Troubleshooting
Problem
Unable to remove a managed host from the QRadar® deployment due to not having a fully allocated EPS and FPS license or not deallocating the license the managed host is providing to the license pool.
Symptom
The removal action fails with the error:
Cause
Before QRadar® 7.3.x each appliance in a deployment received a license. After 7.3.x, you are now able to merge the licenses into a single pool and redistribute EPS/FPM from the deployment to any host.
The remove host problem can be caused by 2 scenarios:
- Not having the fully allocated EPS and FPS covered by the license attached to the managed host.
- Not having enough deallocated EPS and FPS as the license contributing to the pool attached to the managed host.
Visit this link for more information on Shared license pools.
Environment
QRadar® 7.3.x and later
Diagnosing The Problem
The following example illustrates the issue:
This deployment is composed of 1 Console, 1 Event Processor, and 1 Event Collector.
- The Console is contributing 5000 EPS and 200000 FPM to the license pool.
- The Event Processor is contributing 2500 EPS to the license pool.
- This license pool becomes a total of 7500 EPS and 200000 FPM assignable to the appliances.
The administrator can confirm the allocated values in the license pool:
- The Console has 5500 EPS and 200000 FPM allocated to it.
- The Event Processor has 2000 EPS allocated to it.
Removing the Event Processor incurs into this issue as it removes the 2500 EPS license from the license pool, causing the Console to become overallocated by 500 EPS as its license just provides 5000 EPS to the pool.
Resolving The Problem
To remove the managed host, redistribute the allocated EPS and FPS to the managed host that is unable to be removed.
See the following document for the steps to redistribute capacity: Distributing event and flow capacity
The administrator needs to reallocate the full EPS and FPS capacity to the managed host, or ensure that there is enough deallocated EPS/FPS to cover the license attached to the managed host.
Based on the previous example, the Console license must be reallocated to 5000 EPS so that the Event Processor and its 2500 EPS license can be removed.
Document Location
Worldwide
[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.0;7.3.1;7.3.2;7.3.3;7.4.0"}]
Was this topic helpful?
Document Information
Modified date:
04 September 2020
UID
ibm10957279