IBM Support

QRadar: High Availability - HA_manager fails to start (Go Active)

Troubleshooting


Problem

The customer installed\upgraded their HA hosts and after rebooting, the primary hosts ha_manager failed to start.

Symptom

The content of /var/log/qradar-ha.log shows the following error:
Mon Jun  8 21:09:06 BRT 2015: GoActive: Failed to acquire VIP

Cause

This issue is caused by missing GATEWAY and GATEWAYDEV parameters in the /etc/sysconfig/network file

Environment

QRadar 7.2 or later

Diagnosing The Problem

The following error is produced when trying to stop and start the ha_ipaddr service:
  
# /opt/qradar/ha/init.d/ha_ipaddr stop
Error: an inet address is expected rather than "dev".
Jun 9 17:40: [ERROR] Failed to update default route       [FAILED]

# /opt/qradar/ha/init.d/ha_ipaddr start
RTNETLINK answers: No such device
Error: an inet address is expected rather than "dev".
Jun 9 17:40: [ERROR] Couldn't update routing table        [FAILED]

Resolving The Problem

Administrators must verify that the primary system to ensure that the system includes a gateway address and a management interface value in the gatewaydev parameter.

Procedure

  1. Log in to the primary QRadar appliance as the root user.
  2. Edit the /etc/sysconfig/network file and verify that the GATEWAY and GATEWAYDEV parameters are not empty. GATEWAY must contain the gateway IP address in your network. GATEWAYDEV must contain the management interface (for example, eth0).
    Example of an incorrect file: 
    # WARNING: Please use qchange_netsetup to make changes to this file
GATEWAY=
GATEWAYDEV=
HOSTNAME=csd2-primary.q1labs.lab
NETWORKING=yes
NOZEROCONF=yes
  3. Save the changes.
  4. Restart the network by using the following command: 
    service network restart

Results
After the network service restarts, the administrator can verify that the HA primary appliance starts as intended.

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"High Availability","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
28 June 2022

UID

swg21959542

Page Feedback