IBM Support

QRadar: About the qappmanager support utility

Troubleshooting


Problem

In QRadar® 7.4.0 the qappmanager utility was introduced to assist support with managing, controlling, and diagnosing applications. This article is a basic overview the qappmanager support utility.

Resolving The Problem

Administrators who experience issues with QRadar appliances can use this utility to view the status of an application. The qappmanager utility is intended for QRadar Support, but can provide information to administrators to assist with a support case. Administrators might be instructed by QRadar Support representatives to complete specific tasks in the qappmanager utility. Never make changes to an application, unless instructed by QRadar Support. 

Important: To restart applications, administrators should use the QRadar Assistant App.


When administrators run the qappmanager, they are presented with an overview of what is installed and status of each application.
APP Definitions are what applications are installed. The output table shows application criteria such as:
  • Application ID
  • Version
  • Installation status
  • Application status
  • Installed date
  • Memory usage (MB)
  • Multi-tenanted instances
image 3615
APP Instances are the application instances of installed application. The instance can be an application owned by the admin user or tenant user. Applications in this table need to show a status of RUNNING. If the status is displaying ERROR for the application, administrators need to select option 23 to start the app instance. When in ERROR status administrators are presented information on the error for troubleshooting. 
image 3663
The administrator also has information of where the application is installed, memory used and if the application is owned by the Admin or a Tenant, as well as total memory used by applications.
image 3616
The qappmanager has features to show detail information about the application. The qappmanager can start, stop, cancel an installation, and delete applications. For multi-tenant deployments, qappmanager can create or delete instances for applications that need to have data specific for that tenant. If an application is using too many resources, administrators can stop applications for one instance to allocate resources for another.  
Important: If you stop an instance of the application, the application cannot be used by the tenant and might display a blank tab in the user interface.
image 3658
 
Note: Not all applications support multi-tenanted installations. Administrators can confirm functionality from the X-Force® App Exchange or the QRadar Assistant application.
image 3666
The qappmanager offers options to manage app definitions, app instances, and admin users. The following table lists qappmanager options:
 
  0) Quit   
1) Help  
10) App definition - list all  
11) App definition - list authorized  
12) App definition - show manifest  
15) App definition - cancel install  
16) App definition - delete  
20) App instance - list all  
21) App instance - list authorized  
22) App instance - create  
23) App instance - start  
24) App instance - stop  
25) App instance - authorize  
26) App instance - change authorized user  
27) App instance - change security profile  
28) App instance - cancel install  
29) App instance - delete  
30) Augmented security profiles - list  
31) Admin user - add security profile  
32) Admin user - remove security profile  
40) App containers - list  
Choose option:  
Before you begin
  • The qappmanager is only run from the QRadar Console. Administrators with App Host appliances can use qappmanager from the Console to view details for applications installed on their App Host.
  • When you add an application to a tenant, the tenant requires a user, a user role, and security profile.
To run the qappmanager utility:
  1. Use SSH to log in to the Console as root user.
  2. Type the command:
      /opt/qradar/support/qappmanager
  3. Choose an option to run by typing the associated number.
  4. Follow the instructions for each menu.
  5. To exit a previous menu, press CTRL and C.
  6. To exit the qappmanager utility, press 0.

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GnbvAAC","label":"QRadar-\u003EApps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 October 2021

UID

ibm16210362