MustGather: Information to collect when troubleshooting issues with IBM Security QRadar SOAR workflows

Resolving The Problem

• Describe the problem providing screen shots and other contextual information so the problem can be accurately relayed to IBM Support
• Enable functional logging by going to System Settings -> System Diagnostics -> Functional logging
  • Enable and choose Workflow from the list of functional areas

• Does the workflow invoke an application or function?
  • Enable debug logging for the application
    • If you use an App Host go to App -> Details -> Configuration -> app.config
      • Edit the app.config adding loglevel = DEBUG under the [resilient] heading
      • Click on Save and Push Changes
      • Allow the app to restart
    • If you use an integration server locate the app.config
      • If you are having difficulty finding the app.config see MustGather: Collecting logs for IBM Resilient Circuits for hints
      • Edit the app.config adding loglevel = DEBUG under the [resilient] heading
      • Restart Resilient Circuits

[resilient]
loglevel = DEBUG

• Reproduce the problem
• What date and time did the problem occur or did you reproduce the problem?
  • What time zone is the reported time?
• Provide the incident or case ID
• What is the name and API name of the workflow?
• Take a screen shot of the Workflow Status screen

• Take a screen shot of the actions status ensuring all options are checked

• Export the configuration
  • Administrator Settings -> Organization -> Migrate Settings -> Export -> check all values -> Export
  • Upload the .resz file to the case
• Run sudo resPackageLogs -l 3 (on-premises only)
• Does the workflow invoke an application or function?
  • If so IBM Support needs the application logs
    • See MustGather: Information to Collect when Troubleshooting Issues with IBM Security SOAR AppHost which includes instructions that will collect application logs and App Host logs
    • See MustGather: Collecting logs for IBM Resilient Circuits which includes instructions as to how to collect logs if an integration server is used
    • Run sudo -u postgres -i psql co3 -c "select container, count(*), sum(length(msg)) as bytes, max(length(msg)) as bytes from monapp.activemq_msgs group by container order by container" on the SOAR server CLI (on-premises only)

sudo -u postgres -i psql co3 -c "select container, count(*), sum(length(msg)) as bytes, max(length(msg)) as bytes from monapp.activemq_msgs group by container order by container" on the SOAR server CLI