Skip to content

Troubleshooting#

For some issues, we need extra information in logs to troubleshoot and understand to root causes. To gather and share this, please read carefully and follow these steps.

Warning

**ENABLING TRACE LOGS HAS SIGNIFICANT IMPACT ON PERFORMANCES. DO NOT ENABLE IT ON PRODUCTION SERVERS. **

Stop TheHive service and ensure it is stopped#

service thehive stop

Ensure the service is stopped with the following command: 

service thehive status

Renew application.log file#

  • in /var/log/thehive move the file application.log to application.log.bak
mv /var/log/thehive/application.log /var/log/thehive/application.log.bak

Update log configuration#

  • Edit the file /etc/thehive/logback.xml. Look for the line containing <logger name="org.thp" level="INFO"/> and update it to have following lines:
    [..]
    <logger name="org.thp" level="TRACE"/>
    [..]
  • Save the file.

Restart the service#

service thehive start

A new log file /var/log/thehive/application.log should be created and filed with a huge amount of logs.

Wait for the issue to appear and/or the application stop.

Save the logs#

Copy the log file in a safe place. 

cp /var/log/thehive/application.log /root

Share it with us#

Create an issue on Github and please share context and symptoms with the log file. Please add information regarding:

  • Context:
  • instance (single node/cluster, backend type, index engine)
  • System: Operating System, amount of RAM, #CPU for each server/node
  • Symptoms:
  • what you did, how you you come to this situation, what happened
  • The log file with traces

Revert#

To get back a to normal log configuration, stop thehive, update logback.xml file with the previous configuration, and restart the application.