Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[STRM/JSA] "Full Deploys" hang at In Progress or Initializing phase and eventually time out

0

0

Article ID: KB34695 KB Last Updated: 09 Jul 2019Version: 1.0
Summary:

This article explains why "Full Deploy" changes may get stuck at the In Progress or Initializing phase and eventually time out, and suggests a solution to go ahead with the deployment.

 

Symptoms:

If you see a "Full Deploy" changes in a state where the managed hosts never complete the In Progress or Initializing state like this one, it could mean that a search is running.

 

Cause:

The Ariel server is too busy to respond to the request to see whether there are any running searches.

Look in /var/log/qradar.log for a message similar to this one:

Aug 18 14:54:47 ::ffff:192.168.0.75 [ariel.ariel_proxy_server] [q1labs_worker_1] com.q1labs.ariel.searches.AccessManager: [INFO] [NOT:0000006000][192.168.0.75/- -] [-/- -]+++> Ariel Server is running 32 queries <+++

In Juniper Secure Analytics (JSA) 2014 code, a check was created to determine if searches were running when a Full Deploy changes was started. Users would then be prompted that the deployment will cancel the searches that are running and asked if they want to continue. If the Query Server is too busy, this would cause the process to hang at the In Progress or Initializing phase while the check is being done. Eventually this would lead to a Timeout.

 

Solution:

If the number of queries is large, then it is best to wait until the searches have completed. However, if you need to deploy changes, some steps that can be attempted are as follows:

  1. Log in to the QRadar user interface.
  2. Click Log Activity.

  3. Click Search > Manage Search Results.

  4. Click the search that you need to cancel.

  1. Make a list that includes the users associated with the search, the search name, and the time the process was started and its duration. This is so that you can contact the users to restart their search or you can restart it when the deploy completes.

  2. Click Cancel for all the searches that you need to stop.

  3. After you have enough searches canceled, click the Admin tab > Deploy Changes.

  4. Restart all the stopped searches.

You now have completed deploying the changes and have restarted all the searches. Alternatively, you have the information to notify these users of the search to restart their searches.

 

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search