#!/bin/sh
Edition='HQ-basic'
Version='2025-08-06'
TMP=/tmp/collect
# Temp folder for collect contents and _must not_ exist.
# Report itself will be created under /tmp or $TMP/../ and _must_ exist.

if [ $(id -u) -ne 0 ]; then
	echo "This script requires root privileges in order to run!"
	ERROR=1
else
	SYSTEM_TYPE=$(uname | tr [:lower:] [:upper:])
	HOST_NAME=$(hostname | tr [:upper:] [:lower:])
	ERROR=0

	ACCEPT_EULA=n
	REMOTE_DIAG=n
	EXECNAME=${0##*/}
	
	ARGS=$(getopt --name "$EXECNAME" --options h --longoptions accept-eula,remote-diag -- "$@")
	eval set -- "$ARGS"

	while true;
	do
		case $1 in
			--accept-eula) ACCEPT_EULA="y";;
			--remote-diag) REMOTE_DIAG="y";;
			--)  shift; break;;
		esac
		shift
	done

	echo "
	----------------------------------------------------------------------------
	This script collects various system information about your linux/unix/mac host.
	This information is important for Kaspersky Support service.
	You would find the result at /tmp/%hostname%-%date%-collect.tar.gz
	
	PLEASE REMOVE EVERYTHING YOU CONSIDER CONFIDENTIAL BEFORE SENDING
	
	To find out what is collected you can open this script in a text editor and 
	read its comments.
	
	By continuing you agree to the End User License Agreement in license.rtf file
	which is distributed in the same archive with this script.
	
	Press [y] and [Enter] keys if you accept the End User License Agreement.
	----------------------------------------------------------------------------
	"
	if [ "$ACCEPT_EULA" = "y" -o "$ACCEPT_EULA" = "Y" ]; then
		echo "EULA pre-accepted"
	else
		read ACCEPT_EULA
		if [ "$ACCEPT_EULA" != "y" ] && [ "$ACCEPT_EULA" != "Y" ]; then
			echo "Must agree with EULA."
			exit 1
		fi
	fi

	mkdir $TMP
	if [ $? -ne 0 ]; then
		echo "Could not create target directory. Must specify non-existing folder under existing path"
		exit 1
	fi
    # Log all error during execution to clog
	exec 6>&2
	exec 2> $TMP/clog

	echo "Script version" $Edition $Version
	#echo $Version > $TMP/HQ-basic-version
	echo $Version > $TMP/$Edition.$Version.version

	echo -n "free space pre-check:" | tee -a $TMP/clog
	df -h $TMP | tail -n 1 | awk '{print " "$4" available in "$6" mount point"}'

	echo "collecting environment..." | tee -a $TMP/clog

	TMPE=$TMP/environment
	mkdir $TMPE
	# Save environment variables
	set > $TMPE/set.txt
	env > $TMPE/env.txt

	TMPK=$TMP/kaspersky
	mkdir $TMPK

	if [ "$SYSTEM_TYPE" = "DARWIN" ]; then
		# list jobs loaded into launchd
		launchctl list > $TMPE/launchctl.txt
		# get current memory usage information
		memory_pressure > $TMPE/memory.txt
		# list all mounts
		mount > $TMPE/hdd.txt
		# get free space on mounted file systems
		df -h >> $TMPE/hdd.txt
		# get free inodes on mounted file systems
		df -hi >> $TMPE/hdd.txt
		# diskutil
		diskutil info -all > $TMPE/diskutil.txt
		# get groups
		cp /etc/group $TMPE/group
		# list processes
		ps -ef > $TMPE/ps.txt
		# list processes
		top -l 1 > $TMPE/top.txt
		# OS/kernel version
		uname -a >> $TMPE/uname.txt
		# kernel parameters
		sysctl -a > $TMPE/sysctl.txt
		# currently open files
		lsof > $TMPE/lsof.txt
		# virtual memory statistics
		vm_stat > $TMPE/vmstat.txt
		# IO statistics
		iostat > $TMPE/iostat.txt
		# user limits
		ulimit -a > $TMPE/ulimit.txt
		# routing information
		netstat -nr > $TMPE/route.txt
		# network interfaces
		ifconfig > $TMPE/ifconfig.txt
		# time system running
		uptime > $TMPE/uptime.txt
		# hostname
		hostname -f > $TMPE/hostname.txt
		# hosts file
		cp /etc/hosts $TMPE
		# DNS configuration
		cp /etc/resolv.conf $TMPE
		# scheduled scripts
		cp -R /etc/periodic/ $TMPE
		# current time
		date > $TMPE/date.txt
		# check internet availability
		ping -c2 support.kaspersky.com > $TMPE/ping.txt
		# loaded kernel extensions
		kextstat > $TMPE/kextstat.txt
		# system hardware and software configuration
		system_profiler -detailLevel full -xml > $TMPE/system.spx
		# get status of Kaspersky components
		(kav status > $TMPK/kav_status.txt) & sleep 10 ; kill $! #limit the execution time as kav hangs from time to time
		# get product configuration file
		cp /Library/Application\ Support/Kaspersky\ Lab/KAV/Binaries/config.xml $TMPK/config.xml
		# Check Kaspersky Network Agent configuration
		/Library/Application\ Support/Kaspersky\ Lab/klnagent/Binaries/klnagchk > $TMPK/klnagchk.txt
		# copy KLNagent - product connectors 
		mkdir $TMPK/connectors
		cp -R /Library/Application\ Support/Kaspersky\ Lab/klnagent_conf/connectors.d/ $TMPK/connectors
		cp -R /Library/Application\ Support/Kaspersky\ Lab/klnagent_conf/connectors64.d/ $TMPK/connectors
		PRODVERSION=`ls $TMPK/connectors`
		grep ProductHotfix /Library/Application\ Support/Kaspersky\ Lab/KAV/Data/blregistry.xml | awk '{print $2}' >> $TMPK/connectors/$PRODVERSION
		# KLNagent Statistics
		dir=/Library/Application\ Support/Kaspersky\ Lab/klnagent/Data/1103/1.0.0.0/Statistics/AVState
		output_file="$TMPK/AVState.txt"
		echo > "$output_file"

		find "$dir" -maxdepth 1 -type f -print0 | while IFS= read -r -d $'\0' file; do
		    filename=$(basename "$file")
		    content=$(cat "$file")
		    echo "$filename : $content" >> "$output_file"
		done
		
		# list subdirecories of /Users
		dscl . list /Users | grep -v -e '^_' > $TMPE/users.txt
		# is user consent needed to install kernel extensions?
		spctl kext-consent status > $TMPE/kext_consent.txt
		# get current policy for kernel extensions (list kernel extensions that were allowed by user)
		sqlite3 -separator $'\t' -header /var/db/SystemPolicyConfiguration/KextPolicy "select * from kext_policy" > kext_policy.txt
		# get sudo security policy configuration
		cp /etc/sudoers $TMPE/sudoers.txt
		# get SSHD and systemd configuration options - for remote installation troubleshooting
		grep 'PasswordAuthentication\|ChallengeResponseAuthentication' /etc/ssh/sshd_config > $TMPE/klnagent.remote.txt
		grep 'KillUserProcesses\|KillExcludeUsers' /etc/systemd/logind.conf >> $TMPE/klnagent.remote.txt
		# OS version
		sw_vers > $TMPE/os_release.txt
		# list system extensions
		systemextensionsctl list > $TMPE/systemextensionsList.txt
		#FileVault status
		fdesetup status > $TMPE/FileVault.txt

	elif [ "$SYSTEM_TYPE" = "LINUX" ]; then
		# get systemd services information
		systemctl --full --all > $TMPE/systemctl.txt
		# hardware configuration
		lshw > $TMPE/lshw.txt
		# detailed CPU information
		cat /proc/cpuinfo > $TMPE/cpuinfo.txt
		# memory usage
		free -h > $TMPE/memory.txt
		# list mounts
		mount > $TMPE/hdd.txt
		# get free space on mounted file systems
		df -h >> $TMPE/hdd.txt
		# get free inodes on mounted file systems
		df -hi >> $TMPE/hdd.txt
		# get physical device information
		lsblk >> $TMPE/hdd.txt
		# get list of system users (no passwords included)
		cp /etc/passwd $TMPE/passwd
		# get list of system groups
		cp /etc/group $TMPE/group
		# process list
		ps axo state,pid,ppid,tid,pcpu,pmem,rsz,vsz,comm,cmd > $TMPE/ps.txt
		ps axo state,pid,ppid,tid,pcpu,pmem,rsz,vsz,comm,cmd -T > $TMPE/pst.txt
		pstree > $TMPE/pstree.txt
		top -b -n 1 -w 120 > $TMPE/top.txt
		top -bH -n 1 -w 120 > $TMPE/toph.txt
		# OS issue text (normally version)
		cat /etc/issue > $TMPE/uname.txt
		# kernel version information
		uname -a >> $TMPE/uname.txt
		# OS issue and release text (normally version)
		#ls /etc/issue /etc/*release /etc/*version > $TMPE/os_release.txt
		#cat /etc/issue /etc/*release /etc/*version >> $TMPE/os_release.txt
		for name in $(ls /etc/issue /etc/*release /etc/*version); do printf "\n$name\n" >> $TMPE/os_release.txt; cat $name >> $TMPE/os_release.txt; done
		# kernel parameters
		sysctl -a > $TMPE/sysctl.txt
		# SELinux status
		sestatus > $TMPE/sestatus.txt
		cp /etc/selinux/config	$TMPE/seconfig.txt
		# AppArmor status
		apparmor_status > $TMPE/app_armor.txt
		# loaded kernel modules
		lsmod > $TMPE/lsmod.txt
		# third party libraries
		cat /etc/ld.so.preload > $TMPE/ld.so.preload.txt
		# currently open files
		lsof -n > $TMPE/lsof.txt
		# inter-process communication status (active message queues, semaphore sets, shared memory segments)
		ipcs -a > $TMPE/ipcs.txt
		# virtual memory statistics
		vmstat 1 10 > $TMPE/vmstat.txt & vmstat -d 1 10 > $TMPE/vmstatd.txt & vmstat -m 1 10 > $TMPE/vmstatm.txt & iostat -xk 1 10 > $TMPE/iostat.txt
		# disk statistics
		vmstat -D > $TMPE/vmstatd2.txt
		# memory statistics
		vmstat -s > $TMPE/vmstats.txt
		# list installed rpm packages
		rpm -qa >> $TMPE/packages.txt
		# list installed dpkg packages
		dpkg -l >> $TMPE/packages.txt
		# list of repositories
		apt policy > $TMPE/repositories.txt
		dnf repolist all >> $TMPE/repositories.txt
		# python/python3 version
		echo "python --version: " > $TMPE/pythonvers.txt
		python --version >> $TMPE/pythonvers.txt
		echo "python3 --version: " >> $TMPE/pythonvers.txt
		python3 --version >> $TMPE/pythonvers.txt
		# pip3 packages
		pip3 list > $TMPE/pip3list.txt
		# user limits
		ulimit -a > $TMPE/ulimit.txt
		# systemd dumps listing
		coredumpctl list > $TMPE/coredumps.txt
		ls -la /var/lib/systemd/coredump >> $TMPE/coredumps.txt
		# system time sync settings
		timedatectl status > $TMPE/timedatectl.txt
		systemctl status systemd-timesyncd >> $TMPE/timedatectl.txt
		ls /etc/systemd/timesyncd.conf >> $TMPE/timedatectl.txt
		cat /etc/systemd/timesyncd.conf >> $TMPE/timedatectl.txt
		# routing information
		route -n > $TMPE/route.txt
		# network interfaces
		ifconfig >$TMPE/ifconfig.txt
		# network interfaces
		ip a > $TMPE/ipa.txt
		# network connections info
		netstat -apln > $TMPE/netstat.txt
		# list sockets
		ss -npatu > $TMPE/ss.txt
		# routing tables and rules
		ip -4 route ls > $TMPE/ipv4routes.txt
		ip -4 rule ls > $TMPE/ipv4rules.txt
		ip -6 route ls > $TMPE/ipv6routes.txt
		ip -6 rule ls > $TMPE/ipv6rules.txt
		# list iptables firewall rules
		#iptables -L > $TMPE/iptables.txt
		iptables -nvL -t filter > $TMPE/iptables-filter.txt
		iptables -nvL -t mangle > $TMPE/iptables-mangle.txt
		iptables -nvL -t nat > $TMPE/iptables-nat.txt
		iptables -nvL -t raw > $TMPE/iptables-raw.txt
		#ip6tables -L > $TMPE/ip6tables.txt
		ip6tables -nvL -t filter > $TMPE/ip6tables-filter.txt
		ip6tables -nvL -t mangle > $TMPE/ip6tables-mangle.txt
		ip6tables -nvL -t nat > $TMPE/ip6tables-nat.txt
		ip6tables -nvL -t raw > $TMPE/ip6tables-raw.txt
		# netfilter
		nft list ruleset > $TMPE/nft-ruleset.txt
		# ufw status
		ufw status verbose > $TMPE/ufwstatus.txt
		# list firewalld zones
		firewall-cmd --list-all-zones > $TMPE/firewalld.zones.txt
		# time system running, load average
		uptime > $TMPE/uptime.txt
		# get hostname
		hostname > $TMPE/hostname.txt
		hostnamectl status >> $TMPE/hostname.txt
		# get hosts file
		cp /etc/hosts $TMPE
		# DNS resolver configuration
		cp /etc/resolv.conf $TMPE
		# get Cron scheduled scripts
		cp -RL /etc/cron.d/ $TMPE
		cp -RL /etc/cron.daily/ $TMPE
		cp -RL /etc/cron.weekly/ $TMPE
		cp -RL /etc/cron.monthly/ $TMPE
		cp -RL /etc/cron.hourly/ $TMPE
		cp -R /etc/rsyslog.d/ $TMPE
		# rsyslog logging configuration
		cp /etc/rsyslog.conf $TMPE
		mkdir $TMPE/mta
		mkdir $TMPE/mta/postfix
		mkdir $TMPE/mta/sendmail
		# audit rules export
		mkdir $TMPE/audit
		cp /etc/audit/auditd.conf $TMPE/audit
		cp /etc/audit/audit.rules $TMPE/audit
		cp -R /etc/audit/rules.d $TMPE/audit/rules.d
		systemctl --all status auditd > $TMPE/audit/ctlstatus.txt
		journalctl -u auditd > $TMPE/audit/ctljournal.txt
		# get postfix configuration files
		cp /etc/postfix/*.cf $TMPE/mta/postfix/
		cp /etc/postfix/header_checks $TMPE/mta/postfix/
		# get sendmail configuration files
		cp /etc/mail/*.cf $TMPE/mta/sendmail/
		cp /etc/mail/*.mc $TMPE/mta/sendmail/
		# get exim configuration files
		cp -R /etc/exim4 $TMPE/mta/
		# crontab scheduled scripts
		cp /etc/crontab $TMPE
		# get listing of system directories
		ls -la / /tmp /opt /var /etc /usr /boot /bin > $TMPE/lsroot.txt
		ls -laL / /tmp /opt /var /etc /usr /boot /bin > $TMPE/lsroot-L.txt
		# get recursive listing of product directories
		ls -laR /opt/kaspersky > $TMPE/lskasp.txt
		ls -laR /var/opt/kaspersky >> $TMPE/lskasp.txt
		ls -laR /etc/opt/kaspersky >> $TMPE/lskasp.txt
		# get listing of system libs
		ls -la / /usr | grep lib > $TMPE/lslib.txt
		ls -laL /lib* >> $TMPE/lslib.txt
		ls -laL /usr/lib* >> $TMPE/lslib.txt
		# get current time
		date > $TMPE/date.txt
		LC_ALL=en_EN.utf8  date > $TMPE/date_en.txt
		# check if internet is available
		ping -c2 support.kaspersky.com > $TMPE/ping.txt
		# get sudo security policy configuration
		cp /etc/sudoers $TMPE/sudoers.txt
		# are filesystem wide access notifications enabled in kernel
		grep "CONFIG_FANOTIFY" /boot/config-$(uname -r) > $TMPE/fanotify.txt
		grep -E "TRACEPOINT|KPROBE" /boot/config-$(uname -r) > $TMPE/ebpf.txt
		cp /boot/config-* $TMPE/
		# get SSHD and systemd configuration options - for remote installation troubleshooting
		grep 'PasswordAuthentication\|ChallengeResponseAuthentication' /etc/ssh/sshd_config > $TMPE/klnagent.remote.txt
		grep 'KillUserProcesses\|KillExcludeUsers' /etc/systemd/logind.conf >> $TMPE/klnagent.remote.txt
		# Samba config
		testparm -s > $TMPE/smb.conf
		# cgroup list
		systemd-cgls -l > $TMPE/cgls.txt
		systemd-cgtop -b -n 1 > $TMPE/cgtop.txt
		
		# 3rd party configs
		if [ $(grep postgres $TMPE/packages.txt | wc -l) -ne 0 ]; then
			mkdir $TMPE/postgres
			cp /etc/postgresql/*/main/*.conf $TMPE/postgres/
			systemctl --all status "postgres*" > $TMPE/postgres/ctlstatus.txt
			journalctl -u "postgres*" > $TMPE/postgres/ctljournal.txt
		fi
		
		# OS specific
		if [ -f /sys/digsig/elf_mode ]; then
			echo "Astra Linux in Closed Software Environment mode:" > $TMPE/astrazps.txt 
			echo "" >> $TMPE/astrazps.txt 
			echo -n "/sys/digsig/elf_mode: " >> $TMPE/astrazps.txt && cat /sys/digsig/elf_mode >> $TMPE/astrazps.txt
			echo -n "/sys/digsig/xattr_mode: " >> $TMPE/astrazps.txt && cat /sys/digsig/xattr_mode >> $TMPE/astrazps.txt
			echo "" >> $TMPE/astrazps.txt
			echo "Note:" >> $TMPE/astrazps.txt
			echo "0 - CSE/ZPS disabled;" >> $TMPE/astrazps.txt
			echo "1 - CSE/ZPS enabled;" >> $TMPE/astrazps.txt
			echo "2 - CSE/ZPS debug;" >> $TMPE/astrazps.txt
	
			else
			echo "The system does not support Astra Linux Closed Software Environment mode;" > $TMPE/astrazps.txt 
		fi

		# Docker

		if which docker > /dev/null; then
			mkdir $TMPE/docker
			docker ps --all > $TMPE/docker/docker-ps.txt 2>&1
			docker info > $TMPE/docker/docker-info.txt 2>&1
			docker container ls --all > $TMPE/docker/container-ls.txt 2>&1
			docker inspect $(docker ps -a -q) > $TMPE/docker/inspect-ps.txt 2>&1
			docker inspect $(docker network ls -q) > $TMPE/docker/inspect-network.txt 2>&1
			docker inspect $(docker volume ls -q) > $TMPE/docker/inspect-volume.txt 2>&1
			docker inspect $(docker service ls -q) > $TMPE/docker/inspect-service.txt 2>&1
			docker service ps --no-trunc $(docker service ls -q) > $TMPE/docker/service-ps.txt 2>&1
			docker inspect $(docker node ls -q) > $TMPE/docker/inspect-node.txt 2>&1
			docker node ps --no-trunc  $(docker node ls -q) > $TMPE/docker/node-ps.txt 2>&1
		fi

		# Kaspersky product related stuff
			# various product configuration files
			cp -RL /etc/opt/kaspersky  $TMPK/etc
			cp -R /var/opt/kaspersky/lmc-agent $TMPK/
			cp -R /var/opt/kaspersky/lmc-server $TMPK/
			
			for d in $(find "/var/opt/kaspersky/klnagent/1103/1.0.0.0/Statistics/AVState" -maxdepth 1 -type f); do
				printf "$(basename $d) : $(cat $d)\n" >> $TMPK/klnagent_avstate.txt
			done
			
			# Check Kaspersky Network Agent configuration
			/opt/kaspersky/klnagent/bin/klnagchk -tl 5 -savecert $TMPK/klnagchk-cert  > $TMPK/klnagchk.txt
			cat $TMPK/klnagchk-cert | openssl x509 -text -noout > $TMPK/klnagchk-certinfo.txt
			/opt/kaspersky/klnagent64/bin/klnagchk -tl 5 -savecert $TMPK/klnagchk64-cert > $TMPK/klnagchk64.txt
			cat $TMPK/klnagchk64-cert | openssl x509 -text -noout > $TMPK/klnagchk64-certinfo.txt
			cp /var/opt/kaspersky/klnagent/log/\$klnagchk-klnagchk.log $TMPK
			systemctl status klnagent > $TMPK/klnagent_ctlstatus.txt
			systemctl cat klnagent > $TMPK/klnagent_ctlcat.txt
			journalctl -u "klnagent*" > $TMPK/klnagent_journal.txt
			for pid in $(pidof klnagent); do
				echo $pid >> $TMPK/klnagent_proc_fd.txt;
				ls -la /proc/$pid/fd >> $TMPK/klnagent_proc_fd.txt;
				echo $pid >> $TMPK/klnagent_proc_status.txt;
				cat /proc/$pid/status >> $TMPK/klnagent_proc_status.txt;
				echo $pid >> $TMPK/klnagent_proc_limits.txt;
				cat /proc/$pid/limits >> $TMPK/klnagent_proc_limits.txt;
			done
			# KSC version
			kscver=$(/opt/kaspersky/klnagent64/sbin/klscflag -ssvget -pv klnagent -s KLNAG_GLOBAL_SRVDATA_SECTION -n KLNAG_GLB_SRVDATA_SERVER_VERSION -ss "|ss_type = \"SS_GLBHST_PH\";" | egrep -o 'KLNAG_GLB_SRVDATA_SERVER_VERSION = \(INT_T\)[0-9]*')
			echo $kscver > $TMPK/klnagent_kscver.txt
			kscver=$(echo $kscver | egrep -o '[0-9]+')
			if [ $? -eq 0 ]; then
			echo $(($kscver/65536)).$(($kscver%65536/256)).$(($kscver%256)) >> $TMPK/klnagent_kscver.txt
			fi

			# Copy KSC, nagent and remote install logs
			#cp /tmp/*_install_script.log $TMPK # redundant and conflicted with cp kesl* in systems with 'cp' aliased to 'cp -i'
			cp /tmp/klnagent*.log $TMPK
			cp /tmp/kesl*.log $TMPK
			cp /tmp/kics*.log $TMPK
			cp /tmp/kess*.log $TMPK
			cp /tmp/akinstall*.log $TMPK
			cp /opt/kaspersky/klnagent64/sbin/*.log $TMPK/
		# KLMS
			# KLMS setup script choices
			cat /var/opt/kaspersky/klms/installer.dat | grep -v installation_id > $TMPK/installer.dat
			# postgres configuration file 
			cp /var/opt/kaspersky/klms/postgresql/postgresql.conf $TMPK/
			# KLMS settings export
			/opt/kaspersky/klms/bin/klms-control --export-settings -f $TMPK/klms8set.xml
			# KLMS rules export
			/opt/kaspersky/klms/bin/klms-control --export-rules -f $TMPK/klms8rules.xml
			# KLMS licenses
			/opt/kaspersky/klms/bin/klms-control -l --get-installed-keys > $TMPK/klms8.lic
			# KLMS dashboard statistics
			/opt/kaspersky/klms/bin/klms-control --dashboard --month > $TMPK/klms8.stats
			# gather sendmail utility information
			cp /opt/kaspesrky/klms/bin/sendmail $TMPK/
			SENDMAIL=$(which sendmail)
			echo "$SENDMAIL" >> $TMPK/lms-sm
			ls -l "$SENDMAIL" >> $TMPK/lms-sm
			ls -l /etc/alternatives >> $TMPK/lms-sm
			ls -l /opt/kaspesrky/klms/bin/sendmail >> $TMPK/lms-sm


		# KESL KICS KESS
			prods=""
			if [ $(grep kesl $TMPE/packages.txt | wc -l) -ne 0 ]; then
			prods="${prods} kesl"
			fi
			if [ $(grep kics $TMPE/packages.txt | wc -l) -ne 0 ]; then
			prods="${prods} kics"
			fi
			if [ $(grep kess $TMPE/packages.txt | wc -l) -ne 0 ]; then
			prods="${prods} kess"
			fi

			for prod in ${prods}; do
				if [ "$prod" = "kesl" ]; then
				TMPKPROD="${TMPK}/KESL"
				mkdir $TMPKPROD
				fi
				if [ "$prod" = "kics" ]; then
				TMPKPROD="${TMPK}/KICS"
				mkdir $TMPKPROD
				fi
				if [ "$prod" = "kess" ]; then
				TMPKPROD="${TMPK}/KESS"
				mkdir $TMPKPROD
				fi
				
				# Service status
				systemctl status $prod > $TMPKPROD/ctl_status.txt
				systemctl cat $prod > $TMPKPROD/ctl_cat.txt
				journalctl -u "${prod}*" > $TMPKPROD/ctl_journal.txt
				for pid in $(pidof $prod); do
					echo $pid >> $TMPKPROD/proc_fd.txt;
					ls -la /proc/$pid/fd >> $TMPKPROD/proc_fd.txt;
					echo $pid >> $TMPKPROD/proc_status.txt;
					cat /proc/$pid/status >> $TMPKPROD/proc_status.txt;
					echo $pid >> $TMPKPROD/proc_limits.txt;
					cat /proc/$pid/limits >> $TMPKPROD/proc_limits.txt;
				done
				# copy events database
				# disabled legacy locations and symlinks
				#cp /var/opt/kaspersky/$prod/events.db $TMPKPROD/
				#cp /var/opt/kaspersky/$prod/private\ storage/events.db $TMPKPROD/
				#cp /var/opt/kaspersky/$prod/install-current/var/opt/kaspersky/$prod/private/storage/events.db $TMPKPROD/
				cp /var/opt/kaspersky/$prod/private/storage/events.db* $TMPKPROD/
				cp -R /var/opt/kaspersky/$prod/private/storage/kvdb $TMPKPROD/kvdb
				cp -R /var/opt/kaspersky/$prod/private/storage/kvdb-user $TMPKPROD/kvdb-user
				# general application information and extended metrics
				/opt/kaspersky/$prod/bin/$prod-control --app-info > $TMPKPROD/appinfo.txt
				/opt/kaspersky/$prod/bin/$prod-control --get-statistic > $TMPKPROD/getstat.txt
				/opt/kaspersky/$prod/bin/$prod-control --get-categories > $TMPKPROD/categories.txt
				/opt/kaspersky/$prod/bin/$prod-control --supported-tech-info > $TMPKPROD/supportedtech.txt
				/opt/kaspersky/$prod/bin/$prod-control --export-metrics > $TMPKPROD/exportmetrics.txt
				# non-root permission checker
				echo "Dir check:" >> $TMPKPROD/rootperm.txt
				ls -lLd / /var /var/opt /var/opt/kaspersky /opt /opt/kaspersky /opt/kaspersky/klnagent64 /opt/kaspersky/klnagent64/sbin /opt/kaspersky/klnagent64/sbin/klnagent /usr /usr/lib64 /usr/bin/$prod-control | egrep -v '^.{5}-.{2}-.*root *root' >> $TMPKPROD/rootperm.txt
				echo "libs:" >> $TMPKPROD/rootperm.txt
				for d in $(cat /proc/$(pidof -s $prod)/maps | awk '{print $6}' | grep ^/ | grep -v 'kaspersky' | sort | uniq); do ls -la $d | egrep -v '^-.{4}-.{2}-.*root root'; done >> $TMPKPROD/rootperm.txt
				echo "gui libs:" >> $TMPKPROD/rootperm.txt
				for d in $(cat /proc/$(pidof -s $prod-gui)/maps | awk '{print $6}' | grep ^/ | grep -v 'kaspersky' | sort | uniq); do ls -la $d | egrep -v '^-.{4}-.{2}-.*root root'; done >> $TMPKPROD/rootperm.txt
				echo "nagent libs:" >> $TMPKPROD/rootperm.txt
				for d in $(cat /proc/$(pidof -s klnagent)/maps | awk '{print $6}' | grep ^/ | grep -v 'kaspersky' | sort | uniq); do ls -la $d | egrep -v '^-.{4}-.{2}-.*root root'; done >> $TMPKPROD/rootperm.txt
				echo "connection errors:" >> $TMPKPROD/rootperm.txt
				($prod-control -E --query "EventType=='RemoteConnectionRejected'" | egrep "RemoteConnectionRejected|Reason|Path|Process" | sort --unique) >> $TMPKPROD/rootperm.txt 2>&1
				echo "Process|Reason|Path" >> $TMPKPROD/rootperm.txt
				sqlite3 $TMPKPROD/events.db 'SELECT DISTINCT Process, Reason, Path FROM events WHERE EventType=134;' >> $TMPKPROD/rootperm.txt
				# license
				/opt/kaspersky/$prod/bin/$prod-control -L --query > $TMPKPROD/license.txt
				# settings export
				/opt/kaspersky/$prod/bin/$prod-control --export-settings > $TMPKPROD/expset.txt
				/opt/kaspersky/$prod/bin/$prod-control --get-app-set > $TMPKPROD/appset.txt
				/opt/kaspersky/$prod/bin/$prod-control --get-net-set > $TMPKPROD/netset.txt
				# task list
				/opt/kaspersky/$prod/bin/$prod-control --get-task-list > $TMPKPROD/tasklist.txt
				# task settings
				for i in $($prod-control --get-task-list | egrep '(ID|Идентификатор)' | awk '{print $3}'); do echo 'TaskID '$i $($prod-control --get-task-list | grep -w -B1 $i | egrep '(Name|Имя|Nom)' | awk '{print $2}') 'configuration:' >> $TMPKPROD/taskset$i.txt; $prod-control --get-settings $i >> $TMPKPROD/taskset$i.txt; printf '\n' >> $TMPKPROD/taskset$i.txt; cat $TMPKPROD/taskset$i.txt >> $TMPKPROD/taskset.all.txt; done
				# host Device list, App list
				/opt/kaspersky/$prod/bin/$prod-control --get-device-list > $TMPKPROD/devlist.txt
				/opt/kaspersky/$prod/bin/$prod-control --get-app-list > $TMPKPROD/applist.txt
				# update log
				/opt/kaspersky/$prod/bin/$prod-control -E --query "TaskType == 'Update'" > $TMPKPROD/updateLog.txt
				# get recursive listing of product directory
				ls -la /var/opt/kaspersky/$prod > $TMPKPROD/listing.txt
				find /var/opt/kaspersky/$prod/ >> $TMPKPROD/listing.txt
				# various configs of interest
				cp /var/opt/kaspersky/$prod/private/exported_settings.ini $TMPKPROD/
				cp /var/opt/kaspersky/$prod/private/storage/appSettings.xml $TMPKPROD/
				cp /var/opt/kaspersky/$prod/common/$prod.ini $TMPKPROD/
				cp /var/opt/kaspersky/$prod/common/agreements.ini $TMPKPROD/
				health_log=$(grep 'ProductHealthLogFile' "/var/opt/kaspersky/${prod}/common/${prod}.ini" | awk -F'=' '{print $2}')
				if [ -f "$health_log" ]; then
					cp $health_log $TMPKPROD/
				fi
				# module dependencies
				echo "$prod" > $TMPKPROD/ldd.txt
				ldd /opt/kaspersky/$prod/libexec/$prod >> $TMPKPROD/ldd.txt
				echo "$prod-gui" >> $TMPKPROD/ldd.txt
				ldd /opt/kaspersky/$prod/libexec/$prod-gui >> $TMPKPROD/ldd.txt
				echo "$prod-control" >> $TMPKPROD/ldd.txt
				ldd /opt/kaspersky/$prod/bin/$prod-control >> $TMPKPROD/ldd.txt
			done
		# LENA
		if [ $(grep epagent $TMPE/packages.txt | wc -l) -ne 0 ]; then
			mkdir $TMPK/LENA
			cp -R /var/opt/kaspersky/epagent $TMPK/LENA/var-epagent
			cp -R /etc/opt/kaspersky/epagent $TMPK/LENA/etc-epagent
			cp -R /var/log/audit $TMPK/LENA/auditlog
			cp -R /tmp/agentdumps $TMPK/LENA/agentdumps
			fuser /run/log/audit-messages | awk '{print $1,$2}' | xargs ps -p > $TMPK/LENA/messages-pids.txt
		fi
		#KPSN detection and response
		if [ $(grep kpsn $TMPE/packages.txt | wc -l) -ne 0 ]; then 
			# components status
			monit status > $TMPK/monit.txt
			runuser -l ksnuser -c 'monit status' >> $TMPK/monit.txt
			mkdir $TMPK/KPSN/
			mkdir $TMPK/KPSN/pubdata/
			mkdir $TMPK/KPSN/gateway/
			mkdir $TMPK/KPSN/etc/
			# KPSN listings
			ls -laR /usr/local/kpsn /usr/local/ksn > $TMPK/KPSN/lskpsn.txt
			# product logs
			#find /usr/local/ksn/log/ -type f -newermt $(date +%Y-%m-%d -d '-3 days') -printf "%f\n" -exec cp {} $TMPK/KPSN/ >/dev/null 2>&1 \;
			cp -R /usr/local/ksn/log/ $TMPK/KPSN
			# apache logs
			cp -R /var/log/apache/ $TMPL
			cp -R /var/log/httpd/ $TMPL
			# product configuration
			cp -R /usr/local/ksn/var/pubdata/ $TMPK/KPSN
			cp -R /usr/local/ksn/var/gateway/ $TMPK/KPSN
			cp -R /usr/local/ksn/etc/ $TMPK/KPSN
			# python packages
			pip list > $TMPK/KPSN/pip.txt
		fi
		# ScanEngine
			cp /etc/klScanEngineUI.xml $TMPK/scanengine.klScanEngineUI.xml
			cp /etc/kavhttpd.xml $TMPK/scanengine.kavhttpd.xml
			cp /etc/kavicapd.xml $TMPK/scanengine.kavicapd.xml
			cp /opt/kaspersky/ScanEngine/version $TMPK/scanengine.version
			cp /opt/kaspersky/ScanEngine/bin/bases/data/u1313g.xml $TMPK/scanengine.u1313g.xml
			sudo -u postgres pg_dump -f /tmp/kavbase.sql -d kavebase
			mv /tmp/kavbase.sql $TMPK/scanengine.kavbase.sql
		# KSC Linux Administration Server
		if [ $(grep ksc64 $TMPE/packages.txt | wc -l) -ne 0 ]; then
			mkdir $TMPK/KSC
			# KSC install and service logs
			cp /tmp/ksc*.log $TMPK/KSC
			cp /tmp/kl*.log $TMPK/KSC
			cp /tmp/\$kl*.log $TMPK/KSC
			cp /tmp/\$ksn*.log $TMPK/KSC
			cp /tmp/\$vapm*.log $TMPK/KSC
			cp /tmp/\$up2date*.log $TMPK/KSC
			# KSC kuu logs
			cp /opt/kaspersky/ksc64/kuu/report.txt $TMPK/KSC/kuu.report.txt
			cp /opt/kaspersky/ksc64/kuu/trace.log $TMPK/KSC/kuu.trace.log
			cp /opt/kaspersky/ksc64/kuu/updater.ini $TMPK/KSC/kuu.updater.ini
			# Common issues
			/opt/kaspersky/ksc64/sbin/klscflag -ssvget -pv klserver -s KLSRV_DEF_NAGENT_PACKAGE -ss "|ss_type = \"SS_SETTINGS\";" > $TMPK/KSC/flag.address.txt
			# DB settings
			mkdir $TMPK/KSC/MariaDB
			cp /etc/mysql/my.cnf $TMPK/KSC/MariaDB/
			mkdir $TMPK/KSC/PostgreSQL
			cp /etc/postgresql/*/main/*.conf $TMPK/KSC/PostgreSQL/
			journalctl -u "KSC*" -u "kl*" > $TMPK/KSC/journalKSC.txt
			journalctl -u "postgresql" -u "mariadb" -u "mysql" > $TMPK/KSC/journalDB.txt
			for i in $(systemctl list-units -t service --full -all --plain --no-legend | egrep '(^KSC|^kl|postgresql|mariadb|mysql)' | awk '{ print $1 }'); do systemctl status $i >> $TMPK/KSC/ctlstatus_$i.txt; printf "\n-----$i\n" >> $TMPK/KSC/ctlcat.txt; systemctl cat $i >> $TMPK/KSC/ctlcat.txt; done

			for pid in $(pidof klserver); do
				echo $pid >> $TMPK/KSC/proc_fd.txt;
				ls -la /proc/$pid/fd >> $TMPK/KSC/proc_fd.txt;
				echo $pid >> $TMPK/KSC/proc_status.txt;
				cat /proc/$pid/status >> $TMPK/KSC/proc_status.txt;
				echo $pid >> $TMPK/KSC/proc_limits.txt;
				cat /proc/$pid/limits >> $TMPK/KSC/proc_limits.txt;
			done
		fi
		# KSC Linux Web Console
		if [ $(grep ksc-web-console $TMPE/packages.txt | wc -l) -ne 0 ]; then
			# Web console logs
			mkdir $TMPK/KSC-web-console
			cp -R /var/opt/kaspersky/ksc-web-console/logs/ $TMPK/KSC-web-console
			cp /etc/ksc-web-console-setup.json $TMPK/KSC-web-console
			cp /var/opt/kaspersky/ksc-web-console/server/config.json $TMPK/KSC-web-console
		fi
		# KUMA
		if [ $(grep kuma- $TMPE/systemctl.txt | wc -l) -ne 0 ]; then
			# KUMA satellites logs
			mkdir $TMPK/KUMA
			mkdir $TMPK/KUMA/clickhouse
			cp -R /opt/kaspersky/kuma/clickhouse/logs/ $TMPK/KUMA/clickhouse
			cp -R /opt/kaspersky/kuma/clickhouse/cfg/ $TMPK/KUMA/clickhouse
			mkdir $TMPK/KUMA/grafana
			cp -R /opt/kaspersky/kuma/grafana/data/log/ $TMPK/KUMA/grafana
			mkdir $TMPK/KUMA/mongodb
			mkdir $TMPK/KUMA/mongodb/log
			cp /opt/kaspersky/kuma/mongodb/log/mongod.log $TMPK/KUMA/mongodb/log
			mkdir $TMPK/KUMA/journals
			journalctl -u "kuma*" > $TMPK/KUMA/journals/all.txt
			for i in $(systemctl list-units -t service --full --all --plain --no-legend | grep kuma- | awk '{ print $1 }'); do systemctl status $i >> $TMPK/KUMA/services.txt; done
			for i in $(systemctl list-units -t service --full --all --plain --no-legend | grep kuma- | awk '{ print $1 }'); do journalctl -u $i > $TMPK/KUMA/journals/$i.log; done	
			/opt/kaspersky/kuma/kuma version > $TMPK/KUMA/execvers.txt
			kumalogs="$(find /opt/kaspersky/kuma/core/log/* /opt/kaspersky/kuma/core/*/log/core /opt/kaspersky/kuma/storage/*/log/storage /opt/kaspersky/kuma/collector/*/log/collector /opt/kaspersky/kuma/correlator/*/log/correlator /opt/kaspersky/kuma/eventrouter/log/* /opt/kaspersky/kuma/metrics/*/log/* -type f)"
			tar cfh $TMPK/KUMA/logs.tar $kumalogs
			# KUMA services and resources export
			/opt/kaspersky/kuma/mongodb/bin/mongo kuma --eval 'db.resources.find({"kind":"storage"}).forEach(printjson)' | sed '1,4d' > $TMPK/KUMA/resources.json
			/opt/kaspersky/kuma/mongodb/bin/mongo kuma --eval 'db.services.find({"kind":"storage"}).forEach(printjson)' | sed '1,4d' > $TMPK/KUMA/services.json
		fi
		
		# Antimalware report
		mkdir $TMPE/avz
			# System autorun
			mkdir $TMPE/avz/system
			cp -L /etc/X11/xinit/xinitrc $TMPE/avz/system/
			cp -L /etc/X11/xinit/xserverrc $TMPE/avz/system/
			cp -L /etc/anacrontab $TMPE/avz/system/
			cp -L /etc/bash.bash_logout $TMPE/avz/system/
			cp -L /etc/bash.bashrc $TMPE/avz/system/
			cp -L /etc/bash.bashrc $TMPE/avz/system/
			cp -LR /etc/incron.d/ $TMPE/avz/system/
			cp -LR /etc/init.d/ $TMPE/avz/system/
			cp -L /etc/inittab $TMPE/avz/system/
			cp -L /etc/ld.so.conf $TMPE/avz/system/
			cp -LR /etc/ld.so.conf.d/ $TMPE/avz/system/
			cp -L /etc/ld.so.preload $TMPE/avz/system/
			cp -L /etc/modules $TMPE/avz/system/
			cp -LR /etc/modules-load.d/ $TMPE/avz/system/
			cp -L /etc/profile $TMPE/avz/system/
			cp -LR /etc/profile.d/ $TMPE/avz/system/
			cp -L /etc/rc.boot $TMPE/avz/system/
			cp -L /etc/rc.local $TMPE/avz/system/
			cp -LR /etc/systemd/system/ $TMPE/avz/system/etc-systemd
			cp -L /etc/systemd/system.conf $TMPE/avz/system/
			cp -LR /etc/udev/rules.d/ $TMPE/avz/system/
			cp -LR /etc/update-motd.d/ $TMPE/avz/system/
			cp -LR /etc/update.d/ $TMPE/avz/system/
			cp -LR /etc/xdg/autostart/ $TMPE/avz/system/
			cp -L /etc/xdg/lxsession/LXDE/autostart $TMPE/avz/system/
			cp -LR /lib/systemd/system/ $TMPE/avz/system/lib-systemd
			cp -LR /var/run/motd.d/ $TMPE/avz/system/
			cp -LR /var/spool/anacron/ $TMPE/avz/system/
			cp -L /var/spool/cron/atjobs $TMPE/avz/system/
			cp -LR /var/spool/cron/crontabs/ $TMPE/avz/system/
			cp -LR /var/spool/incron/ $TMPE/avz/system/
			# User autorun
			list="$(find /home/*/.bash_login /home/*/.bash_logout /home/*/.config/lxsession/LXDE/autostart /home/*/.config/lxsession/Lubuntu/autostart /home/*/.config/systemd/user/ /home/*/.profile /home/*/.xinitrc /home/*/.bash_profile /home/*/.bashrc /home/*/.config/autostart /root/.bash_login /root/.bash_logout /root/.config/lxsession/LXDE/autostart /root/.config/lxsession/Lubuntu/autostart /root/.config/systemd/user/ /root/.profile /root/.xinitrc /root/.bash_profile /root/.bashrc /root/.config/autostart -type f)"
			tar cfh $TMPE/avz/users.tar $list
			# Units
			systemctl status > $TMPE/avz/ctlstatus.txt
			systemctl list-timers --all > $TMPE/avz/ctltimers.txt
			systemd-analyze unit-paths > $TMPE/avz/unit-paths.txt
			systemd-analyze unit-paths --user > $TMPE/avz/unit-paths-user.txt
			#getcap -r / 2>/dev/null > $TMPE/avz/getcap.txt
			echo "getcap -r This was disabled due to long execution time" > $TMPE/avz/getcap.txt
			#find / -type f -perm -u=s 2>/dev/null > $TMPE/avz/findperm.txt
			echo "find / -type f -perm -u=s This was disabled due to long execution time" > $TMPE/avz/findperm.txt
			# Modules
			find /lib/modules -printf "%M\t%u\t%g\t%s\t%AY-%Am-%Ad-%AH:%AM\t%CY-%Cm-%Cd-%CH:%CM\t%TY-%Tm-%Td-%TH:%TM\t%P\n" > $TMPE/avz/modules.txt

	elif [ "$SYSTEM_TYPE" = "FREEBSD" ]; then
	    # mounts
        mount > $TMPE/hdd.txt
        # free space
        df -h >> $TMPE/hdd.txt
        # free inodes
        df -hi >> $TMPE/hdd.txt
        # list of users
        cp /etc/passwd $TMPE/passwd
        # list of groups
        cp /etc/group $TMPE/group
        # status of linked files into kernel
        kldstat > $TMPE/kldstat.txt
        # inter-process communication status (active message queues, semaphore sets, shared memory segments)
        ipcs -a > $TMPE/ipcs.txt
        # proccess list
		top -d1 > $TMPE/top.txt
		# virtual memory statistics
        vmstat -a > $TMPE/vmstata.txt
        # forks
		vmstat -f > $TMPE/vmstatf.txt
		# interrupts
		vmstat -i > $TMPE/vmstati.txt
		# dynamic memory
		vmstat -m > $TMPE/vmstatm.txt
		# kernel state variables
		sysctl -a > $TMPE/sysctl.txt
		# proccess list
		ps axo comm,user,group,state,rss,vsz,pcpu,pmem,time,command >  $TMPE/ps.txt
		# user limits
        ulimit -a > $TMPE/ulimit.txt
        # list open files
		fstat > $TMPE/fstat.txt
		# sockets
		netstat -na > $TMPE/nestat.txt
		# routing table
		netstat -r > $TMPE/route.txt
		# IO statistics
		iostat -xc 3 > $TMPE/iostat.txt
		# packages list
		pkg_info > $TMPE/pkgi1.txt
		echo "N" | pkg info > $TMPE/pkgi2.txt
		# firewall state
		ipfw show  > $TMPE/ipfw.txt
		# time running from boot
        uptime > $TMPE/uptime.txt
        # hostname
        hostname > $TMPE/hostname.txt
        # hosts file
        cp /etc/hosts $TMPE
        # DNS configuration
        cp /etc/resolv.conf $TMPE
        # get network interfaces
        ifconfig > $TMPE/ifconfig.txt
        # periodic jobs
        cp -R /etc/periodic $TMPE
        cp /etc/crontab $TMPE
        # listing of core directories
	ls -la / /tmp /usr/local /var /etc  > $TMPE/lsroot.txt
	# recursive listing of product directories
	ls -laR /usr/local/kaspersky /var/db/kaspersky > $TMPE/lskasp.txt
        # current date
        date > $TMPE/date.txt
        # check if internet is available
        ping -c2 support.kaspersky.com > $TMPE/ping.txt
        # product configuration files
		cp -R /usr/local/etc/kaspersky/klms  $TMPK/etc
		cp /var/db/kaspersky/klms/postgresql/postgresql.conf $TMPK/
		# export of KLMS settings
		klms-control --export-settings -f $TMPK/klms8set.txt
		# export of KLMS rules
		klms-control --export-rules -f $TMPK/klms8rules.xml
		# KLMS license information
		klms-control -l --get-installed-keys > $TMPK/klms8.lic
		# KLMS detection statistics
		klms-control --dashboard --month > $TMPK/klms8.stats
		# sendmail utility information
        SENDMAIL=$(which sendmail)
        echo "$SENDMAIL" >> $TMPK/lms-sm
        ls -l "$SENDMAIL" >> $TMPK/lms-sm
		ls -l /usr/sbin/mailwrapper >> $TMPK/lms-sm
	fi

	echo "logs..." | tee -a $TMP/clog

	TMPL=$TMP/logs
	mkdir $TMPL
	
	# kernel ring buffer / system message buffer
	dmesg > $TMPL/dmesg.txt
	dmesg -T > $TMPL/dmesgt.txt
	ls -laR /var/log/ > $TMPL/log_list.txt

	if [ "$SYSTEM_TYPE" = "DARWIN" ]; then
		# system logs
		#tail -1000 /var/log/mail.log > $TMPL/mail.log.txt
		#tail -3000 /var/log/system.log > $TMPL/system.log
		cp /var/log/system.log* $TMPL/
		cp /var/log/install.log $TMPL/install.log
		# product logs
		#cp /var/log/kav_daemon_stderr.log $TMPL/kav_daemon_stderr.log
		cp /var/log/kav_daemon*.log $TMPL/
		#cp /var/log/kav_daemon_stdout.log $TMPL/kav_daemon_stdout.log
		cp /var/log/klnagent_daemon*.log $TMPL/
		cp /var/log/kav_sysextctrld_stderr.log $TMPL/kav_sysextctrld_stderr.log
		cp /var/log/kav_sysextctrld_stdout.log $TMPL/kav_sysextctrld_stdout.log
		# product traces
		mkdir $TMPL/mac_traces
		mkdir $TMPL/mac_traces/copy
		mkdir $TMPL/mac_traces/ucopy
		cp /Library/Logs/klnagent_trace.log $TMPL/klnagent_trace.log
		cp /Library/Application\ Support/Kaspersky\ Lab/klnagent/Binaries/$klnagent-1103.log $TMPL/klnagent-trace.log
		cp -R /Library/Logs/Kaspersky\ Lab/* $TMPL/mac_traces/copy
		cp -R ~/Library/Logs/Kaspersky\ Lab/* $TMPL/mac_traces/ucopy
		for pathname in /Users/*/Library/Logs/Kaspersky\ Lab/*; do
			ndir=$(echo $TMPL/mac_traces/fcopy/$( dirname -- "$pathname" ) |  sed 's/ /\ /g')
			mkdir -p "$ndir"
			cp -i -- "$pathname" "$ndir/$( basename -- "$pathname" )"
		done
		# crash reports
		cp -R /Library/Logs/DiagnosticReports/ $TMPL/DiagnosticReports/;
		cp -R ~/Library/Logs/DiagnosticReports/ $TMPL/DiagnosticReports/;
		# system logs
		log show --debug --predicate 'subsystem == "com.kaspersky.kav.sysext"'  --last 10m --info > $TMPL/logShowKavSysExt.txt
		log show --debug --last 30m --info > $TMPL/logShow30min.txt
		# product events
		cp /Library/Application\ Support/Kaspersky\ Lab/KAV/Data/reports.db* $TMPL/


	elif [ "$SYSTEM_TYPE" = "LINUX" ]; then
		# system logs
		tail -10000 /var/log/maillog > $TMPL/maillog.txt
		tail -10000 /var/log/mail.log > $TMPL/mail.log.txt
		tail -10000 /var/log/mail.err > $TMPL/mail.err.txt
		tail -10000 /var/log/mail.warn > $TMPL/mail.warn.txt
		tail -50000 /var/log/syslog > $TMPL/syslog.txt
		tail -10000 /var/log/boot.log > $TMPL/bootlog.txt
		tail -10000 /var/log/kern.log > $TMPL/kernlog.txt
		tail -n10 /var/log/upstart/*.log > $TMPL/upstartlog.txt
		tail -50000 /var/log/messages > $TMPL/messages.txt
		tail -10000 /var/log/dmesg > $TMPL/dmesg.log.txt
		tail -10000 /var/log/audit/audit.log > $TMPL/audit.log.txt
		tail -10000 /var/log/ufw.log > $TMPL/ufw.log.txt
		# product logs
		cp -R /var/log/kaspersky/ $TMPL
		# system logs
		journalctl -n 50000 > $TMPL/journal.txt
		journalctl -p 4 -n 10000 > $TMPL/journal.4.txt
		journalctl -o verbose -p 4 -n 100 > $TMPL/journal.v.4.txt
		# KESL/KICS/KESS crash dumps
		#gathering dependencies
		get_deps()
		{
			ldd "$1" 2>/dev/null | grep '=>' | grep -v 'kaspersky' | awk '{print $3}' | grep '^/' | grep "$2"
		}
		#gathering additional dependant libraries
		collect_dumps()
		{
			dst_dir="$1"
			product="$2"
			exe="/opt/kaspersky/${product}/libexec/${product}"
			version="$(readlink /var/opt/kaspersky/${product}/install-current | grep -o ^.*_ | sed s/_//)"

			arch='unknown'
			case "$(file ${exe})" in
				*aarch64*) arch='arm64' ;;
				*x86-64*)  arch='64' ;;
				*32-bit*)  arch='32' ;;
			esac

			libcontainers="$(find /opt/kaspersky/${product}/lib${arch}/ -name libcontainers.so)"
			libinstrumental_services="$(find /opt/kaspersky/${product}/lib${arch}/ -name libinstrumental_services.so)"

			libs="$(get_deps ${exe})"
			libz="$(get_deps $libcontainers libz)"
			libresolv="$(get_deps $libinstrumental_services libresolv)"

			interp="$(ldd ${exe} | grep -Ev 'vdso|=>' | awk '{print $1}')"

			comcache="$(ls /var/opt/kaspersky/${product}/common/updates/cache/* 2> /dev/null)"
			privcache="$(ls /var/opt/kaspersky/${product}/private/updates/cache/* 2> /dev/null)"
			#dumps="$(ls /var/opt/kaspersky/${product}/common/dumps*/* 2>/dev/null)"
			#probably also intended to gather gui dumps, but ls does not work with subdirs, use find instead
			dumps="$(find /var/opt/kaspersky/${product}/common/dumps* -type f 2> /dev/null)"
			#klnagent="$(ls /opt/kaspersky/klnagent*/sbin/* 2>/dev/null)"

			#archiving collected data
			tar cfh "${dst_dir}/${product}_${version}_${arch}.tar" $libs $libz $libresolv $interp $comcache $privcache $dumps $klnagent
		}
		# checking if there are some dumps
		for product in kesl kics kess; do
			if [ $(find /var/opt/kaspersky/${product}/common/dumps* -type f 2> /dev/null | wc -l) -gt 0 ]; then
				#dumps found, gathering extra information
				mkdir -p $TMP/libs_and_dumps
				collect_dumps "$TMP/libs_and_dumps" "${product}"
			fi
		done
		
	elif [ "$SYSTEM_TYPE" = "FREEBSD" ]; then
	    # system logs
		tail -1000 /var/log/maillog > $TMPL/maillog.txt
		tail -1000 /var/log/messages > $TMPL/messages.txt
		dmesg > $TMPL/dmesg.txt
		# product logs
		cp -R /var/log/kaspersky/ $TMPL
	fi

	if [ -d "$TMP" ]; then
		echo -n "$TMP unpacked size: " | tee -a $TMP/clog
		du -sh "$TMP" | awk '{print $1}'| tee -a $TMP/clog
	fi

	report="$TMP/../$HOST_NAME-$(date +%Y-%m-%d_%H-%M)_collect.tar.gz"
	if [ "$REMOTE_DIAG" = "y" ]; then
		echo -n "Looking for remote diag utility result folder... "
		if [ -d "$KLACDT_SAVE_SETTINGS" ]; then
			echo "Found"
			echo "Report will be gathered remotely"
			report="$KLACDT_SAVE_SETTINGS/$HOST_NAME-$(date +%Y-%m-%d_%H-%M)_collect.tar.gz"
		else
			echo "Not found"
			echo "Report will be created in default folder"
		fi
	fi

	echo -n "packing... " | tee -a $TMP/clog	
	tar czf $report $TMP

	report_result="$?"
	if [ -f "$report" ]; then
		echo -n "packed size: "
		du -sh "$report" | awk '{print $1}'
	fi

	echo -n "free space post-check:"
	df -h $TMP | tail -n 1 | awk '{print " "$4" available in "$6" mount point"}'

	echo "cleaning..."
	rm -rf $TMP

	if [ $report_result -eq 0 ]; then
		echo "All done!"
	else
		echo "packing finished with error $report_result. No space left on device?"
	fi

	echo -n "Report name: "
	basename $report

	exec 2>&6 6>&-

fi

exit $ERROR

