IBM Support

QRadar: qchange_netsetup command fails with error: 'Please un-assign host before running this script.'

Troubleshooting


Problem

At times, even after cleanly removing a managed host from a deployment, the qchange_netsetup command fails with the error, 'Please un-assign host before running this script'.

Symptom

Example error message: 
ERROR:
----
Please un-assign host before running this script.
----
Failed. Exit code: 255.

Cause

In some instances, removing a managed host from a deployment does not remove console IP from the managed host's configuration, which leads to the error message.

Diagnosing The Problem

When a managed host is removed from a deployment, the field CONSOLE_PRIVATE_IP is usually cleared from these files on the managed host:
/opt/qradar/conf/nva.conf
/opt/qradar/conf/nva.hostcontext.conf
The error occurs when that field is not cleared and still has the private IP of the console.

Resolving The Problem

Before you attempt to run qchange_netsetup, review the following technical note: Important: A critical issue has been identified in /opt/qradar/bin/qchange_netsetup (IJ31239).

Procedure
  1. SSH to the Console as root user.
  2. Use SSH to connect to the managed host.
  3. Back up the existing configuration files, such as nva.conf and nva.hostcontext.conf, before you attempt to modify files. 
    cp -p /opt/qradar/conf/nva.conf /store/backup
cp -p /opt/qradar/conf/nva.hostcontext.conf /store/backup
  4. Edit the following files to set the variable CONSOLE_PRIVATE_IP to an empty string: 
    /opt/qradar/conf/nva.conf
/opt/qradar/conf/nva.hostcontext.conf
    For example,
    CONSOLE_PRIVATE_IP=
  5. To prevent the hostcontext service from starting, create a token file hostcontext.STOP, in the directory "/opt/qradar/conf/" 
    touch /opt/qradar/conf/hostcontext.STOP
  6. Stop the hostcontext service: 
    systemctl stop hostcontext
  7. Confirm that the service is not active: 
    systemctl status hostcontext
     systemctl status hostcontext
● hostcontext.service - hostcontext daemon
   Loaded: loaded (/usr/lib/systemd/system/hostcontext.service; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/hostcontext.service.d
           └─timeout.conf, ulimit.conf
   Active: failed (Result: exit-code) since Thu 2020-09-17 13:51:39 EDT; 1h 6min ago
  Process: 29247 ExecStart=/usr/bin/env ${JAVA_HOME}/bin/java $JOPTS -classpath ${CLASSPATH} -Dcom.q1labs.frameworks.jmx.port=${JMXPORT} -Xcompressedrefs $GC_OPTS $MEM_OPTS $DUMPOPTS $REMOTE_DEBUG_OPTS com.q1labs.hostcontext.HostContext start (code=exited, status=143)
  Process: 29206 ExecStartPre=/opt/qradar/systemd/bin/check_hostcontext_stop.sh (code=exited, status=0/SUCCESS)
  Process: 28944 ExecStartPre=/opt/qradar/systemd/bin/generate_environment.sh hostcontext (code=exited, status=0/SUCCESS)
 Main PID: 29247 (code=exited, status=143)
    Tasks: 0
   Memory: 1.5G
   CGroup: /system.slice/hostcontext.service
  8. Use the qchange_netsetup command to modify the network settings for the managed host.
  9. Remove the hostcontext.STOP file.

    Results
    After you updated the network configuration for the managed host, you can add the host to the QRadar deployment. If you continue to experience issues with updating network settings, contact QRadar Support.

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"}]

Document Information

Modified date:
08 September 2021

UID

ibm16330499

Page Feedback