Troubleshooting
Problem
In the Extensions Management menu, after an application file is installed the following error is captured "For the importing extension, the UUID in dB and extension package is not the same". It appears in the /var/log/qradar.error log file.
Cause
The issue happens because the application extension has a different ID in the database and in the XML file.
Diagnosing The Problem
The app extension has a different ID in the database and in the XML File, follow the next steps to confirm if the environment has the same issue:
- Log in to the QRadar console GUI as the administrator user.
- Click the Admin tab.
- Click Extension Management:
- In the Extension Management menu, click Add.
- Browse the application or content pack package.
- Click the "Install immediately" box, then Add:
Result
The error "For the importing extension, the UUID in dB and extension package is not the same" appears. In some cases, instead of a descriptive error, you might see a generic message that states "An error occurred. See logs for details." as seen in the following screenshot. - Proceed to Resolving The Problem.
Resolving The Problem
Important
- Read all the steps before they are applied on a production environment.
- The following steps require advanced knowledge. Administrators who feel uncomfortable with this procedure or need assistance, contact QRadar Support.
Use these steps to find the UUID and rename it to be able to install the app.
- SSH to the QRadar console.
- Create the backup directory:
mkdir -p /store/IBM_Support/
- Create a backup for the table:
pg_dump -U qradar -t device_ext > /store/IBM_Support/device_ext.sql
- Run the next command to find the DB UUID in the qradar.error file:
grep "extension package is not the same" /var/log/qradar.error
Import of Field UUID from the ContentType: deviceextension experienced/caused failure. Value in dB: 5a033f18-1234-5678-8327-a0171790fffe; value in XML: f6696a03-1234-5678-8fc4-fd2ca900e164; Error: For the importing extension, the UUID in dB and extension package is not the same
- Take the UUID after the string "Value in dB".
For this example, the DB ID is 5a033f18-1234-5678-8327-a0171790fffe: - To retrieve the Extension with the problematic UUID, run the following command. Replace DB_UUID with the DB UUID from the output in Step 5
psql -U qradar -c "select * from device_ext where uuid = '<DB_UUID>';"
<...> Value in dB: 5a033f18-1234-5678-8327-a0171790fffe; <...>
psql -U qradar -c "select name from device_ext where uuid = '5a033f18-1234-5678-8327-a0171790fffe'"
- For this example, it returns a value of "Acme_ext", then update the name appending _old to the current name:
psql -U qradar -c "update device_ext set name = 'Acme_ext_old' where uuid = '5a033f18-649b-49f2-8327-a0171790fffe';"
- Confirm that the name is updated in the output. The name for this example is Acme_ext_old:
psql -U qradar -c "select id,name,description,enabled,uuid from device_ext where uuid = '5a033f18-649b-49f2-8327-a0171790fffe';"
- Retry the installation.
Result
The administrator is able to install the app without receiving any error.
The administrator is able to install the app without receiving any error.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSV4BL","label":"IBM QRadar"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
18 December 2023
UID
ibm16829101