IBM Support

QRadar: hostcontext service restarting after QRadar configuration restore

Troubleshooting


Problem

After completing a QRadar Configuration Restore users may experience an issue were the QRadar services fails to start correctly.

Symptom

One of the symptons that users may experience is the hostcontext service is constantly in a restart cycle.
The following message may be visible in the qradar.log file.
[hostcontext.hostcontext] [main] com.sun.messaging.jms.JMSException: [C4003]: Error occurred on connection creation [{*}xxx.xxx.xxx.xxx:7677{*}]. - cause: java.net.NoRouteToHostException: No route to host (Host unreachable)

Diagnosing The Problem

  1. SSH in to the QRadar Console as the root user.
  2. Review the file /opt/qradar/conf/frameworks.properties and confirm if the old IP Address for the QRadar Console is still present and it has not been updated with the QRadar Consoles new IP Address. 
    cat /opt/qradar/conf/frameworks.properties | grep xxx.xxx.xxx.xxx

Resolving The Problem

To resolve this issue the file /opt/qradar/conf/frameworks.properties has to be updated with the correct QRadar Console IP Address.
  1. SSH in to the QRadar Console as the root user.
  2. Take a backup of the /opt/qradar/conf/frameworks.properties file before we make any changes.
    Create a location to store the backup file. 
    mkdir -v /storetmp/ibm_support/framework.properties.backup
mkdir: created directory ‘/storetmp/ibm_support/framework.properties.backup’
    Take a backup of the framework.properties file. 
    cp -pv /opt/qradar/conf/frameworks.properties /storetmp/ibm_support/framework.properties.backup/
‘/opt/qradar/conf/frameworks.properties’ -> ‘/storetmp/ibm_support/framework.properties.backup/frameworks.properties’
  3. Edit the frameworks.properties file and change the IP Address to the correct QRadar Console IP address.
    To edit the framework.properties file. 
    vi /opt/qradar/conf/frameworks.properties
    Make the required changes, then save the file with the following command. 
    :wq
  4. The QRadar services are required to be stopped and started in the following order for the changes to take affect.
    Stop the hostcontext service. 
    systemctl stop hostcontext
    Stop the tomcat service. 
    systemctl stop tomcat
    Stop the hostservices service. 
    systemctl stop hostservices
    Start the hostservices service. 
    systemctl start hostservices
    Start the tomcat service. 
    systemctl start tomcat
    Start the hostcontext service. 
    systemctl start hostcontext
Result:
QRadar will restart successfully, no reference to the message cause: java.net.NoRouteToHostException: No route to host (Host unreachable) will be seen in the qradar.log file.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
15 May 2024

UID

ibm17150167

Page Feedback