Troubleshooting
Problem
The VIS service is the scanner component that connects to scanning integration points and runs on all hosts. The VIS process is unable to start and fails with an error notification.
Cause
The VIS process fails with the following error notification.
Error: [ProcessMonitor] com.q1labs.hostcontext.processmonitor.
ProcessManager: [ERROR] [NOT:0150114103][x.x.x.x/- -]
[-/- -]Process vis.vis0 has failed to start for 1950 intervals.
Continuing to try to start...
Diagnosing The Problem
- Log in to QRadar console as the root user.
- Check whether the VIS service is down.
# systemctl status visvis.service - VA Integration Server Loaded: loaded (/usr/lib/systemd/system/vis.service; static; vendor preset: disabled) Drop-In: /etc/systemd/system/vis.service.d └─ulimit.conf Active: failed (Result: exit-code) since Thu 2022-12-29 16:49:24 IST; 28s ago - Check that there is no VIS directory.
# ls -ld /storetmp/vis/ls: cannot access /storetmp/vis/: No such file or directory
Resolving The Problem
If there is no VIS directory, perform the following steps:
- Create the directory by running the following command.
# mkdir /storetmp/vis - Assign the required permissions.
# chown vis:qradar /storetmp/vis
ResultThe VIS service starts again.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS011665296","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
31 May 2023
UID
ibm16997521