QRadar: MVS tool and enterprise licensing reporting FAQ

• /var/log/mvs.log
• /store/mvs/count_mvs.csv
• /store/mvs/details_mvs.csv
• /store/mvs/{domainname}_mvs_count.csv
   

1. Open a case with QRadar Support: https://www.ibm.com/mysupport/s/createrecord/NewCase
2. Log in with your IBM ID.
3. In the Type of support field, select Product support.
4. In the Case title field, type MVS tool help.
   
   Note: The keyword MVS is important in the case title as it helps our support system more effectively route your case to the proper support team.
5. Complete the product information fields and select your QRadar software version. For example,
   
6. In the Severity  and account information section, select a Severity and include your business impact. The impact might be counting issues or errors you experience with the MVS tool.
   
7. Fill out the Case Description field and ensure you attach your logs and verify your contact number. If you plan to be out of the office, you can add a team member from your organization to your case.
   
   
   Results
   A QRadar Support representative will review the case and contact you using your preferred method of communication.

• All servers (physical and virtual)
  • Servers are counted regardless of infrastructure: Amazon AWS, Microsoft Azure, Google Cloud, IBM Cloud, Oracle Cloud.
  • Operating systems: Windows, Linux (Ubuntu, Red Hat, Kali, and other distros), Unix, HP-UX, and AIX.
• Kubernetes Nodes
• Satellite ground stations

• Network infrastructure
  • Routers and switches
  • Firewalls and VPNs
  • Load balancers
  • Proxies
  • Intrusion Prevention Systems (IPS)
  • File Integrity Monitoring (FIM) or File Activity Monitoring (FAM)
  • Data Loss Prevention (DLP)
  • Audio-visual (AV) equipment
• Client endpoints
  • Workstations
  • Point of Sale devices
  • Meters
  • Network storage and disk drives
• IoT infrastructure
• SaaS solutions

Users who experience issues with the MVS tool can review the logs in /var/log/mvs/mvs.log.

Incorrect permissions
If your user permission is not correct, the following error message is displayed in the log:

[QRADAR] [main] com.mvs.counter.MvsManager: [INFO] [NOT:0000006000][-/- -] [-/- -]Authenticate user request status: 401
[QRADAR] [main] com.mvs.counter.MvsManager: [ERROR] [NOT:0000003000][-/- -] [-/- -]Credentials are not valid, killing process - 3539
[QRADAR] [main] com.mvs.counter.MvsManager: [INFO] [NOT:0000006000][-/- -] [-/- -]Authentication has been completed successfully false

1. Use SSH to log in to the QRadar Console as the root user.
2. Navigate to the /opt/qradar/jars directory.
3. To remove the jar file, type:

   rm mvs-1.0.jar

4. Navigate to the MVS directory, such as /store/mvs.
5. To replace the removed jar file, type:

   sh mvs.sh -s -v

6. Provide permissions for the script to start.
   
   Results
   If the script continues to fail, you can contact QRadar Support for assistance.

The MVS tool runs daily at midnight hardware time on the Console to create a new MVS output file.

The MVS tool outputs a detailed list of IP addresses and hostnames that contributed to the MVS score. Depending on the tuning applied to your asset database, unknown assets might be counted. Administrators need to review the output to confirm if the number of IT servers in use to ensure that the best possible number can be declared for licensing.

The numeric score output by the MVS tool is dependent on the data within QRadar. If you want to improve the MVS count accuracy, you can:

• Run a vulnerability assessment import on QRadar to collect the operating system information for assets in your network. QRadar supports Qualys, Beyond Security, Rapid7, Outpost24, Tripwire, Saint, and more. To configure a vulnerability import to update assets, see our Supported vulnerability scanners list.
• Create asset identity exclusions from real-time searches to exclude assets you do not want counted by MVS.
• Ensure network hierarchy is updated so you are not collecting assets outside of your network, such as remote to remote.

As the MVS script uses the asset database to generate the MVS count. Administrators can experience issues where unknowns, such as mobile phones on the network or unknown assets being added to the count based on the mvs_details.csv file. Administrators who need to tune their assets to prevent hosts from being counted as MVS should create real-time searches for asset types they want to exclude, such as VPNs, load balancers, or other asset types.

What types of data should I tune with identity exclusions?

• VPN users with different DHCP addresses. For example, 10.3.18.19, 10.3.18.22, 10.3.20.21, 10.3.20.25
• Workstations IP addresses or hostnames e.g “JOHN” or “DESKTOP-XXX”
• Mobile phone IP addresses or hostname e.g “galaxy-xx” or “iphone-xx”
• Mac addresses that report as ::1

References

• QRadar: How to effectively manage Asset Autodiscovery using exclusions
• Creating identity exclusion searches

Operating Systems that contributes to MVS
Asset data with operating system information added by VA scanner imports is used to collect information in QRadar on what are servers versus what are endpoints to create a list of hostnames and IP addresses for MVS counting reports. The following operating systems are used to generate MVS counts for data within QRadar:

• Windows Servers
• Linux Servers
• AIX Servers
• AS/400
• zOS
• and other Server OS
• Kubernetes Nodes
• Satellite ground stations
• Apache HTTP servers with HTTP code 200

Log Source Types that contribute to MVS
Log source types that are configured in QRadar that are common to servers are evaluated to estimate the number of servers in QRadar. Each Log Source enabled for the following Log Source Types counts as 1 MVS:

Ports that contribute to MVS
Open ports are counted for common server communications where data is exchanged from computer to computer on specific ports, which are common to servers. As QRadar detects common port traffic from flow data, this can be used to help identify servers where operating system information is available. The following ports are counted as server communication and each asset that communicates on the following ports would count as 1 MVS.

The MVS tool is used to generate an MVS count based on data evaluated in QRadar. Administrators who experience problems with the MVS tool can contact their sales representative or customer success lead for assistance. As tuning of the assets might be required, administrators have the option to use another tool to declare their MVS count for licensing purposes. If you experience issues with the MVS script, administrators can discuss using a scan report, such as a Tenable Nessus credentialed scan to assist with the MVS process.

• Provide a count from your CMDB or internal asset tools.
• Use the MVS 2.1 utility and create asset identity exclusions.
• Scan report from a VA scanner. Several vendors provide credentialed scans that can report the OS version or application information. These details can be used to count servers or provide an OS overview through default report types.
• Use the original Python MVS script to count MVS: https://github.com/IBM/count-mvs.

As MVS is reported, users are expected to report the assets protected by QRadar directly or indirectly. Administrators who use the MVS 2.1 utility are provided a nightly MVS count and a greatest count that defines the current count of MVS and the highest value recorded. Administrators are required to report the greatest MVS number seen by the tool. Servers identified by the MVS tool can drop off the count after the asset expires based on the Asset Profiler Configuration set by the administrator. The default asset profile keeps automatically discovered assets is 120 days, but this time frame can be configured by administrators.