FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
nmathur
Staff
Staff
Article Id 190194
Description

If there is a record that is heavy because it contained a number of pictures in the rich text field etc., then the following issues can occur on such records:

  • Post-create playbooks that are run on records whose record size is very high, then the record creation process displays the "Error 500".

  • Post-update playbooks do not run while updating a large record.
  • Manual trigger playbooks do not get triggered when run on a large record.


Solution

To resolve this issue, do the following:

  1. Run the following command:  
    vi /etc/nginx/conf.d/cyops-workflow.conf 
  2. In the cyops-workflow.conf file, change the value of the client_max_body_size parameter to a higher value based on the size of your records:  
    # max upload size 
    client_max_body_size 75M;
    <- change this to 200M (This value can vary as per record size)
  3. Run the following command: 
    systemctl restart nginx
  4. Check the sealab.log to see if you find the following issue:
    [root@csadmin~]# tail -f /var/log/cyops/cyops-workflow/sealab.log
    [17/Jun/2020 07:00:09] ERROR [django.security.RequestDataTooBig:77] Request body exceeded settings.DATA_UPLOAD_MAX_MEMORY_SIZE. 
    [17/Jun/2020 07:00:09] WARNING [django.request:228] Bad Request: /wf/workflow/start/

    The default value for the DATA_UPLOAD_MAX_MEMORY_SIZE key is '2.5MB' and as per the log, it seems that the record size is greater than 2.5MB. 
  5. To resolve this issue, you have to increase the value of the DATA_UPLOAD_MAX_MEMORY_SIZE key, by editing the settings.py file:
    1. Open the settings.py file:
      # vi /opt/cyops-workflow/sealab/sealab/settings.py
       
    2. Add the following new line in the settings.py file: 
      DATA_UPLOAD_MAX_MEMORY_SIZE = 5242880 
      Note: For post-update triggers to work you require to set the above parameter to double the record size. 
  6. Restart the uwsgi and celery services using the following command:  
    # systemctl restart uwsgi celeryd 
Note: It is highly recommended that images that have larger file sizes should added as "File Attachments" and these attachments should be correlated to records instead of pasting them as inline images.



Contributors