Troubleshooting
Problem
If an attempt to upgrade an app that uses Assistant or the extension management tool fails, it can cause the app to go into "Error" state.
Symptom
- Connect to your qradar console by using ssh
- Start qappmanager:
/opt/qradar/support/qappmanager
- Try to start the application that uses option 23
- Enter any security profile id with Admin/Admin
- Enter the id of the application that you want to start
- Observe the following error:
In qradar.log:[tomcat.tomcat] [pool-3-thread-7] com.q1labs.restapi_annotations.content.exceptions.endpointExceptions.ServerProcessingException: An error occurred while registering app instance with id XXXX with QRadar.
2751 | 2751 | QRadar Log Source Management | ERROR | ERROR | 2023-03-13 07:46 | consoleprimary | LOCAL | 100 | | An error occurred while registering app instance with id 2751 with QRadar.
Note: For more information on Qappmanager, visit: https://www.ibm.com/support/pages/qradar-about-qappmanager-support-utility
Cause
When an application goes through the upgrade process, the app zip_source_file path is changed to a temporary location.
If the upgrade fails, the path is not always reverted to the initial value.
Environment
IBM Qradar version 7.5
Diagnosing The Problem
- Connect to your qradar console by using ssh
- Run the following command:
psql -U qradar -c "select id,name,zip_source_file_path from installed_application;"
[root@hostname ~]# psql -U qradar -c "select id,name,zip_source_file_path from installed_application;" id | name | zip_source_file_path ------+------------------------------+--------------------------- 2702 | pulse.full_name | /store/qapp/2702/2702.zip 2705 | QRadar Use Case Manager | /store/qapp/2705/2705.zip 2704 | QRadar Assistant | /store/qapp/2704/2704.zip 2751 | QRadar Log Source Management | /storetmp/AppFmw/2751.zip 2801 | Deployment Intelligence | /store/qapp/2801/2801.zip
- In this scenario, the path for the application with id 2751 (Log source management) is "/storetmp/AppFmw/2751.zip"
- Confirm that the path does not exist:
ls <path>
[root@hostname ~]# ls /storetmp/AppFmw/2751.zip ls: cannot access /storetmp/AppFmw/2751.zip: No such file or directory
Resolving The Problem
- Rerun the previous psql command:
psql -U qradar -c "select id,name,zip_source_file_path from installed_application;"
- Note the application id:
ID Here-> 2751 | QRadar Log Source Management | /storetmp/AppFmw/2751.zip
- Correct the zip_source_file_path:
[root@hostname ~]# psql -U qradar -c "update installed_application set zip_source_file_path='/store/qapp/<ID>/<ID>.zip' where id=<ID>;"
Replace <ID> with the real application id noted in step 2.
Example:[root@hostname ~]# psql -U qradar -c "update installed_application set zip_source_file_path='/store/qapp/2751/2751.zip' where id= 2751;" UPDATE 1
- Verify that the path has been successfully updated:
psql -U qradar -c "select id,name,zip_source_file_path from installed_application;"
Example:[root@hostname ~]# psql -U qradar -c "select id,name,zip_source_file_path from installed_application;" id | name | zip_source_file_path ------+------------------------------+--------------------------- 2702 | pulse.full_name | /store/qapp/2702/2702.zip 2705 | QRadar Use Case Manager | /store/qapp/2705/2705.zip 2751 | QRadar Log Source Management | /store/qapp/2751/2751.zip 2704 | QRadar Assistant | /store/qapp/2704/2704.zip <-- Here 2801 | Deployment Intelligence | /store/qapp/2801/2801.zip
- Try to restart the application by using qappmanager:
/opt/qradar/support/qappmanager
Result
The application should start without throwing a docker registration error.
Related Information
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.5.0"}]
Was this topic helpful?
Document Information
Modified date:
30 May 2023
UID
ibm16997505