Support bundles

When you escalate to [email protected], attach a support bundle: a single zip that gathers everything support usually asks for, collected consistently and with secrets redacted. One bundle replaces a back-and-forth of pasted fragments and gets your case moving on the first email.

What is in a bundle

• A manifest: node, version, timestamp, and whether the bundle was built offline.
• A copy of the running configuration, redacted: secret values are masked.
• The results of the same checks the Diagnose page runs.
• A snapshot of cluster membership.
• Health checks, with probe credentials masked.
• Subnet-to-region mappings and the region list, plus the configured discovery scopes and the latest detection state (pending drift), so support can see what discovery covers and what is waiting for review.
• The effective DoT/DoH transport state, which can differ from the config file because the runtime transport record wins at boot.
• A service-account inventory: token counts, roles, and never-expiring, unscoped, or revoked accounts, with all secret material stripped.
• Recent audit entries.
• Zone metadata and records, with any template secrets masked. Very large datasets are capped at 50,000 records, and the bundle flags it when that cap is hit.
• A 24-hour ring of per-minute process vitals (memory, file descriptors, queries per second, replication queue, storage headroom), including the scheduled-backup health signals: last success time, a total failure count, and the upload-stage failure count (so an off-node copy that is silently failing stands out), letting support spot a dead backup pipeline from the bundle alone.
• Version information.

Redaction happens as the bundle is built: configuration secrets, probe credentials, and record-template secrets are masked before anything is written.

Note

A bundle still contains your DNS names, records, and recent audit entries. Treat it like any operational data, and encrypt it if your policy requires encryption for data shared outside your organisation.

From the web UI

On the Diagnose page, use the download button. Your browser saves bundle-<node>-<timestamp>.zip.

From the API

POST /api/v1/support-bundle (admin role) returns the bundle directly; capture the $DTM_TOKEN bearer token per the API overview:

curl -sk -X POST https://dtm.internal:8443/api/v1/support-bundle \
  -H "Authorization: Bearer $DTM_TOKEN" \
  -H "X-DTM-CSRF: 1" \
  -OJ

The response is the bundle itself; -OJ saves it under the server-provided name, bundle-<node>-<timestamp>.zip.

Offline, when the node will not start

The offline builder exists for the worst case: the service will not start, or the API is unreachable. It reads the node’s local data store and configuration directly, with no running cluster and no authentication.

It needs exclusive access to the local data store, so stop the service first, then run it on the affected node:

sudo systemctl stop dtm-server
sudo dtm-server support-bundle --local --config /etc/dtm/dtm-server.yaml

This writes ./bundle-<node>-<timestamp>.zip. Optional flags:

• --db <path>: path to the local data store, if it is not readable from the configuration file.
• -o <path>: output path.
• --passphrase <p>: encrypt the bundle.

An offline bundle is marked as offline in its manifest, carries no process-vitals ring (that history lives only in the running server), and its cluster view is limited to what this node last knew. Restart the service afterwards if it can run.

Encrypt the bundle

With a passphrase, the bundle is encrypted with AES-256-GCM and saved with a .dtmbundle extension instead of .zip.

Over the API, pass the passphrase in the request body:

curl -sk -X POST https://dtm.internal:8443/api/v1/support-bundle \
  -H "Authorization: Bearer $DTM_TOKEN" \
  -H "X-DTM-CSRF: 1" \
  -H "Content-Type: application/json" \
  -d '{"passphrase": "a-long-passphrase"}' \
  -OJ

Offline, add --passphrase to the command above.

Send the .dtmbundle file to support, and share the passphrase through a separate channel (not in the same email as the bundle). Support decrypts it on their side; there is nothing for you to install.

Escalating

Email [email protected] with the symptom, what you have already tried (the troubleshooting entry you followed, if any), and the bundle attached. If the cluster is healthy enough, build the bundle from the UI or API; if a node will not start, use the offline path above on that node, since its local view is usually exactly what support needs.