Support Support Downloads Knowledge Base Juniper Support Portal Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[JSA] How to copy a file from JSA console to all managed hosts at one time using ''



Article ID: KB34204 KB Last Updated: 10 May 2019Version: 1.0

In a distributed environment where you have a JSA console and many managed hosts (Flow processor or Event Processors), it is helpful to be able to run one command to put files to the managed hosts or request information back from the managed hosts. 


Using the '' is a versatile tool that allows a user to execute a command on the console and avoids the need to either SSH to each managed host or SCP a file to each managed host. The  '' is located here:

[root@jsa ~]# find / -name

To copy a file from the console to all of the managed hosts at one time, use the following command:


[root@jsa ~]# /opt/qradar/support/ -p /tmp/test1.txt
INFO: Copying /tmp/test1.txt to each server in /storetmp

SCP of large files can take a considerable amount of time before you receive feedback. Please be patient. ->
Appliance Type: 1699    Product Version:
 08:00:06 up 58 min,  1 user,  load average: 0.13, 2.17, 2.02
INFO: The scp put of "/tmp/test1.txt" is complete.

[root@jsa ~]#

In 7.3, it puts the test1.txt file into /storetmp of the managed host and in 2014.x, it puts the test1.txt file into /tmp

SSH from Console to Managed Host to confirm:

[root@jsa ~]# ssh root@
Last login: Tue Apr 16 07:03:25 2019
This server has Secure Analytics installed on Tue Jul 24 17:46:51 EDT 2018.
[root@EP22195 ~]# cd /storetmp
[root@EP22195 storetmp]# ll test1.txt
-rw-r--r-- 1 root root 43 Apr 16 08:00 test1.txt
[root@EP22195 storetmp]#

Not sure you have disk space on all your managed hosts to copy the file "test1.txt" from console to managed hosts? Check available disk space on all devices with this command:

[root@jsa ~]# /opt/qradar/support/ -C "df -h" ->
Appliance Type: 3199    Product Version:
 08:04:30 up 37 min,  2 users,  load average: 3.22, 5.52, 6.24
Filesystem                        Size  Used Avail Use% Mounted on
/dev/mapper/rootrhel-root          13G  3.0G  9.6G  24% /
devtmpfs                           16G     0   16G   0% /dev
tmpfs                              16G   20K   16G   1% /dev/shm
tmpfs                              16G   18M   16G   1% /run
tmpfs                              16G     0   16G   0% /sys/fs/cgroup
/dev/sda3                          32G  4.6G   28G  15% /recovery
/dev/sda2                        1014M  207M  808M  21% /boot
/dev/mapper/rootrhel-storetmp      15G   44M   15G   1% /storetmp
/dev/mapper/rootrhel-opt           13G  8.4G  4.2G  67% /opt
/dev/mapper/rootrhel-home        1014M   33M  982M   4% /home
/dev/mapper/storerhel-store       306G   31G  276G  10% /store
/dev/mapper/storerhel-transient    77G   36M   77G   1% /transient
/dev/mapper/rootrhel-var          5.0G  261M  4.8G   6% /var
/dev/mapper/rootrhel-tmp          3.0G  130M  2.9G   5% /tmp
/dev/mapper/rootrhel-varlog        15G  415M   15G   3% /var/log
/dev/mapper/rootrhel-varlogaudit  3.0G  108M  2.9G   4% /var/log/audit
tmpfs                             3.2G     0  3.2G   0% /run/user/0 ->
Appliance Type: 1699    Product Version:
 08:04:30 up  1:02,  1 user,  load average: 0.12, 1.02, 1.58
Filesystem                        Size  Used Avail Use% Mounted on
/dev/mapper/rootrhel-root          13G  2.3G   11G  19% /
devtmpfs                           12G     0   12G   0% /dev
tmpfs                              12G   12K   12G   1% /dev/shm
tmpfs                              12G  8.8M   12G   1% /run
tmpfs                              12G     0   12G   0% /sys/fs/cgroup
/dev/mapper/rootrhel-tmp          3.0G   33M  3.0G   2% /tmp
/dev/mapper/rootrhel-var          5.0G  132M  4.9G   3% /var
/dev/mapper/rootrhel-opt           13G  4.3G  8.3G  35% /opt
/dev/mapper/rootrhel-home        1014M   33M  982M   4% /home
/dev/sda2                        1014M  207M  808M  21% /boot
/dev/sda3                          32G  4.6G   28G  15% /recovery
/dev/mapper/rootrhel-storetmp      15G   33M   15G   1% /storetmp
/dev/mapper/rootrhel-varlog        15G  104M   15G   1% /var/log
/dev/mapper/rootrhel-varlogaudit  3.0G   35M  3.0G   2% /var/log/audit
tmpfs                             2.4G     0  2.4G   0% /run/user/0
/dev/mapper/storerhel-store       334G   12G  323G   4% /store
/dev/mapper/storerhel-transient    39G   33M   39G   1% /transient

[root@jsa ~]#

Above is just a few examples of how to run the ''. Use the --help for more:

[root@jsa ~]# /opt/qradar/support/ --help v2.0


-a <APPLIANCE>  :: Matches host appliance_name in a SQL LIKE statement.
                   eg:  -a '16%' matches all 16XX appliances
                   -a '%05' matches any XX05 appliance.
-C              :: Include the Console
-i <IP>         :: Matches host IP address in a SQL LIKE statement.
                   eg:  -i '10%' matches all 10X.X.X.X hosts
                   -i '%215' matches any X.X.X.215 host.
-I <IPs>        :: Pass a comma separated list of IPs.
-k              :: Include HA Standby Boxes.
                   Does not include HA standy systems behind NATs
-n <NAME>       :: Matches hostname in a SQL LIKE statement.
                   eg:  -n '%col%' matches all hosts with 'col' in the name

Note: Multiple filters can be passed.


-p <FILE>  :: Copy to mode.  The <FILE> passed should include the full path. It will be pushed to /storetmp on the remote host.
              NOTE: Will not SCP file to remote system if the destination partition will be more than 90% full after transfer.
-g <FILE>  :: Copy from mode.  The <FILE> passed should include the full path.
-r <DIR>   :: Change remote directory.  Used in conjuction with -p option, to specify remote directory to copy file.  Default is /storetmp
-s PATCH   :: Patch Staging Mode.  This PATCH should include the full path. This option will push the patch to the hosts and mount it.
-P PATCH   :: Patch mode. This option will intall the patch on all the hosts in parallel. Include the name of the patch file.
-R         :: Patch Report and Monitoring mode. This option will open a screen session and display the patch status of all hosts.
-l         :: List IP mode.  The IPs that would be operated on are returned as a separated list.



-m <THREADS> :: Set Maximum Parallel Threads. Default: 2 Max: 4
-L <RATE>    :: Set the scp transfer rate limit in kilobits
-v           :: Display revision information
-V           :: Verbose output
-h,--help    :: Displays this dialog

You have new mail in /var/spool/mail/root

[root@jsa ~]#
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search