[STRM/JSA] "Full Deploys" hang at In Progress or Initializing phase and eventually time out

Summary:

This article explains why "Full Deploy" changes may get stuck at the In Progress or Initializing phase and eventually time out, and suggests a solution to go ahead with the deployment.

Symptoms:

If you see a "Full Deploy" changes in a state where the managed hosts never complete the In Progress or Initializing state like this one, it could mean that a search is running.

Cause:

The Ariel server is too busy to respond to the request to see whether there are any running searches.

Look in /var/log/qradar.log for a message similar to this one:

Aug 18 14:54:47 ::ffff:192.168.0.75 [ariel.ariel_proxy_server] [q1labs_worker_1] com.q1labs.ariel.searches.AccessManager: [INFO] [NOT:0000006000][192.168.0.75/- -] [-/- -]+++> Ariel Server is running 32 queries <+++

In Juniper Secure Analytics (JSA) 2014 code, a check was created to determine if searches were running when a Full Deploy changes was started. Users would then be prompted that the deployment will cancel the searches that are running and asked if they want to continue. If the Query Server is too busy, this would cause the process to hang at the In Progress or Initializing phase while the check is being done. Eventually this would lead to a Timeout.

Solution:

If the number of queries is large, then it is best to wait until the searches have completed. However, if you need to deploy changes, some steps that can be attempted are as follows:

Log in to the QRadar user interface.
Click Log Activity.
Click Search > Manage Search Results.
Click the search that you need to cancel.

Make a list that includes the users associated with the search, the search name, and the time the process was started and its duration. This is so that you can contact the users to restart their search or you can restart it when the deploy completes.
Click Cancel for all the searches that you need to stop.
After you have enough searches canceled, click the Admin tab > Deploy Changes.
Restart all the stopped searches.

You now have completed deploying the changes and have restarted all the searches. Alternatively, you have the information to notify these users of the search to restart their searches.

Knowledge Base