IBM Support

QRadar: How to increase application installation check time out values (appfw.app.health.check.failed)

Troubleshooting


Problem

The installation check times out before Flask has time to start, resulting in applications not being installed properly.

Cause

There are a number of reasons why an application installation can time out. For example, a slow network connection between the QRadar App Host and the Console appliance. Applications like UBA and DNS Analyzer can use significant resources when they are installed.

Examples of when to increase timeout values:

Diagnosing The Problem

Applications that repeatedly fail to install might be experiencing an application framework health check time out. QRadar includes default values for application installs that might need to be increased by an administrator. Administrators who continually see application installation issues when other apps are operational can confirm if the logs report appfw.app.health.check.failed errors.

Example from /var/log/qradar.log:
Mar  1 21:47:35 ::ffff:10.x.x.x [tomcat.tomcat] [admin@X.X.X.X] com.example.si.data_ingestion.api.impl.cmt.tasks.InstallExtensionTask: [ERROR] [NOT:0000003000][10.x.x.x/- -] [-/- -]installing extension with id = 3609 failed:
appfw.app.health.check.failed

Resolving The Problem

If the installation check is timing out before Flask has time to start, then you can increase the health check timeout with nva.conf.

Before you begin
The procedure to extend the application framework health check must be applied on the Console appliance. Administrators are not required to SSH to the QRadar App Host as the full deploy in this procedure replicates nva.conf to other appliances, including the QRadar App Host.
 
  1. Use SSH to log in to the Console as root user.
  2. Navigate to /store/configservices/staging/globalconfig/
  3. Before you make any changes, copy nva.conf to a backup location: 
    cp -p /store/configservices/staging/globalconfig/nva.conf /store/IBM_Support/nva.conf
  4. Create another copy of the file that you edit. 
    cp -p /store/configservices/staging/globalconfig/nva.conf /store/IBM_Support/nva.conf-temp
  5. Change directories by using the command 
    cd /store/IBM_Support/
  6. Edit nva.conf-temp.
  7. Search for values that begin with APPFW_HEALTH_CHECK.
  8. Increase the values for APP_HEALTH_CHECK:
    APPFW_HEALTH_CHECK_DELAY_SECONDS=30 # Default delay between each attempt.
    APPFW_HEALTH_CHECK_RETRY_LIMIT=20 # Default number of attempts.
    Important: Administrators must not increase the timeout values by more than 3 times the default, unless advised by a QRadar support representative.
  9. Save your changes.
  10. Copy the file nva.conf-temp to the original nva.conf file by using the command. 
    cp -p /store/IBM_Support/nva.conf-temp /store/configservices/staging/globalconfig/nva.conf
  11. Log in to the QRadar Console as an administrator.
  12. Click the Admin tab.
    Important: Deploy Full Configuration results in services being restarted. While services are restarting, event processing stops until services restart. Scheduled reports that are in-progress need to be manually restarted by users. Administrators with strict outage policies are advised to complete the next step during a scheduled maintenance window for their organization.
  13. Click Advanced > Deploy Full Configuration.
  14. Attempt to install the application.

    Results
    If the application does not install after the health check timeout is increased, contact QRadar Support.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GnbvAAC","label":"QRadar->Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.2;7.3;7.4","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
18 August 2020

UID

swg22009385

Page Feedback