Troubleshooting
Problem
What information needs to be submitted to effectively diagnose Deploy issues in QRadar?
Resolving The Problem
IBM QRadar support requires following information to investigate QRadar deploy related issues.
a. Share detailed screenshot of the error.
b. Provide tentative date and time frame to investigate through logs.
c. Were any changes performed to observe the issue? Provide details. Eg: Patch updates, failovers, auto-updates, migration, and so on.
c. Were any changes performed to observe the issue? Provide details. Eg: Patch updates, failovers, auto-updates, migration, and so on.
d. Execute following commands on the Console to check the integrity of file. Save the output in the text file and send for review.
# xmllint -noout /opt/qradar/conf/deployment.xml
No result means no issues with deployment.xml file.
# /opt/qradar/support/validate_deployment.sh
It returns output with bad and good entries of the deployment.
# grep -i "" /storetmp/status/deployment.*
It would return the status of the deployment for the past attempt.
Run test_tomcat_connections.sh to check whether managed host can establish connection with Console.
# /opt/qradar/bin/test_tomcat_connection.sh
Starting up...
Connected to tomcat
e. Mention number hosts affected.
f. Check the bandwidth between the console to managed host.
Refer to QRadar: Replication bandwidth requirements and verifying speed between console and managed host.
If the issue with bandwidth is observed; fix the bandwidth and attempt to deploy changes again.
g. Collect get_logs from QRadar Console and managed host.
# /opt/qradar/support/get_logs.sh -a -s -q 5
Refer Deploy Changes 101 more information.
Contact QRadar Support for further assistance.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
11 July 2023
UID
ibm16988003