Collect MustGather Logs for troubleshooting IBM Security QRadar SOAR workflow failures

Resolving The Problem

• Describe the problem providing screen shots and other contextual information so the problem can be accurately relayed to IBM Support
• Enable functional logging by going to System Settings -> System Diagnostics -> Functional logging
  • Enable and choose Workflow from the list of functional areas

• If you do not see the option System Settings in the UI then you
  • Can ask a user who already has this role to add you
  • If you are a SaaS customer, contact IBM Security® Support
  • If you are an on premises customer, use the create user command with the -sysadmin option. If you have an existing organization and no user is assigned the System Settings permission, you can add the permission to an existing user by using the following command. Log out of SOAR and then back in again to see System Settings.

sudo resutil newuser -email "<user_account>" -org "<org_name>" -sysadmin

• Does the workflow invoke an application or function?
• Enable debug logging for the application hosted on an App Host
  • Go to App -> Details -> Configuration -> app.config
    • Edit the app.config adding loglevel = DEBUG under the [resilient] heading
    • Click on Save and Push Changes
    • Allow the app to restart

• Enable debug logging for the application hosted on an integration server
  • If you are having difficulty finding the app.config see MustGather: Collecting logs for IBM Resilient Circuits for hints
    • Edit the app.config adding loglevel = DEBUG under the [resilient] heading
    • Restart Resilient Circuits

[resilient]
loglevel = DEBUG

• Reproduce the problem
• What date and time did the problem occur or did you reproduce the problem?
  • What time zone is the reported time?
• Provide the incident or case ID
• What is the name and API name of the workflow?
• Take a screen shot of the Workflow Status screen

• Take a screen shot of the actions status ensuring all options are checked

• Export the configuration
  • Administrator Settings -> Organization -> Migrate Settings -> Export -> check all values -> Export
  • Upload the .resz file to the case
• Run sudo resPackageLogs -l 3 (on-premises only)
• Does the workflow invoke an application or function?
  • If so IBM Support needs the application logs
    • See MustGather: Information to Collect when Troubleshooting Issues with IBM Security SOAR AppHost which includes instructions that will collect application logs and App Host logs
    • See MustGather: Collecting logs for IBM Resilient Circuits which includes instructions as to how to collect logs if an integration server is used
    • Run sudo -u postgres -i psql co3 -c "select container, count(*), sum(length(msg)) as bytes, max(length(msg)) as bytes from monapp.activemq_msgs group by container order by container" on the SOAR server CLI (on-premises only)

sudo -u postgres -i psql co3 -c "select container, count(*), sum(length(msg)) as bytes, max(length(msg)) as bytes from monapp.activemq_msgs group by container order by container" on the SOAR server CLI