IBM Support

QRadar: "Not enough memory to install" message in QRadar Assistant

Troubleshooting


Problem

Administrators cannot update applications with QRadar Assistant. The button returns "Not Enough Memory to Install" message.

Symptom

In the QRadar Assistant application, the button display "Not Enough Memory to Install" message:
assistant

Cause

The admin token is not working.

Diagnosing The Problem

The issue can be verified in two ways, either by using the user interface or the CLI.

In the User Interface

  1. Log in to the QRadar Console as an admin user.
  2. Click the QRadar Assistant tab.
  3. Click the Applications tab.
  4. Search for an application.

    Result
    The "Not Enough Memory to Install" message appears.assistant

In the CLI

  1. SSH to the QRadar Console as a root user.
  2. Run the recon command to find the QRadar Assistant app-id: 
    /opt/qradar/support/recon ps
    Output example:
    In this output, the app-id is 1053 
    /opt/qradar/support/recon ps

Output Example:
App-ID  Name              Managed Host ID  Workload ID  Service Name  AB  Container Name  CDEGH  Port  IJKL
1053	QRadar Assistant		53		apps			qapp-1053	++	qapp-1053	+++++	5000	++++
  3. Run the cd command to access to applications logs by using the app-id you obtained. 
    cd /store/docker/volumes/qapp-<id>/log
    Command Example: 
    cd /store/docker/volumes/qapp-1053/log
  4. Run the grep command and search for the "SEC header present" error message in the app.log file. 
    grep -E 'SEC header present' app.log

    Result
    If you find an error stating "You are unauthorized to access the requested resource", you have confirmed the error. 
    [MainThread] [ERROR] [APP_ID:1053] [NOT:0000003000] Failed to fetch list of installed qradar apps: {"http_response":{"code":401,"message":"You are unauthorized to access the requested resource."},"code":18,"description":"","details":{},"message":"No SEC header present in request. Please provide it via \"SEC: token\". You may also use BASIC authentication parameters if this host supports it. e.g. \"Authorization: Basic base64Encoding\""}

Resolving The Problem

To fix the issue, the administrator must create a token and update it on the QRadar Assistant app.
Create a token:
  1. Log in to the QRadar user interface as an admin user.
  2. Go to Admin, then to the Authorized Services tab.
    Authorized Services
  3. Click the +Add Button.image-20230512160955-1
  4. In the Authorized Services label type any name for the new token.
  5. In the permissions section:
    • Select the tenant name or N/A if no tenant.
    • For Security profile, select Admin.
    • User Role selects Admin.
  6. Disable the checkbox for the Expire Settings.
  7. Click the Save button
    save
  8. The following window shows up. The administrator must copy the new token for use later.
    Note: After this window is closed, the token is not displayed anymore.
    copy
Update the token in QRadar Assistant:
  1. Open the application configuration for QRadar Assistant.
  2. Add the new token on the SEC Token tab.
  3. Click the Save button.
    new

    Result
    The administrator can now update or install applications. If the administrator continues to experience issues, contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
15 May 2023

UID

ibm16986655

Page Feedback