IBM Support

How to check if a QRadar Application (App) is running

How To


Summary

This article shows you how to confirm Apps status are RUNNING.

Steps

For QRadar 7.4.0: Apps health check

  1. Using an SSH session, login to the Console as the root user.
  2. Type the command:
psql -U qradar -c "select i.id,i.name,i.status,i.task_status,i.managed_host_id, m.hostname from installed_application_instance as i left join managedhost as m on m.id = i.managed_host_id;"
Note: The output of the psql command shows the status of all Apps. The status should show RUNNING.
Example:
[root@training1 ~]# psql -U qradar -c "select i.id,i.name,i.status,i.task_status,i.managed_host_id, m.hostname from installed_application_instance as i left join managedhost as m on m.id = i.managed_host_id;"

  id  |             name             | status  | task_status | managed_host_id |   hostname
------+------------------------------+---------+-------------+-----------------+---------------
 1151 | QRadar Log Source Management | RUNNING | COMPLETED   |             103 | QRadarAPPHost
 1201 | QRadar Assistant             | RUNNING | COMPLETED   |             103 | QRadarAPPHost
 1301 | pulse.full_name              | RUNNING | COMPLETED   |             103 | QRadarAPPHost
 1302 | Pulse - Threat Globe         | RUNNING | COMPLETED   |             103 | QRadarAPPHost
 1351 | Deployment Intelligence      | RUNNING | COMPLETED   |             103 | QRadarAPPHost

For QRadar 7.3.2 and 7.3.3: Apps health check

  1. Using an SSH session, login to the Console as the root user.
  2. Type the command:
psql -U qradar -c "select i.id,i.name,i.status,i.task_status,i.managed_host_id, m.hostname from installed_application as i left join managedhost as m on m.id = i.managed_host_id;"

Note: The output of the psql command shows the status of all Apps. The status should show RUNNING.

Example:

[root@training1 ~]# psql -U qradar -c "select i.id,i.name,i.status,i.task_status,i.managed_host_id, m.hostname from installed_application as i left join managedhost as m on m.id = i.managed_host_id;"

  id  |             name             | status  | task_status | managed_host_id |   hostname
------+------------------------------+---------+-------------+-----------------+--------------
 1205 | QRadar Log Source Management | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1207 | Pulse - Threat Globe         | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1206 | pulse.full_name              | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1201 | User Analytics               | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1001 | Deployment Intelligence      | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1202 | Reference Data Import - LDAP | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1251 | QRadar Assistant             | RUNNING | COMPLETED   |             153 | exampleAPPHost

For QRadar 7.3.1 and prior: Apps health check

  1. Using an SSH session, login to the Console as the root user.
  2. Type the command:

# psql -U qradar -c "select id,name,status,task_id,task_status,image_repo,marathon_id,memory from installed_application;"

Note: The output of the psql command shows the status of all Apps. The status should show RUNNING.

Example:
[root@training1 ~]# psql -U qradar -c "select id,name,status,task_id,task_status,image_repo,marathon_id,memory from installed_application;"

  id  |             name             | status  | task_id | task_status |           image_repo            | marathon_id | memory

------+------------------------------+---------+---------+-------------+---------------------------------+-------------+--------

 1002 | App Authorization Manager    | RUNNING |       9 | COMPLETED   | qapp/1002:1.0.13                | /qapp-1002  |    200

 1261 | Deployment Intelligence      | RUNNING |    8786 | COMPLETED   | qapp/1261:2.1.4-20180917165158  | /qapp-1261  |    600

 1260 | Machine Learning Analytics   | RUNNING |    9809 | COMPLETED   | qapp/1260:3.0.0-20180928181711  | /qapp-1260  |   5000

 1462 | Pulse - Threat Globe         | RUNNING |    8795 | COMPLETED   | qapp/1462:1.1.2-20180917165635  | /qapp-1462  |    200

 1552 | User Analytics               | RUNNING |   10070 | COMPLETED   | qapp/1552:3.0.0-20181002150541  | /qapp-1552  |    800

 1553 | Reference Data Import - LDAP | RUNNING |   10076 | COMPLETED   | qapp/1553:3.0.0-20181002150846  | /qapp-1553  |    200

 1353 | Threat Intelligence          | RUNNING |    8803 | COMPLETED   | qapp/1353:1.4.0-20180917170108  | /qapp-1353  |    200

 1269 | IBM QRadar Operations        | RUNNING |    8823 | COMPLETED   | qapp/1269:1.3.0-20180917170618  | /qapp-1269  |    200

 1461 | pulse.full_name              | RUNNING |    8551 | COMPLETED   | qapp/1461:2.1.1-20180913113521  | /qapp-1461  |    350

 1506 | QRadar Advisor With Watson   | RUNNING |    9173 | COMPLETED   | qapp/1506:1.14.0-20180920083920 | /qapp-1506  |   1024

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GnbvAAC","label":"QRadar->Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"QRadar 7.3, 7.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
13 April 2020

UID

ibm16152433