Skip to main content

Integrations

Check the Application Logs

View the application logs by accessing the application from QRadar using a remote connection.

  1. Log into QRadar using a remote connection.

  2. List all installed applications and their App-ID values using this command: /opt/qradar/support/recon ps.

  3. If no issues are detected, the recon command output might look like this example:

    Reconn_Output_Command.png

  4. Connect to the app container using the following command: /opt/qradar/support/recon connect APP-ID.

    Note

    For the preceding image, the Illumio App-ID is 4352.

  5. Use the following command to go to the log directory: cd /opt/app-root/store/log.

  6. In the log directory, use the ‘ls’ command to list all files and the ‘cat’ command to print log file content:

    ls
cat app.log

The app.log file contains all of the logs related to the configuration page and dashboard and the label_data_collect.log file contains logs related to label collection from the Illumio PCE.

Uninstall the App

To uninstall the application:

  1. In QRadar, go to the Admin page and open Extension Management.

  2. Select Illumio App for QRadar, and click Uninstall.