IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

Resilient Circuits service on Windows keeps stopping

  • 1.  Resilient Circuits service on Windows keeps stopping

    Posted Thu November 02, 2023 04:21 AM
    Edited by benlinux Thu November 02, 2023 01:53 PM

    Hello Experts,

    I have successfully installed integration server on a Windows server 2016. I installed the app.config file in a different path. I observed that the Resilient service stops few minutes after been started.

    Commands i used to install resilient::

    > resilient-circuits.exe config -c C:\Users\Administrator\test_app.config

    > resilient-circuits.exe run --config-file C:\Users\Administrator\test_app.config =====> This runs without any error.

    > resilient-circuits.exe service install  ===> i have also tried > resilient-circuits.exe service --res-circuits-args "--config-file C:\Users\Administrator\test_app.config" install (still no luck)

    The below gif explains the issue.

    Please note, if I install the resilient without specifying a custom location or new name for the app.config file, it works perfectly i.e. the resilient circuits service runs without stopping.

    Kindly assist I am on a SOAR project, and the customer does not want to save the app.config file in the default C: drive that resilient saves the app.config file (C:\Users\<User_name>\.resilient\).

    Best Regards,



    ------------------------------
    benlinux
    ------------------------------



  • 2.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Thu November 02, 2023 03:47 PM

    Hello,,

    Any help will be appreciated.

    Regards,



    ------------------------------
    benlinux
    ------------------------------



  • 3.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Fri November 03, 2023 07:09 AM

    Hi,

    Apologies for the delayed response. I am trying replicate this issue. Do you have any logs associated with this ?

    Regards,



    ------------------------------
    Calvin Wynne
    ------------------------------



  • 4.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Fri November 03, 2023 04:47 PM
    Edited by benlinux Fri November 03, 2023 04:48 PM

    Hello Calvin,

    I will really appreciate if this is resolved. In the app.log file, and I don't see anything that points to this issue. Just the connection to the resilient.

    Regards,



    ------------------------------
    benlinux
    ------------------------------



  • 5.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Fri November 03, 2023 04:54 PM
    Edited by Calvin Wynne Fri November 03, 2023 06:33 PM

    Hey Benlinux,

    Would you be able to share a screenshot of your app.log file, redacting any sensitive information ? Also i just want to confirm, have you installed pywin32 ? 



    ------------------------------
    Calvin Wynne
    ------------------------------



  • 6.  RE: Resilient Circuits service on Windows keeps stopping
    Best Answer

    Posted Fri November 03, 2023 06:50 PM

    Hey Benlinux,

    I suspect the path we are providing is not read properly on windows. You see we have to escape the "\" character on windows for it to be read while being passed as a string. Could you try replacing "\" with "\\" as shown below ?

    resilient-circuits.exe service --res-circuits-args "--config-file C:\\Users\\Administrator\\test_app.config" 

    Regards



    ------------------------------
    Calvin Wynne
    ------------------------------



  • 7.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Sat November 04, 2023 07:39 AM
    Edited by benlinux Sat November 04, 2023 07:44 AM

    Hello Calvin,

    Kindly find the requested information.

    Yes i installed pywin32 successfully:


    app.log file as requested:

    Resilient-circuits service is still stopping after apply this:
    I used a new app.config file i.e. nlng_app.config.


    Please note, if I install the resilient without specifying a custom location or new name for the app.config file, it works perfectly i.e. the resilient circuits service runs without stopping.
    ------------------------------
    benlinux
    ------------------------------



  • 8.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Sat November 04, 2023 08:04 AM

    Hey Benlinux,

    I just want to confirm that you're running the start command after the install command. 

    so that would be: 

    resilient-circuits.exe service --res-circuits-args "--config-file C:\\Users\\Administrator\\nlng_app.config" install

    resilient-circuits.exe service --res-circuits-args "--config-file C:\\Users\\Administrator\\nlng_app.config" start

    If yes, could you also try the following ? 

    resilient-circuits.exe service --res-circuits-args "--config-file C:\\Users\\Administrator\\nlng_app.config" debug

    Regards,



    ------------------------------
    Calvin Wynne
    ------------------------------



  • 9.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Sat November 04, 2023 09:09 AM
    Edited by benlinux Sat November 04, 2023 09:21 AM

    Hello Calvin,

    It is not stopping again,

    The commands worked. I think this should be documented in IBM documentation.

    One more question, how do you use res-keyring with this custom app.config file??

    Thanks,



    ------------------------------
    benlinux
    ------------------------------



  • 10.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Mon November 06, 2023 01:17 AM

    Hello Calvin,

    Please can you assist with this other question?

    How do you use res-keyring with this custom app.config file??

    Thanks 



    ------------------------------
    benlinux
    ------------------------------



  • 11.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Mon November 06, 2023 09:15 AM

    Hi Benlinux,

    You could refer to this documentation. Like any resilient-circuits or resilient-sdk command, you can always set the Environment variable APP_CONFIG_FILE to the path to the config file. res-keyring will work just fine with that variable set and will interpolate any secrets from the file that the variable points to.

    Regards,



    ------------------------------
    Calvin Wynne
    ------------------------------



  • 12.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Tue November 07, 2023 03:36 AM

    Hello Calvin,

    Thanks for the help.

    I thought this environmental variable APP_CONFIG_FILE applies to Resilient circuits running on Linux machine, I am working with Windows machine.

    Also, the link you shared has been removed.

    Please assist .

    Regards,



    ------------------------------
    benlinux
    ------------------------------



  • 13.  RE: Resilient Circuits service on Windows keeps stopping

    Posted Tue November 07, 2023 05:37 AM

    Hello Calvin,

    Thanks for the help. Can you assist with this???

    I thought this environmental variable APP_CONFIG_FILE applies to Resilient circuits running on Linux machine, I am working with Windows machine.

    Also, the link you shared has been removed.

    Please assist .

    Regards



    ------------------------------
    benlinux
    ------------------------------