QRadar: Changing the status of an application fails with error "Application instance is not in the required state"

Troubleshooting

Problem

Administrators who try to change the state of an application by using the qappmanager utility can receive the error, "Application instance is not in the required state" when the application is in UPGRADING, STOPPING, or STARTING state in the definition and instance tables.

Symptom

By using the qappmanager utility, display the application status and attempt to stop or start it.

Changing app instance <APP ID> status to STOPPED
POST https://localhost/api/gui_app_framework/applications/<APP ID>?status=STOPPED was unsuccessful
Application instance is not in the required state, status is UPGRADING

The following screen capture shows an example of the QRadar Assistant App in STARTING state, which triggers the error message when is started.

Cause

A previous application upgrade or an unexpected restart did not finish correctly and left the application entry in a nonexpected status by the qappmanager utility.

Environment

7.4.0 and later

Diagnosing The Problem

Log in to the QRadar Console CLI as the root user.
Run the /opt/qradar/support/qappmanager utility.

Check whether the conflicting application is in UPGRADING, STOPPING, or STARTING status on the APP DEFINITIONS and APP INSTANCES tables.

APP DEFINITIONS (SIO=Single Instance Only, MTS=Multi-tenancy Safe):
ID   | Name                      | Version | Status    | Installed        | Memory | Instances | SIO | MTS | Errors
1001 | QRadar Assistant          | 3.5.1   | UPGRADING | 2019-08-07 19:26 |    600 |         1 | t   | t   |

APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):
IID  | DID  | Name              | Status    | Task Status | Installed        | MHN        | AHT   | Memory | SP | Errors
1001 | 1001 | QRadar Assistant  | UPGRADING | UPGRADING   | 2021-11-25 17:39 | <Hostname> | LOCAL |    400 |    |

Select option 23 to change status RUNNING or 24 to change status STOPPED.

The following error shows up:

Changing app instance <APP ID>status to STOPPED
POST https://localhost/api/gui_app_framework/applications/<APP ID>?status=STOPPED was unsuccessful
Application instance is not in the required state, status is UPGRADING

Resolving The Problem

To resolve this problem, administrators must manually change the state of the conflicting application to a state that qappmanager expects in the pertinent tables in the database. If you are not comfortable enough to run the commands that modify the tables in the database, contact QRadar Support for assistance.

Note: In this article, the conflicting application is QRadar Assistant, which has the ID 1001.

Update the APP DEFINITION and APP INSTANCE tables status of the conflicting application.

Create the backup directory.
```
mkdir -pv /store/IBM_Support/
```

Back up the required tables.

pg_dump -U qradar -t installed_application --inserts -f /store/IBM_Support/installed_application.sql-bck$(date +%F)

pg_dump -U qradar -t installed_application_instance --inserts -f /store/IBM_Support/installed_application_instance.sql-bck$(date +%F)

Update the status of the application in the APP DEFINITION table.

psql -U qradar -c "update installed_application set status='COMPLETED' where id = <app-id>;"

Output Example

psql -U qradar -c "update installed_application set status='COMPLETED' where id ='1001';"
UPDATE 1

Update the status of the application in the APP INSTANCE table.

psql -U qradar -c "update installed_application_instance set status='STOPPED',task_status='COMPLETED' where id = <app-id>;"

Output Example

psql -U qradar -c "update installed_application_instance set status='STOPPED',task_status='COMPLETED' where id ='1001';"
UPDATE 1

Run /opt/qradar/support/qappmanager to verify the status of the apps were changed successfully.

The status in the APP DEFINITION table must show COMPLETED.
The status in the APP INSTANCES table must show STOPPED and the task status must show COMPLETED.

APP DEFINITIONS (SIO=Single Instance Only, MTS=Multi-tenancy Safe):
ID   | Name                      | Version | Status    | Installed        | Memory | Instances | SIO | MTS | Errors
1001 | QRadar Assistant          | 3.5.1   | COMPLETED | 2019-08-07 19:26 |    600 |         1 | t   | t   |

APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):
IID  | DID  | Name              | Status    | Task Status | Installed        | MHN        | AHT   | Memory | SP | Errors
1001 | 1001 | QRadar Assistant  | STOPPED   | COMPLETED   | 2021-11-25 17:39 | <Hostname> | LOCAL |    400 |    |

Select option 23 to change the application status to RUNNING.
```
App instance - start > Choose app instance ID: 1001

Changing app instance 1001 status to RUNNING
```
Result

The application was restarted successfully by using the qappmanager utility. If the application was not restarted successfully after the steps in this technote are run, contact QRadar Support for assistance.

Related Information

QRadar: Basic App troubleshooting Before Opening a QRadar Support Ticket

QRadar: About the qappmanager support utility

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0;and future releases"}]

Tips