topic Re: ServerLogs integration does not work. in Cortex XSOAR Discussions

ServerLogs integration does not work.

HackDefendr — Mon, 13 Sep 2021 18:24:15 GMT

I have the integration enabled and configured using the requirements stated in the Marketplace, but when I try to load the dashboard it says I don't have the SSH integration enabled. But I do, and I have a local user and have tested it manually, so I don't think this is credential related. It just looks like the integration is not able to access SSH on localhost. The SSH integration test function passes too.

Has anyone else experienced this with this integration/dashboard?

Jeff

Re: ServerLogs integration does not work.

HackDefendr — Mon, 13 Sep 2021 18:30:54 GMT

Script failed to run: Error: [Traceback (most recent call last): File "<string>", line 4, in <module> File "<string>", line 82, in executeCommand File "<string>", line 137, in __do ValueError: Unsupported Command : ssh , verify you have proper integration enabled to support it (23) ] (2604) (2603)

Re: ServerLogs integration does not work.

balmer — Tue, 14 Sep 2021 03:18:42 GMT

First make sure the integration works with a test command in the playground, in my testing the test button wasn't always accurate for the RemoteAccess integration (try without a username/password and it'll say success but fail with commands).

This was my test command in the playground:

!ssh cmd=hostname using=localhost

The next thing to check is to make sure you named your instance `localhost`. The automation is hardcoded with that value for the instance name. The test example above also uses `localhost` so if that fails, the instance name could be the cause. See: https://github.com/demisto/content/blob/d4a6fdd9e50a35e5218bcce7e40d87c95c7ff6c0/Packs/ServerLogs/Scripts/ServerLogs/ServerLogs.py#L9

If that's all correct, then check the user you're using for the RemoteAccess instance has read access to the log files in the automations. These are their paths (also hardcoded):

/var/log/demisto/server.log

/var/log/demisto/docker.log

Check with an `ls -a $PATH` while on the host.

Re: ServerLogs integration does not work.

HackDefendr — Mon, 04 Oct 2021 19:33:28 GMT

Boom! That was the ticket. Setting the hostname and instance name to localhost resolved this for me.

Thank-you!!