Sometimes, the upgrade QDI App from 3.0.13 to 3.0.18 fails with the following message:

The application upgrade has failed. This may be because you are attempting to upgrade an extension that is not supported on an older release of QRadar, or could be due to an application/framework issue. Please check the X-Force Application Exchange to verify compatibility and identify where to obtain support for the Application.

This article explains how to fix the issue.

Please try to uninstall the QDI app and install QDI app 3.0.18.

Check if the app uninstallation is failing with the below error:

Aug 18 12:18:53 ::ffff:127.0.0.1 [tomcat.tomcat] [[email protected]] com.ibm.si.data_ingestion.api.impl.cmt.tasks.DeleteExtensionTask: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]Deleting extension with id = 85 failed: null

Aug 18 12:18:53 ::ffff:127.0.0.1 [tomcat.tomcat] [[email protected]] java.lang.NullPointerException

If yes, please follow the below steps:

• Remove the app instance and app definition from the qappmanager.
• Run the command on the console to check the app in any other state than the installed and uninstalled states: 

psql -U qradar -c "select hub_id,content_status,id from content_package where content_status not in (3,6,9);"

• Updated the status to uninstalled with:

psql -U qradar -c "update content_package set content_status = 6 where id='<ID>';"

• Tried to uninstall the app again from the UI and install it again
• Check if it is failing with the below error in qradar.log or qradar.error:

Nov 29 10:12:27 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-5] com.ibm.si.hostcontext.app.tasks.workloads.PlatformCreateAppTask: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]An error occurred while attempting to execute task to create app [1351].
Nov 29 10:12:27 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-5] com.ibm.si.application.platform.exception.ApplicationPlatformServiceException: Unable to create app with id [qapp-1351] on host [https://1d0c5646e860a73fbc3c.localdeployment:9000/v1/api/]
Nov 29 10:12:27 ::ffff:127.0.0.1 [hostcontext.hostcontext] [pool-2-thread-5]    com.ibm.si.application.workloads.api.service.exception.WorkloadStatusException: Workload service [qapp-1351] did not return with the expected status of [SUCCESS], returned with [ERROR] with error code [1] and metadata [Health check failed].

If yes, please follow the below work around to fix the issue:

Performed the commands on the console: 

podman tag console.localdeployment:5000/qradar-app-base:4.0.7 console.localdeployment:5000/qradar-app-base:4.0.7_backup

podman run -d --name temp-container console.localdeployment:5000/qradar-app-base:4.0.7

podman cp /usr/share/zoneinfo temp-container:/usr/share/zoneinfo

podman commit temp-container console.localdeployment:5000/qradar-app-base:4.0.7

systemctl restart hostcontext

**Install Qradar Deployment Intelligence**

Remove the container.

podman rm -f temp-container

Installed the app again