When troubleshooting issues with QRadar applications, which application Docker container log file can be used to get more information about the apps?

Question

Options

• A/var/log/qradar.error
• B/var/log/qradar.log
• C/var/log/app.log
• D/store/log/app.log

• A
  2% (1)
• B
  5% (2)
• C
  11% (5)
• D
  82% (36)

Explanation

In QRadar's containerized application architecture, /store/log/app.log (option D) is the correct path because QRadar apps run in Docker containers where /store is the persistent volume mount point - logs written there survive container restarts and are accessible for troubleshooting.

Why the distractors are wrong:

• A & B (/var/log/qradar.error and /var/log/qradar.log) are fabricated paths - these files don't exist in QRadar's standard logging structure.
• C (/var/log/app.log) is a plausible-sounding path, but /var/log inside the container is ephemeral; QRadar apps write their persistent logs to /store/log/, not /var/log/.

Memory tip: Think of /store as the "storage vault" - it's the persistent volume in QRadar app containers, so anything you need to keep and retrieve (like logs) lives under /store/, making /store/log/app.log the go-to path for app diagnostics.

No community discussion yet for this question.