IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Can not deploy QRADAR CE 7.3.3

    Posted Mon February 19, 2024 06:55 AM

    I have qradar ce 7.3.3 and i can not make deployments, i tried adding more ram and memory but it did not solve the issue, the wifi is not the problem either, when i try to see the qradar log errors does not show any useful information. On the log errors i could see that it said index too small or something like this but i don't have git or any kind of repository like this, can someone help me? The only message it says when i make a deployment is timed out.



    ------------------------------
    Blanca Benavent
    ------------------------------


  • 2.  RE: Can not deploy QRADAR CE 7.3.3

    Posted Mon February 19, 2024 07:00 AM

    Hi Blanca

    Have you tried restart services on it?  

    systemctl stop hostcontext

    systemctl stop tomcat

    systemctl restart hostservices

    systemctl start tomcat

    systemctl start hostcontext

    Thanks



    ------------------------------
    John Dawson
    Qradar Support Architect
    IBM
    ------------------------------

    Original Message


  • 3.  RE: Can not deploy QRADAR CE 7.3.3

    Posted Tue February 20, 2024 03:46 AM
    Edited by Blanca Benavent Tue February 20, 2024 05:38 AM

    The error was the same:

    These are my logs error:

    Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] com.q1labs.hostcontext.configuration.ConfigSetUpdater: [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]Failed to execute db app sync post deploy action
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] com.q1labs.configservices.process.ProcessException: Unable to execute platform app sync.
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.action.DBAppSyncPostDeployAction.executeAction(DBAppSyncPostDeployAction.java:51)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.configuration.ConfigSetUpdater.postDownloadAndApply(ConfigSetUpdater.java:2040)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.configuration.ConfigSetUpdater.downloadAndApplyConfiguration(ConfigSetUpdater.java:300)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.configuration.ConfigSetUpdater.startDownloadAndApplyConfiguration(ConfigSetUpdater.java:215)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.configuration.ConfigChangeObserver.updateConfiguration(ConfigChangeObserver.java:259)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.configuration.ConfigChangeObserver.update(ConfigChangeObserver.java:341)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.observer.Subject.updateNotify(Subject.java:84)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.observer.JMSMessageSubject.messageReceived(JMSMessageSubject.java:148)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.frameworks.events.jms.JMSMessageEvent.dispatchEvent(JMSMessageEvent.java:107)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.frameworks.events.SequentialEventDispatcher$DispatchThread.run(SequentialEventDispatcher.java:129)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] Caused by:
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] com.ibm.si.application.workloads.sync.ApplicationSyncException: An error occurred while attempting to sync apps on host [49960de5880e8c687434.localdeployment]
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.ibm.si.application.workloads.sync.DBConmanSyncService.syncAppsOnHost(DBConmanSyncService.java:124)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.ibm.si.application.workloads.sync.DBConmanSyncService.performManagedHostAppSync(DBConmanSyncService.java:229)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.ibm.si.application.workloads.sync.DBConmanSyncService.performSync(DBConmanSyncService.java:263)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.q1labs.hostcontext.action.DBAppSyncPostDeployAction.executeAction(DBAppSyncPostDeployAction.java:36)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    ... 9 more
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] Caused by:
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] com.ibm.si.application.platform.exception.ApplicationPlatformServiceException: Unable to sync service on host [https://49960de5880e8c687434.localdeployment:9000/v1/api/]
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.ibm.si.application.workloads.WorkloadsPlatformService.syncApps(WorkloadsPlatformService.java:577)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.ibm.si.application.workloads.sync.DBConmanSyncService.syncAppsOnHost(DBConmanSyncService.java:120)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    ... 12 more
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] Caused by:
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] com.ibm.si.application.workloads.api.service.exception.WorkloadStatusException: Workload with id [apps] did not return with the expected status of [SUCCESS], returned with [ERROR]
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.ibm.si.application.workloads.WorkloadsPlatformService.validateWorkloadResult(WorkloadsPlatformService.java:438)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    at com.ibm.si.application.workloads.WorkloadsPlatformService.syncApps(WorkloadsPlatformService.java:573)
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher]    ... 13 more
Feb 20 10:13:49 ::ffff:127.0.0.1 [hostcontext.hostcontext] [Thread-2589] com.q1labs.hostcontext.configuration.ConfigMetaDataProcessor: [WARN] [NOT:0000004000][127.0.0.1/- -] [-/- -]Restarting processes as part of deployment
Feb 20 10:13:51 ::ffff:127.0.0.1 [hostcontext.hostcontext] [Thread-2600] ComponentOutput: [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream post-config-update: fatal: index file smaller than expected
Feb 20 10:13:51 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] com.q1labs.configservices.util.ConfigServicesUtil: [WARN] [NOT:0000004000][127.0.0.1/- -] [-/- -]Saving history for directory /opt/qradar/conf didn't run cleanly
Feb 20 10:15:46 localhost OutOfMemoryMonitor[28791]: Starting out-of-memory monitoring (enabled: yes)...
Feb 20 10:15:46 localhost [Hardware Monitoring]: [WARN] Unable to determine the RAID Controller or Hardware type. Hardware diagnostics can not proceed.

    I also wanted do add that this Qradar ce is in a virtual machine from virtual box.

    ------------------------------
    Blanca Benavent
    ------------------------------

    Original Message


  • 4.  RE: Can not deploy QRADAR CE 7.3.3
    Best Answer

    Posted Wed February 21, 2024 05:15 AM

    Blanca

    this looks really bad. The fatal error iindicated is critical . When you use systemctl status hostcontext you will find services missing.

    Feb 20 10:13:51 ::ffff:127.0.0.1 [hostcontext.hostcontext] [Thread-2600] ComponentOutput: [ERROR] [NOT:0000003000][127.0.0.1/- -] [-/- -]ErrorStream post-config-update: fatal: index file smaller than expected
Feb 20 10:13:51 ::ffff:127.0.0.1 [hostcontext.hostcontext] [2173d164-cf01-4303-90bc-44d840ec328a/SequentialEventDispatcher] com.q1labs.configservices.util.ConfigServicesUtil: [WARN] [NOT:0000004000][127.0.0.1/- -] [-/- -]Saving history for directory /opt/qradar/conf didn't run cleanly

    so the best thing to do is use sufficient ressources and reinstall CE in ESX from the beginning. Double check setup log log for everything is ok. Dont forget thepatch highlighted in instructions. Virtual box may be an alternative but in your case I doubt it would help.



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------

    Original Message