IBM Support

QRadar: Failed to add HA if there is kernel version mismatch

Troubleshooting


Problem

Administrator is not able to add HA when the DRBD KMOD rpm “kmod-drbd” and the OS kernel loaded are on different versions.

Symptom

On adding the HA for any host, the following error is displayed in HA wizard UI:

drbd

Cause

This problem is observed in any of the following circumstances:

  • When the system boots in EFI firmware mode and secure boot is enabled
  • For BOOT firmware mode where there is no secure boot 

Diagnosing The Problem

If this issue persists, the following errors are observed in qradar_hasetup log file.

[HA Setup (P-M----)] [DEBUG] Checking to see if /dev/mapper/storerhel-store is on a Fibre Channel device
REMOTE_STORE_DEVICE=/dev/mapper/storerhel-store
modprobe: FATAL: Module drbd not found.
[HA Setup (P-M----)] [ERROR] DRBD kernel module is either not installed or won't load

Run the following command to check whether the DRBD module loads.

# modprobe drbd

Sample output

modprobe: FATAL: Module drbd not found.
DRBD kernel module is either not installed or won't load

Resolving The Problem

To resolve the issue, perform the following steps:

  1. Run the following command to check whether the Secure Boot is disabled. 
    ]# mokutil --sb-state
    Sample output 
    SecureBoot disabled
  2. Run the following command to check the OS level loaded kernel version. 
    ]# uname -a
    Sample output 
    Linux hostname.local X.X.X-1160.76.1.el7.x86_64 #1 SMP Tue Jul 26 14:15:37 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
  3. Run the following command to confirm whether the installed rpm "kmod-drbd" and other kmod rpms on are on same version that the kernel is loaded. 
    # rpm -qa | grep -i kmod
    Sample output 
    kmod-pf_ring-6.2.0_3.10.0_1160.80.1-1.el7.x86_64
kmod-libs-20-28.el7.x86_64
kmod-megaraid_sas-07.719.03.00_3.10.0_1160.80.1-1.el7.x86_64
kmod-drbd84-8.4.11_3.10.0_1160.80.1-1.el7.x86_64
kmod-napatech3-3.26.1.115_3.10.0_1160.80.1-1.20221114.el7.x86_64
kmod-20-28.el7.x86_64
  4. Compare the versions from step 2 and 3. 
    For example, it is observed that the OS is loaded on kernel version 1160.76 and the kmod rpms are on version 1160.80.
  5. After you observe the difference, reboot the affected system and select the right kernel to boot the system to match kmod rpm kernel version. 

    Result
    After you select the right kernel to boot the system to match kmod rpm kernel version, the error is resolved. 

Related Information

QRadar: Unable to add HA

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
29 June 2023

UID

ibm16999219

Page Feedback