IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  50,000 Line Limit Clarification

    Posted 5 days ago

    Hi everyone. Looking for some clarification on the 50,000 line limit in our workflows/playbooks. 

    Is the limit:

    a) the number of lines for each FOR loop

    b) the number of lines for all the FOR loops in a given script

    c) the number of lines for all the FOR loops in a given workflow or playbook

    d) something else?

    Is there a way to see how many lines are being "consumed" for workflows/playbooks that are not erroring on this limit?

    Thanks!

    Ken 



    ------------------------------
    ken ching
    ------------------------------


  • 2.  RE: 50,000 Line Limit Clarification

    Posted 4 days ago

    Hi Ken,

    the 50000 lines limit is a limit for executed lines per script. Every script in a playbook/workflow has its own separate 50000 lines limit.

    E.g. this script

    for i in range(5):
      log.debug("hello")

    consumes 11 lines. 

    Lines of code executed in a third party library are excluded. json.dumps(incident) only consumes one line of code rather than all the lines executed within json.dumps.

    The number of lines that had been executed in a script are logged to resilient-scripting.log, e.g. for the above script you would see an entry like this:

    09:42:59.317 [LogReaderThread for qtp-1003469119-88] INFO  v=unknown  c.r.s.cpython.process.CPythonProcess - pid 44364: ScriptRunner - Finished running script. 11 script lines executed in 0.041656 seconds.

    Hope this helps

    Bastian



    ------------------------------
    Bastian Graebener
    ------------------------------



  • 3.  RE: 50,000 Line Limit Clarification

    Posted 4 days ago

    Thank you Bastian. Just what I needed to know.



    ------------------------------
    ken ching
    ------------------------------