IBM Support

QRadar: Applications are stuck in STARTING status

Troubleshooting


Problem

Apps get stuck in 'STARTING' status after deploying changes or restarting the Tomcat service.

Diagnosing The Problem

Administrators run the following steps to confirm the issue:
  1. Login to the QRadar Console as the root user.
  2. Check the application instances status by using the qappmanager tool: 
     APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):
 IID  | DID  | Name                               | Status   | Task Status | Installed        | MHN           | AHT   | Memory | SP | Errors
----------------------------------------------------------------------------------------------------------------------------------------------
 1001 | 1001 | Application X                      | STARTING | STARTING    | 2021-03-23 13:45 | QRadarConsole | LOCAL |    200 |    |
    Result
    The administrator found that an application instance is stuck in the STARTING status.

Resolving The Problem

An application instance in STARTING status does not show up on the QRadar User Interface (UI) and fails to restart by using the qappmanager tool because the app status is not valid for restart. Administrators run the following steps to resolve the issue:
  1. Login to the QRadar Console as the root user.
  2. Create a backup directory: 
    mkdir -pv /store/ibm_support
  3. Create a backup of the installed_application_instance table: 
    pg_dump -U qradar -t installed_application_instance --inserts -f /store/ibm_support/installed_application_instance.sql-$(date +%F)
  4. Set the non-starting application instances status to STOPPED: 
    psql -U qradar -c "update installed_application_instance set status='STOPPED',task_status='COMPLETED' where task_status='STARTING'"
    Output example:
    UPDATE X
  5. Confirm that the non-starting application instances status is now STOPPED by using the qappmanager tool: 
     APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):
         IID  | DID  | Name                               | Status  | Task Status | Installed        | MHN           | AHT   | Memory | SP | Errors
         ----------------------------------------------------------------------------------------------------------------------------------------------
         1001 | 1001 | Application X                      | STOPPED | COMPLETED   | 2021-03-23 13:45 | QRadarConsole | LOCAL |    200 |    |
  6. Stop the application by using the qappmanager tool.
  7. Start the application by using the qappmanager tool.
    Result
    The application is now running and accessible from the QRadar User Interface (UI). If the issue persists, contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
14 March 2024

UID

ibm17130349

Page Feedback