IBM Support

QRadar: Unable to log in with local user account

Troubleshooting


Problem

If the tomcat process running on your console host is in an inconsistent state, you may experience issues with user authentication.

Cause

This issue can arise if the tomcat process is in an inconsistent state.

Diagnosing The Problem

You can attempt the troubleshooting actions in this article when using system authentication and are seeing the following symptoms:
  • The account in question is a recently created account.
  • The account in question can pass the authentication page but then receives a blank page with the address below:

    https://<qradar_hostname>/console/core/jsp/Main.jsp
  • Previously created users are able to log in without issues.

Resolving The Problem

The type of inconsistency discussed can be corrected by restarting the tomcat process. However, before restarting the tomcat process, you should try clearing your browser cache to ensure that the problem is not caused by your browser.

If you are still experiencing the issue even after you clear your browser cache, you can log in to your active console host via SSH connection and run the command to restart your tomcat process:

For QRadar version 7.3.x type  systemctl restart tomcat
For QRadar version 7.2.8 type service tomcat restart

Note: The restart of the tomcat process can take 10 minutes or longer. During this time, the web UI is not available.

 

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Admin Console","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2;7.3","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
07 January 2021

UID

swg21985668

Page Feedback