IBM Support

QRadar: VIS Service Fails to Start Due to Failed Mount of /storetmp

Troubleshooting


Problem

In some scenarios, the VIS service is to be failed and cannot be restarted. The following error messages are observed:-

[root@xxxx ~]# systemctl status vis
● vis.service - VA Integration Server
   Loaded: loaded (/usr/lib/systemd/system/vis.service; static; vendor preset: disabled)
  Drop-In: /etc/systemd/system/vis.service.d
           └─ulimit.conf
   Active: inactive (dead)

systemd[1]: Dependency failed for VA Integration Server.
[1]: vis.service: Job vis.service/start failed with result 'dependency'.
systemd[1]: Dependency failed for VA Integration Server.

Cause

Upon investigation, it was discovered that the issue is a failed mount of the /storetmp directory. The VIS service relies on the /storetmp directory for storing temporary files and data. The failure to mount this directory prevents the VIS service from starting correctly.

Diagnosing The Problem

  1. Review the journalctl logs for error messages that are related to the VIS service and the /storetmp directory.
     
    The following errors were observed under journalctl logs:
    systemd[1]: storetmp.mount: Directory /storetmp to mount over is not empty, mounting anyway.
-- The directory /storetmp is specified as the mount point (second field in
systemd[1]: Mounting /storetmp...
-- Subject: Unit storetmp.mount has begun start-up
-- Unit storetmp.mount has begun starting up.
mount[340022]: mount: /storetmp: /dev/mapper/storetmp already mounted on /storetmp.
systemd[1]: storetmp.mount: Mount process exited, code=exited status=32
systemd[1]: storetmp.mount: Failed with result 'exit-code'.
-- The unit storetmp.mount has entered the 'failed' state with result 'exit-code'.
systemd[1]: Failed to mount /storetmp.
-- Subject: Unit storetmp.mount has failed
  2. Verify the status of storetmp.mount service:
     
      
    root@xxxx ~]# systemctl status storetmp.mount
● storetmp.mount - /storetmp
   Loaded: loaded (/etc/fstab; generated)
   Active: failed (Result: exit-code)
    Where: /storetmp
     What: /dev/mapper/storetmp
     Docs: man:fstab(5)
           man:systemd-fstab-generator(8)

Resolving The Problem

  1. Stop the relevant services to prevent conflicts during the mount process - Note this will cause a disruption in data processing:
      
    # systemctl stop hostcontext
# systemctl stop hostservices
  2. Unmount and remount the /storetmp directory:
      
    # umount /storetmp
# mount /storetmp
  3. Start the relevant services after ensuring that the /storetmp directory is mounted correctly:
      
    # systemctl start hostservices
# systemctl start hostcontext
  4. Issue should be resolved after /storetmp is mounted properly, you can verify the status of storetmp.mount service and VIS service:
      
    [root@xxxx ~]# systemctl status storetmp.mount
● storetmp.mount - /storetmp
   Loaded: loaded (/etc/fstab; generated)
   Active: active (mounted) (Result: exit-code)
    Where: /storetmp
     What: /dev/mapper/storetmp
     Docs: man:fstab(5)
           man:systemd-fstab-generator(8)
    Tasks: 0 (limit: 821277)
   Memory: 0B
   CGroup: /system.slice/storetmp.mount
      
    [root@xxxx ~]# systemctl status vis
● vis.service - VA Integration Server
   Loaded: loaded (/usr/lib/systemd/system/vis.service; static; vendor preset: disabled)
  Drop-In: /etc/systemd/system/vis.service.d
           └─ulimit.conf
   Active: active (running)
  Process: 1725329 ExecStartPre=/opt/qradar/systemd/bin/generate_environment.sh vis auto (code=exited, status=0/SUCCESS)
 Main PID: 1725793 (java)
    Tasks: 79 (limit: 821277)
   Memory: 567.2M
   CGroup: /system.slice/vis.service
           └─1725793 /bin/java -Dfile.encoding=UTF-8 -Djava.io.tmpdir=/storetmp/vis -Dapplication.baseURL=file:///opt/qradar/conf/ -classpath .:/opt/qradar/jars/acme-1.0.jar:/opt/qradar/jars/activation-1.1.1.jar:/o>

systemd[1]: Starting VA Integration Server...
systemd[1]: Started VA Integration Server.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"TS019464791","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.5.0"}]

Document Information

Modified date:
17 July 2025

UID

ibm17236333

Page Feedback