Unable to run SIEM agent as a Cron job from crontab

Products

• CASB Audit
• CASB Gateway Advanced

Issue/Introduction

Running the SIEM agent from crontab results in the following error: 

Log_Exporter_Client-ERROR-Config.json does not exist or it is not present in the same directory in which qradar_agent.py is present. Exiting!

 

Cause

The config.json needs to be in the location the Python command is running from, not the location of the SIEM agent .py file.

The cron command looks like the following

python /home/admin/SIEM agent/qradar_agent.py --severity all

Resolution

Place the config.json file in the location where the python command is running from.  The default for cron is the home directory of the use running the job.  If it is root, then place the config.json in /root.  For other users it will be /home/<username>