IBM Support

QRadar: How to remove Event Processors after failed upgrade from 7.4.0 to 7.4.2

How To


Summary

If one or more event processors fail to upgrade from 7.4.0 to 7.4.2. and does not turn on, it might be impossible to remove or uninstall them through the GUI or by removing them from the tables in the CLI. You can use the following modified procedure to remove them.

Objective

Remove unresponsive event processors when other methods fail.

Steps

Disconnect any high availability clusters
Note: When you remove an HA host from a cluster, the host restarts.
  1. On the navigation menu, click Admin.
    menu
  2. Click the System and License Management icon.
    icon
  3. Select the HA host that you want to remove.
  4. From the toolbar, select High Availability > Remove HA Host.
    remove
  5. Click OK.

    Result
    If the procedure does not remove the high availability cluster, users can run the following command from primary managed host: 
    /opt/qradar/bin/ha_setup.sh --uninstall
    Note: In some circumstances, the command might need to be run from the secondary as well.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"TS005574895","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.4.2"}]

Document Information

Modified date:
02 August 2023

UID

ibm16554234

Page Feedback