IBM Support

How to check if a QRadar Application (App) is running

How To


Summary

This article shows you how to confirm Apps status are RUNNING.

Steps

 

For QRadar 7.5.0: Apps health check

  1. Using an SSH session, log in to the Console as the root user.
  2. Type the command:
/opt/qradar/support/qappmanager
Note: The output of the qappmanager command shows the status of all Apps. The status will show RUNNING. It will show STOPPED if the application has previously been set to STOPPED.
Example:

# /opt/qradar/support/qappmanager

APP DEFINITIONS (SIO=Single Instance Only, MTS=Multi-tenancy Safe):

 ID   | Name                         | Version | Status    | Installed        | Memory | Instances | SIO | MTS | Errors                                                                          

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

 1103 | pulse.full_name              | 2.2.9   | COMPLETED | 2022-04-26 07:21 |    350 |         1 | t   | t   |                                                                                                                                                     

 1105 | QRadar Use Case Manager      | 3.6.0   | COMPLETED | 2022-04-26 07:25 |    500 |         1 | f   | f   |                                                                                 

 1560 | QRadar Log Source Management | 7.0.7   | COMPLETED | 2022-11-01 10:42 |    100 |         1 | t   | t   |             

 1569 | Deployment Intelligence      | 3.0.7   | COMPLETED | 2022-11-23 04:29 |    800 |         1 | t   | f   |                                                                                 

 1606 | User Analytics               | 4.1.8   | COMPLETED | 2022-12-02 05:45 |   1000 |         1 | f   | t   |                                                                                 

APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):

 IID  | DID  | Name                         | Status  | Task Status | Installed        | MHN   | AHT   | Memory | SP | Errors

------------------------------------------------------------------------------------------------------------------------------

 1103 | 1103 | pulse.full_name              | RUNNING | COMPLETED   | 2022-04-26 07:21 | MHN | LOCAL |    350 |    |       

 1105 | 1105 | QRadar Use Case Manager      | RUNNING | COMPLETED   | 2022-04-26 07:25 | MHN | LOCAL |   1000 |    |       

 1560 | 1560 | QRadar Log Source Management | RUNNING | COMPLETED   | 2022-11-01 10:42 | MHN | LOCAL |    100 |    |       

 1569 | 1569 | Deployment Intelligence      | RUNNING | COMPLETED   | 2022-11-23 04:29 | MHN | LOCAL |   1000 |    |       

 1606 | 1606 | User Analytics               | STOPPED | COMPLETED   | 2022-12-02 05:45 | MHN | LOCAL |   1000 |    |       

For QRadar 7.4.0: Apps health check

  1. Using an SSH session, log in to the Console as the root user.
  2. Type the command:
/opt/qradar/support/qappmanager
Note: The output of the qappmanager command shows the status of all Apps. The status will show RUNNING. It will show STOPPED if the application has previously been set to STOPPED.
Example:

# /opt/qradar/support/qappmanager

APP DEFINITIONS (SIO=Single Instance Only, MTS=Multi-tenancy Safe):

 ID   | Name                         | Version | Status    | Installed        | Memory | Instances | SIO | MTS | Errors                                                                          

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

 1103 | pulse.full_name              | 2.2.9   | COMPLETED | 2022-04-26 07:21 |    350 |         1 | t   | t   |                                                                                                                                                     

 1105 | QRadar Use Case Manager      | 3.6.0   | COMPLETED | 2022-04-26 07:25 |    500 |         1 | f   | f   |                                                                                 

 1560 | QRadar Log Source Management | 7.0.7   | COMPLETED | 2022-11-01 10:42 |    100 |         1 | t   | t   |             

 1569 | Deployment Intelligence      | 3.0.7   | COMPLETED | 2022-11-23 04:29 |    800 |         1 | t   | f   |                                                                                 

 1606 | User Analytics               | 4.1.8   | COMPLETED | 2022-12-02 05:45 |   1000 |         1 | f   | t   |                                                                                 

APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):

 IID  | DID  | Name                         | Status  | Task Status | Installed        | MHN   | AHT   | Memory | SP | Errors

------------------------------------------------------------------------------------------------------------------------------

 1103 | 1103 | pulse.full_name              | RUNNING | COMPLETED   | 2022-04-26 07:21 | MHN | LOCAL |    350 |    |       

 1105 | 1105 | QRadar Use Case Manager      | RUNNING | COMPLETED   | 2022-04-26 07:25 | MHN | LOCAL |   1000 |    |       

 1560 | 1560 | QRadar Log Source Management | RUNNING | COMPLETED   | 2022-11-01 10:42 | MHN | LOCAL |    100 |    |       

 1569 | 1569 | Deployment Intelligence      | RUNNING | COMPLETED   | 2022-11-23 04:29 | MHN | LOCAL |   1000 |    |       

 1606 | 1606 | User Analytics               | STOPPED | COMPLETED   | 2022-12-02 05:45 | MHN | LOCAL |   1000 |    |       

For QRadar 7.3.2 and 7.3.3: Apps health check

  1. Using an SSH session, log in to the Console as the root user.
  2. Type the command:
psql -U qradar -c "select i.id,i.name,i.status,i.task_status,i.managed_host_id, m.hostname from installed_application as i left join managedhost as m on m.id = i.managed_host_id;"

Note: The output of the psql command shows the status of all Apps. The status should show RUNNING.

Example:

[root@training1 ~]# psql -U qradar -c "select i.id,i.name,i.status,i.task_status,i.managed_host_id, m.hostname from installed_application as i left join managedhost as m on m.id = i.managed_host_id;"

  id  |             name             | status  | task_status | managed_host_id |   hostname
------+------------------------------+---------+-------------+-----------------+--------------
 1205 | QRadar Log Source Management | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1207 | Pulse - Threat Globe         | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1206 | pulse.full_name              | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1201 | User Analytics               | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1001 | Deployment Intelligence      | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1202 | Reference Data Import - LDAP | RUNNING | COMPLETED   |             153 | exampleAPPHost
 1251 | QRadar Assistant             | RUNNING | COMPLETED   |             153 | exampleAPPHost

For QRadar 7.3.1 and prior: Apps health check

  1. Using an SSH session, log in to the Console as the root user.
  2. Type the command:

# psql -U qradar -c "select id,name,status,task_id,task_status,image_repo,marathon_id,memory from installed_application;"

Note: The output of the psql command shows the status of all Apps. The status should show RUNNING.

Example:
[root@training1 ~]# psql -U qradar -c "select id,name,status,task_id,task_status,image_repo,marathon_id,memory from installed_application;"

  id  |             name             | status  | task_id | task_status |           image_repo            | marathon_id | memory

------+------------------------------+---------+---------+-------------+---------------------------------+-------------+--------

 1002 | App Authorization Manager    | RUNNING |       9 | COMPLETED   | qapp/1002:1.0.13                | /qapp-1002  |    200

 1261 | Deployment Intelligence      | RUNNING |    8786 | COMPLETED   | qapp/1261:2.1.4-20180917165158  | /qapp-1261  |    600

 1260 | Machine Learning Analytics   | RUNNING |    9809 | COMPLETED   | qapp/1260:3.0.0-20180928181711  | /qapp-1260  |   5000

 1462 | Pulse - Threat Globe         | RUNNING |    8795 | COMPLETED   | qapp/1462:1.1.2-20180917165635  | /qapp-1462  |    200

 1552 | User Analytics               | RUNNING |   10070 | COMPLETED   | qapp/1552:3.0.0-20181002150541  | /qapp-1552  |    800

 1553 | Reference Data Import - LDAP | RUNNING |   10076 | COMPLETED   | qapp/1553:3.0.0-20181002150846  | /qapp-1553  |    200

 1353 | Threat Intelligence          | RUNNING |    8803 | COMPLETED   | qapp/1353:1.4.0-20180917170108  | /qapp-1353  |    200

 1269 | IBM QRadar Operations        | RUNNING |    8823 | COMPLETED   | qapp/1269:1.3.0-20180917170618  | /qapp-1269  |    200

 1461 | pulse.full_name              | RUNNING |    8551 | COMPLETED   | qapp/1461:2.1.1-20180913113521  | /qapp-1461  |    350

 1506 | QRadar Advisor With Watson   | RUNNING |    9173 | COMPLETED   | qapp/1506:1.14.0-20180920083920 | /qapp-1506  |   1024

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GnbvAAC","label":"QRadar-\u003EApps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"QRadar 7.3, 7.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
19 December 2023

UID

ibm16152433

Page Feedback