Access logs and log bundles

In Cortex XSOAR 8.10 On-prem, access logs and log bundles for troubleshooting.

Logs provide information about events that occur in the system. They are a valuable tool in troubleshooting issues that might arise in your Cortex XSOAR environment. If you need additional help to find the source of an issue, you can download the log bundle to send to support or engineering or to attach to a support ticket to facilitate the troubleshooting process.

Note

You need viewer SSH user permissions to view and download logs.

Once Cortex XSOAR is installed and running, you can view system status and download log bundles from the Cortex XSOAR UI. If you encounter issues during installation or if Cortex XSOAR is not running, you can access logs and log bundles from the textual UI menu.

View logs and download log bundles from the textual UI

1. If the textual UI is not already open, either launch the web console from your VM or SSH log in from an external terminal. For more information, see Troubleshoot your installation.

   

   opp-logs.png
2. To see the logs, in the textual UI menu, select View Logs.

   These logs are not related to any user session in Cortex XSOAR.
3. To download a log bundle, in the textual UI menu, select Log Bundle.

   The viewer user can use scp/sftp to download the log bundle to their home directory.

View system status and download log bundles from Cortex XSOAR

1. In Cortex XSOAR, navigate to Settings & Info → System → System Diagnostics.

   The System Diagnostics page provides system status data over time in the form of graph and table widgets.

   

   opp-system-diagnostics.png

System status details

The graphs and tables in the System Diagnostics page show the following data. This information can help troubleshoot system performance issues. If you need additional help to find the source of the issue, you can download the log bundle to send to support or engineering or to attach to a support ticket.

Widget	Description
Nodes - CPU	A trend graph showing CPU consumption. The graph shows an increase as system usage increases. Temporary peaks may indicate system delays or slowness. We recommend increasing CPU resources when you reach system limits.
Active Nodes Snapshot	A list of all active nodes and their statuses. Possible values are Connected or Disconnected.
Storage Groups	A trend graph showing storage group utilization. The graph shows an increase as storage usage increases. A rapid surge in storage utilization may indicate a change in system usage. We recommend either increasing storage capacity or performing a data cleanup when utilization reaches 80%.
Nodes Memory	A trend graph showing memory consumption. The graph shows an increase as memory usage increases. Temporary peaks may indicate system delays or slowness. We recommend increasing memory resources when you reach system limits.
XSOAR Components Snapshot	A table showing the status of Cortex XSOAR components. Possible values are Healthy, Warning, or Error. If you see a warning or error for a Cortex XSOAR component, we recommend you: Check cluster health graphs for temporary peaks or high resource utilization. Check storage utilization graphs. If you have recently made changes to your system, verify if these changes have impacted system components. Open a support case if you cannot find the source of the issue.
Playbooks in Queue	A graph that includes both manually triggered and automatically triggered playbooks and displays how many playbooks were waiting in the queue over the displayed time period. Playbook queues manage playbook executions efficiently and prevent system overload. Rapid surge in the graph values may indicate a temporary peak of triggered playbooks that can cause playbooks to take longer to execute and/or slow UI performance. If the queue count is consistently higher than 0, we recommend contacting customer support to discuss scaling options.
Nodes - Storage	A trend graph showing storage usage. The graph shows an increase as storage usage increases. Temporary peaks may indicate system delays or slowness. We recommend increasing storage resources when you reach system limits.
Cortex Connectivity Snapshot	A table showing the status of the connection between your Cortex XSOAR local tenant and the external gateway. If the status is Disconnected, you cannot upgrade Cortex XSOAR, access Marketplace, or update Docker images.

Select the time frame for the system status data

You can choose the following time frames to display the system status data:

• Last hour
• Last 6 hours
• Last 12 hours
• Last 24 hours (Default)
• Last 3 days
• Last 7 days

1. To download a log bundle, from the System Diagnostics page click .