IBM Support

IBM QRadar SIEM Console does not display correctly after upgrade to V7.3.3 or V7.4.0



The IBM QRadar SIEM Console may not load properly, causing display issues, after upgrading to v7.3.3 or v7.4.0. 


User Interface Split View


The issue is because of the file ownership on /opt/qradar/webapps folder.
Post upgrade, the ownership on folder sets to root:root as below :
# ls -larth /opt/qradar/

# drwxr-xr-x   5 root root   85 Feb  3  2020 webapps

Resolving The Problem

Console will be properly visible after following mentioned steps :
1. Stop tomcat service.
#  systemctl stop tomcat
2. Change the ownership on the folder /opt/qradar/webapps to nobody:nobody using command :
# chown -R nobody:nobody /opt/qradar/webapps/
3. Verify if the ownership.

# ls -larth /opt/qradar/

# drwxr-xr-x   5 nobody nobody   85 Feb  3  2020 webapps
4. Start tomcat service.
# systemctl start tomcat
5. Verify status for tomcat service.
# systemctl status tomcat
6. Re-login to Console to load it properly. 

Document Location


[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000Gnc6AAC","label":"QRadar-\u003EUpgrade"}],"ARM Case Number":"TS003625228","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.3;7.4.0","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
01 June 2020