Timeout: Palo Alto Networks WildFire v2

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Timeout: Palo Alto Networks WildFire v2

L3 Networker

Hello

 

I've configured the Palo Alto Networks WildFire v2 Service with a Wildfire-API Key from our Wildfire-Account at https://eu.wildfire.paloaltonetworks.com/wildfire/account

I also use this Server base URL: https://wildfire.paloaltonetworks.com/publicapi

 

But if I press the Test Button or use this Service in a Playbook, It runs into this:

Script failed to run: Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)

 

In the /var/log/syslog I see many of these Lines:

Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /var/lib/docker/overlay2/53bc122e04e2b296b8e9b49aa42c6f78f7cbb32272f540b3e09a0157557fb3bb/merged: Permission denied
Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /run/docker/netns/92dbf58c974e: Permission denied
Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /var/lib/docker/overlay2/c653ffb365434cc055c31abecbff87764e9a46e0ed49877a57d28b323849255c/merged: Permission denied
Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /run/docker/netns/3d5b1470c9af: Permission denied

 

And in /var/log/demisto/server.log I do see these lines:

2021-02-12 08:09:55.4613 info Starting instance test: [Palo Alto Networks WildFire v2 | WildFire-v2_instance_1] [server: "https://wildfire.paloaltonetworks.com/publicapi"] [insecure: false] [proxy: false] [suppress_file_type_error: false] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/integrations.go:739)
2021-02-12 08:09:55.4620 info Removed module: WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e (source: /home/circleci/.go_workspace/src/github.com/demisto/server/modules/registry.go:44)
2021-02-12 08:09:55.4658 info Starting new container for Docker Image [demisto/python3:3.9.1.14969], amount of containers in array is 0/20 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/containerpool.go:116)
2021-02-12 08:09:55.4659 info added container for docker image [demisto/python3:3.9.1.14969] amount of containers in array is 1 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/containerpool.go:128)
2021-02-12 08:13:54.0479 info No telemetry data to send (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/telemetry.go:336)
2021-02-12 08:14:56.1758 info WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e_WildFire-v2_test-module: Timeout (300000000000) reached, killing (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:602)
2021-02-12 08:14:56.2304 info Stopping docker container demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:361)
2021-02-12 08:15:06.7443 error Container exit with error. container name: [demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68] error: [exit status 137] (2619) (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:118)
2021-02-12 08:15:06.7444 error Failed to run script: WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e_WildFire-v2_test-module with image: demisto/python3:3.9.1.14969 [error '
Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604)'] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/runner.go:57)
2021-02-12 08:15:06.7445 error Instance test failed: Palo Alto Networks WildFire v2 | WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e [error 'Script failed to run:
Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)'] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/integrations.go:765)
2021-02-12 08:15:06.7446 info [POST] "/settings/integration/test" 200 5m11.285461065s (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/middleware.go:96)
2021-02-12 08:15:06.8082 info Removing container [demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68] from from container pool [demisto/python3:3.9.1.14969]

 

What do I wrong?

Thanks

roger

1 accepted solution

Accepted Solutions

Hello Esteban

 

Yes, I could solve it last week: I've deleted the Integration Inctance entry and added them again with the same credentials.

 

Hopefully it solves your problem too...

regards

roger

View solution in original post

5 REPLIES 5

L4 Transporter

Hi

 

There appears to be a permissions issue with docker, what do you get if you run ls -alh /var/lib/docker/overlay2/ | grep 53bc122

All the directories should be root root in that dir

PCCSA PCNSA PCNSE PCSAE

Hello

 

With the grep command I do not see any output. If I remove that grep command I get lots of dirs - all of them got root root permission.

 

thanks

r

L0 Member

Hello

 

could yo solve this issue? because after of a reboot in my soar i have this problem to Qradar integration 

 

Thanks, i wait your comments

 

Regards

Esteban 

Hello Esteban

 

Yes, I could solve it last week: I've deleted the Integration Inctance entry and added them again with the same credentials.

 

Hopefully it solves your problem too...

regards

roger

Hello Roger,

Thanks so much, I applied your suggestion and Works well,

Redards
Esteban
  • 1 accepted solution
  • 4628 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!