Troubleshoot integrations running on engines - Administrator Guide - Cortex XSIAM - Cortex

Troubleshoot integrations running on engines - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-10-08

Category

Administrator Guide

The following are common errors that occur when integrations are running on an engine.

When running an integration on an engine, the most common errors are:

Broken Pipe
"ImportError: No module named...
Invalid syntax
Script failed to run: exec: “python”: executable file not found in $PATH (2603)

These errors could indicate that the engine is not using Docker.

Use SSH to access the engine server.
Make sure Docker is healthy.
1. Ensure that Docker is installed and is running.
  sudo systemctl status docker
  If the Docker status is not good, restart your Docker.
  sudo systemctl restart docker
2. Ensure Docker can run a container.
  sudo docker run hello-world
  If this fails, reinstall your Docker.
Access the d1.conf file on the engine server.
sudo vi /usr/local/demisto/d1.conf
Add the "python.engine.docker": true configuration to the d1.conf file and remove any other configurations related to python and Docker, such as “python.executable.no.docker”.
Restart the system on the engine server.
sudo systemctl restart d1
Note
If the Allow running multiple engines on the same machine option is selected, run the command:
sudo systemctl restart d1_<Engine _name>
Retest the integration from the user interface. This may take a few minutes because it may need to pull the relevant Docker image.

A common error message you may see when running integrations on engines is something like: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.35/images/json?t.

Determine if you are using a Docker group or Dockerroot group by running one of the following on the server engine:
- ls -la /var/run/docker.sock
  The output from this command will show what user/group is running docker.sock. For example:
```
srw-rw----. 1 root docker 0 Apr 12 20:32 /var/run/docker.sock
```
  shows that it’s a Docker group and not Dockerroot.
- cat /etc/group | grep docker
  This command shows if you are running Docker or Dockerroot.
Note
Docker CE installations typically run Docker, while Docker EE installations typically run Dockerroot.
To fix a Docker user, run the following commands on the server engine:
1. sudo groupadd docker
2. sudo usermod -aG docker demisto
3. sudo systemctl restart docker
4. sudo systemctl restart d1
  Note
  If the Allow running multiple engines on the same machine option is selected, run the command:
  sudo systemctl restart d1_<Engine _name>
To fix a dockerroot user, run the following commands on the server engine:
1. sudo groupadd dockerroot
2. Set the dockerroot group in /etc/docker/daemon.json. For example: { "group": "dockerroot" }.
3. sudo usermod -aG dockerroot demisto
4. sudo chcon -Rt svirt_sandbox_file_t /var/lib/demisto/temp
5. sudo systemctl restart docker
6. sudo systemctl restart d1
  Note
  If the Allow running multiple engines on the same machine option is selected, run the command:
  sudo systemctl restart d1_<Engine _name>

Note

Note

Note

Note