MustGather: Change the logging level in IBM Security SOAR

Resolving The Problem

IBM Security SOAR

You can configure IBM Security SOAR to output different logging levels to the client.log

1. Create /crypt/logback-custom.xml (sudo vi /crypt/logback-custom.xml)
2. Add content in line with the following examples depending on the problem that requires debugging
3. Save /crypt/logback-custom.xml
4. Set the permissions by running sudo chown root:co3 /crypt/logback-custom.xml
5. Restart IBM Resilient by running sudo systemctl restart resilient.service
6. Debug output is sent to /usr/share/co3/logs/client.log

<included> <logger name="<PACKAGE>" level="<LOGGING LEVEL>"> <appender-ref ref="Co3File" /> </logger> </included>

Output levels:
    •    FATAL
    •    ERROR
    •    WARN
    •    INFO
    •    DEBUG
    •    TRACE

The following are examples that you can use to enable debugging for specific problems.

SAML

Pre-v40

<included> <logger name="org.opensaml.saml2.binding.decoding" level="TRACE"> <appender-ref ref="Co3File"/></logger> </included>

v40 and later

<included> <logger name="com.co3.saml" level="DEBUG"> <appender-ref ref="Co3File" /> </logger> <logger name="org.opensaml.saml.saml2.binding.decoding" level="TRACE"> <appender-ref ref="Co3File"/> </logger> </included>

Threat Service

<included> <logger name="com.co3.threat" level="DEBUG"> <appender-ref ref="Co3File" /> </logger> </included>

<included> <logger name="org.apache.http.wire" level="DEBUG" additivity="false"> <appender-ref ref="Co3File" /> </logger> </included>

LDAP

<included> <logger name="com.co3.ldap" level="DEBUG"> <appender-ref ref="Co3File" /> </logger> </included>

Email notifications

<included> <logger name="com.co3.notifier" level="DEBUG"> <appender-ref ref="Co3File" /> </logger> </included>

Scheduling

<included> <logger name="com.co3.schedule" level="DEBUG"> <appender-ref ref="Co3File" /> </logger> </included>

IBM Security SOAR Messaging service

You can enable DEBUG logging for the Resilient Messaging to output to /var/log/resilient-messaging/resilient-messaging.log

1. Create /crypt/resilient-messaging-custom.xml (sudo vi /crypt/resilient-messaging-custom.xml)
2. Add the following content
3. Save /crypt/resilient-messaging-custom.xml
4. Restart IBM Resilient by running sudo systemctl restart resilient-messaging
5. Debug output is sent to /var/log/resilient-messaging/resilient-messaging.log

<configuration>
    <root level="DEBUG">
        <appender-ref ref="ResilientMessagingFile" />
    </root>
</configuration>