IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Error while importing extension, the UUID is present in dB but the extension package does not have it

  • 1.  Error while importing extension, the UUID is present in dB but the extension package does not have it

    Posted Mon April 13, 2020 12:47 AM
    Edited by Jabez Daniel Mon April 13, 2020 01:06 AM

    Hi ,

    I'm getting this error when I try to install a custom app in QRadar(Developed in-house). I'm facing this problem in only one QRadar instance ,though it installs perfectly fine in all the other QRadar instance.

    Any idea what could be the reason? Looks like I have to clear some residual UUID in the db.

     

    com.ibm.si.content_management.ContentFailureException: Import of Field UUID from the ContentType: deviceextension experienced/caused failure. Value: f46eff19-02ff-40db-8312-826accf7bcdd; Error: for the importing extension, the UUID is present in dB but the extension package does not have it

     

    Thanks and Regards,

    Jabez Daniel S 



  • 2.  RE: Error while importing extension, the UUID is present in dB but the extension package does not have it

    Posted Mon April 13, 2020 09:26 AM
    Hi Jabez,

    This means that there is a log source extension (these can be created manually or be generated automatically by the DSM Editor) on the importing system with the same name as one in the inbound content export, but the one in the importing system's database has a UUID and the inbound one from the export does not. We only started generating UUIDs for LSXs fairly recently, so it sounds like you independently created the same extension on two or more different systems where one was a never version than the other (and thus one has a UUID and one does not). You have a few options:

    1. Delete the existing LSX on the importing system to allow the one in the export to import properly. You can do this via the Log Source Extension UI in the admin tab, but to find the name you'll need to run this command from the CLI:
    psql -U qradar -c "select name from device_ext where uuid = 'f46eff19-02ff-40db-8312-826accf7bcdd';"

    2. Clear the uuid in the database, like so:
    psql -U qradar -c "update device_ext set uuid = null where uuid = 'f46eff19-02ff-40db-8312-826accf7bcdd';"

    3. Add the uuid value to the export file so they line up. But you probably don't want to go with this option as it will make the extension uninstallable on any other system where an LSX with the same name exists but has a different uuid or no uuid at all.


    For your information, best practice would be to create any content entity on one system and always migrate it to other systems using export/import, to ensure the same uuid is maintained. If you independently create the same item on multiple systems, they will have different uuids, and QRadar can't tell fi they're supposed to be the same entity or if they were given the same name by different authors. We don't want users accidentally flattening their content with similarly-named content from an outside source, which is why we've started adding UUIDs to other entities. We've always had them for rules, custom properties and saved searches but recently added them to other types.

    Cheers
    Colin

    ------------------------------
    COLIN HAY
    ------------------------------

    Original Message


Related Content