> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/create-a-log-bundle.md). # Create a Log Bundle A log bundle is a zip file of additional logs available in the Cortex XSOAR system. These logs provide additional information that is useful in troubleshooting issues that arise in your Cortex XSOAR system. Send the log bundle zip file to Cortex XSOAR support to use for debugging purposes. After you create the log bundle, the logs will also appear in `/var/log/demisto/`. 1. Go to Settings → About → **Troubleshooting**. 2. To create the log bundle, click **Download logs**. (Multi-tenant) - For multi-tenant deployments, download **All logs**. The following are the logs that appear in the bundle. | Log | Description | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | workers |

Displays the total number of configured workers, the total number of workers that are busy, and the total number of available workers.

If you experience performance issues, check the workers log to check if all workers are busy. To increase the worker count, see Configure the Number of Workers for the Server for details.

| | web-app | Displays the active integrations and maps all the data types in the system. If there is a problem in the system, you can import this information to your system to try to troubleshoot the problem. | | version\_control |

Displays the following information:

| | telemetry |

Cortex XSOAR uses telemetry to collect specific usage data. This data is analyzed and used to improve Cortex XSOAR, and to identify common usage to help drive the product roadmap. This log displays if telemetry is enabled.

By default, telemetry is enabled.

For information on telemetry, see Telemetry.

| | preprocessRules | Displays the actual data of any existing pre-process rules. Use this information if the pre-process rules are not working as expected, or if incidents are dropped or wrongfully closed . | | os | Displays the exact amount of usage of the general resources of the system at the time you create the log. This information includes operating system usage, kernel usage, memory usage, CPU usage, etc. | | network | Displays all the programs used in the network and contains the record of user and process access calls to objects, attempts at authentication, and other network activity. | | ml | Displays the activities of the training machine learning in the platform. If the training of the model fails, look in this log to understand the error. The error can be a script execution error or a Docker error. For a Docker error, search for demisto/dl. For a script error, search for DBotBuildPhishingClassifier or one of the following subscripts: GetIncidentsByQuery, DBotPreProcessTextData, DBotTrainTextClassifierV2, WordTokenizerNLP. Note that errors that appear may be general Docker errors because all of the scripts and subscripts run in Docker. | | license\_data | Displays the licensing information, including the license validation date, number of users permitted in the system, the amount of users currently using the system, etc. | | installedpacks | Displays the installed packs from Marketplace. | | go\_stats | Go is used to retrieve information about the environment of the server, such as how many CPUs are used, how many goroutines (threads) are used, etc. This log displays the location of all Go routines in the code. | | filesystem | Displays how much free disk space there is in the file system. Displays all the folders that Cortex XSOAR uses and the total usage of the disk space for each folder. Can indicate there is not enough available disk space. | | env | Displays the version and build number for Cortex XSOAR, and the version of the server SHA and web-client. | | content | Displays the activities for all playbook integrations, automations, and incident types. These activities also appear in the server log. | | confserver | Displays the configuration of the server. This information also appears in the Settings → About → **Troubleshooting** page in Cortex XSOAR. | | confdb | Displays the configuration of the database. | | conf | Displays the generic server configurations. | | bolt\_stats | Displays information about Bolt disk and index usage. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/logs/create-a-log-bundle.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.