IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  CMT imporint Error

    Posted Wed March 06, 2024 09:22 AM
      |   view attached

    Hello community, I have encountered an error while trying to import some rules or whatever using CMT to new freshly installed instance of Qradar, but i always recieve this error: [osadmin@qradar743-1 CMT]$ sudo /opt/qradar/bin/contentManagement.pl -a import -f custom_function-ContentExport-20240306111937.zip -d
    [ERROR] Another instance of the CMT or extension management is already running an import/update/uninstall.

    Please if you have any suggestions to solve this i will really grateful. Thanks in advance



    ------------------------------
    Mohamed Lourch
    ------------------------------


  • 2.  RE: CMT imporint Error

    Posted Wed March 06, 2024 09:53 AM
    Edited by Jonathan Pechta Wed March 06, 2024 09:53 AM

    This error is generated when CMT is running an import currently running (or stuck) or will display in the CLI if any of the applications on the Console is in the following state: INSTALLING, PREVIEWING, UNINSTALLING, or UNINSTALL_PREVIEWING. 

    Important: If you are unsure, it is best to contact support, than it is to guess. It is likely an app issue is causing your problem, but if you need help, open a case. 

    Troubleshooting steps (or contact support)

    1. Wait to see if the process finished. If this has been running for a long time already, go to step 2.
    2. Run the qappmanager application to check the status of your applications.
      /opt/qradar/support/qappmanager
      If an app reports a status of INSTALLING, PREVIEWING, etc, then you need to resolve that issue or contact support for assistance. If none of the apps are in a strange state, you can check if CMT is running in step 3. 
    3. Type ps aux and confirm that contentManagement.pl is running.
      For example,
      # ps aux | grep -i contentmanagement.pl
root     10286  0.0  0.0 131408  4124 pts/0    S+   09:26   0:00 /usr/bin/perl /opt/qradar/bin/contentManagement.pl --action export --content-type all
    4. You can kill the PID that is associated to the content management script, if you believe it is stuck. Then run your import again. 

      If you have follow-up questions, let us know. 



    ------------------------------
    Jonathan Pechta
    IBM Security - Community of Practice Lead
    jonathan.pechta1@ibm.com
    ------------------------------

    Original Message


  • 3.  RE: CMT imporint Error

    Posted Wed March 06, 2024 10:43 AM

    Thank you for your quick response Jonathan Pechta, the problem is solved for me.



    ------------------------------
    Mohamed Lourch
    ------------------------------

    Original Message


  • 4.  RE: CMT imporint Error

    Posted Wed March 06, 2024 10:42 AM

    unfortunately for me, i didn't pay attention that this operation would need to be carried by the root user, the user i had used have all the access permissions, so i didn't think that i need to change the user, upon using the root account it seems that the problem was solved and i'm able to import normally. i will keep this post here for future refrences for people that might be facing the same prob. Thanks to Jonathan Pechta for his quick activity and response.



    ------------------------------
    Mohamed Lourch
    ------------------------------

    Original Message