> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/reference/performance-tuning-for-cortex-xsoar.md). # Performance Tuning for Cortex XSOAR Performance tuning may include general troubleshooting for memory and CPU usage, or troubleshooting of more specific UI issues, for example playbook execution. The information in this article will help you identify common causes of slow system performance and implement system improvements. #### Memory Issues Memory issues are a common cause of slow system performance. To verify if memory issues are causing performance issues, check for memory spikes in the system health dashboard and search the journalctl log for the following entry: kernel: **`Out of memory: Kill process X (server) score X or sacrifice child`**. | Issue |

Relevant

Database

| Verification | Solution | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Storing large amount of historical data (more than 1 year) | BoltDB | Check the file sizes in the partition folder to verify that no file is larger than 10GB. The default directory is **`/var/lib/demisto/data/ partitionsData`**. | Archive old data. For more information, learn how to [Free up Disk Space with Data Archiving](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md). | | Inefficient playbooks storing too much data | BoltDB | Validate with **Largest Incidents by Storage Size** widget. This widget is part of the **Common Widgets** content pack. | Archive old data. For more information, learn how to [Free up Disk Space with Data Archiving](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md). | | Playbooks performing many loops or creating many entries | BoltDB | Verify with [dbstats route](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPEuCAO\&lang=en_US) **`https:// localhost:8443/`** dbstats that no investigation has more than 500 entries. | Reduce the number of loops and/or entries. | | Server machine does not meet the [minimum memory requirements](https://app.gitbook.com/s/9gZ0C5CI8Bl5Aulkp4dZ/onboarding-in-cortex-xsoar/single-server-deployment/system-requirements) | BoltDB / Elasticsearch | Open the **`docker.log`** file in the log bundle and check the memory and CPU of the machine. | Verify that your server meets the [minimum memory requirements](https://app.gitbook.com/s/9gZ0C5CI8Bl5Aulkp4dZ/onboarding-in-cortex-xsoar/single-server-deployment/system-requirements). | | Storage does not meeting [minimum requirements](https://app.gitbook.com/s/9gZ0C5CI8Bl5Aulkp4dZ/onboarding-in-cortex-xsoar/single-server-deployment/system-requirements) | BoltDB | N/A | Verify that the disk is SSD based, with 3k dedicated IOPS. | | Too much data indexing of investigation tasks or entries | BoltDB | Check folders with prefix **`/var/lib/demisto/data/demistoidx/ invTaskIdx_`** for files larger than 3GB. | Add the following server configuration and value to limit indexing: **`investigation.task.partial.index = 7`**. | | Docker containers | BoltDB / Elasticsearch | Check **`docker.log`** file. Verify number of running containers, machine CPU/memory and Docker stats that indicate whether a container is consuming too many resources. | [Limit container resources](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/docker/docker-hardening-guide.md). | | Audits index folder | BoltDB | Check the file sizes in the audits index folder to verify that no file is larger than 3GB. The default directory is **`/var/lib/demisto/data/demistoidx/audits`**. | Perform [scheduled and manual audit purges](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/audit-trail.md). | | Messages index | BoltDB | Check the file size of the messages index to verify it isn’t larger than 3GB. The default directory is **`/var/lib/demisto/data/demistoidx/messages`**. | Drop messages and delete the index. Add configuration setting: **`disable.msgs.sending`**. | #### CPU Spikes Check for CPU spikes by viewing the system health dashboard or by using system tools such as the Linux top command. | Issue | Relevant Database | Verification | Solution | | ---------------------------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Too many threads | BoltDB / Elasticsearch | Check threads in the **`go_stats.log`** file. More than 3000 threads (referred to as goroutines in Golang) indicates a possible thread leak or too many processes/tasks running in parallel. | Restart service. If problem reoccurs, contact Cortex XSOAR customer support. | | Workers overloaded | BoltDB / Elasticsearch | Check **`workers.log`** file. Available or Buffer Space == 0, indicates the system is overloaded. If Total == Busy, the system has all workers busy, and you need to increase workers. | [Change default number of workers](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/onboarding-in-cortex-xsoar/engines/configure-engines.md#UUID-530b67e4-ad19-faed-d6af-d893b94e27e7). | | Docker containers overloaded | BoltDB / Elasticsearch | Check **`docker.log`** file. Verify number of running containers, machine CPU/memory and Docker stats that indicate whether a container is consuming too many resources. | Change limit for pool of running Docker images (default is 20) with the server configuration: **`containers.high.water.mark`** or for a specific Docker image **`containers.high.water.mark.${image_name}`**. | #### Slow Playbooks | Issue | Relevant Database | Verification | Solution | | -------------------------------------------- | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Indicator Extraction Enabled | BoltDB / Elasticsearch | N/A | Check Indicator Extraction settings and turn off Indicator Extraction where not needed. See [Indicator Extraction](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/indicators/indicator-extraction.md). | | Enrichment integrations that fail or timeout | BoltDB / Elasticsearch | Verify you don’t have enrichment integrations that fail frequently or experience timeouts. This might occur with free enrichment services that quickly exceed quotas. | Depending on the integration, you might need to increase the quota or modify integration settings. | | Playbooks storing a large amount of data | BoltDB / Elasticsearch | Check if playbooks are storing more than 0.5 MB per incident. Confirm by running **`!PrintContext`** in the War Room, downloading output entry to a file and checking file size. If file size is not over 0.5 MB, run **`!Print value=${incident}`** to view incident data. | [View playbook metadata](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/playbooks/manage-playbook-settings.md#UUID-4c677c88-0e65-dea8-7e0f-f8ec88034b34) to understand which tasks are generating large amounts of data and then optimize tasks to reduce data storage. | | Complex playbooks with many tasks | BoltDB / Elasticsearch | Check for playbooks with a large number of tasks or sub playbooks. | Confirm that the **`playbook.willnotexecute.old.eval`** server configuration has NOT been set to **`True`**. By default, the **`playbook.willnotexecute.old.eval`** server configuration is set to **`False`**, which prevents repeated task checks in playbooks. | #### Other Possible Performance Issues | Issue | Relevant Database | Verification | Solution | | ----------------------------------------------- | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Insufficient disk space | BoltDB | Check the **`filesystem.log`** in the log bundle for large files and folders. | Archive old data. For more information, learn how to [Free up Disk Space with Data Archiving](/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/customize-and-configure-cortex-xsoar/manage-data/free-up-disk-space-with-data-archiving.md). | | Indicators page | BoltDB / Elasticsearch | Check for noticeable lags on the Indicators page. |

Exclude indicators that appear in every incident.

Check Indicator Extraction settings and turn off Indicator Extraction where not needed. See Indicator Extraction.

| | Overall slow UI | BoltDB / Elasticsearch | Check network latency and ping other Cortex XSOAR components, such as engines from the server. | Check with your IT admin regarding latency between client and server. | | Large exclusion list impacts system performance | BoltDB/Elasticsearch | Go to **Settings** → **About** → **System Diagnostics** to check if list exceeds 1000 entries (yellow, Issue) or 5000 entries (red, At Risk). | | #### WebSockets If the Cortex XSOAR server is responding slowly and does not receive data updates on certain pages and actions, the WebSocket might be disconnecting. Verification Steps 1. Confirm that this issue persists across different browsers (Chrome, Firefox, etc.) 2. Check WebSocket messages on the server. 3. Check the **`server.log`** file for messages to confirm that the WebSocket scenario is working, e.g., WebSocket req arrived and HTTP connection upgraded to WebSocket. 4. Check for WebSocket errors such as: Closing WebSocket ReadPump with err: websocket: close 1005 (no status). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.13/learn-about-cortex-xsoar/reference/performance-tuning-for-cortex-xsoar.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.