IBM Support

QRadar: App troubleshooting before opening a support case

Troubleshooting


Problem

The procedure in this document outlines steps administrators need to take before opening a support ticket. The steps outline how administrators can stop, start, and delete applications with the QRadar API if they are experiencing difficulty opening applications in the QRadar User Interface, installing or uninstalling applications. As opposed to the QRadar API administrators can also use the qappmanager utility to manage applications by following this documentation: qappmanager utility

Resolving The Problem

Choose one of these solutions for an application.
 

How to start and stop QRadar Applications

1. Log in to the QRadar UI as an admin.

2. From the menu, click Interactive API for Developers. QRadar ships with several API versions, with the latest version being indicated by the highest version number. QRadar Support recommends using the most recent API version.

3. Select: gui_app_framework from the menu.

Application Post

4. Select: applications. 

5. Scroll down and click the Try It Out button. In the Response Field, it returns the application_id for the applications. 

Application ID

Application ID

6. Select from the menu {application_id} that is located under applications:

7. Click the POST tab. In the application_id field, type the application ID number of the application you want to stop or start.

Application Post

8. To stop or start your application, type one of the following options in the Status field:

  • STOPPED - this value stops the application after you click the Try it Out button.
  • RUNNING - this value starts the application after you click the Try it Out button.
API Stopped Application

9. Verify the response field returned for the command displays 200 (OK).  The response code returned verifies that the command was successfully sent to the QRadar API. 

API Stopped Try It Out

How to delete and reinstall a QRadar Application

1. Log in to the QRadar UI as an admin.

2. From the menu, click Interactive API for Developers. QRadar ships with several API versions, with the latest version being indicated by the highest version number. QRadar Support recommends you use the most recent API version.

3. Select: gui_app_framework from the menu.

Application Delete

4. Select: applications. 

5. Scroll down and click the Try It Out button. In the Response Field, it returns the application_id for the applications. 

Application ID

Application ID

6. Select from the menu {application_id} that is located under applications:

7. Click the DELETE tab. In the application_id field, type the application ID number of the application you want to delete.

Application Delete

7. Go to Admin > Extensions Management or Assistant application on your QRadar UI and verify whether the application is deleted. If not, delete it and then the application can be reinstalled.

Results
If the issue wasn't resolved by restarting applications or deleting and reinstalling the application, administrators can open a support ticket with IBM QRadar Support. IBM QRadar Support troubleshoots and resolves issues related to the QRadar application framework and issues related to IBM developed applications. For non-IBM applications, see the X-Force App Exchange website to identify the support representative for your specific application. Administrators can also ask questions through the QRadar Customer forums at: QRadar Support Forum.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
01 December 2022

UID

ibm10716891