AppHost Utilities

#ibm #working #troubleshooting #siem #apphost

Determining the app ID

There are a few ways to determine the app ID.

Use the qappmanager support utility (/opt/qradar/support/qappmanager)
Use the recon support utility (/opt/qradar/support/recon ps)
Open the SOAR app from the IBM QRadar console - Admin page and take note of the app ID in the URL

Entering the container

Once you know where the plug-in is installed and you have the app ID you can enter the container.

Log on to the IBM QRadar appliance as root by using SSH.
Use the recon utility

 /opt/qradar/support/recon connect <app-ID>

Enabling debug

Version 3.x and 4.x are different. The steps to enable debug differ slightly depending on the version installed.

Change the app.config
Restart the plug-in

Version 3.x

Edit the file /store/app.config

    vi /store/app.config

Change
```
loglevel=INFO
```
to
```
loglevel=DEBUG
```
Save and close
```
:wq
```
Restart the plug-in
```
pkill -9 -f "python run_circuits.py"
```

Version 4.x

Edit the file /store/app.config
```
vi /opt/app-root/store/app.config
```
Change
```
loglevel=INFO
```
To
```
loglevel=DEBUG
```
Save and close
```
:wq
```

Restart the plug-in

pkill -9 -f "python /opt/app-root/container/conf/run_circuits.py"

Version 5.x

In the plug-in, check "Enable loglevel DEBUG." See Configuring the QRadar SOAR Plug-in app for further information.

With DEBUG enabled, circuits.log are rotated quickly. Reproduce the problem and gather the logs quickly.