Troubleshoot a failed engine installation.
Note
If the installer fails to start due to a permissions issue, even if running as root, add one of the following two arguments when running the installer:
--target <path>- Extracts the installer files into the specified custom path.--keep- Extracts the installer files into the current working directory (without cleaning at the end).
If using installer options such as -- -tools=false, the option should come after the --target or --keep arguments. For example:
sudo ./d1-installer.sh --target /some/temp/dir -- -tools=false
After installing the engine, check that the engine is connected to the Cortex XSOAR tenant and that it is running.
Go to → → → and verify that the engine is connected.
If the engine is not connected, run the following command on the engine server to check if the engine service is running.
sudo systemctl status d1Note
If the Allow running multiple engines on the same machine option is selected, run the command:
sudo systemctl status d1_<Engine _name>Access the d1 log on the engine server.
sudo tail -f /var/log/demisto/d1.logIf the engine service wasn’t running, and there’s nothing relevant in the log, run
journalctlon the engine server to understand why the installation failed.If the engine service is running, review the errors to see if the engine is failing to connect or if there are other issues. (Ignore all errors related to \d2ws, since this is not the same as d1ws.) Most often, the server address is incorrect and you will see an error like this:
error Cannot connect to [wss://<mainServerIP/HostName>/d1ws]: wss://<mainServerIP/HostName>/d1ws: dial tcp: lookup localhost: no such host. . Waiting 3 seconds. Will try until…In this case, navigate to
/usr/local/demisto/d1.confand change theEngineURLsparameter to an address the engine can reach. Check the addresses at the beginning of the upgrade_engine.sh file and update them to be the same as in the conf file. The addresses should be a comma-separated list.Note
You can ignore the following error:
Cannot create folder '/var/lib/demisto'The configurations that might affect the upgrade_engine.sh script are the following variables located at the beginning of the script:
SERVER_URLSTRUST_ANY_CERT
If you make a change to the baseURLs configuration, you must apply the change in
/usr/local/demisto/d1.confAND in/usr/local/demisto/upgrade_engine.shunder the SERVER_URLS var.If you make a change in the
engine.connection.trust_any_certificateconfiguration, you must apply the change in/usr/local/demisto/upgrade_engine.shas follows:If the
engine.connection.trust_any_certificateconfiguration was set to true (trust any certificate), set the TRUST_ANY_CERT variable to -k.If the
engine.connection.trust_any_certificateconfiguration was set to false, the TRUST_ANY_CERT variable should be blank (““).
To check the connectivity from the engine to the Cortex XSOAR tenant, see Troubleshoot Engine Connectivity.
If the installation issue remains, open a support case with logs from the engine.
On the engine server, in
/usr/local/demisto/d1.conf, set "LogLevel": "debug”.Restart the d1 service and let it run for a few minutes.
sudo systemctl restart d1Note
If the Allow running multiple engines on the same machine option is selected, run the command:
sudo systemctl restart d1_<Engine _name>Capture a
journalctl:journalctl --since "1 day ago" > engineTroubleshootingJournalctl.logOn the engine server, tar up the log, conf,
journalctl, and install log on the engine.tar -cvzf engineLogs.tar.gz /var/log/demisto /usr/local/demisto/d1.conf /tmp/demisto_install.log engineTroubleshootingJournalctl.log