Troubleshooting
Problem
If the docker service fails to start on the console for some reason, the hostservices service also fails to start. And as a result, the tomcat service does not start. The user interface does not load and is disabled through the web browser.
Cause
The failure of the hostservices service to start is caused by a docker service dependency check within the /opt/qradar/systemd/bin/hostservices.sh startup script.
Diagnosing The Problem
Check the status of the following services:
# systemctl status hostservices
# systemctl status docker
Check the service journal output of the hostservices service to look for an error message similar to the following:
# journalctl -u hostservices
...
Dec 08 08:53:11 CONSOLE.corp.com configure-docker-daemon.sh[24897]: Configuring docker daemon...
Dec 08 08:53:11 CONSOLE.corp.com systemd[1]: docker.service: control process exited, code=exited status=1
Dec 08 08:53:11 CONSOLE.corp.com systemd[1]: Failed to start Docker Application Container Engine.
-- Subject: Unit docker.service has failed
Resolving The Problem
To restore access to the web user interface take the following steps:
Make a backup of the /opt/qradar/systemd/bin/hostservices.sh file, for example:
# cp /opt/qradar/systemd/bin/hostservices.sh /store/ibm_support
Then, edit and change following value settings in the /opt/qradar/systemd/bin/hostservices.sh file:
# vim /opt/qradar/systemd/bin/hostservices.sh
Change the following setting values from:
SERVICE_DOCKER_ENABLED=`/opt/qradar/bin/myver -docker`
SUPPORTS_APPS=$(/opt/qradar/bin/myver -sa)
To:
SERVICE_DOCKER_ENABLED=false
SUPPORTS_APPS=false
And save the changes to the file:
wq!
Then, start and check the status of services:
# systemctl start hostservices; systemctl status hostservices
# systemctl start tomcat; systemctl status tomcat
# systemctl start hostcontext; systemctl status hostcontext
Subsequently, to address the issue with the docker service (and the apps) not starting, open a new case with IBM Support for investigation.
Document Location
Worldwide
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000blT9AAI","label":"QRadar->Configuration->Master Console"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
04 January 2021
UID
ibm16217602