Timeout: Palo Alto Networks WildFire v2

[r_buchwalder]

Hello

I've configured the Palo Alto Networks WildFire v2 Service with a Wildfire-API Key from our Wildfire-Account at https://eu.wildfire.paloaltonetworks.com/wildfire/account

I also use this Server base URL: https://wildfire.paloaltonetworks.com/publicapi

But if I press the Test Button or use this Service in a Playbook, It runs into this:

Script failed to run: Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)

In the /var/log/syslog I see many of these Lines:

Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /var/lib/docker/overlay2/53bc122e04e2b296b8e9b49aa42c6f78f7cbb32272f540b3e09a0157557fb3bb/merged: Permission denied
Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /run/docker/netns/92dbf58c974e: Permission denied
Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /var/lib/docker/overlay2/c653ffb365434cc055c31abecbff87764e9a46e0ed49877a57d28b323849255c/merged: Permission denied
Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /run/docker/netns/3d5b1470c9af: Permission denied

And in /var/log/demisto/server.log I do see these lines:

2021-02-12 08:09:55.4613 info Starting instance test: [Palo Alto Networks WildFire v2 | WildFire-v2_instance_1] [server: "https://wildfire.paloaltonetworks.com/publicapi"] [insecure: false] [proxy: false] [suppress_file_type_error: false] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/integrations.go:739)
2021-02-12 08:09:55.4620 info Removed module: WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e (source: /home/circleci/.go_workspace/src/github.com/demisto/server/modules/registry.go:44)
2021-02-12 08:09:55.4658 info Starting new container for Docker Image [demisto/python3:3.9.1.14969], amount of containers in array is 0/20 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/containerpool.go:116)
2021-02-12 08:09:55.4659 info added container for docker image [demisto/python3:3.9.1.14969] amount of containers in array is 1 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/containerpool.go:128)
2021-02-12 08:13:54.0479 info No telemetry data to send (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/telemetry.go:336)
2021-02-12 08:14:56.1758 info WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e_WildFire-v2_test-module: Timeout (300000000000) reached, killing (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:602)
2021-02-12 08:14:56.2304 info Stopping docker container demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:361)
2021-02-12 08:15:06.7443 error Container exit with error. container name: [demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68] error: [exit status 137] (2619) (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:118)
2021-02-12 08:15:06.7444 error Failed to run script: WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e_WildFire-v2_test-module with image: demisto/python3:3.9.1.14969 [error '
Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604)'] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/runner.go:57)
2021-02-12 08:15:06.7445 error Instance test failed: Palo Alto Networks WildFire v2 | WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e [error 'Script failed to run:
Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)'] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/integrations.go:765)
2021-02-12 08:15:06.7446 info [POST] "/settings/integration/test" 200 5m11.285461065s (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/middleware.go:96)
2021-02-12 08:15:06.8082 info Removing container [demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68] from from container pool [demisto/python3:3.9.1.14969]

What do I wrong?

Thanks

roger

[laurence64]

Hi

There appears to be a permissions issue with docker, what do you get if you run ls -alh /var/lib/docker/overlay2/ | grep 53bc122

All the directories should be root root in that dir

[r_buchwalder]

Hello

With the grep command I do not see any output. If I remove that grep command I get lots of dirs - all of them got root root permission.

thanks

r

[Esteban1C]

Hello

could yo solve this issue? because after of a reboot in my soar i have this problem to Qradar integration 

Thanks, i wait your comments

Regards

Esteban 

[r_buchwalder · Accepted solution]

Hello Esteban

Yes, I could solve it last week: I've deleted the Integration Inctance entry and added them again with the same credentials.

Hopefully it solves your problem too...

regards

roger

[Esteban1C]

Hello Roger,

Thanks so much, I applied your suggestion and Works well,

Redards
Esteban