IBM Support

QRadar: App Installation fails with error "Failed to extract compressed archive"

Troubleshooting


Problem

Administrators who try to install applications or content packs can face an error when the application file is in the decompression stage. When this issue occurs, consequent application installations also fail.

Symptom

The following symptoms can be seen when the issue occurs:
  • When an application installation on the Extension Management is attempted, it reports the error "See server logs for further details".
    Figure01
  • In the QRadar Assistant application, the application to be installed shows "Retry Install". In the following example, the Qualys VM for QRadar application was affected by this issue.

    Error02

Cause

A previous application installation leaves a directory that affects the extraction of the files inside the content package.

Environment

7.4.0 and later.

Diagnosing The Problem

In addition to the symptoms in the user interface, the administrators can confirm the issue by using the grep command and search for "content_management" and "FileNotFoundException" in /var/log/qradar.log.
  1. Log in to the QRadar Console command line as the root user.
  2. Run the following grep command to decompression error.
    grep -E 'content_management|FileNotFoundException' /var/log/qradar.log
    Output Example
    [tomcat.tomcat] [[email protected]] com.ibm.si.content_management.types.compression.Zip: 
    [ERROR][-/- -]Encountered error decompressing file [/store/cmt/exports/20220104232917.zip]
    [tomcat.tomcat] [[email protected]] com.ibm.si.content_management.types.compression.Zip: 
    [ERROR][-/- -]Unable to close ZipInputStream
    [tomcat.tomcat] [[email protected]] com.ibm.si.content_management.ContentManager: 
    [ERROR][-/- -]Failed to extract compressed archive [/store/cmt/exports/20220104232917.zip]
    [tomcat.tomcat] [[email protected]] com.ibm.si.content_management.ContentManager: 
    [ERROR][-/- -]Failed to unmarshall XML content of file [/store/cmt/exports/20220104232917.zip]
    [tomcat.tomcat] [[email protected]] java.io.FileNotFoundException: /store/cmt/exports/20220104232917.zip (Is a directory)

Resolving The Problem

To resolve the problem, administrators must delete the application or extension that failed.
 
  1. Delete the failed extension in extensions management.
    1. Log in to the QRadar Console user interface as an administrator user.
    2. Click the Admin tab.
    3. Click the Extensions Management menu.
  2. In the Extensions Management menu, search the failed extension and click delete. 

    Figure02
     
  3. Then, click delete again to confirm the action.

    Figure03
     
  4. After the extension was deleted, upload the application extension again and try the installation.
  5. Add the extension in extensions management.
  6. Verify the application got installed successfully in the Extensions Management menu.

    Result
    The required application is now installed. If an error occurs after the steps in this technote are run, contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0;and future releases"}]

Document Information

Modified date:
01 July 2022

UID

ibm16589209