Troubleshoot Docker issues - Administrator Guide - Cortex XSIAM - Cortex

Troubleshoot Docker issues - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM 3.x Documentation

Product

Cortex XSIAM

Creation date

2025-07-15

Last date published

2026-06-11

Category

Administrator Guide

The following provides troubleshooting solutions for Docker networking and performance issues.

In Cortex XSIAM, integrations and scripts run either on the tenant, or on an engine.

If you have Docker networking issues when using an engine, you need to modify the d1.conf file.

On the machine where the Engine is installed, open the d1.conf file.

Add the following to the d1.conf file:

{
	"LogLevel": "info",
	"LogFile": "/var/log/demisto/d1.log",
	"EngineURLs": [
	"wss://1234.demisto.live/d1ws"
	],
					"BindAddress": ":443",
	"EngineID": "XYZ",
	"ServerPublic": "ABC"
	"ArtifactsFolder": "",
	"TempFolder": "",
	"python.pass.extra.keys": "--network=host"
	}

Save the file.
Restart the engine using systemctl restart d1 or service d1 restart.

This information is intended to help resolve the following Docker performance issues.

Containers are getting stuck.
The Docker process consumes a lot of resources.
Time synchronization issues between the container and the operating system.

Cause

The installed Docker package and its dependencies are not up to date.

Workaround

Update the package manager cache.
Linux Distribution
Command
Debian
apt-get update
(Optional) Check for a newer version of the Docker package.
Linux Distribution
Command
Debian
apt-cache policy docker
Update the Docker package.
Linux Distribution
Command
Debian
apt-get update docker