IBM Support

QRadar: Failed to start a service with error "Unit is masked."

Troubleshooting


Problem

On Linux systems, masking a service is used to prevent the service from starting. The mask action creates a symbolic link of the service file pointing to /dev/null, which prevents the service from starting unless the service is unmasked.

Cause

Administrator accidentally masked the service.

Diagnosing The Problem

When a service is masked, the service information shows the loaded status as "masked", and when the service is started the error "Unit is masked" shows up. Administrators can confirm that the service is masked by using the following steps:
  1. Use SSH to log in to the QRadar Console as the root user.
  2. SSH to the affected host if it is not the console.
  3. Check the status of the service having startup issues. 
    systemctl status <service>
    Output example: 
    ● <service>.service
   Loaded: masked (/dev/null; bad)
   Active: inactive (dead) since Mon 2023-02-13 09:07:28 CST; 3s ago
 Main PID: 27441 (code=exited, status=0/SUCCESS)
  4. Try to start the service having startup issues. 
    systemctl start <service>
    Output example: 
    Failed to restart <service>.service: Unit is masked.
    Result
    The previous output is enough for the Administrator to know whether the service is masked or not.

Resolving The Problem

To resolve the issue, Administrator must unmask the service by running the following steps:
  1. Use SSH to log in to the QRadar Console as the root user.
  2. SSH to the affected host if it is not the console.
  3. Unmask the service masked. 
    systemctl unmask <service>
  4. Start the service. 
    systemctl start <service>
    Result
    The service is now unmasked and successfully started. If the service still fails to start, contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
07 March 2023

UID

ibm16955075

Page Feedback