Troubleshooting
Problem
When an administrator attempts to import a configuration backup that is corrupted, the backup is unable to be processed by QRadar, since it detects that the backup is not in a "gzip" or "tgz" format. The purpose of this article is to help the administrator troubleshoot the issue, and to verify the correct status of the backup.
Symptom
After an import attempt, the following error is found in the /var/log/qradar.log file in the console:
[hostcontext.hostcontext] [BackupServices_sync] com.q1labs.hostcontext.backup.BackupRecoveryEngine: [ERROR]
Cannot process inbound backup archive: backup.nightly.QRADAR01_53.13_09_2022.config.1663126258427.tgz. Move it to 'invalid' directory
QRADAR root:
QRADAR root: gzip: stdin: not in gzip format
QRADAR root: tar: Child returned status 1
QRADAR root: tar: Error is not recoverable: exiting now
QRADAR root: [backup.sh] ERROR: Failed to extract backup
[hostcontext.hostcontext] [Thread-180722] ComponentOutput: [ERROR][-/- -]ErrorStream backup_extract:
QRADAR root: [backup.sh] ERROR: Failed to extract backup
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]
Log InLog in to view more of this document
This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.
Was this topic helpful?
Document Information
Modified date:
14 March 2023
UID
ibm16841891