Description

This article highlights the location of app logs in Juniper Secure Analytics (JSA) and details how to access these logs via JSA CLI by using the recon method.

Symptoms

The app logs are different from one another, depending on the app functionality and the services (packages) that are being leveraged. However, some common app logs that can be found in most apps are listed as follows:

  • app.log

    • Contains logs of user actions on the UI or live user actions on the app. It can be used to debug problems with the UI such as when trying to click a button. 

    • # less /store/docker/volumes/qapp-<app_id>/log/app.log

  • startup.log

    • Contains logs related to app startup. This log can be used to determine errors, such as the RPMS or Python modules failing to install. 

    • # tail /store/docker/volumes/qapp-<app_id>/log/startup.log

  • poll.log

    • Contains logs for background processes, which can be useful for troubleshooting background process issues 

    • # more /store/docker/volumes/qapp-<app_id>/log/poll.log

Solution

The apps in JSA run in a docker container each and each app has its own set of logs. You can access the app logs in two ways:

  1. By connecting to the docker container by using the recon script:

    1. SSH to the JSA Console as the root user.

    2. If the apps are installed on an app host, SSH to the app host from the JSA Console.

    3. Run the following command to get the list of all apps and their IDs from the console or the app host (if installed). 

/opt/qradar/support/recon ps

Example Output 

App-ID  Name    Managed Host ID Workload ID             Service Name    AB      Container Name  CDEGH   Port    IJKL
                0               apps                    qapp-1055       ++      qapp-1055       +++++   5000    ++++
                0               apps                    qapp-1052       ++      qapp-1052       +++++   5000    ++++
                0               apps                    qapp-1056       ++      qapp-1056       +++++   5000    ++++
                0               apps                    qapp-1054       ++      qapp-1054       +++++   5000    ++++
                0               apps                    qapp-1053       ++      qapp-1053       +++++   5000    ++++
  1. Connect to the app docker container: 
/opt/qradar/support/recon connect <app_id>

For example: 

/opt/qradar/support/recon connect 1056

  1. Navigate to the logs directory inside the container. 

cd store/log
sh-4.1# ls
sh-4.1# access.log  error.log  startup.log  supervisord.log

  1. By accessing the app log’s mount point on the console or app host (if installed) directly

    1. SSH to the JSA Console as the root user.

    2. If the apps are installed on an app host, SSH to the app host from the JSA console.

    3. Run the following command to list the app IDs for the apps that are running on the console or the app host (if installed). 

/opt/qradar/support/recon ps
  1. Navigate to the app log’s mounted directory. 
cd /store/docker/volumes/qapp-<app_id>
For example: 
[root@jnpr log]# cd /store/docker/volumes/qapp-1056/log
[root@jnpr log]# ls
access.log  error.log  startup.log  supervisord.log poll.log