Troubleshooting
Problem
The QRadar® QFlow process can stop receiving and processing flows from some flow sources. When the issue occurs, it causes the received packet count to drop and the swap memory usage to grow continually until the QFlow service is restarted as described in APAR IJ29315. This technical note provides a utility for administrators that can monitor and restart the QFlow service when swap memory grows to prevent administrators from needing to intervene while this issue is reviewed.
Symptom
The processed packet count declines and amount of swap required to process flows increases over time.
Environment
Memory fixes were implemented to address this type of memory behavior in QRadar® V7.4.1 fix pack 1, but the behavior can still occur.
Diagnosing The Problem
When this issue occurs, administrators might see messages with numeric differences between the packets received and processed.
qflow: [INFO] [1603076220] Sent 98531 flows on transport connection to xxx.xxx.xxx.xxx:32010
qflow: [INFO] [1603076280] IPFIX Flow Source Stats for default_Netflow: received and processed 13553 packets.Resolving The Problem
Before you begin
- You must have root access to the QRadar Console to complete this procedure.
- This procedure restarts the cron service, administrators might need a maintenance window to complete this procedure.
- Download SwapMonitor_script.sh.
- Copy the file to /root on the QRadar Console.
- To set permissions on the file, type:
chmod +x SwapMonitor_script.sh - To edit crontab, type:
crontab -e - Add the following lines to the end of your crontab file:
#Run the swap monitor on flow appliances every hour 0 * * * * /root/SwapMonitor_script.sh >> /var/log/messages 2>&1 -
To restart the crond service, type:
systemctl restart crond
Results
After services start, the utility SwapMonitor_script.sh runs hourly to evaluate the current swap size, if required the utility restarts the qflow process. After the service is restarted the templates are flushed and swap memory usage returns to normal. Administrators can subscribe to APAR IJ29315 to be notified when this issue is resolved. If you continue to experience issues with received and processed qflow packets, contact QRadar Support for assistance.
Related Information
Document Location
Worldwide
[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsuAAA","label":"Flow Source"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.1"}]
Was this topic helpful?
Document Information
Modified date:
20 November 2020
UID
ibm16370705