Installing the QRadar Log Source Management app

Use the IBM® QRadar® Assistant app to install the QRadar Log Source Management app archive on your QRadar computer.

Before you begin

Before you install the app, ensure that the QRadar Log Source Management app meets the minimum memory (RAM) requirements. The QRadar Log Source Management app requires ∫100 MB of free memory from the application pool of memory. If the QRadar Log Source Management app fails to install, then your application pool does not have enough free memory to run the app. Consider adding an App Node or an App Host to your QRadar deployment. For more information on calculating the required memory, see Apps and Resource Limitation (https://support content.ibm.com/support/pages/qradar-apps-and-memory-resource-limitation).

QRadar 7.3.0 and 7.3.1 use an App Node, which is an unmanaged host, that is dedicated to running apps. Provision an App Node to provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console.

QRadar 7.3.2 uses an App Host, which is a managed host, that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console. For more information, see App Hosts.

Procedure

  1. Choose one of the following methods to download your app:
    • If the IBM QRadar Assistant app is configured on QRadar, use the following instructions to install the QRadar Log Source Management app: QRadar Assistant app (https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.apps.doc/t_qradar_adm_assistant_download.html).
    • If the QRadar Assistant app is not configured, download the QRadar Log Source Management app archive from the IBM Security App Exchange (https://apps.xforce.ibmcloud.com/) onto your local computer. You must have an IBM ID to access the App Exchange.
  2. If you downloaded the app from the App Exchange, complete the following steps:
    1. On the QRadar Console, click Admin > Extensions Management.
    2. On the Extension Management page, click Add and select the app archive that you want to upload to the console.
    3. Select the Install immediately check box.
      Important: You might have to wait several minutes before your app becomes active.
    4. To preview the contents of an app after it is added and before it is installed, select it from the list of extensions, and click More Details. Expand the folders to view the individual content items in each group.

Results

When the installation is complete, if you have Admin > System Administrator assigned to your User Role, a QRadar Log Source Management subsection appears in the Apps section on the Admin tab.

If you have Delegated Administration > Manage Log Sources assigned to your User Role, a system administrator must add the QRadar Log Source Management capability to your user role.

What to do next

When the installation is complete, clear your browser cache and refresh the browser window before you use the app.