Troubleshooting
Problem
Creating any backup (nightly or on demand) does not create the backup files neither gives any error in the UI.
Symptom
While creating a backup, this error can be observed by keywords related to backup:
[root@Source ~]# tailf /var/log/qradar.log | grep -i "Unable to process backup"
Jun 17 11:47:20 ::ffff:127.0.0.1 [hostcontext.hostcontext] [Backup] com.q1labs.hostcontext.backup.BackupRecoveryEngine: [ERROR] [NOT:0000003000][SOURCE_IP/- -] [-/- -]Unable to process backup
Jun 17 11:47:20 ::ffff:127.0.0.1 [hostcontext.hostcontext] [Backup] com.q1labs.configservices.hostcontext.exception.BackupException: unable to process backup target of type manifest-directory
Cause
The error can be caused due to any of the following scenarios:
- Residual file from previous version
- Policy file that is copied after the upgrade
Environment
QRadar IBM SIEM 7.5.0 (commonly in the version Update Pack 12)
Diagnosing The Problem
To diagnose the problem, run the following checks:
- Check entries of manifest-directory backup type:
grep -i "manifest-directory" /var/log/qradar.log
When the system is failing to create backups due to manifest policy type the following errors are shown.
Expected output:
Jun 17 11:26:57 ::ffff:127.0.0.1 [hostcontext.hostcontext] [BackupServices_backup] com.q1labs.hostcontext.backup.BackupRecoveryEngine: [ERROR] [NOT:0150023105][10.122.24.76/- -] [-/- -]Backup Failed: com.q1labs.configservices.hostcontext.exception.BackupException: unable to process backup target of type manifest-directory
Jun 17 11:26:57 ::ffff:127.0.0.1 [hostcontext.hostcontext] [BackupServices_backup] com.q1labs.configservices.hostcontext.exception.BackupException: unable to process backup target of type manifest-directory
- Check if a backup policy exists inside the manifest directory:
ls -l /opt/qradar/conf/manifest/POLICY.Java.MANIFEST
If the file exists, it means that residual policies are currently affecting the system.
Resolving The Problem
Disclaimer:
This technote is not Qradar specific. It is intended to assist local system administrators who have experience with running commands on a Linux® system.
Steps:
- Make a copy of the backup policy
[root@Source ~]# mkdir -p /store/ibm_support/
[root@Source ~]# cp -pr /opt/qradar/conf/manifest/POLICY.Java.MANIFEST /store/ibm_support/
- Remove the backup policy
[root@Source ~]# rm /opt/qradar/conf/manifest/POLICY.Java.MANIFEST
Then proceed making an on-demand backup to confirm the issue resolution:
If you continue to experience error, contact IBM QRadar Support
Related Information
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"TS019606965","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.5.0"}]
Was this topic helpful?
Document Information
Modified date:
17 July 2025
UID
ibm17237020