IBM Support

QRadar: Error "Application Installation fails on custom log source type conflicts with the existing log source type with Name"

Troubleshooting


Problem

In the Extensions Management menu, during the application installation, you might see a failure message: log source type and their UUIDs do not match. If you try the installation second time, the installation fails with an error: "An error occurred. See console logs for details."

Cause

The issue happens because the application extension has a different ID in the database and in the XML file.

Diagnosing The Problem

To diagnose the issue, perform the following steps:
  1. Log in to the console CLI where the app, content pack, or extension is being installed.
  2. In the QRadar log, search for a more detailed error message with any of the following two commands: 
    grep -i conflict /var/log/qradar.log
    grep -i conflict /var/log/qradar.error
    The following error messages are observed:
    Conflict: The inbound custom log source type with Name: QualysFIMJSONCustom, ID: 4001, and UUID: 512aa96a-4d79-4fdf-9d15-c756865ede3c conflicts with the existing log source type with Name: QualysFIMJSONCustom, ID: 4025 and UUID: a5fc57ea-c1f7-44e9-8285-d568110862a3
The inbound log source type cannot be created because it has the same name as an existing log source type and their UUIDs do not match.
  3. If the inbound log source type replaces the existing one, the UUIDs must match. Check with the following commands. 
    ​psql -U qradar -c "select id,name,description,enabled,uuid from device_ext where uuid = '41f29207-643a-46a3-a6d3-617f1ac5107b';"
    ​psql -U qradar -c "select id,devicetypename,uuid from sensordevicetype where uuid = 'a5fc57ea-c1f7-44e9-8285-d568110862a3'";

Resolving The Problem

Important
  • Read all the steps before you apply them on a production environment. 
  • The following steps require advanced knowledge. Administrators who need assistance with this procedure, contact IBM Support.
Use these steps to find the UUID and rename it to install the application.
  1. SSH to the QRadar console.
  2. Create the backup directory: 
    mkdir -p /store/IBM_Support/
  3. Create a backup for the table: 
    pg_dump -U qradar -t device_ext > /store/IBM_Support/device_ext.sql


pg_dump -U qradar -t sensordevicetype > /store/IBM_Support/sensordevicetype.sql
  4. Take the UUID after the string "Value in dB".
    For example, the DB ID is 41f29207-643a-46a3-a6d3-617f1ac5107b:
  5. Run the next command to rename with the _old: 
    psql -U qradar -c "update device_ext set name = 'QualysFIMJSON_ext_old' where uuid = '<DB_UUID>';"


psql -U qradar -c "update sensordevicetype set devicetypename = 'QualysFIMJSONCustom_old' where uuid = '<DB_UUID>';"
     Command example 
    psql -U qradar -c "update device_ext set name = 'QualysFIMJSON_ext_old' where uuid = '41f29207-643a-46a3-a6d3-617f1ac5107b';"


psql -U qradar -c "update sensordevicetype set devicetypename = 'QualysFIMJSONCustom_old' where uuid = 'a5fc57ea-c1f7-44e9-8285-d568110862a3';"
  6. Confirm the name is updated in the output. The name for this example is Custom_ext_old: 
    psql -U qradar -c "select id,name,description,enabled,uuid from device_ext where uuid = '41f29207-643a-46a3-a6d3-617f1ac5107b';"

psql -U qradar -c "select id,devicetypename,uuid from sensordevicetype where uuid = 'a5fc57ea-c1f7-44e9-8285-d568110862a3'";
  7. Retry the installation.

    Result
    The administrator is able to install the application without receiving any error.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
02 July 2023

UID

ibm17002371

Page Feedback