IBM Support

QRadar: Deploys intermittently timeout on virtual machines or adding managed hosts for version 7.4.2 and earlier

Troubleshooting


Problem

Deploys intermittently timeout or managed hosts fail to add when you are using virtual machines (VMs).
Notice: This technical note applies to the QRadar versions described in the sidebar of this technical note. If you are on QRadar 7.4.3 or later, see: Deploys intermittently timeout on virtual machines or adding managed hosts for version 7.4.3 and later.

Cause

Deploys are originally written for hardware appliances. However, with the introduction of VMs, the deployment timeout might need to be changed depending on VM host performance, as well as some other indicators. This VM performance issue can also cause a timeout when you are adding a managed host to the deployment.

Resolving The Problem

Before you Begin:
  • Running a Deploy Full Configuration or restarting hostcontext might result in Event collection being briefly interrupted while services restart.
  • Restarting Tomcat results in users not being able access the Console UI.
  • Schedule a maintenance window before a Deploy Full Configuration, restarting hostcontext, or restarting Tomcat.
Procedure
  1. Log in to the QRadar Console by using an SSH session as the root user.
  2. Back up /opt/qradar/conf/nva.configservices.conf by using this command:
    mkdir -p /store/IBM_Support && cp /opt/qradar/conf/nva.configservices.conf /store/IBM_Support
  3. Use vi editor to modify nva.configservices.conf: vi /opt/qradar/conf/nva.configservices.conf
  4. Search for and update the following lines:
    INITIATE_DEPLOYMENT_TIMEOUT=240000 [default is 120000]
    INPROGRESS_DEPLOYMENT_TIMEOUT=900000 [default is 600000]
    ADD_HOST_TIMEOUT=800000 [default is 300000]
  5. Save the changes to the file by entering:  Esc :wq
  6. Restart hostcontext by using the command:
    /opt/qradar/init/hostcontext restart -q
  7. Restart the Tomcat service by using the command:
    systemctl restart tomcat
  8. Log in to the Console User interface.
  9. From the Admin page, click Advanced > Deploy Full Configuration.
Results:
Your changes are able to deploy or your host can be added to the deployment.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.0;7.3.1;7.3.2;7.3.3;7.4.0;7.4.1;7.4.2"}]

Document Information

Modified date:
20 September 2022

UID

ibm10871370

Page Feedback