QRadar: Starting apps that are in an ERROR state or do not display in the user interface

To resolve the issue by using the QRadar Assistant app.

1. Log in the QRadar Console as admin user.
2. Click the QRadar Assistant app shield.
   
3. Click Applications.
4. Click Manage.
   
5. Under Installed Extensions, locate the App with the issue.
   Note: The red bar indicates an application is in an error state or stopped.
   
6. In the Options column, click the ellipsis (...) to expand the menu.
7. Click Start All Instances.

Results
The app instance starts and the bar changes from red to blue if successful.

The qappmanager utility is installed on QRadar V7.4 Console appliances after an auto update is run for the first time. The utility has all the functionality of the recon utility and the API to manage apps. It also has more functionality to manage apps. The scope of this article is to address how to use the utility to start or stop apps that might not be appearing in the UI or are in an error state. In some cases apps are not showing in the UI and not in an error state, but restating the app can resolve the issue.

Notes: 

• This application is intended primarily for QRadar Support representatives and is considered a support tool.
• In order to perform these steps you need to have an authentication token with admin rights.
• You don't need to have the token, but this token needs to exist. On step 4, the tool displays the existing tokens and requests to select one with admin rights.
• For more information on how to create the authentication token, check Creating an authorized service token for QRadar Operations.

To use the qappmanager:

1. Use SSH to log in to the Console as root user.
2. Type the command: /opt/qradar/support/qappmanager
   Note: The Assistant app will be used as an example.
3. From the Options list, select App instance - start (23).
   
4. Type the number associated with the Authorized Service for your app.
   Note: This must be an Admin security profile.
   
5. Type the application ID for the app you want to start. The QRadar Assistant app 1453 is used in the example.
   
6. The application should display a status of RUNNING.
   
7. From Choose option, enter 0 to exit the qappmanager utility.

The qappmanager is not available in QRadar 7.3.x versions so administrators need to use the Developers interactive API to locate the App-ID and start the app.

To resolve the issue by using the recon utility and API.

1. Log in to the Console as admin user.
2. Click the navigation menu (☰) > Interactive API for Developers
3. Expand gui_app_framework.
4. Click Applications.
   
5. Click Try It Out
6. Search in the Response Body for the application that is not working. Record the Application ID and its status.
   
7. Expand applications.
8. Click application_id.
9. Click POST.
10. In the Parameter application_id, enter the App-ID from step #6
    
11. In the Parameter status, enter RUNNING.
12. Click Try it Out!

{
  "installed_on": 1579643001405,
  "application_state": {
    "memory": 2000,
    "application_id": "1101",
    "status": "STARTING"
  },
  "manifest": {
    "description": "Machine Learning Analytics",
    "console_ip": "192.168.0.80",
    "uuid": "3f42e91e-bab9-4e7f-a943-64067a728f70",
    "app_id": 1101,
    "multitenancy_safe": "true",
    "resources": {
      "memory": 2000
    },
    "version": "3.8.0",
    "dependencies": {
      "rpms_directory": "/src_deps/init/rpms",
      "pip_directory": "/src_deps/init/pip"