ML app status is in an error state

If the Machine Learning Analytics (ML) app fails to install and the Machine Learning Settings shows an Error status, you can use the cURL command line tool and the API Documentation settings to uninstall the ML app.

Procedure

If the Machine Learning Analytics (ML) App Status in the Machine Learning Settings page shows Error, complete the procedure to uninstall the failed app.

ML app Error
Note: You must have a valid authentication token. You can see the list of configured authentication tokens in the Authorized Services section in the Admin settings of the QRadar® Console.
  1. Using SSH, log in to the QRadar Console.
  2. Run the following command:
    # psql -U qradar -c 'select id,name,status from installed_application'
    Example output: 
     id  |  name  |  status
-----+---------------------------------+--------- 
1356 | User Analytics | RUNNING
1358 | Machine Learning Analytics | ERROR
1357 | dataimport.ldap.applicationname | RUNNING
  3. Locate and record the id value for Machine Learning Analytics from the output of the command.
  4. Using a valid authentication token in the place of <valid token> and the recorded id value in place of <id>, run the following command to uninstall the failed Machine Learning app: # curl -X DELETE -k -H 'SEC:<valid token>' https://127.0.0.1/api/gui_app_framework/applications/<id>

Removing the Machine Learning app

To remove the Machine Learning app using the gui_app_framework API, complete the following steps:
  1. Open the QRadar Console and navigate to the API doc page at the following location: https://<host_address_port>/api_doc
  2. Open the folder for the highest API version number (the number is different based on the QRadar version; for example, 7.0 on QR 7.2.8).
  3. Open the /gui_app_framework folder and then select /applications.
  4. At this point, you should be at the GET API. Click the "Try It Out!" button to get the list of installed applications.
  5. Search for Machine Learning Analytics in the results from step 4 and get the application_id attribute value.
  6. Expand the /applications menu in the API docs (same location as step 3), select the /application_id API and click the DELETE tab.
  7. Enter the application ID value from step 5 and then click the "Try It Out!" button to remove the application.
  8. The API should return an HTTP 204 status code to indicate the application was successfully removed.