IBM Support

QRadar: Error when trying to start an app by using the qappmanager "An error occurred setting app status to [RUNNING]."

Troubleshooting


Problem

Administrators who try to restart an application by using the qappmanager utility can receive the following error: 
"An error occurred setting app status to [RUNNING]. Task state found to be [EXCEPTION]."

Symptom

When users open the applications in the user interface, they can see errors such as "404 page not found", "Bad Gateway" or the application tab is not in the interface.
 
The following image illustrates the Log Source Management app not opening and requesting to be downloaded:
imagen1

Diagnosing The Problem

Administrators can use the following steps to reproduce the issue:

  1. SSH to the QRadar Console as a root user.
  2. Start the qappmanager utility:
    Note: The QRadar Log Source Management app is used as an example. 
    /opt/qradar/support/qappmanager
    Output example: 
    APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):
 IID  | DID  | Name                                    | Status  | Task Status | Installed        | MHN     | AHT   | Memory | SP | Errors
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 1151 | 1151 | pulse.full_name                         | STOPPED | COMPLETED   | 2021-09-07 15:55 | console | LOCAL |    350 |    |
 1153 | 1153 | QRadar Use Case Manager                 | STOPPED | COMPLETED   | 2021-09-07 16:04 | console | LOCAL |    500 |    |
 1253 | 1253 | Threat Intelligence                     | RUNNING | COMPLETED   | 2022-06-29 13:53 | console | LOCAL |    800 |    |
 1402 | 1402 | QRadar Assistant                        | RUNNING | COMPLETED   | 2022-10-25 21:22 | console | LOCAL |    600 |    |
 1553 | 1552 | Deployment Intelligence                 | RUNNING | COMPLETED   | 2023-02-17 20:26 | console | LOCAL |    800 |    |
 1555 | 1554 | QRadar Log Source Management            | STOPPED | COMPLETED   | 2023-03-17 15:12 | console | LOCAL |    100 |    |

Total memory used by LOCAL app instances: 2900MB

OPTIONS:
 0) Quit
 1) Help
10) App definition - list all
11) App definition - list authorized
12) App definition - show manifest
13) App definition - cancel install
14) App definition - delete
20) App instance - list all
21) App instance - list authorized
22) App instance - create
23) App instance - start
24) App instance - stop
25) App instance - authorize
26) App instance - change authorized user
27) App instance - change security profile
28) App instance - change memory allocation
29) App instance - cancel install
30) App instance - delete
40) Augmented security profiles - list
41) Admin user - add augmented security profile
42) Admin user - remove augmented security profile
50) App containers - list
Choose option:
  3. From the Options list, select App instance - start (23): 
    OPTIONS:
 0) Quit
 1) Help
10) App definition - list all
11) App definition - list authorized
12) App definition - show manifest
13) App definition - cancel install
14) App definition - delete
20) App instance - list all
21) App instance - list authorized
22) App instance - create
23) App instance - start
24) App instance - stop
25) App instance - authorize
26) App instance - change authorized user
27) App instance - change security profile
28) App instance - change memory allocation
29) App instance - cancel install
30) App instance - delete
40) Augmented security profiles - list
41) Admin user - add augmented security profile
42) Admin user - remove augmented security profile
50) App containers - list
Choose option: 23
  4. Type the number associated with the Authorized Service for your app.
    Note: Select an Admin security profile. 
    To execute this option, you must supply an Admin-capable Authorized Service authentication token

AUTHORIZED SERVICES (SP=Security Profile):
 ID | Name                | SP    | Role
------------------------------------------
 2  | UCM                 | Admin | Admin
 3  | test                | Admin | Admin
 4  | Assistant           | Admin | Admin
 5  | Threat Intelligence | Admin | Admin
 6  | QDI                 | Admin | Admin
App instance - start > Choose Authorized Service ID: 4
  5. Type the application ID for the app that you want to start. In this example, the QRadar Log Source Management app ID is 1555: 
    NOTE: Authorized Service Assistant will be used for any options that require authentication

APP INSTANCES (SP=Security Profile):
 ID   | Name                                    | Status  | Task Status | Installed        | SP
------------------------------------------------------------------------------------------------
 1151 | pulse.full_name                         | STOPPED | COMPLETED   | 2021-09-07 15:55 |
 1153 | QRadar Use Case Manager                 | STOPPED | COMPLETED   | 2021-09-07 16:04 |
 1253 | Threat Intelligence                     | RUNNING | COMPLETED   | 2022-06-29 13:53 |
 1402 | QRadar Assistant                        | RUNNING | COMPLETED   | 2022-10-25 21:22 |
 1553 | Deployment Intelligence                 | RUNNING | COMPLETED   | 2023-02-17 20:26 |
 1555 | QRadar Log Source Management            | STOPPED | COMPLETED   | 2023-03-17 15:12 |
App instance - start > Choose app instance ID or enter 0 to select all: 1555
    Output example: 
    Changing app instance 1555 status to RUNNING

APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):
 IID  | DID  | Name                                    | Status   | Task Status | Installed        |  MHN    | AHT   | Memory | SP | Errors
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 1151 | 1151 | pulse.full_name                         | STOPPED  | COMPLETED   | 2021-09-07 15:55 | console | LOCAL |    350 |    |
 1153 | 1153 | QRadar Use Case Manager                 | STOPPED  | COMPLETED   | 2021-09-07 16:04 | console | LOCAL |    500 |    |
 1253 | 1253 | Threat Intelligence                     | RUNNING  | COMPLETED   | 2022-06-29 13:53 | console | LOCAL |    800 |    |
 1402 | 1402 | QRadar Assistant                        | RUNNING  | COMPLETED   | 2022-10-25 21:22 | console | LOCAL |    600 |    |
 1553 | 1552 | Deployment Intelligence                 | RUNNING  | COMPLETED   | 2023-02-17 20:26 | console | LOCAL |    800 |    |
 1555 | 1554 | QRadar Log Source Management            | ERROR    | ERROR       | 2023-03-17 15:12 | console | LOCAL |    100 |    | An error occurred setting app status to [RUNNING]. Task state found to be [EXCEPTION].

    Result
    Administrators are not able to start the app, instead, they receive the "An error occurred setting app status to [RUNNING]. Task state found to be [EXCEPTION]." message in the Errors field.

     

Resolving The Problem

Administrators clear the tomcat cache to fix the issue with the apps:
Important: Administrator might need a maintenance window to clear the Tomcat cache since this action requires stopping the tomcat service. For more information, see QRadar: Core services and the impact of restarting services.
 
  1. Log in to the QRadar Console as the root user.
  2. Create a backup directory: 
    mkdir -pv /store/ibm_support/
  3. Run the following command to stop the Tomcat service: 
    systemctl stop tomcat
  4. To back up the /opt/tomcat/work/Catalina/localhost directory, enter the following command: 
    cp -pr /opt/tomcat/work/Catalina/localhost/console/org/apache/jsp  /store/ibm_support/
  5. To clear the cached files from the /opt/tomcat/work/Catalina/localhost/console directory, enter the following command: 
    rm -rfv /opt/tomcat/work/Catalina/localhost/console/org/apache/jsp
  6. Run the following command to start the Tomcat service: 
    systemctl restart tomcat
    Result
    Administrator cleared the tomcat cache and the apps are working as expected. If the issue persists, contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0;and future releases"}]

Document Information

Modified date:
13 July 2023

UID

ibm17009209

Page Feedback