QRadar: App Installation fails with error "Failed to extract compressed archive"

Troubleshooting

Problem

Administrators who try to install applications or content packs can face an error when the application file is in the decompression stage. When this issue occurs, consequent application installations also fail.

Symptom

The following symptoms can be seen when the issue occurs:

When an application installation on the Extension Management is attempted, it reports the error "See server logs for further details".
In the QRadar Assistant application, the application to be installed shows "Retry Install". In the following example, the Qualys VM for QRadar application was affected by this issue.

Cause

A previous application installation leaves a directory that affects the extraction of the files inside the content package.

Environment

7.4.0 and later.

Diagnosing The Problem

In addition to the symptoms in the user interface, the administrators can confirm the issue by using the grep command and search for "content_management" and "FileNotFoundException" in /var/log/qradar.log.

Run the following grep command to decompression error.

grep -E 'content_management|FileNotFoundException' /var/log/qradar.log

Output Example

[tomcat.tomcat] [Assistant@169.254.3.8] com.ibm.si.content_management.types.compression.Zip: 
[ERROR][-/- -]Encountered error decompressing file [/store/cmt/exports/20220104232917.zip]
[tomcat.tomcat] [Assistant@169.254.3.8] com.ibm.si.content_management.types.compression.Zip: 
[ERROR][-/- -]Unable to close ZipInputStream
[tomcat.tomcat] [Assistant@169.254.3.8] com.ibm.si.content_management.ContentManager: 
[ERROR][-/- -]Failed to extract compressed archive [/store/cmt/exports/20220104232917.zip]
[tomcat.tomcat] [Assistant@169.254.3.8] com.ibm.si.content_management.ContentManager: 
[ERROR][-/- -]Failed to unmarshall XML content of file [/store/cmt/exports/20220104232917.zip]
[tomcat.tomcat] [Assistant@169.254.3.8] java.io.FileNotFoundException: /store/cmt/exports/20220104232917.zip (Is a directory)

Resolving The Problem

To resolve the problem, administrators must delete the application or extension that failed.

Delete the failed extension in extensions management.
1. Log in to the QRadar Console user interface as an administrator user.
2. Click the Admin tab.
3. Click the Extensions Management menu.
In the Extensions Management menu, search the failed extension and click delete.
Then, click delete again to confirm the action.
After the extension was deleted, upload the application extension again and try the installation.
Add the extension in extensions management.
Verify the application got installed successfully in the Extensions Management menu.

Result
The required application is now installed. If an error occurs after the steps in this technote are run, contact QRadar Support for assistance.

Related Information

Installing extensions by using Extensions Management

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0;and future releases"}]

Tips