IBM Support

QRadar: VIS service failed to start



The VIS service is the scanner component that connects to scanning integration points and runs on all hosts. The VIS process is unable to start and fails with an error notification.


The VIS process fails with the following error notification.
Error:  [ProcessMonitor] com.q1labs.hostcontext.processmonitor.
ProcessManager: [ERROR] [NOT:0150114103][x.x.x.x/- -] 
[-/- -]Process vis.vis0 has failed to start for 1950 intervals.  
Continuing to try to start...

Diagnosing The Problem

  1. Log in to QRadar console as the root user.
  2. Check whether the VIS service is down.
    # systemctl status vis
    vis.service - VA Integration Server
    Loaded: loaded (/usr/lib/systemd/system/vis.service; static; vendor preset: disabled)
     Drop-In: /etc/systemd/system/vis.service.d
      Active: failed (Result: exit-code) since Thu 2022-12-29 16:49:24 IST; 28s ago
  3. Check that there is no VIS directory.
    # ls -ld /storetmp/vis/
    ls: cannot access /storetmp/vis/: No such file or directory

Resolving The Problem

If there is no VIS directory, perform the following steps:
  1. Create the directory by running the following command.
    # mkdir /storetmp/vis
  2. Assign the required permissions.
    # chown vis:qradar /storetmp/vis
The VIS service starts again.

Document Location


[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS011665296","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
31 May 2023