> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/shut-down-cortex-xsoar.md).

# Shut down Cortex XSOAR

You may need to shut down Cortex XSOAR in order to perform maintenance or troubleshooting activities.

You can gracefully shut down or reboot a cluster by selecting the **Shutdown/Reboot** menu item from the textual UI.

{% hint style="info" %}

### Important

* Do not reboot Cortex XSOAR or do a hard shutdown if it is not working properly. Instead, download a log bundle and perform a graceful shutdown from the textual UI menu. Contact support or engineering for assistance.
* When performing shutdown or reboot on any single node in a three-node cluster, at least two nodes must be online and in healthy status.
* You must shut down or reboot one node at a time. Shutting down or rebooting two or more nodes at the same time is not possible and would possibly crash the app cluster.
* Ensure one node has finished its complete boot-up sequence and is online and in healthy status before initiating shutdown on another node.
* Before shutting down or rebooting a node, you must first drain it to ensure the node stops accepting new work before going offline.
  {% endhint %}

**Perform graceful shutdown (one node at a time)**

1. Drain the node you want to shut down.
   1. From the textual UI menu in your VM, select **Cluster Administration**.
   2. Select the IP address of the node you want to drain.
   3. Select **Drain**.

      In the list of nodes in the **Cluster Administration** menu, the node IP will display as **Ready,SchedulingDisabled**.
2. Shut down the node.
   1. From the textual UI menu in your VM, select Shutdown/Reboot → **Shutdown**.
   2. Wait for the node to completely shut down.

**Perform graceful reboot (one node at a time)**

1. Drain the node you want to reboot.
   1. From the textual UI menu in your VM, select **Cluster Administration**.
   2. Select the IP address of the node you want to drain.
   3. Select **Drain**.

      In the list of nodes in the **Cluster Administration** menu, the node IP will display as **Ready,Schedulable**.
2. Reboot the node.
   1. From the textual UI menu in your VM, select Shutdown/Reboot → **Reboot**.
   2. Wait for the node to completely restart.

**Monitor node status before and after shutdown or reboot**

Before initiating a graceful shutdown or reboot, you can use the textual UI menu in the VM to check the node list under **Cluster Administration**. A node is considered safe to shut down/reboot only after it has been successfully drained, changing its status to **`Ready,SchedulingDisabled`**. For more information, see [Manage nodes in a cluster](/cortex-xsoar-8-on-prem/8.7/onboard-cortex-xsoar/cortex-xsoar-installation/post-installation/optimize-performance-and-robustness-from-the-textual-ui.md#UUID-16e8f05d-3d05-3da9-7f90-00305ee4c18d).

After shutdown or reboot, you can check the node's health and status from the **System Diagnostics** page, where the **Active Nodes Snapshot** widget lists all nodes and their status (for example, Connected or Disconnected). For more information, see [View system status in the System Diagnostics page](/cortex-xsoar-8-on-prem/8.7/troubleshoot-and-reference/troubleshoot/view-system-status-in-the-system-diagnostics-page.md). You must confirm the node has finished its complete boot-up sequence and is online and in healthy status before acting on another node.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/onboard-cortex-xsoar/cortex-xsoar-installation/troubleshoot-your-installation/shut-down-cortex-xsoar.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.