IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

QRadar 7.3.3 - How to enable DEBUG logging in app?

  • 1.  QRadar 7.3.3 - How to enable DEBUG logging in app?

    Posted Mon October 26, 2020 08:34 AM

    Hi!

    After recent question from our customer we found some issues while setting log level to DEBUG mode in our application on QRadar 7.3.3.

    We tried different ways to change log level:

    1) API request to https://<console_ip>/console/plugins/{application_id}/app_proxy/log_level

    2) Adding “debug=True” into app.run() paramters in Flask entry point (run.py) and restarting Flask in docker container

    3) Creating FLASK_DEBUG=1 env variable in docker container and restarting Flask

    Unfortunately none of them was helpful – in app.log file there are still no [DEBUG] string or strings with level differing from [INFO].

    Could you please help us providing right way to change log level to DEBUG?



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: QRadar 7.3.3 - How to enable DEBUG logging in app?
    Best Answer

    Posted Mon October 26, 2020 01:26 PM

    Ok what I found - that in API request in 7.3.3 there should not be any basic authentication headers unlike the SEC header with auth token that linked with target App.

    So the request like:

    curl --location --request POST 'https://[QRadar IP]/console/plugins/[App ID]/app_proxy/log_level' --header 'SEC: [Auth token]' --header 'Content-Type: application/x-www-form-urlencoded' --data-urlencode 'level=DEBUG'

    works fine.



    #QRadar
    #Support
    #SupportMigration


Related Content