Most QRadar administrators are familiar with the backend command that restarts services (systemctl restart hostcontext). You should know which services are available and what they do.
If you are not familiar, then please read this article first: qradar-services
In this short article, I want to mention one technique (manual.sh) that can be useful if you need to stop a service for longer. Normally, the hostcontext service tries to keep all the services running; therefore, as long as hostcontext lives, the other services, which are managed by hostcontext, will be restarted. If nothing is corrupted in the system, then shortly after stopping any hostcontext-dependent service, it will run again because of the nature of hostcontext. It does not apply to ecs-ec-ingress or tomcat, though. Ingress isn’t dependent on hostcontext because, during a full deploy, log collection would be interrupted (it was like this in the pre-ingress era). Ingress restarts itself after you stop it with the systemctl stop command.
So, how to stop the service for good? For this purpose, you can use the script included in the QRadar installation in the folder /opt/qradar/systemd/bin/ called manual.sh
Use the following syntax to stop the service permanently and avoid accidentally running any of them during major system changes.
/opt/qradar/systemd/bin/manual.sh hostcontext enable
systemctl stop hostcontext
/opt/qradar/systemd/bin/manual.sh hostcontext disable
systemctl start hostcontext
I believe these kinds of tasks, which require manually stopping services, should be done only with support, so I don’t advise you to do them yourself except for testing. On the other hand, if you see that after each attempt to restart the service, it goes down again and again, it may be worth checking for a manual script token.
/store/tmp/${APP_NAME}.${APP_ID}.manually_stopped
After enabling the manual.sh script, it generates the token with the syntax above. Disabling the manual.sh script should remove the mentioned token, but sometimes it stays there. This file interferes with the service running properly. If you find it there and want to restart the service, remove the token from the location in storetmp; the next time the service restarts, it should succeed.
