IBM Support

QRadar Network Packet Capture: 'Failed to load because of an unsupported SFP' prevents services from starting

Troubleshooting


Problem

A common cause of QRadar Network Packet Capture appliances not capturing packets is due to services not starting when incompatible small form-factor pluggable (SFP) modules are used. When unsupported SFP or QSFP modules are used with the QRadar Network Packet Capture, driver limitations prevent services from starting successfully and 'failed to load because an unsupported SFP' errors are reported. This issue must be resolved by using the correct SFP or QSFP module for your appliance.

Symptom

To confirm the capture issue, review /var/log/messages directory for unsupported SFP kernel messages.
Jun 21 14:36:23 LABDMZ kernel: ixgbe 0000:0a:00.0: PCI INT A -> GSI 32 (level, low) -> IRQ 32
Jun 21 14:36:23 LABDMZ kernel: ixgbe 0000:0a:00.0: failed to load because an unsupported SFP+ or QSFP module type was detected.
Jun 21 14:36:23 LABDMZ kernel: ixgbe 0000:0a:00.0: Reload the driver after installing a supported module.
Jun 21 14:36:23 LABDMZ kernel: ixgbe 0000:0a:00.0: PCI INT A disabled
Jun 21 14:36:23 LABDMZ kernel: ixgbe 0000:0a:00.1: PCI INT B -> GSI 36 (level, low) -> IRQ 36
Jun 21 14:36:23 LABDMZ kernel: ixgbe 0000:0a:00.1: failed to load because an unsupported SFP+ or QSFP module type was detected.
Jun 21 14:36:23 LABDMZ kernel: ixgbe 0000:0a:00.1: Reload the driver after installing a supported module.
Jun 21 14:36:23 LABDMZ kernel: ixgbe 0000:0a:00.1: PCI INT B disabled

As a result of an unsupported module, the capture service cannot successfully start. If you have a compatible SFP, but the capture service continues to be stopped, the license might be set to evaluation mode.
 

Cause

An unsupported SFP or QSFP brand or model is used with the QRadar Network Packet Capture Appliance.

Environment

All QRadar versions.

Resolving The Problem

Users who experience, 'failed to load because an unsupported SFP+ or QSFP module type was detected' error messages need to confirm their adapter type to confirm it is supported.

Procedure
  1. From the Console, use SSH to log in to QRadar Network Insights as the root user.
  2. To confirm your SFP version, type the following command: 
    grep -i pn /var/log/messages
zgrep -i pn /var/log/messages
  3. Compare the output of the transceivers with the supported SFP/QSFP list in the documentation. For more information, see QRadar Network Insights appliance hardware specifications.
  4. If the output type for your SFP matches the documentation, verify that the transceiver is in the correct slot and seated correctly.
    Note: Network capture transceivers (QSFP+) must be used on capture ports in position 5 of the diagram.
    image-20230426154918-1
    Figure 1: Example of a QRadar Network Insights 1940 appliance. For more information, see QRadar Network Insights appliance hardware specifications.
  5. Transceivers for IBM appliances are located in the Accessories box. If you purchased hardware, confirm that the Accessories box contains the required adapters.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSMT8P","label":"IBM QRadar Network Packet Capture Appliance"},"ARM Category":[{"code":"a8m0z000000cwtcAAA","label":"Hardware"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions","Type":"MASTER"}]

Document Information

Modified date:
27 April 2023

UID

swg21998129

Page Feedback