Configure the logging levels for the action daemon

You can adjust the logging level for the action daemon running in to help debug or troubleshoot issues.

daemons

The following daemons in work to control collection and scheduling tasks in the background independently from the web interface:

Daemon	Description
Action daemon	Responsible for launching actions by putting into effect the appropriate app on the specified asset. Also responsible for the debug log that says what version of Python is being used. The debug log for Python 3 shows Running executable: spawn3. The following key actions are logged by this daemon: Manual actions run against any configured asset Scheduled actions against any configured asset
Decide daemon	Responsible for operating on incoming data. The following key actions are logged by this daemon: Launching active playbooks against new containers for associated Operates On types Playbook validation Playbook loading and use Custom automation or playbook APIs Prompting the action daemon for action and app use Prompting the workflow daemon for the approval workflow process Processing approval response and results from the workflow daemon Matching app execution to specific action results Playbook debugging Counting licensed action uses
Ingest daemon	Responsible for ingesting data into the product. The following key actions are logged by this daemon: Ingestions from data sources that use polling to get new data Asset health reporting, also known as, connectivity checking for the Asset Health dashboard component Configuration changes to any assets or any app-specific configuration Manual Test Connectivity actions launched directly from any asset
Proxy daemon	Responsible for communicating with Splunk mobile apps to register devices and send notifications to mobile users. This daemon is available only when the mobile app feature is enabled.
Watchdog daemon	Responsible for tracking the status of other daemons and adding or removing them in the system startup list. The following key actions are logged by the watchdog daemon: Installation of new apps Health monitoring the deployment Maintenance of other platform daemons and components Restarts of the platform daemons and components
Workflow daemon	Responsible for managing approval requests to action reviewers and asset owners. The following key actions are logged by the workflow daemon: Processing and launching approval processes and managing approval escalations Sending user email notifications for container assignment, expiry, manual action requests, and other email templates

Configure the logging level for the action daemon

Adjust the logging levels as needed to assist Support with troubleshooting any issues you might experience.

1. From the main menu, select Administration.
2. Select System Health > Debugging.
3. Select a logging level for the action daemon. The log levels determine the message types that are written to each daemon's corresponding log file. The Debug level is the most verbose level of logging and is useful for troubleshooting. Only set the Action Daemon Log Level to Debug if you are actively troubleshooting an issue.
4. Click Save Changes.

Example log structure

See the following sample of a common log format:

Oct  5 22:55:18 localhost DECIDED[7177]: TID:7422 : WARNING: DECIDED : rules_engine.cpp : 1503 : DECIDED_CMD_PROCESS_CONTAINERS : All rules FAILED t

This table summarizes the structure of the example log message.

Log message content	Description
Oct 5 22:55:18	Timestamp of when the log message was generated.
localhost	Name of the host where the log message was generated.
DECIDED[7177]:	Name of the component and process ID (PID) generating the message.
TID:7422:	Threat ID (TID) of the message.
WARNING:	Log level or class of the message.
DECIDED:	Functional component that generated the log message.
rules_engine.cpp:	Source file applicable to the log message.
1503:	Line number in the source file that caused this log message to be generated.
DECIDED_CMD_PROCESS_CONTAINERS: All rules FAILED to process the container: 2964. Error: Playbook 'local/test11 (version: 1, id: 711)' cannot be executed since it is: NOT ACTIVE, ENABLED and VALID	The log message.