IBM Support

QRadar: Network service fails to start due to connection activation failed no suitable device error for enp0s20u1u5 interface.

Troubleshooting


Problem

 The network service fails to start after network service restart is run manually, by patches or manually triggered operating system restarts as it cannot find an enabled device for the enp0s20u1u5 interface.

Symptom

The systemctl status network command shows the following output:
network[45070]: Bringing up interface enp0s20u1u5: Error: Connection activation failed: No suitable device found for this connection.
network[45070]: [FAILED]
systemd[1]: network.service: control process exited, code=exited status=1
systemd[1]: Failed to start LSB: Bring up/down networking.
systemd[1]: Unit network.service entered failed state.
systemd[1]: network.service failed.

Cause

After QRadar® 7.3.x, the device enp0s20u1u5 is the Ethernet over USB (also known as LAN over USB) interface, and must be disabled unless a firmware upgrade is ongoing on QRadar® appliances.
If this file is present, the network service can fail as it cannot determine the link status of this interface because it does not work as a regular interface with carrier enabled.

Environment

This issue affects QRadar® hardware appliances running 7.3.x and later.
Note: Integrated Management Module (IMM) is present only on QRadar® M3, M4, and M5 appliances. QRadar® M6 appliances use XClarity Controller (XCC) instead. 

Resolving The Problem

Note: As this error causes network service to fail no inband connection such as SSH can be run to recover the state.
  1. Log in to the IMM or XCC WebUI and start a console connection to the appliance.
  2. Disable the Ethernet over USB as outlined in this technote. 
  3. Move or remove the enp0s20u1u5 configuration file out of the network-scripts directory

    Move the file with: 
    mv /etc/sysconfig/network-scripts/ifcfg-enp0s20u1u5 /root/ifcfg-enp0s20u1u5.bak
    Remove the file with:  
    rm /etc/sysconfig/network-scripts/ifcfg-enp0s20u1u5
  4. Restart network service: systemctl restart network

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtcAAA","label":"Hardware"}],"ARM Case Number":"TS003832140","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.0;7.3.1;7.3.2;7.3.3;7.4.0;7.4.1"}]

Document Information

Modified date:
04 September 2020

UID

ibm16321377

Page Feedback