IBM Support

QRadar: How to determine if Applications (Apps) are installed on the Console or App Host

How To


Summary

One of the first steps in troubleshooting apps is to determine whether they are installed on the Console or App Host. This article explains how to determine where apps are installed.

Environment

QRadar 7.4 and 7.5

Steps

  1. SSH to the Console as the root user.
  2. Type the following command to run the qappmanager utility: 
    /opt/qradar/support/qappmanager
  3. When prompted, enter 20 to access the option "App instance - list all".

    Result
    In the output, the MHN column identifies the host where the apps reside.
    The host consoleprimary is hosting the apps in this example output:
    [root@consoleprimary ~]# /opt/qradar/support/qappmanager
-------------------------------output truncated----------------------------------------------------    
APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):
 IID  | DID  | Name                         | Status  | Task Status | Installed        | MHN            | AHT   | Memory | SP | Errors
---------------------------------------------------------------------------------------------------------------------------------------
 2701 | 2701 | QRadar Log Source Management | RUNNING | COMPLETED   | YYYY-MM-DD TIME | consoleprimary | LOCAL |    100 |    |       
 2702 | 2702 | pulse.full_name              | RUNNING | COMPLETED   | YYYY-MM-DD TIME | consoleprimary | LOCAL |    350 |    |       
 2703 | 2703 | threatglobe.name             | RUNNING | COMPLETED   | YYYY-MM-DD TIME | consoleprimary | LOCAL |    200 |    |       
 2704 | 2704 | QRadar Assistant             | RUNNING | COMPLETED   | YYYY-MM-DD TIME | consoleprimary | LOCAL |    600 |    |       
 2705 | 2705 | QRadar Use Case Manager      | RUNNING | COMPLETED   | YYYY-MM-DD TIME | consoleprimary | LOCAL |    500 |    |  
-------------------------------output truncated----------------------------------------------------

Document Location

Worldwide

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000GnbvAAC","label":"QRadar-\u003EApps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
31 May 2023

UID

ibm16152523

Page Feedback