Hi,

When i try to installing any apps from XFE in QRadar i see marathon error logs and the apps  also "install with error ". I'm currently on QRadar 7.3.1p8if3 .Looks like some problem with marathon service,but i also observed  marathon service up and running. Also used appnode.sh to restart the app services.

Is there any other options, i can try further in debugging?

Following are the log from qradar.error:

May 6 20:12:06 ::ffff:192.168.0.231 [hostcontext.hostcontext] [qapp_monitor] com.q1labs.hostcontext.app.monitor.ApplicationMonitorThread: [ERROR] [NOT:0000003000][192.168.0.231/- -] [-/- -]An error occurred handling application 1002.
May 6 20:12:06 ::ffff:192.168.0.231 [hostcontext.hostcontext] [qapp_monitor] com.q1labs.hostcontext.app.monitor.state.ApplicationStateHandlerException: An error occurred while attempting to contact Marathon.
May 6 20:12:06 ::ffff:192.168.0.231 [hostcontext.hostcontext] [qapp_monitor] at com.q1labs.hostcontext.app.monitor.state.MarathonApplicationRunningStateHandler.handleApplicationState(MarathonApplicationRunningStateHandler.java:60)
May 6 20:12:06 ::ffff:192.168.0.231 [hostcontext.hostcontext] [qapp_monitor] at java.lang.Thread.run(Thread.java:812)
May 6 20:12:06 ::ffff:192.168.0.231 [hostcontext.hostcontext] [qapp_monitor] Caused by:
May 6 20:12:06 ::ffff:192.168.0.231 [hostcontext.hostcontext] [qapp_monitor] com.q1labs.core.shared.application.marathon.ApplicationMarathonServiceException: An error occurred while checking if Marathon app [/qapp-1002] exists.


Following are the log from appnode.log:

May 6 20:33:30 qradar231 zookeeper[11318]: 2020-05-06 20:33:30,414 [myid:] - WARN [NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181:NIOServerCnxn@368] - caught end of stream exception
May 6 20:33:30 qradar231 zookeeper[11318]: EndOfStreamException: Unable to read additional data from client sessionid 0x171e69f11f7003a, likely client has closed socket
May 6 20:33:30 qradar231 zookeeper[11318]: at org.apache.zookeeper.server.NIOServerCnxn.doIO(NIOServerCnxn.java:239)
May 6 20:33:30 qradar231 zookeeper[11318]: at org.apache.zookeeper.server.NIOServerCnxnFactory.run(NIOServerCnxnFactory.java:203)
May 6 20:33:30 qradar231 zookeeper[11318]: at java.lang.Thread.run(Thread.java:812)
May 6 20:33:30 qradar231 consul[11321]: 2020/05/06 20:33:30 [WARN] agent: Check 'service:marathon' is now critical
May 6 20:33:30 qradar231 marathon[51759]: Connected to zookeeper.service.consul:2181
May 6 20:33:30 qradar231 marathon[51759]: Sent ruok
May 6 20:33:30 qradar231 marathon[51759]: Zookeeper is ok
May 6 20:33:30 qradar231 marathon-restart-monitor.sh[17732]: Wed May 6 15:03:30 UTC 2020 [marathon-restart-monitor.sh]: Restarted Marathon
May 6 20:33:31 qradar231 marathon[51778]: .docker/
May 6 20:33:31 qradar231 marathon[51778]: .docker/config.json
May 6 20:33:39 qradar231 marathon[51911]: [2020-05-06 20:33:39,049] INFO Starting Marathon 1.3.10/unknown with (mesosphere.marathon.Main$:main)
May 6 20:33:40 qradar231 marathon[51911]: [2020-05-06 20:33:40,121] WARN Method [public javax.ws.rs.core.Response mesosphere.marathon.api.MarathonExceptionMapper.toResponse(java.lang.Throwable)] is synthetic and is being intercepted by [mesosphere.marathon.DebugModule$MetricsBehavior@cac84de4]. This could indicate a bug. The method may be intercepted twice, or may not be intercepted at all. (com.google.inject.internal.ProxyFactory:main)
May 6 20:33:40 qradar231 mesos-agent[17221]: W0506 20:33:40.175318 17599 slave.cpp:1088] Authentication timed out
May 6 20:33:40 qradar231 mesos-agent[17221]: W0506 20:33:40.175863 17599 slave.cpp:1033] Failed to authenticate with master master@192.168.0.231:15050: Authentication discarded

------------------------------
Jabez Daniel
------------------------------