IBM Support

QRadar: How to remove Event Processors after failed upgrade from 7.4.0 to 7.4.2.

How To


If one or more event processors fail to upgrade from 7.4.0 to 7.4.2. and does not turn on, it might be impossible to remove or uninstall them through the GUI or by removing them from the tables in the CLI. You can use the following modified procedure to remove them.


Remove unresponsive event processors when other methods fail.


Disconnect any high availability clusters
Note: When you remove an HA host from a cluster, the host restarts.
  1. On the navigation menu, click Admin.
  2. Click the System and License Management icon.
  3. Select the HA host that you want to remove.
  4. From the toolbar, select High Availability > Remove HA Host.
  5. Click OK.
If the procedure does not remove the high availability cluster, users can run the following command from primary managed host:
/opt/qradar/bin/ --uninstall
Note: In some circumstances, the command might need to be run from the secondary as well.
If none of these procedures resolve the issue, contact support for an alternative solution.

Document Location


[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"TS005574895","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.4.2"}]

Document Information

Modified date:
28 April 2022