Support

This article is an overview of the technical support provided by Exasol.

Exasol provides you with support and services through maintenance and service packages. Standard and premium maintenance forms the basis of the services that Exasol offers you. Additional services such as sizing and planning, installation, operation, incident management, monitoring, or performance services can be booked as per your requirements.

To learn more about the support services, see Our Services. To get help from our Support team, create a case.

The following describes the additional access that Exasol may need depending on the services that you opt for.

Logs for support cases

When you open a support case, the Support team will in most cases ask you to provide system logs for debugging purposes. You can generate system logs and share them with the Support team through our support system without the need of a VPN tunnel.

Logs that are generated for support cases may contain SQL texts and other details for SQL processes. These details are usually necessary for proper debugging. You can disable SQL texts in the log files by setting the database parameters -sqltexthide=1 and -show_statements=0.

In the case of coredumps, some database data from the query that was being executed may be saved.

For information about how to generate logs for support, see Log Files for Support (AWS) or Log Files for Support (on-prem).

VPN access

If you opt for Exasol’s managed services, the Support team will require VPN access to your cluster. Configuring VPN access and creating a corresponding EXAoperation user will allow Exasol Support team members to log in to the cluster.

For information about how to configure your network to allow VPN access, see VPN Access for Support.

What can Support access over VPN?

  • Support team members that access your cluster over VPN will have administrative rights at the OS level. This allows indirect access to contents of the database by pulling logs or reading the memory of processes through the OS interfaces.

  • Support team members can read certain passwords on the OS, such as the EXAoperation Disk password or passwords for a remote archive volume.

  • Support team members can log in to EXAoperation and view the configuration of the cluster, and are also able to pull logs when needed. Within the logs, SQL text is visible.

Exasol Support team members will have access to the deployment configuration using Exasol Deployment Tool (c4) and to the Exasol cluster operating system (COS) through the Administration API and ConfD. This allows the Support team to view and change the configuration of the cluster, including passwords for COS and database access and for remote archive volumes, and to access system logs. Within the logs, SQL text is visible.

Database access

If Exasol Support needs VPN access to your system for any of its managed services, database access may also be required. In this case, you need to create a debug user with limited access to the database. The debug user must be granted the CREATE SESSION, EXPORT, and SELECT ANY DICTIONARY permissions.

  • The SELECT ANY DICTIONARY permission allows read-only access to the contents of every system table in the SYS and EXA_STATISTICS schemas. This includes content describing data models, script text, table columns, etc., even if the user does not have access to the actual objects.

  • All system tables are mapped to internal tables and views owned by the SYS user. This cannot be changed. It is therefore impossible to grant table-specific privileges or to limit what information can be viewed within the SYS and EXA_STATISTICS schemas.

  • If auditing is enabled for the database, the auditing tables in the EXA_STATISTICS schema will also contain SQL statements. The debug user does not have direct access to data located in other schemas.

To create the exa_debug user, run the following commands:

CREATE USER exa_debug IDENTIFIED BY "<password>";
GRANT CREATE SESSION TO exa_debug;
GRANT SELECT ANY DICTIONARY TO exa_debug;
GRANT EXPORT TO exa_debug;

Credentials handover

In the case of Exasol Support installing a cluster, the credentials of the SYS user will be handed over to you after installation with the requirement to change the password. Once you have changed the SYS password, the Support team will not be able to log in to the database as SYS and will instead use the debug user.

Additional requirements for monitoring

If you opt for Exasol's monitoring services, you need to provide an additional port. To know about the network requirements, see VPN Access for Support. For more information about monitoring, see Create Monitoring Services.

Root access with private key

You can use SSH keys as a secure way of logging into a server instead of using a username and password. An SSH key pair contains private and public keys. Keep the private key safe and secure and only share the public key.

To create SSH keys and place them to a destination host:

  1. Run the following command to create the keys:

    ssh-keygen -t rsa

  2. Specify location and password, or choose the default settings.

  3. Contact Exasol Support to add the keys to a destination host (Exasol cluster).