Description

This article explains how to diagnose and resolve when deployment changes fail, especially for the console, due to the FileNotFoundException for files under the /store/tmp directory.

 

Symptoms

When you perform the deployment changes, it directly goes into an error state. And found the following error traces in the qradar.log.

 


127.0.0.1 [tomcat.tomcat] [xxxxxxxx (1030) /console/JSON-RPC/QRadar.scheduleDeployment QRadar.scheduleDeployment] java.io.FileNotFoundException: /store/tmp/status/addhost.txt (Permission denied)

127.0.0.1 [tomcat.tomcat] [xxxxxxxx (5985) /console/JSON-RPC/QRadar.scheduleDeployment QRadar.scheduleDeployment] java.io.FileNotFoundException: /store/tmp/forensics.yar (Permission denied)

This issue happens because the folder /store/tmp is not a symbolic link to /storetmp. Also, its permission is compared to the /storetmp folder.

 

Solution

 

1. Create a new Symbolic link by using the following command.

 

# ln -s /storetmp /store/tmp



 


2. Change ownership of /store/tmp & /store/tmp/status.


# chown -h nobody:nobody /store/tmp
# chown -h nobody:nobody /store/tmp/status



3.Check the check /store/tmp is a symbolic link, and the owner is nobody.



# ls -l /store/tmp
lrwxrwxrwx 1 nobody nobody 10 Jan  4  2022 /store/tmp -> /storetmp/






4. Perform the deployment changes.


 


 


5 . After you assign the symbolic link and required ownership, deployment changes will be completed successfully.


 
Modification History
2025-12-01 : Article Created