IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Unable to install / delete extentions

    Posted Sat September 26, 2020 07:39 AM

    I am unable to install extentions, after failing its not allowing even to delete them. Unable to delete using the API as well.

    { "http_response": { "code": 500, "message": "Unexpected internal server error" }, "code": 1020, "description": "The request could not be completed.", "details": {}, "message": "Unable to process request because Container Manager service is unavailable" }

    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Unable to install / delete extentions

    Posted Tue October 20, 2020 11:27 PM

    I too am seeing this on upgrade from 7.3.2 to 7.4.1. Candidly, I had a PaloAlto app that couldn't be removed before upgrade which stopped the upgrade once till I ripped it out of the qradar postgres db... I think its still stuck in there somewhere. I used the flip ip method (installed form iso, changed prod server ip, put new server online as old ones ip and applied config backup. The ghost followed, and now I get this Container Manager message when using the API to delete the apps.

    Did I mention I am no fan of these whacky apps? Just sayin. Any ideas??? I am going to continue hunting config files and db items associated with the stuck apps and take them out by any means I can find.



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: Unable to install / delete extentions

    Posted Tue October 27, 2020 10:54 AM

    after upgrade from 732 to 741fp1 i'm in the same situation. Someone have solved this problem ?? Thanks and regards.



    #QRadar
    #Support
    #SupportMigration


  • 4.  RE: Unable to install / delete extentions

    Posted Fri December 18, 2020 03:54 PM

    Hi,

    app troubleshooting has some dependencies to cover. Are you running Apps on an apphost or on the console? Did you check the services which are responsible for apps like conman, traefik, docker, vault-qrd? And sometimes finaly the tomcat service needs to be restarted.. In doubt create a SR to get support. BR Ralph



    #QRadar
    #Support
    #SupportMigration


  • 5.  RE: Unable to install / delete extentions

    Posted Tue August 03, 2021 09:29 AM

    You can find app id from database, using:

    psql -U qradar -c "select id, name, status from installed_application_instance;"

    Then remove it:

    psql -U qradar -c "delete from installed_application_instance where id={app id};"

    Be very careful.

    Delete from webUI after it.



    #QRadar
    #Support
    #SupportMigration


  • 6.  RE: Unable to install / delete extentions

    Posted Thu November 09, 2023 06:51 AM

    running out of options I used this trick to remove my offense forwarder app in 7.5.0 

    APP DEFINITIONS (SIO=Single Instance Only, MTS=Multi-tenancy Safe):
     ID   | Name                              | Version | Status    | Installed        | Memory | Instances | SIO | MTS | Errors
    -----------------------------------------------------------------------------------------------------------------------------
     1051 | QRadar Log Source Management      | 7.0.7   | COMPLETED | 2023-07-26 08:10 |    100 |         1 | t   | t   |       
     1052 | pulse.full_name                   | 2.2.7   | COMPLETED | 2023-07-26 08:10 |    350 |         1 | t   | t   |       
     1053 | QRadar Assistant                  | 3.5.2   | COMPLETED | 2023-07-26 08:13 |    600 |         1 | t   | t   |       
     1054 | QRadar Use Case Manager           | 3.7.0   | COMPLETED | 2023-07-26 08:15 |    500 |         1 | f   | f   |       
     1055 | IBM QRadar Offenses Forwarder App | 1.1.0   | COMPLETED | 2023-08-11 16:57 |    200 |         0 | f   | f   |      

    Good news 1st. Was removed from table and subsequently from the GUI successfully. However when listing app containers using qappmanager its still shown:

    APP CONTAINERS (IID=App Instance ID):
     IID  | Container Name     | Container ID | Status      | Ports                   | Image                                                      
    ------------------------------------------------------------------------------------------------------------------------------------------------
     1051 | qapp-1051-sUs2IbAD | d3a8cb590264 | Up 25 hours | 0.0.0.0:32769->5000/tcp | console.localdeployment:5000/qapp/1051:7.0.7-20230726081017
     1052 | qapp-1052-Fg1OHS6r | f3fa9c900b88 | Up 25 hours | 0.0.0.0:32772->5000/tcp | console.localdeployment:5000/qapp/1052:2.2.7-20230726081106
     1053 | qapp-1053-5TF5e7wh | 4338e06fb9f5 | Up 25 hours | 0.0.0.0:32771->5000/tcp | console.localdeployment:5000/qapp/1053:3.5.2-20230726081337
     1054 | qapp-1054-dPDvbgfT | 6cfd05df168c | Up 25 hours | 0.0.0.0:32770->5000/tcp | console.localdeployment:5000/qapp/1054:3.7.0-20230809190101
     1055 | qapp-1055-rhb3dDE9 | 64a20437ab67 | Up 25 hours | 0.0.0.0:32768->5000/tcp | console.localdeployment:5000/qapp/1055:1.1.0-20230811165755

    looking for a method to get rid of the container as well

    Ideas anybody?



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------

    Original Message


  • 7.  RE: Unable to install / delete extentions

    Posted Fri November 10, 2023 08:08 AM

    Hello, 

    have you tried using the API:

    https://www.ibm.com/support/pages/qradar-deleting-application-api

    Though note I would refrain from using an APP article that was for an older release of QRadar. 
    The App framework is very different in 7.5 to other releases. 

    Overall if you are still having an issue I'd recommend opening a case on this with support. 



    ------------------------------
    Comghall Morgan
    ------------------------------

    Original Message


Related Content