IBM Support

QRadar: Error "UUID in dB and extension package is not the same" when installing an app

Troubleshooting


Problem

​In the Extensions Management menu, after an application file is installed the following error is captured "For the importing extension, the UUID in dB and extension package is not the same". It appears in the /var/log/qradar.error log file.

Cause

The issue happens because the application extension has a different ID in the database and in the XML file.

Diagnosing The Problem

The app extension has a different ID in the database and in the XML File, follow the next steps to confirm if the environment has the same issue:

  1. Log in to the QRadar console GUI as the administrator user.
  2. Click the Admin tab.
  3. Click Extension Management:
    Figure02
  4. In the Extension Management menu, click Add.
  5. Browse the application or content pack package.
  6. Click the "Install immediately" box, then Add:
    Figure03

    Result
    The error "For the importing extension, the UUID in dB and extension package is not the same" appears. In some cases, instead of a descriptive error, you might see a generic message that states "An error occurred.  See logs for details." as seen in the following screenshot. 
  7. Proceed to Resolving The Problem.
An error has occured.

Resolving The Problem

Important
  • Read all the steps before they are applied on a production environment. 
  • The following steps require advanced knowledge. Administrators who feel uncomfortable with this procedure or need assistance, contact QRadar Support.
Use these steps to find the UUID and rename it to be able to install the app.
  1. SSH to the QRadar console.
  2. Create the backup directory:
    mkdir -p /store/IBM_Support/
  3. Create a backup for the table:
    pg_dump -U qradar -t device_ext > /store/IBM_Support/device_ext.sql
  4. Run the next command to find the DB UUID in the qradar.error file:
    grep "extension package is not the same" /var/log/qradar.error
    The result looks like this:
    Import of Field UUID from the ContentType: deviceextension experienced/caused 
    failure. Value in dB: 5a033f18-1234-5678-8327-a0171790fffe; value in XML: 
    f6696a03-1234-5678-8fc4-fd2ca900e164; Error: For the importing extension, 
    the UUID in dB and extension package is not the same
  5. Take the UUID after the string "Value in dB".
    For this example, the DB ID is 5a033f18-1234-5678-8327-a0171790fffe:
  6. To retrieve the Extension with the problematic UUID, run the following command. Replace DB_UUID with the DB UUID from the output in Step 5
    psql -U qradar -c "select * from device_ext where uuid = '<DB_UUID>';"
    For this example, the error shows 5a033f18-1234-5678-8327-a0171790fffe as the DB UUID:
    <...> Value in dB: 5a033f18-1234-5678-8327-a0171790fffe; <...>
    To retrieve the current name of the Extension with the problematic UUID, run the following:
    psql -U qradar -c "select name from device_ext where uuid = '5a033f18-1234-5678-8327-a0171790fffe'"
  7. For this example, it returns a value of "Acme_ext", then update the name appending _old to the current name:
    psql -U qradar -c "update device_ext set name = 'Acme_ext_old' where uuid = '5a033f18-649b-49f2-8327-a0171790fffe';"
  8. Confirm that the name is updated in the output. The name for this example is Acme_ext_old:
    psql -U qradar -c "select id,name,description,enabled,uuid from device_ext where uuid = '5a033f18-649b-49f2-8327-a0171790fffe';"
  9. Retry the installation.
Result
The administrator is able to install the app without receiving any error.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
18 December 2023

UID

ibm16829101