IBM Support

QRadar: Deploy Changes does not complete (APAR IJ15811)

Troubleshooting


Problem

After attempting deploy changes, users might notice that the deploy changes does not complete as expected and a timeout message is displayed to users. It has been reported that the system can generate and fail to clean up a .NODOWNLOAD file that causes managed hosts to timeout with a deploy changes is attempted. Administrators who experience issues with deploy changes can review the issue is described in APAR IJ15811.

Symptom

When deploying changes from the User Interface (UI) the deploy changes does not complete from the Console. The Deploy Status menu has the console in an initiating state indefinitely or the user interface displays a timeout message.

Diagnosing The Problem

Administrators who have recently completed a software update or who experience general deploy timeout issues can check for the presence of a hostcontext.NODOWNLOAD file. This file is intended to prevent deploys from downloading new changes while a deploy is in progress in order to prevent replication issues between the managed host and the Console. There are situations where the .NODOWNLOAD file is not removed properly, which prevents future attempts to deploy changes from successfully completing in the user interface. When this occurs, administrators might notice that the deploy times out or a specific appliance repeatedly fails to deploy in a distributed deployment.

Resolving The Problem

Before you Begin

  • Do not remove the file hostcontext.NODOWNLOAD while a software update or patch is in progress on the QRadar appliance. The command-line interface will display a message, "Patch in progress -- Do not reboot!" when a software update is ongoing.
  • Backup the hostcontext.NODOWNLOAD file to a safe location before starting these instructions.
  • In QRadar 7.3.0 and earlier, a deploy changes can cause services to reload. Administrators should be aware of interruptions to core services that can cause data loss.

To resolve this issue on an All-in-One appliance

  1. Using SSH, log in to the QRadar Console as the root user.
    NOTE: If you see a "Patch in progress -- Do not reboot! message, do not attempt to remove the .NODOWNLOAD file.
  2. To verify a .NODOWNLOAD file exists, type: ls /opt/qradar/conf/hostcontext.NODOWNLOAD
  3. If the file exists, type: rm /opt/qradar/conf/hostcontext.NODOWNLOAD
  4. Press Y to confirm the deletion of the file.
  5. Log in to the QRadar user interface as an administrator.
  6. Open the Admin tab.
    NOTE: In later versions of QRadar, click the navigation menu ☰ , and then click Admin to open the Admin tab.
  7. Click Advanced > Deploy Full Configuration.
  8. Click Continue.

    Results
    After the administrator has removed the .NODOWNLOAD file, the deploy changes should successfully complete.

To resolve this issue in a distributed deployment (multiple appliances)

  1. Using SSH, log in to the QRadar Console as the root user.
  2. To verify if the hostcontext.NODOWNLOAD file is present on any appliances, type:  /opt/qradar/support/all_servers.sh "ls /opt/qradar/conf/hostcontext.NODOWNLOAD"
  3. Open an SSH session to each appliance that the file hostcontext.NODOWNLOAD exists.
    NOTE: If you see a "Patch in progress -- Do not reboot! message, do not attempt to remove the .NODOWNLOAD file.
  4. To remove the .NODOWNLOAD file, type: rm /opt/qradar/conf/hostcontext.NODOWNLOAD
  5. Press Y to confirm the deletion of the file.
  6. Repeat steps 3 to 5 for each managed host with a .NODOWNLOAD file.
  7. Log in to the QRadar user interface as an administrator.
  8. Open the Admin tab.
    NOTE: In later versions of QRadar, click the navigation menu ☰ , and then click Admin to open the Admin tab.
  9. Click Advanced > Deploy Full Configuration.
  10. Click Continue.

    Results
    After the administrator has removed the .NODOWNLOAD file, the deploy changes should successfully complete.


[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Deploy Changes","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2.8;7.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
20 September 2019

UID

ibm10744001