IBM Support

QRadar: Service dead but pid file exists



When trying to restart a QRadar-service (or query the service's status), you might come across the following error:
  • In QRadar versions 7.2.8 similar to
    /opt/qradar/init/ status [instance name]
    (QRadar-service|instance name) dead but pid file exists
  • In QRadar versions 7.3. the error is similar to
    systemctl status <QRadar-service>
    ERROR: ... <QRadar-service>: <QRadar-service> dead but pid file exists

Resolving The Problem

Before you begin:

Restarting services may cause interruptions with logging data. Please schedule a maintenance period before you restart services.
  1. Login to the QRadar Console using an SSH session as the root user.
  2. If the affected appliance is not the console SSH to that appliance.
  3. Confirm that the /store/IBM_Support exists
    mkdir -p /store/IBM_Support
  4. Check QRadar's pid file directory for the presence of the service's pid file:
    1. ls -l /store/tmp/status | grep -i "<QRadar-service>"
    2. If the pid file is present (<QRadar-service>.pid), move it:
      mv /store/tmp/status/<QRadar-service>.pid /store/IBM_Support
  5. Check for the presence of a lock file:
    1. ls -l /var/lock/subsys | grep -i "<QRadar-service>"
    2. If the lock file is present, move it:
       mv /var/lock/subsys/<QRadar-service> /store/IBM_Support
  6. To confirm whether the service has restarted automatically, run the command:
    1. In QRadar versions 7.3
      Type:  systemctl status <QRadar-service>
    2. In QRadar version 7.2.8
      Type:  /opt/qradar/init/<QRadar-service> status [instance name]
      Example: /opt/qradar/init/qflow status qflow0

      The output should be similar to
      Status <QRadar-service>
      QRadar-service> (pid  ###) is running...
      QRadar-service> status                                             [  OK  ]
  7. If the service is still stopped, execute:
    1. In QRadar versions 7.3
      Type: systemctl restart <QRadar-service>
    2. In QRadar version 7.2.8
      Type:  /opt/qradar/init/<QRadar-service> start [instance name]
      Example:  /opt/qradar/init/qflow start qflow0

Where do you find more information?

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Operating System","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2;7.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
23 April 2019