IBM Support

QRadar: How to determine container port usage for QRadar Docker Apps



This article discusses how to determine the port used for QRadar Docker Apps.

Resolving The Problem

Determine the ports by using Docker

Use this command to get the IDs of the running Apps and feed them into the docker port command to see an output of the ports being used by each App: 

docker ps -a --format "{{.ID}},{{.Image}}" | grep qapp | cut -d, -f1 | xargs -t -n1 docker port 


The command returns the ports. Example output:

docker port 073c50fdaddd
5000/tcp ->
docker port e3eed31e1ff7
5000/tcp ->

Alternatively, determine the ports by using the utility tools:

You can use the qapp_utils to get the App ID and Port in 7.2.8, 7.3.0 and 7.3.1 versions. To get the App ID and Port in 7.3.2 use the recon utility.

  • In QRadar versions 7.3.2 and above run the command:
    /opt/qradar/support/recon ps
  • In QRadar versions 7.3.0 and 7.3.1 run the command:
    /opt/qradar/support/ ps./
  • In QRadar versions 7.2.8 run the command:
    /opt/qradar/support/ ps


The command returns the ports. Example output:

Collecting app data......... Complete!

Id    Name                Container    Container Image          Container ip:port     Host ip:port          ABCDEFGHIJ
1051  Threat Intelligence c7310bec276f qregi...2-20181107191246    +-++++++++
1002  App Authorizatio... 5beffe147606 qregi...qapp/1002:1.0.13     ++++++++++
1001  QRadar Assistant    4c15fd5ea8d9 qregi.../qapp/1001:1.1.1    ++++++++++

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"App Framework","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2.8;7.3.0;7.3.1;7.3.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
24 May 2022