IBM Support

QRadar: How to remove Event Processors after failed upgrade from 7.4.0 to 7.4.2.

How To


Summary

If one or more event processors fail to upgrade from 7.4.0 to 7.4.2. and does not turn on, it might be impossible to remove or uninstall them through the GUI or by removing them from the tables in the CLI. You can use the following modified procedure to remove them.

Objective

Remove unresponsive event processors when other methods fail.

Steps

Disconnect any high availability clusters
Note: When you remove an HA host from a cluster, the host restarts.
  1. On the navigation menu, click Admin.
    menu
  2. Click the System and License Management icon.
    icon
  3. Select the HA host that you want to remove.
  4. From the toolbar, select High Availability > Remove HA Host.
    remove
  5. Click OK.
Result
If the procedure does not remove the high availability cluster, users can run the following command from primary managed host:
/opt/qradar/bin/ha_setup.sh --uninstall
Note: In some circumstances, the command might need to be run from the secondary as well.
If none of these procedures resolve the issue, contact support for an alternative solution.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"TS005574895","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.4.2"}]

Document Information

Modified date:
28 April 2022

UID

ibm16554234