IBM QRadar SOAR

IBM QRadar SOAR

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

Unable to stop a Running Workflow

  • 1.  Unable to stop a Running Workflow

    Posted Thu February 06, 2025 08:20 AM

    Hello,

    I took over an IBM SOAR On-Prem deployment that is in place for quite a long time.

    When I was asked to investigate performances issues, I discovered a Workflow running for several months, triggering a script approximatively every second.

    I can see the "Terminate Workflow" button in the Workflow Status of the Incident Actions panel, but when I click on the button, it never completes.  A "Saving" yellow tag appears on the page, and the application become unresponsive after some time. I checked postgresql database, and I can see queries stuck in status "idle in transaction".

    The table monapp.ACT_RU_JOB contains more than 10 millions entries and new entries are still created by this workflow.

    I was able to modify the script to perform no action on the database, but I am not able to modify the Workflow, as the instance executed is different from the current Workflow defined in the app.

    Is there a way to force the termination of the Workflow ?



    ------------------------------
    Francois Chometton
    ------------------------------