IBM Support

QRadar: GlusterFS to DRBD migration fails when hostname (FQDN) is longer than 54 characters

Troubleshooting


Problem

The QRadar® upgrade to version 7.4.2 and later, requires you to run a migration script on the console. This script migrates the High Availability file system from GlusterFS to Distributed Replication Block Device on all Event Collectors in your deployment (irrespective of whether they are currently part of an HA setup or not).
 
The script will keep looping and not finish, if the hostname(FQDN) of the Event Collector it is being run on, is longer than 54 characters.

Environment

QRadar® Event Collectors upgrading to 7.4.2 and versions after that.

Diagnosing The Problem

  1. On the affected Event Collector, you will see error messages like these in the /var/log/remove_glusterfs.log file:

    [WARNING] spawn drbdadm create-md --config-file=/etc/tempdrbd.conf store
    <hostname_with_more_than_54_characters>  :  File name too long
     
  2. Check the number of characters in the hostname by using the command:
      
    hostname |  wc  -m
    If the number of characters is more than 54, you are seeing a manifestation of this issue.

Resolving The Problem

  1. Remove the Event Collector from the deployment and run a Full Deploy.
  2. Change the hostname (FQDN) such that it has a maximum of 54 characters, by using qchange_netsetup command:
      
    /opt/qradar/bin/qchange_netsetup
  3. Add the Event Collector back into the deployment and run a Full Deploy.
  4. Run the GlusterFS migration script again on the affected Event Collector:
      
    /opt/qradar/ha/bin/glusterfs_migration_manager-<version>.bin
  5. Run the GlusterFS migration script on the Console to ensure that the script ran successfully on the Event Collector - if the script reports that no hosts are pending to migrate, it is confirmed that the GlusterFS to DRBD migration was successful.

     
The words LINSTOR®, DRBD®, LINBIT®, and the logo LINSTOR®, DRBD®, and LINBIT® are trademarks or registered trademarks of LINBIT in Austria, the United States, and other countries.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.2;7.4.3"}]

Document Information

Modified date:
01 September 2021

UID

ibm16479621

Page Feedback