For some issues, we need extra information in logs to troubleshoot and understand to root causes. To gather and share this, please read carefully and follow these steps.
ENABLING TRACE LOGS HAS SIGNIFICANT IMPACT ON PERFORMANCES. DO NOT ENABLE IT ON PRODUCTION SERVERS.
Stop TheHive service and ensure it is stopped#
service thehive stop
Ensure the service is stopped with the following command:
service thehive status
/var/log/thehivemove the file
mv /var/log/thehive/application.log /var/log/thehive/application.log.bak
Update log configuration#
- Edit the file
/etc/thehive/logback.xml. Look for the line containing
<logger name="org.thp" level="INFO"/>and update it to have following lines:
[..] <logger name="org.thp" level="TRACE"/> [..]
- Save the file.
Restart the service#
service thehive start
A new log file
/var/log/thehive/application.log should be created and filed with a huge amount of logs.
Wait for the issue to appear and/or the application stop.
Save the logs#
Copy the log file in a safe place.
cp /var/log/thehive/application.log /root
Share it with us#
Create an issue on Github and please share context and symptoms with the log file. Please add information regarding:
- instance (single node/cluster, backend type, index engine)
- System: Operating System, amount of RAM, #CPU for each server/node
- what you did, how you you come to this situation, what happened
- The log file with traces
To get back a to normal log configuration, stop thehive, update
logback.xml file with the previous configuration, and restart the application.