QRadar: Content Extension or Application Installation Fails on CEP Conflict

Diagnosing The Problem

1. SSH to the console as the root user
2. Search the logs for a more detailed error with the following command:

   ​grep -i contentcustom /var/log/qradar.log

   There are two possible messages that can be corrected:
   1. There's a conflict with an existing name

      Conflict during the import of property [Originating_User], found an existing property with the same name but different [type/id]

   2. There's a conflict with an existing UUID

      ​Property with id [c5496d4e-dd49-46ab-b6dc-04a892757a23] already exists but have a different name

3. Important: If the output seen doesn't match either of these messages, contact QRadar® Support for further assistance.
4. If the issue is identified as a conflict with an existing UUID in step 2, query Postgres to find the CEP name with this command:

   ​# psql -U qradar -c "select id, propertyname, database, username from ariel_regex_property where id='<UUID>';"

   Here's an example output:

   ​# psql -U qradar -c "select id, propertyname, database, username from ariel_regex_property where id='c5496d4e-dd49-46ab-b6dc-04a892757a23';"
                     id                  |   propertyname   | database | username
   --------------------------------------+------------------+----------+----------
    0d7b6408-e76c-4765-95e9-c9a8c3693a0e | Originating User | events   | admin
   (1 row)