IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  An application error. Apps status is error after restarting.

    Posted Thu December 22, 2022 06:33 AM
    Edited by Thomas Jaeger Fri December 23, 2022 05:51 AM
      |   view attached
    Hi, community!

    We faced an issue with Qradar applications. All apps goes to an error state after restarting them. In the web UI we can see the app tabs, but when we try to lounch to the certain app, the empty white window is appearing. We tried to stop and start the application using qappmanager utility. As the result of this action we' ve got an error message as following: "POST https://localhost/api/gui_app_framework/applications/1054?status=RUNNING was unsuccessful",
    "An error occurred while checking if image [qapp/1054:2.2.9-20220923132640] exists in the registry. Task state found to be [EXCEPTION]". 
    The txt file with error messages are attached to this discussion.

    ------------------------------
    Thomas Jaeger
    ------------------------------

    Attachment(s)

    txt
    App_issue.txt   8 KB 1 version


  • 2.  RE: An application error. Apps status is error after restarting.

    Posted Mon December 26, 2022 08:04 AM
    This should give you the status of isntalled apps in the database
    psql -U qradar -c "select id,name,description,status from installed_application;"
    (Using the following command you could check if the registry is working
    curl https://console.localdeployment:5000/v2/_catalog --key /etc/docker/tls/registry/docker-client-registry.key --cert /etc/docker/tls/registry/docker-client-registry.cert (if the response is similar to this {"repositories":["centos-base","qapp/1012","qapp/1052","qapp/1104","qradar-app-base"]} then the registry key and cert should be OK).
    Maybe this will help you move forward.

    ------------------------------
    Dusan VIDOVIC
    ------------------------------



  • 3.  RE: An application error. Apps status is error after restarting.

    Posted Tue December 27, 2022 06:11 AM
    Edited by Thomas Jaeger Tue December 27, 2022 06:13 AM
    Thank you a lot! Your reponse was super helpfull. The error was related with certificates. We have typed following commands to recreate all certificates:
    1. systemctl stop hostcontext
    2. rm -rf /opt/qradar/ca/certs/*
    3. /opt/qradar/ca/bin/reset-qradar-ca.sh all --reset
    4.systemctl start hostcontext
    and then, al applications went to Running state. Now all apps are accessible on UI.

    ------------------------------
    Thomas Jaeger
    ------------------------------