IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  QRadar Assistant Shield App ICON is missing

    Posted Wed February 07, 2024 09:02 PM

    Hello Team,

    In one of my QRadar setup, QRadar Assistant Shield App ICON is not visible in the UI. When digged further, found that QRadar Assistant APP Instance is in ERROR, below is the output of /opt/qradar/support/qappmanager:

    isa-mc ~]# /opt/qradar/support/qappmanager

    APP DEFINITIONS (SIO=Single Instance Only, MTS=Multi-tenancy Safe):

    ID   | Name                         | Version | Status    | Installed        | Memory | Instances | SIO | MTS | Errors

    ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    1051 | QRadar Log Source Management | 7.0.7   | COMPLETED | 2022-1-17 14:00 |    100 |         1 | t   | t   |

    1052 | pulse.full_name              | 2.2.7   | COMPLETED | 2022-1-17 14:01 |    350 |         1 | t   | t   |

    1053 | threatglobe.name             | 1.2.5   | COMPLETED | 2022-1-17 14:02 |    200 |         1 | t   | t   |

    1054 | QRadar Assistant             | 3.4.1   | COMPLETED | 2022-1-17 14:04 |    600 |         1 | t   | t   | Upgrade did not complete. Application rolled back to version 3.4.1

     

    APP INSTANCES (IID=Instance ID, DID=Definition ID, MHN=Managed Host Name, AHT=Application Host Type, SP=Security Profile):

    IID  | DID  | Name                         | Status  | Task Status | Installed        | MHN                 | AHT   | Memory | SP | Errors

    --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    1051 | 1051 | QRadar Log Source Management | RUNNING | COMPLETED   | 2022-1-17 14:00 | isa-host | LOCAL |    100 |    |

    1052 | 1052 | pulse.full_name              | RUNNING | COMPLETED   | 2022-1-17 14:01 | isa-host | LOCAL |    350 |    |

    1053 | 1053 | threatglobe.name             | RUNNING | COMPLETED   | 2022-1-17 14:02 | isa-host | LOCAL |    200 |    |

    1054 | 1054 | QRadar Assistant             | ERROR   | CANCELLED   | 2022-1-17 14:04 | isa-host | LOCAL |    600 |    | Upgrade did not complete. Application rolled back to version 3.4.1

    Could someone share steps on how to fix this ERROR message and bring QRadar Assistant APP instance back to "RUNNING" status?

    Thanks in advance,

    Uma

     



    ------------------------------
    Umamaheshwara Manekar
    ------------------------------


  • 2.  RE: QRadar Assistant Shield App ICON is missing

    Posted Thu February 08, 2024 06:04 AM

    Hello,

    You may find the the following technote useful:


    https://www.ibm.com/support/pages/qradar-starting-apps-are-error-state-or-do-not-display-user-interface

    If you are still unable to get the App into a working state, please raise a case with QRadar Product Support.

    Regards,



    ------------------------------
    Comghall Morgan
    QRadar Support Architect
    IBM
    ------------------------------

    Original Message


  • 3.  RE: QRadar Assistant Shield App ICON is missing

    Posted Fri February 09, 2024 02:38 AM

    Thank you Comghall, the technote was useful, and after following the instructions, the App moved into a RUNNING state now.



    ------------------------------
    Umamaheshwara Manekar
    ------------------------------

    Original Message