IBM Support

Qradar: Fix an error occurred while registering app instance after a failed app upgrade

Troubleshooting


Problem

If an attempt to upgrade an app that uses Assistant or the extension management tool fails, it can cause the app to go into "Error" state.

Symptom

  1. Connect to your qradar console by using ssh
  2. Start qappmanager: 
    /opt/qradar/support/qappmanager
  3. Try to start the application that uses option 23
  4. Enter any security profile id with Admin/Admin 
  5. Enter the id of the application that you want to start
  6. Observe the following error:
    In qradar.log: 
    [tomcat.tomcat] [pool-3-thread-7] com.q1labs.restapi_annotations.content.exceptions.endpointExceptions.ServerProcessingException: An error occurred while registering app instance with id XXXX with QRadar.
    In qappmanager: 
     2751 | 2751 | QRadar Log Source Management | ERROR   | ERROR       | 2023-03-13 07:46 | consoleprimary | LOCAL |    100 |    | An error occurred while registering app instance with id 2751 with QRadar.
    Important: If the application is stuck in "UPGRADING" state, you need to perform the steps here: https://www.ibm.com/support/pages/node/6829111
    Note: For more information on Qappmanager, visit: https://www.ibm.com/support/pages/qradar-about-qappmanager-support-utility

Cause

When an application goes through the upgrade process, the app zip_source_file path is changed to a temporary location. 
If the upgrade fails, the path is not always reverted to the initial value.

Environment

IBM Qradar version 7.5

Diagnosing The Problem

  1. Connect to your qradar console by using ssh
  2. Run the following command: 
    psql -U qradar -c "select id,name,zip_source_file_path from installed_application;"
    Example: 
    [root@hostname ~]# psql -U qradar -c "select id,name,zip_source_file_path from installed_application;"
  id  |             name             |   zip_source_file_path    
------+------------------------------+---------------------------
 2702 | pulse.full_name              | /store/qapp/2702/2702.zip
 2705 | QRadar Use Case Manager      | /store/qapp/2705/2705.zip
 2704 | QRadar Assistant             | /store/qapp/2704/2704.zip
 2751 | QRadar Log Source Management | /storetmp/AppFmw/2751.zip
 2801 | Deployment Intelligence      | /store/qapp/2801/2801.zip
  3. In this scenario, the path for the application with id 2751 (Log source management) is "/storetmp/AppFmw/2751.zip"
  4. Confirm that the path does not exist: 
    ls <path>
    Example: 
    [root@hostname ~]# ls /storetmp/AppFmw/2751.zip
ls: cannot access /storetmp/AppFmw/2751.zip: No such file or directory

Resolving The Problem

  1. Rerun the previous psql command: 
    psql -U qradar -c "select id,name,zip_source_file_path from installed_application;"
  2. Note the application id: 
    ID Here-> 2751 | QRadar Log Source Management | /storetmp/AppFmw/2751.zip
  3. Correct the zip_source_file_path: 
    [root@hostname ~]# psql -U qradar -c "update installed_application set zip_source_file_path='/store/qapp/<ID>/<ID>.zip' where id=<ID>;"
    Replace <ID> with the real application id noted in step 2.
    Example:
    [root@hostname ~]# psql -U qradar -c "update installed_application set zip_source_file_path='/store/qapp/2751/2751.zip' where id= 2751;"
UPDATE 1
  4. Verify that the path has been successfully updated: 
    psql -U qradar -c "select id,name,zip_source_file_path from installed_application;"
    Example:
    [root@hostname ~]# psql -U qradar -c "select id,name,zip_source_file_path from installed_application;"
  id  |             name             |   zip_source_file_path    
------+------------------------------+---------------------------
 2702 | pulse.full_name              | /store/qapp/2702/2702.zip
 2705 | QRadar Use Case Manager      | /store/qapp/2705/2705.zip
 2751 | QRadar Log Source Management | /store/qapp/2751/2751.zip
 2704 | QRadar Assistant             | /store/qapp/2704/2704.zip   <-- Here 
 2801 | Deployment Intelligence      | /store/qapp/2801/2801.zip
  5. Try to restart the application by using qappmanager: 
    /opt/qradar/support/qappmanager
Result
The application should start without throwing a docker registration error.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt3AAA","label":"QRadar Apps"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.5.0"}]

Document Information

Modified date:
30 May 2023

UID

ibm16997505

Page Feedback