db-01.corp.example.com becomes something like db-01.corp.anon-k3x9q.domain.

From the apps

The apps have no bundle command. Each has its own way to hand over what support needs.

macOS and Windows. In Settings, under Diagnostics, choose Open next to Logs, then Copy status report, and paste the report into your email. It holds the app and tunnel versions, whether the tunnel is running, and the result of each health check. In the macOS app from the DMG download, Open logs folder on the same page saves the last 24 hours of logs as sxaccess-last-24h.log in ~/Library/Logs/SXAccess and opens that folder; attach that file. On Windows, the tunnel service logs to %ProgramData%\SXAccess\Logs\service.log, which an administrator account can copy.
iPhone. Settings → Advanced → Share logs opens the share sheet with the app's log files.
Android. The app records logs only while Settings → Advanced → Capture logs is on, and it is off by default. Turn it on, reproduce the problem, then tap Share logs. The shared file leaves out server and host names, network addresses, keys and tokens.

What to include

What you expected and what happened. "The laptop cannot reach db-01" beats "networking is broken".
Which devices, by the names shown in the dashboard.
When it started, with a time zone, and whether anything changed then - an access rule edit, a client upgrade, a new firewall rule.
Whether it affects one device or all of them. This single fact separates a client problem from an access rule problem.
The bundle, attached, or the status report or logs from the app.

Where to send it

Email support@sxaccess.com with the details above and the bundle or the app's logs attached.