IBM QRadar SOAR

 View Only

Unable to stop a Running Workflow

  • 1.  Unable to stop a Running Workflow

    Posted 20 days ago

    Hello,

    I took over an IBM SOAR On-Prem deployment that is in place for quite a long time.

    When I was asked to investigate performances issues, I discovered a Workflow running for several months, triggering a script approximatively every second.

    I can see the "Terminate Workflow" button in the Workflow Status of the Incident Actions panel, but when I click on the button, it never completes.  A "Saving" yellow tag appears on the page, and the application become unresponsive after some time. I checked postgresql database, and I can see queries stuck in status "idle in transaction".

    The table monapp.ACT_RU_JOB contains more than 10 millions entries and new entries are still created by this workflow.

    I was able to modify the script to perform no action on the database, but I am not able to modify the Workflow, as the instance executed is different from the current Workflow defined in the app.

    Is there a way to force the termination of the Workflow ?



    ------------------------------
    Francois Chometton
    ------------------------------