QRadar: Detached App Host upgrade can hang on 'Applying presql script' as described in APAR IJ31253

Troubleshooting

Problem

When patching a App Host that has been detached from the deployment, the installer can hang when 'Applying presql script' in the QRadar command line interface. Administrators who experience this issue can confirm the process ID for the IMQ service and apply the described workaround to continue the upgrade. It is critical that administrators do NOT attempt to reboot or force the installer to quit, but use the IMQ service instructions provided in this technical note to allow the App Host upgrade to continue.

Symptom

If the detached QRadar App Host appliance appears to be stuck on 'Applying presql script' and does not transition to the next step in the patch process after 10 minutes or more, administrators might need to apply the workaround in this technical note.

Resolving The Problem

Use SSH to log in to the QRadar Console command line as the root user.
Open a second SSH session to the App Host appliance.
To get the process ID (PID) for the IMQ service, type:
```
systemctl status imq | grep -i PID
```

To stop IMQ using the following command, type:

gdb --batch --eval-command 'call exit(0)' --pid <IMQPID>

In certain situations, exiting the Main PID from step 3, does not allow the installer to continue. In that case, you might have to use the gdb command on the CGroup PID, and not the Main PID. For example, the PID to be used here is the CGroup PID 4290 and not the Main PID 4205.
```
# systemctl status imq
● imq.service - IMQ
   Loaded: loaded (/usr/lib/systemd/system/imq.service; static; vendor preset: disabled)
  Drop-In: /usr/lib/systemd/system/imq.service.d
           └─imq_systemd.conf
   Active: deactivating (final sigterm) (Result: exit-code) since Tue 2021-08-24 15:57:41 UTC; 2 days ago
 Main PID: 4205 (code=exited, status=143)
 CGroup: /system.slice/imq.service
           └─4290 /usr/java/j2sdk/bin/java 
```
Results
After the command is run, the upgrade can continue as normal. If your App Host upgrade appears to still be stuck on 'Applying presql script', contact QRadar Support for assistance. It is critical for administrators to never exit an upgrade in process, attempt to reboot an appliance mid-upgrade, or force close the installer during a software upgrade. Ensure that your case description summarizes the issue, any steps you completed, and include a reference to APAR IJ31253 in your case summary.

Related Information

IJ31253: PATCHING A DETACHED QRADAR APP HOST CAN HANG AT 'APPLYING PRESQL SCRIP…

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"TS005179307","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.3.3;7.4.0;7.4.1;7.4.2"}]

Document Information

Modified date:
01 December 2021

UID

ibm16428037

Tips