After running the command to generate the support bundle as mentioned in the official documentation, the next step is to interpret it and find relevant information in it.
Issue description
After running the command to generate the support bundle as mentioned in our docs, the next step is to interpret it and find relevant information in it.
Resolution
Here's what you can find in the support bundle and how relevant information can be found in it.
Automation Suite Support Bundle - Complete Guide
A support bundle is a comprehensive diagnostic package that contains logs, configurations, and system information from all components of your UiPath Automation Suite cluster.
What's Inside a Support Bundle
1. Pod Logs
Each pod in your Kubernetes cluster generates logs that are captured in the bundle:
- Application logs: Runtime behaviour, errors, warnings
- Container logs: Standard output/error from containers
- System logs: Kubernetes events, pod lifecycle events
2. Pod Types and Their Functions
Infrastructure Pods
- istio-system: Service mesh for traffic management, security, and observability
- kube-system: Core Kubernetes services (DNS, networking, scheduling)
- rook-ceph: Distributed storage system providing persistent storage
- cilium: Network plugin for pod-to-pod communication
Platform Services
- argocd: GitOps continuous delivery for application deployment
- cert-manager: TLS certificate management and automatic renewal
- redis-system: In-memory data store for caching and sessions
- system-upgrade: Manages cluster upgrades
UiPath Services
- Uipath: Core UiPath platform services including:
- Orchestrator: Workflow orchestration and robot management
- Identity: Authentication and authorization service
- Webhooks: Event-driven integrations
- Insights: Analytics and reporting
- Automation-suite-gateway: API gateway and routing
- Uipath-infra: Infrastructure support services for UiPath components
3. How Pods Connect
User Request
↓
[Gateway/Ingress]
↓
[Istio Service Mesh] ← Controls traffic between services
↓
[Application Pods] ← Your UiPath services
↓
[Storage Layer] ← Rook-Ceph
↓
[Monitoring/Logging] ← Observability stack
Key Connections:
- Gateway → Services: Routes external traffic to internal services
- Identity ↔ All Services: Provides authentication for all components
- Orchestrator ↔ Robots: Manages automation execution
- Services ↔ Storage: Persists data and state
- All Pods → Logging/Monitoring: Send logs and metrics
- Istio Mesh: Intercepts all service-to-service communication
4. Bundle Structure
This support bundle contains:
uipath-support-bundle/
├── alerts/ # System alerts and warnings
│ ├── critical.json # Critical alerts requiring immediate attention
│ └── warning.json # Warning-level alerts
│
├── configmaps/ # Configuration data
│ └── uipath/ # UiPath service configurations
│
├── daemonsets/ # Pods running on every node
│ ├── istio-system/ # Istio ingress gateways
│ └── kube-system/ # Cilium networking, node monitors
│
├── deployments/ # Application deployments
│ ├── argocd/ # ArgoCD components
│ ├── cert-manager/ # Certificate management
│ ├── istio-system/ # Service mesh control plane
│ ├── kube-system/ # Core Kubernetes services
│ ├── redis-system/ # Redis cluster
│ ├── rook-ceph/ # Storage system components
│ ├── uipath/ # UiPath applications
│ └── uipath-infra/ # UiPath infrastructure services
│
├── events/ # Kubernetes events by namespace
│ ├── argocd.json
│ ├── cert-manager.json
│ ├── istio-system.json
│ ├── kube-system.json
│ ├── redis-system.json
│ ├── rook-ceph.json
│ ├── uipath.json
│ └── uipath-infra.json
│
├── jobs/ # One-time or scheduled tasks
│
├── logs/ # Pod logs organized by namespace
│ ├── argocd/
│ ├── cert-manager/
│ ├── istio-system/
│ ├── kube-system/
│ ├── redis-system/
│ ├── rook-ceph/
│ ├── uipath/ # Main UiPath service logs
│ └── uipath-infra/
│
├── pods/ # Pod specifications and status
│
├── services/ # Service definitions
│
├── nodes.json # Node information and status
└── rook-ceph-down.txt # Ceph cluster status issues
How to Use the Support Bundle
Troubleshooting Steps
1. Identify the Issue Timeframe
- Note when the problem occurred (timestamp)
- Time zone matters - Check log timestamps
- Example: `2026-01-23 15:46:28`
2. Check Critical Alerts First
# View critical alerts
cat alerts/critical.json | jq '.'
# View warnings
cat alerts/warning.json | jq '.'
3. Find Relevant Pod Logs
For example, for UiPath-specific issues:
- Orchestrator problems: `logs/uipath/orchestrator-*`
- Authentication failures: `logs/uipath/identity-*`
For infrastructure issues:
- Networking: `logs/istio-system/`, `logs/kube-system/cilium-*`
- Storage: `logs/rook-ceph/`
- DNS resolution: `logs/kube-system/coredns-*`
- Certificates: `logs/cert-manager/`
4. Search for Error Patterns
# Find all errors in UiPath namespace
grep -r "ERROR\|FATAL\|Exception" logs/uipath/
# Search for specific error in timeframe
grep -r "OutOfMemory" logs/uipath/ | grep "2026-01-23"
# Find pod restarts
grep -r "CrashLoopBackOff\|OOMKilled" events/
5. Check Pod and Node Status
# View node status
cat nodes.json
# Check storage issues
cat rook-ceph-down.txt
6. Review Events
# Check UiPath namespace events
cat events/uipath.json | jq '.items[] | select(.type=="Warning" or .type=="Error")'
# Check all critical events across namespaces
cat events/*.json | jq '.items[] | select(.type=="Error")'
Common Investigation Paths
Issue Type |
Start Here |
Then Check |
|---|---|---|
Login failures |
|
|
Automation won’t start |
|
|
Performance issues |
|
Resource usage in pod specs,
|
Certificate errors |
|
|
Storage problems |
|
|
Networking issues |
|
|
Pod crashes |
|
Specific pod logs,
|
Database connectivity |
|
|
Key Files to Review
- nodes.json: Cluster nodes health, resource capacity, and conditions
- rook-ceph-down.txt: Storage cluster health issues
- alerts/critical.json: Active critical alerts
- alerts/warning.json: Active warnings
- events/*.json: Kubernetes events showing pod lifecycle, errors, warnings
- deployments/: Pod specifications, resource requests/limits, environment variables
- configmaps/: Configuration details for services
- logs/: Actual application and system logs
Investigation Workflow
1. Start with the Big Picture
# Check if there are critical alerts
cat alerts/critical.json
# Check storage health
cat rook-ceph-down.txt
# Check node health
cat nodes.json
2. Find Affected Pods
# List all pods in a namespace
ls -la pods/uipath/
# Check pod status
cat pods/uipath/*.yaml | grep -A 5 "status:"
3. Analyze Logs
# View logs from specific pod
cat logs/uipath/orchestrator-*.log
# Search for errors around incident time
grep "2026-01-23 15:" logs/uipath/orchestrator-*.log | grep -i "error\|exception\|fail"
5. Check Dependencies
- If Service A fails, check what it depends on (database, cache, identity)
- Follow the connection path
- Check network policies and service mesh configuration
Tips:
✅ Start broad, then narrow down: Identify the affected service first, then dive into specific logs
✅ Timestamps are crucial: Always correlate events by time. All logs should have timestamps.
✅ Look for patterns:
- Repeated errors often indicate root cause
- Single errors might be transient or self healing
- OOMKilled = out of memory
- CrashLoopBackOff = pod keeps restarting
✅ Check dependencies:
- A failing storage pod affects all services using persistent volumes
- Identity service down = all logins fail
- Redis down = session and cache issues
✅ Resource constraints:
- OOM (Out of Memory) errors
- CPU throttling
- Disk space exhaustion
⚠️ Security Reminder:
- Support bundles may contain sensitive information
- Don't share bundles publicly
Common Error Patterns
Pod won't Start
- Check: `events/` for scheduling issues
- Look for: `ImagePullBackOff`, `CrashLoopBackOff`, `Pending`
- Investigate: Resource constraints, missing dependencies
Service Unavailable
- Check: Service mesh logs (`logs/istio-system/`)
- Look for: Connection refused, timeout errors
- Investigate: Network policies, DNS resolution
Performance Degradation
- Check: `nodes.json` for resource usage
- Look for: High CPU/memory, disk I/O issues
- Investigate: Pod resource limits, node capacity
Authentication Failures
- Check: `logs/uipath/identity-*`
- Look for: Token validation errors, certificate issues
- Investigate: Certificate expiry, configuration mismatches
Useful Commands Reference
# Find all errors in the mentioned hour (adjust timestamp)
find logs/ -type f -exec grep -H "2026-01-23 08:" {} \; | grep -i error
# Count error occurrences
grep -r "specific error message" logs/ | wc -l
# List all pod restart counts
cat pods/*/*.yaml | grep -E "name:|restartCount:"
# Find failed pods
cat events/*.json | jq '.items[] | select(.reason=="Failed") | {pod: .involvedObject.name, message: .message}'