This article explains how to debug and fix the installation issue of the Investigation Assistant App 1.5.0.
You will get the below error from the qradar.error log under /var/log:
Failed to import content file [/store/tmp/cmt/out/20260512120640/ibm-qradar-investigation-assistant-extension-20260420152352.xml]
tomcat.tomcat] com.ibm.si.data_ingestion.api.impl.cmt.tasks.InstallExtensionTask: [ERROR] [NOT:0000003000][x.x.x.x/- -] [-/- -]installing extension with id = 51701 failed: appfw.app.upgrade.health.check.failed
To understand the root cause of the issue, please follow the steps below:
[root@~]# /opt/qradar/support/recon ps
App-ID Name Managed Host ID Workload ID Service Name AB Container Name CDEGH Port IJKL
1054 QRadar Use Case Manager 53 apps qapp-1054 ++ qapp-1054 +++++ 5000 ++++
1052 pulse.full_name 53 apps qapp-1052 ++ qapp-1052 +++++ 5000 ++++
1051 QRadar Log Source Management 53 apps qapp-1051 ++ qapp-1051 +++++ 5000 ++++
1053 IBM QRadar Hub 53 apps qapp-1053 ++ qapp-1053 +++++ 5000 ++++
1101 Investigation Assistant 53 apps qapp-1101 ++ qapp-1101 +++++ 5000 ++++
In the above example, 1101 is the app id.
cd /store/docker/volumes/qapp-1101/log/
cat app_setup.log
This will show you the reason why the app installation failed.
Check if you get the following error:
Installing qradar-mcp package...
Defaulting to user installation because normal site-packages is not writeable
Obtaining file:///opt/app-root/qradar-mcp
Installing build dependencies: started
Installing build dependencies: finished with status 'error'
error: subprocess-exited-with-error
× installing build dependencies did not run successfully.
│ exit code: 2
╰─> [84 lines of output]
Collecting setuptools
WARNING: Retrying (Retry(total=4, connect=None, read=None, redirect=None, status=None)) after connection broken by 'ProxyError('Cannot connect to proxy.', TimeoutError('timed out'))': /packages/9d/76/f789f7a86709c6b087c5a2f52f911838cad707cc613162401badc665acfe/setuptools-82.0.1-py3-none-any.whl.metadata
As per the error, pip installation of qradar-mcp is failing with a connectivity error via the proxy server.
To fix the issue, please check the solution section.
During the app installation, JSA is performing the following command to install qradar-mcp, which requires connectivity to the public repositories:
cd /opt/app-root/qradar-mcp
pip install -e .
As it tries to reach external resources during the install, the customer needs to allow the following URLs on the proxy server: