IBM Support

QRadar: An orphaned ha_setup process can cause deploys to fail until it is killed

Troubleshooting


Problem

In QRadar versions previous to 7.5.0 Update Pack 6 (Build 20230519190832), in some circumstances an orphaned historical ha_setup.sh process can prevent a deployment action from completing.

Environment

The issue is resolved in 7.5.0 Update Pack 6 (Build 20230519190832).

Diagnosing The Problem

 After an unsuccessful attempt to deploy changes, check the qradar.log file for messages similar to the following.
[hostcontext.hostcontext] [ConfigChangeObserver Timer[1]] com.q1labs.configservices.util.ConfigServicesUtil: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]There is another ha_setup currently in progress
[hostcontext.hostcontext] [ConfigChangeObserver Timer[1]] com.q1labs.hostcontext.configuration.ConfigChangeObserver: [INFO] [NOT:0000006000][x.x.x.x/- -] [-/- -]Setting deployment status to Error

Resolving The Problem

If there are no expected HA setup procedures ongoing, and there are no other contributing factors, killing this process allows a subsequent deployment action to complete:
  1. Verify with your team that HA setup procedures are not ongoing, or recently processed and might still be running.
  2. Identify the process by using the ps command on any affected host: 
    ps -ef | grep ha_setup

66786 1 S 0 root 1 0 19 0 - 29370 do_wai Thu Feb 23 10:21:38 2023 S ? 00:00:00 /bin/bash /opt/qradar/ha/bin/ha_setup.sh --deploy
  3. Then, kill the found process: 
    kill <PID>
    In this case, it is 66786. 
    # kill 66786
  4. Restart the hostcontext service: 
    # systemctl restart hostcontext
  5. Try again to deploy the changes.
Result
Changes successfully deployed.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS013041320","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0"}]

Document Information

Modified date:
05 September 2023

UID

ibm17029644

Page Feedback