Troubleshoot Engine Upgrades - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Troubleshoot failed engine upgrades. Manually upgrade Cortex XSOAR engines.

During an upgrade, the upgrade file is sent to the engine server. A cron job running on the engine server checks if that file exists. The most common upgrade error is that the job is not running so the new installer does not run.


If the installer fails to start due to a permissions issue, even if running as root, add one of the following two arguments when running the installer:

  • --target <path> - Extracts the installer files into the specified custom path.

  • --keep - Extracts the installer files into the current working directory (without cleaning at the end).

If using installer options such as -- -tools=false, the option should come after the --target or --keep arguments. For example:

sudo ./ --target /some/temp/dir -- -tools=false

  1. SSH to the machine.

  2. Check the d1 service status on the engine server. It is possible that it stopped or doesn't exist.

    sudo systemctl status d1

  3. Access the installer log on the engine server and review the error.

    sudo vi /tmp/demisto_install.log

  4. Rerun the installer on the engine server using one of the following options. You can open a second window and run watch df -h. If the problem seems to be disk space, you should resolve the disk space issue and then rerun the installer.

    Option 1

    1. Download the installer from the user interface and copy it to the engine server.

    2. sudo chmod +x

    3. sudo ./ -- -y

    Option 2