IBM Support

QRadar: About the qappmanager support utility

Troubleshooting


Problem

In QRadar® 7.4.0 the qappmanager utility was introduced to assist support with managing, controlling, and diagnosing applications. This article is a basic overview the qappmanager support utility.

Resolving The Problem

Administrators who experience issues with QRadar appliances can use this utility to view the status of an application. The qappmanager utility is intended for QRadar Support, but can provide information to administrators to assist with a support case. Administrators might be instructed by QRadar Support representatives to complete specific tasks in the qappmanager utility. Never make changes to an application, unless instructed by QRadar Support. 

Important: To restart applications, administrators need to use the QRadar Assistant App.


When administrators run the qappmanager, they are presented with an overview of what is installed and status of each application.
APP Definitions are what applications are installed. The output table shows application criteria such as:
  • Application ID
  • Version
  • Installation status
  • Application status
  • Installed date
  • Memory usage (MB)
  • Multi-tenanted instances
image 3615
APP Instances are the application instances of installed application. The instance can be an application owned by the admin user or tenant user. Applications in this table need to show a status of RUNNING. If the status is displaying ERROR for the application, administrators need to select option 23 to start the app instance. When in ERROR status administrators are presented information on the error for troubleshooting. 
image 3663
The administrator also has information of where the application is installed, memory used and if the application is owned by the Admin or a Tenant, as well as total memory used by applications.
image 3616
The qappmanager has features to show detail information about the application. The qappmanager can start, stop, cancel an installation, and delete applications. For multi-tenant deployments, qappmanager can create or delete instances for applications that need to have data specific for that tenant. If an application is using too many resources, administrators can stop applications for one instance to allocate resources for another.  
Important: If you stop an instance of the application, the application cannot be used by the tenant, and might display a blank tab in the user interface.
image 3658
 
Note: Not all applications support multi-tenanted installations. Administrators can confirm functionality from the X-Force® App Exchange or the QRadar Assistant application.
image 3666
The qappmanager offers options to manage app definitions, app instances, and admin users. The following table lists qappmanager options:
 
  OPTIONS:
 0) Quit
 1) Help
10) App definition - list all
11) App definition - list authorized
12) App definition - show manifest
13) App definition - cancel install
14) App definition - delete
20) App instance - list all
21) App instance - list authorized
22) App instance - create
23) App instance - start
24) App instance - stop
25) App instance - authorize
26) App instance - change authorized user
27) App instance - change security profile
28) App instance - change memory allocation
29) App instance - cancel install
30) App instance - delete
40) Augmented security profiles - list
41) Admin user - add augmented security profile
42) Admin user - remove augmented security profile
50) App containers - list
Choose option:
Before you begin
  • The qappmanager is only run from the QRadar Console. Administrators with App Host appliances can use qappmanager from the Console to view details for applications installed on their App Host.
  • When you add an application to a tenant, the tenant requires a user, a user role, and security profile.
To run the qappmanager utility:
  1. Use SSH to log in to the Console as root user.
  2. Type the command: 
      /opt/qradar/support/qappmanager
  3. Choose an option to run by typing the associated number.
  4. Follow the instructions for each menu.
  5. To exit a previous menu, press CTRL and C.
  6. To exit the qappmanager utility, press 0.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"},{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.3;7.5.0"}]

Document Information

Modified date:
02 November 2022

UID

ibm16210362

Page Feedback