Learn more about remotely connecting to a Cortex XSIAM Broker VM.
Cortex XSIAM enables you to connect remotely to a Broker VM directly from Cortex XSIAM.
1. In Cortex XSIAM, select Settings → Configurations → Data Broker → Broker VMs table.
2. Locate the Broker VM you want to connect to, right-click and select Open Live Terminal. Cortex XSIAM opens a CLI window where you can perform the following commands:
#### Logs
Broker VM logs are located in `/data/logs/folder` and contain the applet name in the file name. Example 19. Folder `/data/logs/[applet name]`, containing `container_ctrl_[applet name].log`
#### Administration commands
Broker VM supports the commands listed in the following table. All the commands are located in the `/home/admin/sbin` folder.
#### Applet Names
* CSV Collector: `file_collector`
* Database Collector: `db_collector`
* Files and Folders Collector: `log_collector`
* FTP Collector: `ftp_collector`
* Kafka Collector: `kafka_collector`
* Local Agent Settings: `tms_proxy`
* NetFlow Collector: `netflow_collector`
* Network Mapper: `network_mapper`
* Syslog Collector: `anubis`
* Windows Event Collector: `wec`
#### Services
* Upgrade: `zenith_upgrade`
* Frontend service: `webui`
* Sync with Cortex XSIAM: `cloud_sync`
* Internal messaging service (RabbitMQ): `rabbitmq-server`
* Upload metrics to Cortex XSIAM: `metrics_uploader`
* Prometheus node exporter: `node_exporter`
* Backend service: `backend`
The following table displays the available commands in alphabetical order:
| Command | Description | Example |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------- |
| `applets_restart` | Restarts one or more applets. | `sudo ./sbin/applets_restart wec` |
| `applets_start` | Start one or more applets. | `sudo ./sbin/applets_start wec` |
| `applets_status` | Check the status of one or more applets. | `sudo ./sbin/applets_status wec` |
| `applets_stop` | Stop one or more applets. | `sudo ./sbin/applets_stop wec` |
| `restart_routes` | Invoke a restart of the routing service after updating your static network route configuration file, `/etc/network/routes`. The `/etc/network/routes` configuration file is a standard routes configuration file and can be edited directly. The admin user that you logged in with, when using the remote terminal or via SSH, has read/write permissions to this file. | `sudo ./sbin/restart_routes` |
| `services_restart` | Restarts one or more services. OS services are not supported. | `sudo ./sbin/services_restart cloud_sync` |
| `services_start` | Start one or more services. | `sudo ./sbin/services_start cloud_sync` |
| `services_status` | Check the status of one or more services. | `sudo ./sbin/services_status cloud_sync` |
| `services_stop` | Stop one or more services. | `sudo ./sbin/services_restart cloud_sync` |
| `set_ui_password.sh` | Change the password of the Broker VM Web UI. Run the command, enter the new password followed by Ctrl+D. | `sudo ./sbin/set_ui_password.sh` |
| `squid_tail` | Display the Proxy applet Squid log file in real-time. | `sudo ./sbin/squid_tail` |
#### Note
You can either `restart_routes` or reboot the Broker VM for the changes in the `/etc/network/routes` file to take affect.