all incidents are missing

[SOPORTE_ART2SEC]

Hi everyone

All incidents from our cortex xsoar instance are missing or are not shown, but we don't have any filter. The info is still on the server because we can see all the .db files, we tried to re-index the database but this didn't solve the issue.

any ideas what might be happening?

thanks

[james221gee]

Hello,
Your BoltDB files might be corrupted or the app server has lost its pointer to the data directory. Check the server.log for "permission denied" or "database is locked" errors, and verify that the db.indexes.dir path in your server configuration still correctly points to the volume where your .db files reside.

[kiwi]

Hi @SOPORTE_ART2SEC ,

While it could be a pointer issue, an empty incident list usually points to a desynchronization between the BoltDB files and the Indexing engine (Elasticsearch/OpenSearch).  Here are some things I'd check:

1. Check Disk Space: If your data partition is >95% full, Elasticsearch goes into read-only mode. The files stay on disk, but XSOAR can't query them.

2. Verify Indexer Service: Ensure the indexing service is running. If it crashed, a re-index command will fail silently or hang.

3. Search for 'Flood' in Logs: Check server.log for 'disk watermark (x%) exceeded.' This is a common reason incidents stop appearing.

4. Validation: Try to search for a specific Incident ID in the search bar. If it finds it by ID but won't show it in the list, it's definitely an indexing/filter issue.

Hope this helps,