IBM Support

QRadar: HA upgrade fails with error "HA configuration does not appear to be correct"

Troubleshooting


Problem

An upgrade for a High-Availability (HA) pair fails to run with an error message, "HA configuration does not appear to be correct". This issue is commonly reported by administrators when the status of the appliances is incorrect. Software updates for QRadar require that the primary is in the Active state and the secondary by Standby before the installer can begin.

Symptom

The following message is displayed when the patch is run:
[DEBUG] We're ha but not in correct state
[ERROR] HA configuration does not appear to be correct, check that we are active and have a system in standby state.
[ERROR] HA state does not appear to be correct, please check logs on host.

Cause

QRadar® patch requires HA peers to be in a specific state. Any other state causes this failure.
  • Primary must be ACTIVE.
  • Secondary must be STANDBY.

Environment

Any appliance that is configured as a High-Availability (HA) pair.

Diagnosing The Problem

Verify the health (peers and sensors statuses) of the HA Cluster with the following command: 
[root@qradar-console01-primary]# /opt/qradar/ha/bin/ha cstate

Example output:
Local: R:PRIMARY S:ACTIVE/ONLINE CS:NONE P:1.0 HBC:UP RTT:0 I:0 SI:355176178
Remote: R:SECONDARY S:STANDBY/ONLINE CS:NONE P:1.0 HBC:UP RTT:1 I:4281 SI:5260716
HBC: ALIVE/2
LSN: drbd_status => 1.0 I:0
LSN: ha_services => 1.0 I:0
LSN: drbd_sync => 1.0 I:0
LSN: mount_status => 1.0 I:0
LSN: ping_status => 1.0 I:0
LSN: drbd_io_perf => 1.0 I:0
LSN: link_status => 1.0 I:0
LSN: xover_status => 1.0 I:0
LSN: drbd_network_perf => 1.0 I:0
LSN: cluster_ip => 1.0 I:0
RSN: drbd_status => 1.0 I:0
RSN: drbd_sync => 1.0 I:0
RSN: mount_status => 1.0 I:0
RSN: drbd_io_perf => 1.0 I:0
RSN: link_status => 1.0 I:0
RSN: xover_status => 1.0 I:0
Peers status
  • Local: The peer where the script is run.  When run on the secondary, the secondary is displayed as Local.
  • Remote: The HA peer status.
Sensor status
  • LSN: Status of the sensors of the peer where the script is run (Local).
  • RSN: Status of the sensors of the other peer (Remote).
Expected Results
The primary must have an ACTIVE/ONLINE status and the secondary STANDBY/ONLINE. Local and Remote sensors must have a value of 1.0 (optimal status).

Resolving The Problem

Use the QRadar® HA deployments troubleshooting guide to accomplish the expected statuses. The following are scenarios that are not included in that guide and can affect the patch.
The secondary node is ACTIVE and the primary is STANDBY
If the secondary node is in the Active state, the administrator must ensure the primary is the Active before a software upgrade can begin.

Procedure
  1. Press Enter until the screen session is closed.
  2. Set the secondary to Offline so that the primary takeover the ACTIVE role. This process can take up to 30 minutes.
    1. On the navigation menu ( Navigation menu icon ), click Admin.
    2. On the navigation menu, click System Configuration.
    3. Click System and License Management.
    4. Select the secondary peer.
    5. From the High Availability menu, click Set System Offline.
  3. When the primary successfully sets the ACTIVE role, set the secondary to Online so that is set as STANDBY.
    1. On the navigation menu ( Navigation menu icon ), click Admin.
    2. On the navigation menu, click System Configuration.
    3. Click System and License Management.
    4. Select the secondary peer.
    5. From the High Availability menu, click Set System Online
  4. Confirm the status of the primary and secondary with the ha cstate command: 
    /opt/qradar/ha/bin/ha cstate
    Note: For a description of the output, see the Diagnosing the Problem section in this technical note.
  5. Start the installer for the software update. 
    /media/updates/installer
The primary node is ACTIVE and the secondary is STANDBY
If the status of both appliances is correct, but upgrade might not detect the status. If the installer cannot confirm the status, you might be required to restart the ha_manager service, then confirm the state of the primary and secondary hosts.

Procedure
  1. Press Enter until the screen session is closed.
  2. Restart the HA Manager service on the secondary peer to force a refresh. 
    systemctl restart ha_manager
  3. Confirm the status of the primary and secondary with the ha cstate command: 
    /opt/qradar/ha/bin/ha cstate
    Note: For a description of the output, see the Diagnosing the Problem section in this technical note.
  4. Start the installer for the software update. 
    /media/updates/installer
Result
The upgrade confirms the status of the appliances and no long displays the error. The software update can proceed normally. If you continue to experience issues with the Active and Standby state of your HA appliances, contact QRadar Support.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtXAAQ","label":"High Availability"},{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
15 April 2022

UID

ibm16467719

Page Feedback