Hi Everyone,
We have recently installed a new custom app but somehow it didn't listen to message destination to receive action input, attaching the app.log and app.config, may I have some suggestions from you?
app.config
[root@GOAZEDLAP0049 .resilient]# cat app.config
[resilient]
# Basic service connection
host=GOAZEDLAP0049
port=443
# Use (api_key_id, api_key_secret)
api_key_id=07de07ac-8a48-422c-8663-a142b884f974
api_key_secret=****************************
# Or (email, password)
#email=unassigned@XXX.com
#password=***********
org=XXX
# Number of attempts to retry when connecting to Resilient. 0 = unlimited retries
#max_connection_retries=10
# CP4S
# Actions Module connection
# Use stomp_url when configuring an environment for CP4S
#stomp_host=<CP4S stomp URL>
#stomp_port=443
#resource_prefix=/api/respond
# stomp_port=65001
#stomp_timeout=120
#stomp_max_retries=3
# Optional parameters for stomp connections.....
# Please refer to IBM Support for additional settings to those outlined below
# format...... stomp_params=<param1=value1>,<,param2=value2>
#stomp_params=startupMaxReconnectAttempts=3,maxReconnectAttempts=10,initialReconnectDelay=20
# Directory containing additional components to load
# componentsdir=components
# Existing directory to write logs to, or set with $APP_LOG_DIR
logdir=/root/.resilient
logfile=app.log
loglevel=DEBUG
# If your Resilient server uses a self-signed TLS certificate, or some
# other certificate that is not automatically trusted by your machine,
# you need to explicitly tell the Python scripts that it should be trusted.
# If you don't want to use a cert you can set cafile=false.
# To explicitly trust a site, download its certificate to a file, e.g:
# mkdir -p ~/.resilient
# openssl s_client -connect resilient.example.com:443 -showcerts < /dev/null 2> /dev/null | openssl x509 - outform PEM > ~/.resilient/cert.cer
# then specify the file (remove the '#' from the line below):
#cafile=~/.resilient/cert.cer
cafile=false
[chronicle]
queue=chronicle_actions
url=https://dlttl.siemplify-soar.com/api/external/v1
verify=false
token=******************
[root@GOAZEDLAP0049 .resilient]#
app.log
2024-12-11 17:22:04,812 DEBUG [client] [MainThread] Received heart-beat
2024-12-11 17:22:18,528 DEBUG [debugger] [MainThread] <retry_failed_deliveries[*] ( )>
2024-12-11 17:22:19,836 DEBUG [client] [MainThread] Received heart-beat
2024-12-11 17:22:21,238 DEBUG [debugger] [MainThread] <ServerHeartbeat[*] ()>
2024-12-11 17:22:21,239 DEBUG [stomp_component] [MainThread] Checking server heartbeat
2024-12-11 17:22:21,240 DEBUG [debugger] [MainThread] <ServerHeartbeat_success[*] (<ServerHeartbeat[*] ()>, None )>
2024-12-11 17:22:22,790 DEBUG [debugger] [MainThread] <signal[*] (15, <frame object at 0x1e132d8> )>
2024-12-11 17:22:22,791 DEBUG [_api] [MainThread] Attempting to release lock 139927506194216 on /root/.resilient/resilient_circuits.lock
2024-12-11 17:22:22,792 DEBUG [_api] [MainThread] Lock 139927506194216 released on /root/.resilient/resilient_circuits.lock
2024-12-11 17:22:23,782 INFO [app] [MainThread] Configuration file: /root/.resilient/app.config
2024-12-11 17:22:23,785 INFO [app] [MainThread] Resilient server: GOAZEDLAP0049
2024-12-11 17:22:23,785 INFO [app] [MainThread] Resilient api key id: 07de07ac-8a48-422c-8663-a142b884f974
2024-12-11 17:22:23,786 INFO [app] [MainThread] Resilient org: AIA
2024-12-11 17:22:23,787 INFO [app] [MainThread] Logging Level: DEBUG
2024-12-11 17:22:23,787 INFO [app] [MainThread] App Config plugin: Keyring
2024-12-11 17:22:23,789 DEBUG [actions_component] [MainThread] create idle timer
2024-12-11 17:22:23,790 WARNING [co3] [MainThread] Unverified HTTPS requests (cafile=false).
2024-12-11 17:22:23,794 DEBUG [connectionpool] [MainThread] Starting new HTTPS connection (1): goazedlap0049:443
2024-12-11 17:22:23,968 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/session?include_permissions=false HTTP/1.1" 200 905
2024-12-11 17:22:23,970 INFO [co3base] [MainThread] Using org name: AIA
2024-12-11 17:22:23,971 DEBUG [co3] [MainThread] {
"orgs": [
{
"id": 201,
"name": "AIA",
"addr": null,
"addr2": null,
"city": null,
"state": null,
"zip": null,
"attachments_enabled": true,
"final_phase_required": false,
"tasks_private": false,
"has_saml": true,
"require_saml": false,
"twofactor_auth_domain": null,
"has_available_twofactor": false,
"authorized_ldap_group": null,
"supports_ldap": false,
"incident_deletion_allowed": true,
"configuration_type": "standard",
"parent_org": null,
"session_timeout": 1200,
"last_modified_by": {
"id": 9,
"type": "user",
"name": "unassigned@aia.com",
"display_name": "Unassigned Account"
},
"last_modified_time": 1729240249963,
"uuid": "4138b335-a342-4981-ad1c-3dadc2c0c138",
"timezone": null,
"cloud_account": null,
"perms": null,
"effective_permissions": [],
"role_handles": [],
"enabled": true,
"twofactor_cookie_lifetime_secs": 0
}
],
"password_expiration_date": null,
"api_key_handle": 4,
"client_id": "07de07ac-8a48-422c-8663-a142b884f974",
"display_name": "SplunkPhantom Integration"
}
2024-12-11 17:22:24,181 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/orgs/201 HTTP/1.1" 200 None
2024-12-11 17:22:24,184 DEBUG [rest_helper] [MainThread] Getting server version
2024-12-11 17:22:24,322 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/const HTTP/1.1" 200 None
2024-12-11 17:22:24,333 INFO [rest_helper] [MainThread] IBM Security QRadar SOAR version: v47.2.45
2024-12-11 17:22:24,574 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/orgs/201/types/incident/fields HTTP/1.1" 200 None
2024-12-11 17:22:24,792 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/orgs/201/types/actioninvocation/fields HTTP/1.1" 200 None
2024-12-11 17:22:24,990 DEBUG [connectionpool] [MainThread] https://goazedlap0049:443 "GET /rest/orgs/201/actions HTTP/1.1" 200 None
2024-12-11 17:22:24,994 INFO [actions_component] [MainThread] stomp_prefetch_limit set to 25
2024-12-11 17:22:25,006 INFO [actions_component] [MainThread] num_workers set to 25
2024-12-11 17:22:25,007 INFO [app] [MainThread] Components auto-load directory: (none)
2024-12-11 17:22:25,345 INFO [component_loader] [MainThread] Loading 2 components
2024-12-11 17:22:25,346 INFO [component_loader] [MainThread] 'rc_phantomcyber.components.phantomactions.PhantomActions' loading
2024-12-11 17:22:25,348 DEBUG [phantomactions] [MainThread] {'queue': 'chronicle_actions', 'url': 'https://dlttl.siemplify-soar.com/api/external/v1', 'verify': 'false', 'token': '***'}
2024-12-11 17:22:25,348 DEBUG [component_loader] [MainThread] 'rc_phantomcyber.components.phantomactions.PhantomActions' loaded
2024-12-11 17:22:25,349 INFO [component_loader] [MainThread] 'chronicle_actions.components.chronicleactions.ChronicleActions' loading
2024-12-11 17:22:25,351 DEBUG [chronicleactions] [MainThread] {'queue': 'chronicle_actions', 'url': 'https://dlttl.siemplify-soar.com/api/external/v1', 'verify': 'false', 'token': '***'}
2024-12-11 17:22:25,351 DEBUG [component_loader] [MainThread] 'chronicle_actions.components.chronicleactions.ChronicleActions' loaded
2024-12-11 17:22:25,352 DEBUG [debugger] [MainThread] <registered[*] (<Debugger/* 11837:MainThread (queued=0) [S]>, <App/* 11837:MainThread (queued=10) [R]> )>
2024-12-11 17:22:25,353 DEBUG [debugger] [MainThread] <registered[*] (<PhantomActions/* 11837:MainThread (queued=0) [S]>, <ComponentLoader/loader 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,354 DEBUG [debugger] [MainThread] <registered[*] (<Timer/* 11837:MainThread (queued=0) [S]>, <Actions/* 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,354 DEBUG [debugger] [MainThread] <registered[*] (<ChronicleActions/* 11837:MainThread (queued=0) [S]>, <ComponentLoader/loader 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,355 DEBUG [debugger] [MainThread] <registered[*] (<Timer/* 11837:MainThread (queued=0) [S]>, <Actions/* 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,356 DEBUG [debugger] [MainThread] <registered[*] (<Actions/* 11837:MainThread (queued=0) [S]>, <App/* 11837:MainThread (queued=5) [R]> )>
2024-12-11 17:22:25,356 WARNING [actions_component] [MainThread] Unverified STOMP TLS certificate (cafile=false)
2024-12-11 17:22:25,365 INFO [stomp_component] [MainThread] Connect to GOAZEDLAP0049:65001
2024-12-11 17:22:25,365 DEBUG [stomp_component] [MainThread] Stomp uri: failover:(ssl://GOAZEDLAP0049:65001)?maxReconnectAttempts=3,startupMaxReconnectAttempts=3
2024-12-11 17:22:25,366 DEBUG [debugger] [MainThread] <registered[loader] (<ComponentLoader/loader 11837:MainThread (queued=0) [S]>, <App/* 11837:MainThread (queued=6) [R]> )>
2024-12-11 17:22:25,367 DEBUG [debugger] [MainThread] <load_all_success[loader] ( )>
2024-12-11 17:22:25,367 INFO [app] [MainThread] Components loaded
2024-12-11 17:22:25,370 DEBUG [app] [MainThread] Components:
<App/* 11837:MainThread (queued=5) [R]>
do_initialization/*
stopped/*
load_all_success/*
config_logging/*
reload_opts/*
started/*
load_all_failure/*
<Actions/* 11837:MainThread (queued=0) [S]>
registered/*
FunctionErrorEvent/*
subscribe_to_all/*
exception/*
OnStompError/*
Send_failure/*
signal/*
Ack_success/*
reconnect/*
reload/*, *
StatusMessageEvent/*
Connected/*
Send_success/*
SelftestTerminateEvent/*
retry_failed_deliveries/*
Connect_success/*
load_all_success/*
prepare_unregister/*
HeartbeatTimeout/*
Message/*
Ack_failure/*
Disconnected/*
idle_reset/*
<Timer/* 11837:MainThread (queued=0) [S]>
generate_events/*
<FunctionWorker/functionworker 11837:MainThread (queued=0) [S]>
stopped/*
signal/*
unregistered/*
task/*
<Timer/* 11837:MainThread (queued=0) [S]>
generate_events/*
<StompClient/stomp 11837:MainThread (queued=0) [S]>
Ack/*
ServerHeartbeat/*
Send/*
generate_events/*
Disconnect/*
Connect/*
Message/*
ClientHeartbeat/*
Subscribe/*
Unsubscribe/*
<ComponentLoader/loader 11837:MainThread (queued=0) [S]>
exception/loader
load/*
load_complete/*
<PhantomActions/* 11837:MainThread (queued=0) [S]>
reload/*
<ChronicleActions/* 11837:MainThread (queued=0) [S]>
reload/*
<Debugger/* 11837:MainThread (queued=0) [S]>
signal/*
exception/*
2024-12-11 17:22:25,370 DEBUG [debugger] [MainThread] <registered[functionworker] (<FunctionWorker/functionworker 11837:MainThread (queued=0) [S]>, <Actions/* 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,371 DEBUG [debugger] [MainThread] <started[*] (<App/* 11837:MainThread (queued=3) [R]> )>
2024-12-11 17:22:25,372 INFO [app] [MainThread] App Started
2024-12-11 17:22:25,374 DEBUG [debugger] [MainThread] <registered[stomp] (<StompClient/stomp 11837:MainThread (queued=0) [S]>, <Actions/* 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,375 DEBUG [debugger] [MainThread] <reconnect[*] ( subscribe=False)>
2024-12-11 17:22:25,476 INFO [actions_component] [MainThread] STOMP attempting to connect
2024-12-11 17:22:25,478 DEBUG [debugger] [MainThread] <Connect[*] ()>
2024-12-11 17:22:25,479 INFO [stomp_component] [MainThread] Connect to Stomp...
2024-12-11 17:22:25,480 INFO [client] [MainThread] Connecting to GOAZEDLAP0049:65001 ...
2024-12-11 17:22:25,480 DEBUG [stomp_transport] [MainThread] stomp_transport.connect()
2024-12-11 17:22:25,527 INFO [client] [MainThread] Connection established
2024-12-11 17:22:25,528 DEBUG [client] [MainThread] Sending CONNECT frame [headers={'login': '07de07ac-8a48-422c-8663-a142b884f974', 'passcode': '***', 'accept-version': '1.0,1.1,1.2', 'host': '', 'heart-beat': '0,15000'}, version=1.2]
2024-12-11 17:22:25,716 DEBUG [client] [MainThread] Received CONNECTED frame [headers={'version': '1.2', 'session': '***', 'heart-beat': '15000,0', 'server': 'ActiveMQ/5.15.14'}, version=1.2]
2024-12-11 17:22:25,717 INFO [client] [MainThread] Connected to stomp broker [session=ID:GOAZEDLAP0049.AIAAZURE.BIZ-37994-1733871871907-4:10, version=1.2]
2024-12-11 17:22:25,718 DEBUG [stomp_component] [MainThread] State after Connection Attempt: connected
2024-12-11 17:22:25,719 INFO [stomp_component] [MainThread] Connected to failover:(ssl://GOAZEDLAP0049:65001)?maxReconnectAttempts=3,startupMaxReconnectAttempts=3
2024-12-11 17:22:25,719 INFO [stomp_component] [MainThread] Client HB: 0 Server HB: 15000
2024-12-11 17:22:25,720 INFO [stomp_component] [MainThread] No Client heartbeats will be sent
2024-12-11 17:22:25,720 INFO [stomp_component] [MainThread] Requested heartbeats from server.
2024-12-11 17:22:25,722 DEBUG [client] [MainThread] Received heart-beat
2024-12-11 17:22:25,723 DEBUG [debugger] [MainThread] <Connected[stomp] ()>
2024-12-11 17:22:25,724 INFO [actions_component] [MainThread] STOMP connected.
2024-12-11 17:22:25,724 DEBUG [debugger] [MainThread] <registered[*] (<Timer/* 11837:MainThread (queued=0) [S]>, <StompClient/stomp 11837:MainThread (queued=0) [S]> )>
2024-12-11 17:22:25,725 DEBUG [debugger] [MainThread] <Connect_success[*] (<Connect[*] ()>, 'success' )>
2024-12-11 17:22:25,726 DEBUG [actions_component] [MainThread] Connected successfully. Resubscribe? False
2024-12-11 17:22:25,727 DEBUG [debugger] [MainThread] <Connected_done[stomp] (None )>
2024-12-11 17:22:25,728 DEBUG [debugger] [MainThread] <Connected_success[stomp] (<Connected[stomp] ()>, None )>
2024-12-11 17:22:25,830 INFO [actions_component] [MainThread] resilient-circuits has started successfully and is now running...
2024-12-11 17:22:55,588 DEBUG [client] [MainThread] Received heart-beat
2024-12-11 17:22:55,722 DEBUG [debugger] [MainThread] <ServerHeartbeat[*] ()>
2024-12-11 17:22:55,723 DEBUG [stomp_component] [MainThread] Checking server heartbeat
2024-12-11 17:22:55,725 DEBUG [debugger] [MainThread] <ServerHeartbeat_success[*] (<ServerHeartbeat[*] ()>, None )>
2024-12-11 17:23:10,612 DEBUG [client] [MainThread] Received heart-beat
Message stuck in quque
