Splunk® SOAR (Cloud)

Administer Splunk SOAR (Cloud)

The classic playbook editor will be deprecated soon. Convert your classic playbooks to modern mode.
After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:

Configure the logging levels for the action daemon

You can adjust the logging level for the action daemon running in to help debug or troubleshoot issues.


The following daemons in work to control collection and scheduling tasks in the background independently from the web interface:

Daemon Description
Action daemon Responsible for launching actions by putting into effect the appropriate app on the specified asset. Also responsible for the debug log that says what version of Python is being used. The debug log for Python 3 shows Running executable: spawn3.

The following key actions are logged by this daemon:

  • Manual actions run against any configured asset
  • Scheduled actions against any configured asset
Decide daemon Responsible for operating on incoming data.

The following key actions are logged by this daemon:

  • Launching active playbooks against new containers for associated Operates On types
  • Playbook validation
  • Playbook loading and use
  • Custom automation or playbook APIs
  • Prompting the action daemon for action and app use
  • Prompting the workflow daemon for the approval workflow process
  • Processing approval response and results from the workflow daemon
  • Matching app execution to specific action results
  • Playbook debugging
  • Counting licensed action uses
Ingest daemon Responsible for ingesting data into the product.

The following key actions are logged by this daemon:

  • Ingestions from data sources that use polling to get new data
  • Asset health reporting, also known as, connectivity checking for the Asset Health dashboard component
  • Configuration changes to any assets or any app-specific configuration
  • Manual Test Connectivity actions launched directly from any asset
Proxy daemon Responsible for communicating with Splunk mobile apps to register devices and send notifications to mobile users. This daemon is available only when the mobile app feature is enabled.
Watchdog daemon Responsible for tracking the status of other daemons and adding or removing them in the system startup list.

The following key actions are logged by the watchdog daemon:

  • Installation of new apps
  • Health monitoring the deployment
  • Maintenance of other platform daemons and components
  • Restarts of the platform daemons and components
Workflow daemon Responsible for managing approval requests to action reviewers and asset owners.

The following key actions are logged by the workflow daemon:

  • Processing and launching approval processes and managing approval escalations
  • Sending user email notifications for container assignment, expiry, manual action requests, and other email templates

Configure the logging level for the action daemon

Adjust the logging levels as needed to assist Support with troubleshooting any issues you might experience.

  1. From the main menu, select Administration.
  2. Select System Health > Debugging.
  3. Select a logging level for the action daemon. The log levels determine the message types that are written to each daemon's corresponding log file. The Debug level is the most verbose level of logging and is useful for troubleshooting. Only set the Action Daemon Log Level to Debug if you are actively troubleshooting an issue.
  4. Click Save Changes.

Example log structure

See the following sample of a common log format:

Oct  5 22:55:18 localhost DECIDED[7177]: TID:7422 : WARNING: DECIDED : rules_engine.cpp : 1503 : DECIDED_CMD_PROCESS_CONTAINERS : All rules FAILED t

This table summarizes the structure of the example log message.

Log message content Description
Oct 5 22:55:18 Timestamp of when the log message was generated.
localhost Name of the host where the log message was generated.
DECIDED[7177]: Name of the component and process ID (PID) generating the message.
TID:7422: Threat ID (TID) of the message.
WARNING: Log level or class of the message.
DECIDED: Functional component that generated the log message.
rules_engine.cpp: Source file applicable to the log message.
1503: Line number in the source file that caused this log message to be generated.
DECIDED_CMD_PROCESS_CONTAINERS: All rules FAILED to process the container: 2964. Error: Playbook 'local/test11 (version: 1, id: 711)' cannot be executed since it is: NOT ACTIVE, ENABLED and VALID The log message.
Last modified on 29 May, 2024
View ingested container statistics using Ingestion Status   Create and download or upload a diagnostic file

This documentation applies to the following versions of Splunk® SOAR (Cloud): current, current

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters